CEH 312-50 Practice Test

312-50 practice test: what's covered

This question bank follows the CEH v12 blueprint (312-50).

• Certified Ethical Hacker (312-50)

Free 312-50 sample questions

1. During an engagement kickoff, a client asks which security property ensures that financial records cannot be altered by an attacker. Which CIA-triad property addresses this?

   • A. Integrity, ensuring data is not modified by unauthorized parties
   • B. Availability, ensuring records are reachable on demand
   • C. Confidentiality, ensuring records stay secret
   • D. Non-repudiation, ensuring actions can be proven
   Show answer

   Correct: A. Integrity protects data from unauthorized modification, which is exactly the concern for tamper-proof financial records. Availability is incorrect because it concerns uptime, not modification. Confidentiality is wrong because it deals with secrecy. Non-repudiation proves who acted but is not a CIA-triad pillar.

2. A tester captures traffic and needs to map a frame's MAC address handling to the correct OSI layer when troubleshooting an ARP spoofing finding. At which OSI layer do MAC addresses operate?

   • A. Layer 2, the Data Link layer
   • B. Layer 3, the Network layer
   • C. Layer 4, the Transport layer
   • D. Layer 1, the Physical layer
   Show answer

   Correct: A. MAC addresses are used for frame delivery at Layer 2, the Data Link layer, which is why ARP maps IP to MAC there. Layer 3 is incorrect because it uses IP addresses. Layer 4 handles ports and segments, not MACs. Layer 1 deals only with raw bits on the medium.

3. While analyzing a packet capture, you observe a client send SYN, the server reply, and the client confirm before data flows. Which sequence correctly describes the TCP three-way handshake?

   • A. SYN, then SYN-ACK, then ACK
   • B. ACK, then SYN, then FIN
   • C. SYN, then RST, then ACK
   • D. FIN, then ACK, then SYN
   Show answer

   Correct: A. TCP establishes a session with SYN, SYN-ACK, then ACK, confirming both sides can send and receive. The ACK/SYN/FIN order is incorrect because FIN closes connections. SYN/RST/ACK is wrong because RST aborts rather than establishes. FIN-first sequences do not open a session.

4. A junior analyst is documenting default ports for a web-app assessment report and must list services that ride over TCP by default. Which of the following use TCP as their default transport? (Choose TWO)

   • A. HTTPS on port 443
   • B. SSH on port 22
   • C. SNMP on port 161
   • D. TFTP on port 69
   • E. NTP on port 123
   Show answer

   Correct: A and B. HTTPS (443) and SSH (22) both run over TCP because they require reliable, ordered delivery. SNMP (161) and TFTP (69) use UDP, not TCP, so they are incorrect. NTP (123) also uses UDP, making it an incorrect choice for a TCP listing.

5. A network engineer needs a protocol that resolves a hostname like portal.example.com into an IP address before a TLS connection can be attempted. Which protocol performs this resolution?

   • A. DNS, the Domain Name System
   • B. DHCP, for dynamic addressing
   • C. ARP, for address resolution on a LAN
   • D. ICMP, for diagnostic messaging
   Show answer

   Correct: A. DNS translates human-readable hostnames into IP addresses, which must happen before connecting. DHCP is incorrect because it leases IP configuration, not name resolution. ARP resolves IP to MAC within a LAN, not hostnames. ICMP carries diagnostics like echo requests, not name lookups.

Last updated: 2026-10-19

312-50 practice test FAQ

Related practice tests

• PT0-003 practice test
• OSCP practice test
• eJPT practice test
• 312-49 practice test
• CND-312-38 practice test
• SY0-701 practice test