312-50v13 Exam Dumps - ECCouncil CEH v13 Questions and Answers

The correct choice is C because Nessus Essentials is fundamentally a vulnerability assessment scanner. Its core purpose is to identify security weaknesses by checking systems and services against a large vulnerability knowledge base, which includes detecting outdated or vulnerable versions of operating systems, server software, databases, web servers, and common network services. In practical scanning, Nessus performs remote checks such as banner/version identification, configuration and patch-level assessment (where possible), and vulnerability plugin checks to flag software releases that are known to be insecure or end-of-life. This directly matches the scenario emphasis: supporting “diverse technologies including operating systems, databases, web servers, and virtual environments,” and asking for a capability it provides “as part of its scanning process.”

Why the other options are incorrect:

A (Patch management) is not what Nessus Essentials is designed to do. Nessus identifies missing patches and vulnerabilities, but it does not serve as an operating system and third-party application patch deployment platform.

B (High-speed asset discovery) is more characteristic of dedicated asset discovery/attack surface tools or broader platform features; while Nessus can discover hosts during scans, “high-speed asset discovery” is not the defining, primary capability being tested here.

D (Agent-based detection) refers to endpoint agents running locally for continuous monitoring. Nessus Essentials is primarily used for scanner-driven vulnerability assessment; agent-based functionality is a separate approach/tooling concept and not the main Essentials scanning capability being targeted in this question.

Therefore, the best answer is C: Nessus Essentials is designed to scan and identify vulnerabilities, including detecting outdated/vulnerable versions across many server and service technologies.

Android Debug Bridge (ADB) is a powerful debugging interface that, if misconfigured, allows attackers to execute commands remotely. CEH v13 identifies exposed ADB as a critical mobile security risk, especially in enterprise environments.

The most effective countermeasure is to disable ADB entirely, except when explicitly required for development or troubleshooting, and only within tightly controlled environments. This directly removes the attack vector.

VPNs and biometrics improve security but do not prevent ADB abuse. Updating MDM systems is important but does not eliminate the risk if ADB remains enabled.

CEH v13 explicitly recommends strict ADB control as a best practice. Therefore, Option C is the correct answer.

The scenario clearly describes baiting, a physical social engineering technique covered in CEH under human-based attacks. Baiting involves enticing a victim with something appealing or intriguing, such as free software, confidential documents, or valuable information, in order to trick them into compromising security. In this case, the USB drive is deliberately labeled “Confidential 2025 Budget Plans,” which is designed to trigger curiosity and urgency. The attacker relies on human psychology, specifically curiosity and perceived importance, to motivate the target to plug the device into a company system.

Unlike phishing, which typically occurs through email or electronic communication, baiting often involves physical media such as USB drives left in public areas like parking lots or lobbies. CEH materials highlight that attackers may preload such devices with malware that executes automatically when inserted, granting access to the internal network. Even though this experiment uses a harmless tracking script, the methodology mirrors real-world attacks where malicious payloads could establish backdoors, exfiltrate data, or deploy ransomware.

Hoaxes spread false warnings to create panic but do not necessarily require interaction with physical devices. Pretexting involves fabricating a scenario or identity to elicit information directly from a target through conversation or interaction. The use of a strategically placed USB labeled with enticing information fits the definition of baiting precisely. This test reinforces the importance of policies prohibiting unknown removable media usage and promoting employee awareness training.

The correct answer is A. Call Spoofing because the defining behavior in the scenario is manipulating the caller ID information so that the victim’s phone displays a trusted number—specifically, the credit union’s official line. In CEH-aligned social engineering and mobile attack discussions, call spoofing is a technique where an attacker falsifies caller ID data to impersonate a legitimate organization, department, or known contact. This increases credibility and exploits human trust in recognized numbers, making victims more likely to comply with sensitive requests such as disclosing usernames, passwords, or one-time codes.

The attack is also a form of vishing (voice phishing), where the attacker uses phone calls and persuasive pretexts (“mandatory security check”) to trick employees into revealing credentials. The success factor here is the authority and legitimacy signal created by the spoofed number. When staff see what appears to be an official institutional phone number, they are more likely to assume the call is authentic and bypass normal verification steps, especially under time pressure or when framed as a security requirement.

Why the other options are incorrect: OTP hijacking refers to stealing or intercepting one-time passwords (for example via SIM swap, malware, or social engineering focused specifically on MFA/OTP codes). While the attacker could ask for OTPs, the scenario’s core mechanism is the spoofed caller ID, not OTP interception. Bluebugging is a Bluetooth-based attack that gains unauthorized control over a device through Bluetooth vulnerabilities; it is unrelated to caller ID impersonation. SMiShing is phishing via SMS/text messages, not a voice call.

Therefore, the mobile attack vector demonstrated—displaying a trusted institutional number to deceive employees during a credential-harvesting call—is call spoofing.

This scenario most clearly illustrates shoulder surfing, a social engineering technique where an attacker obtains sensitive information by observing a victim’s screen, keystrokes, or written notes—often from a nearby position—without directly interacting with the victim or their device. The key indicators are that the tester is “discreetly watching their screens and hand movements” during login and is able to capture “usernames and partial passwords” without touching anything. That is the defining pattern of shoulder surfing: passive observation to harvest credentials or other confidential information.

Shoulder surfing is particularly effective in open-plan offices, shared workspaces, airports, cafés, or any environment where people can be observed entering credentials. Attackers may watch directly, use reflections (e.g., glass surfaces), or position themselves to see the keyboard and screen. Even partial password capture can be valuable when combined with other information (usernames, password patterns, reset questions, or subsequent observation), and it can help an attacker craft more convincing follow-on social engineering attempts.

Why the other options do not fit:

Dumpster diving (B) involves retrieving sensitive information from trash (printed documents, media, badges, notes), not observing logins in real time.

Impersonation (C) requires actively posing as a trusted person (IT staff, vendor, employee) to persuade someone to disclose information or grant access; the scenario explicitly avoids interaction with staff.

Tailgating (D) is physically following someone through a secure door to gain unauthorized entry; it’s about bypassing physical access controls rather than capturing credentials.

Because the technique relies on visual observation of screens and keystrokes to obtain login details, the correct answer is A. Shoulder Surfing.

The scenario points to a JavaScript-based keylogger because the data capture occurs entirely within a web page and does not require installing software on the victim’s machine. In CEH-aligned social engineering and web attack concepts, phishing pages commonly include client-side scripts that capture form inputs in real time. When a user types credentials into a fake login form, JavaScript event handlers can record keystrokes or the final field values and transmit them to an attacker-controlled endpoint. This explains why Tyler’s “payload” works without local privilege, without dropping executables, and without triggering traditional antivirus focused on file-based malware. The key detail is that “captured keystrokes came exclusively from a web-based form embedded in the fake login page,” which matches browser-based capture rather than OS-level logging.

The other options imply deeper system access than the prompt describes. A keyboard keylogger typically operates at the operating-system level by intercepting keyboard input system-wide, which usually requires running code on the host and is more likely to be detected by endpoint protections. A hypervisor-based keylogger is a highly advanced technique that relies on virtualization-layer control and is not consistent with a simple phishing web page. An application keylogger usually targets specific processes on the endpoint (such as browsers or email clients), again requiring execution on the local machine.

From a defensive viewpoint emphasized in CEH, mitigations include user awareness training to spot phishing pages, enforcing MFA to reduce the value of stolen credentials, using anti-phishing protections and URL filtering, monitoring for lookalike domains, and deploying browser and email security controls that detect credential-harvesting pages and suspicious form-post destinations.

The correct answer is A, Mimikatz. In CEH system hacking and post-exploitation topics, Windows credential attacks commonly focus on hashes, cached credentials, Kerberos tickets, and authentication material stored in memory or in Windows credential stores. The CEH-related material identifies Mimikatz as the de facto standard tool for extracting credentials from Windows memory and states that it can steal hashes, PIN codes, and Kerberos tickets from memory, as well as support pass-the-hash, pass-the-ticket, and Golden Ticket attacks. This directly matches the question’s phrase “dumps Windows hashes.” John the Ripper is mainly a password-cracking tool used after hashes are obtained. Hydra is primarily an online login/password attack tool for network services. Aircrack-ng is used mainly for wireless password/key cracking. Therefore, among the options, Mimikatz is the tool most specifically associated with dumping Windows credentials and hashes during the system hacking phase.

The capability described—administrators instantly provisioning servers, storage, and compute through a web portal without needing the provider to manually intervene—is the NIST cloud characteristic called on-demand self-service. In NIST’s cloud computing model, on-demand self-service means a consumer can unilaterally provision computing capabilities (such as server time and network storage) as needed automatically, without requiring human interaction with each service provider.

The scenario explicitly highlights that the admins can scale resources “instantly” through a dashboard and that there is “no manual involvement from the cloud provider.” That is exactly what on-demand self-service captures: rapid provisioning driven by the customer through automated orchestration and APIs/portals.

Why the other options are not the best match:

Broad network access (D) means cloud capabilities are available over the network and accessed through standard mechanisms by heterogeneous platforms (mobile, laptops, workstations). While the dashboard is accessed over the network, broad access is about reachability and standard access mechanisms, not the self-provisioning behavior.

Resource pooling (C) refers to the provider’s multi-tenant model where physical/virtual resources are pooled and dynamically assigned; it explains how the provider can offer elasticity, but the user-facing “provision it yourself” aspect is on-demand self-service.

Measured service (B) refers to metering and monitoring resource usage for billing/optimization; it doesn’t explain instant self-provisioning.

Therefore, the characteristic is A. On-demand self-service.

An Evil Twin access point is a malicious wireless access point that impersonates a legitimate Wi-Fi network by copying its SSID and often mimicking other observable characteristics such as security settings and signal behavior. In CEH-aligned wireless attack coverage, the goal is to trick users into connecting to the attacker-controlled AP instead of the real one. Once a victim device associates, the attacker can perform man in the middle interception, capture credentials, observe sensitive traffic, and potentially downgrade protections if the victim is not properly validating the network.

This scenario strongly matches an Evil Twin because the tablet connects to an access point “broadcasting a name and signal similar to the hospital’s secure Wi-Fi,” and Sarah finds an unauthorized device capturing sensitive traffic from connected systems. That combination indicates active impersonation and client deception, not merely an accidental device. A rogue AP is typically an unauthorized access point connected to the internal network, often deployed by employees for convenience, and may not be designed to impersonate the official SSID to lure clients. A misconfigured AP refers to an access point with weak settings or improper security controls, not an attacker-created clone. A honeypot AP is a deliberate decoy set up by defenders to attract attackers, which is the opposite of what is described.

Mitigations emphasized in CEH best practices include using WPA2 Enterprise or WPA3 Enterprise with certificate validation, enabling protected management frames where supported, deploying wireless intrusion detection and prevention to identify spoofed SSIDs and BSSID anomalies, disabling auto-join where possible, and training users to report suspicious network prompts or unexpected reconnect behavior.

TCP port 102 is strongly associated with Siemens S7 communications, commonly referred to as S7comm, which is used by Siemens SIMATIC S7 PLC families and related engineering and HMI components in OT environments. In CEH coverage of ICS and SCADA reconnaissance, identifying industrial protocols by their well-known ports is a standard first step because it quickly narrows down device type, vendor ecosystem, and likely attack surface. When Ethan targets TCP 102 and the scan reveals PLC models used in the automation process, that aligns directly with enumerating Siemens SIMATIC S7 PLCs, since S7comm typically operates over ISO-on-TCP on port 102.

The other options do not match the port-protocol pairing described. Modbus TCP most commonly uses TCP port 502, so “scanning Modbus devices” would be associated with 502 rather than 102. “Capturing Modbus TCP traffic using Wireshark” is passive sniffing and also would focus on Modbus traffic patterns on 502, not an active Nmap sweep on 102. Omron PLCs may use different protocols and ports depending on model and configuration, but TCP 102 is the canonical indicator for Siemens S7 in most defensive and offensive playbooks taught for OT discovery.

From a defensive perspective, CEH-aligned best practices emphasize segmenting OT networks, restricting access to engineering ports like 102, monitoring for scanning behavior, and enforcing allowlisted communications between SCADA, HMIs, and PLCs to reduce the risk of unauthorized enumeration and follow-on manipulation.

According to the Certified Ethical Hacker (CEH) IoT, OT, and SCADA Security module, side-channel attacks exploit indirect information leaks such as power consumption, electromagnetic emissions, timing variations, or thermal output rather than software vulnerabilities.

Option A is correct because monitoring hardware-level anomalies is the primary method for detecting side-channel exploitation. CEH materials emphasize that these attacks bypass traditional security controls.

Option B relates to cryptographic weaknesses, not side-channel analysis.

Option C addresses interface misuse, not covert data leakage.

CEH highlights that SCADA systems are especially vulnerable due to legacy hardware and limited monitoring capabilities.

The risk described is increased attack surface caused by unnecessary services and protocols running on a web server—specifically NetBIOS and SMB. The most direct hardening action to mitigate this is to block/disable unnecessary ports and protocols so they are not exposed to the network and cannot be abused by attackers. Option D captures that principle: reduce exposure by closing ports and restricting protocols that are not required for the server’s role.

A well-hardened web server should run only the services needed to deliver its intended web functionality (e.g., HTTP/HTTPS and necessary management interfaces under strict control). Services like SMB (commonly TCP 445/139) and NetBIOS (UDP 137/138, TCP 139) are not normally required for public-facing web hosting and are frequent targets for enumeration and exploitation. Leaving such services open can enable attackers to perform credential attacks, exploit legacy vulnerabilities, access shared resources, or pivot further into the environment. By blocking or disabling these ports at the host firewall and/or perimeter firewall, the organization reduces reachable attack paths and limits what an external attacker can interact with.

Why the other options are less direct:

Dedicated machine (A) can help separation of duties, but if unnecessary services still run, the attack surface remains.

Risk assessment for patching (B) is important, but it doesn’t immediately remove the exposure created by unneeded services.

Eliminating unnecessary files (C) addresses file-system exposure, not open network services like SMB/NetBIOS.

Because the problem is explicitly about unnecessary open services/protocols, the best mitigation is D. Block all unnecessary ports, ICMP traffic, and protocols (i.e., minimize exposed services).

The correct answer is C. Identify and evaluate current practices. In CEH-aligned security assessment concepts, a security audit/review is used to verify whether security policies and procedures are in place and being followed. If documented policies do not exist, the ethical hacker or auditor should not stop the audit or create policies during testing, because policy creation is a management/governance responsibility, not an assessor’s role. Instead, the assessor should identify the organization’s current practices, actual controls, informal procedures, and operational behavior, then evaluate them against accepted standards, baselines, legal requirements, and security best practices. CEH material also emphasizes that information security policies are a fundamental component of the security infrastructure and define requirements, rules, and controls for protecting organizational resources. The absence of policies should be documented as a finding, but the review can still continue by assessing what is currently being done in practice. Increasing testing does not address the governance gap. Thus, the best course is to identify and evaluate current practices.

CEH v13 explains that Side-Channel Attacks exploit physical characteristics of cryptographic devices—such as power consumption, timing variations, electromagnetic leakage, or acoustic emissions—to infer confidential data like encryption keys. These attacks do not break the cryptographic algorithm itself but instead analyze unintended signals produced during computation. The scenario describes a classic power analysis and timing analysis attack, where the attacker monitors fluctuations during encryption operations on a smart card. CEH details how Differential Power Analysis (DPA) and Simple Power Analysis (SPA) allow attackers to extract secret keys by statistically correlating measured power traces to cryptographic operations. This type of attack is extremely dangerous because it bypasses mathematical strength and targets hardware implementation flaws. Options A, C, and D do not relate to side-channel exploitation. CEH specifically categorizes this method as observing hardware emissions to deduce secrets, making Option B the most accurate match.

CEH v13 identifies spear-phishing as one of the most effective and targeted social engineering methods. It involves crafting highly personalized messages that reference real events, internal processes, or upcoming activities to build credibility and reduce suspicion. In this scenario, referencing board meetings—an event executive assistants frequently handle—creates a believable and urgent context for the request. CEH emphasizes that personalization significantly increases success rates because recipients perceive the sender as someone with legitimate access to internal information. A phone call impersonating IT support (Option B) is less convincing for retrieving agenda access-specific credentials. Mass phishing (Option C) lacks personalization and is easily flagged. LinkedIn social engineering (Option D) is long-term and less effective for obtaining immediate credentials. Therefore, a tailored spear-phishing email is the most effective approach.