312-50v13 Exam Dumps - ECCouncil CEH v13 Questions and Answers

CEH materials describe this attack pattern as Living-off-the-Land (LotL), where attackers abuse legitimate tools to avoid detection. Because these binaries are normally trusted, traditional antivirus solutions may not flag them.

CEH recommends file integrity monitoring (FIM), which tracks cryptographic hashes of sensitive executables and alerts administrators when unauthorized modifications occur.

Option D is correct.

Options A and B support resilience but do not detect tampering.

Option C alone is insufficient against LotL attacks.

CEH v13 describes Cross-Site Request Forgery (CSRF) as an attack in which an authenticated user ' s browser is tricked into submitting unauthorized actions to a trusted application without the user ' s intent. CSRF exploits the fact that browsers automatically include stored session cookies when sending requests to a domain the user is logged into. In this scenario, the attacker creates a malicious form that triggers an unwanted funds transfer. Since the application does not validate request origin, enforce CSRF tokens, or require secondary verification, it processes the attacker ' s forged request as if it came legitimately from the victim. CEH emphasizes that CSRF differs from XSS because no malicious script executes on the target website; instead, the attacker leverages the victim’s authenticated session. This is distinct from session fixation (Option A), replay attacks (Option B), and XSS (Option D). The described behavior aligns precisely with CSRF exploitation.

The correct answer is D. ldapsearch -h < host > -x -s base namingContexts.

The goal is to query the directory server’s root DSE for exposed naming contexts. The -x option performs simple authentication, -s base limits the search scope to the base object, and namingContexts requests the attribute that lists available naming contexts, such as domain and configuration partitions.

CEH-aligned LDAP enumeration material explains that LDAP directory services provide information about users, systems, networks, services, and organizational structure, and that LDAP enumeration can reveal domain and directory details useful for later targeting .

Option A is incorrect because it assumes a known base DN before discovering the naming contexts.

Option B is incomplete because it does not request the naming context attribute.

Option C also assumes the base DN is already known.

Option D is correct because it retrieves base-level naming context information before deeper LDAP searches.

Therefore, the best answer is D. ldapsearch -h < host > -x -s base namingContexts.

The CEH web server attack methodology describes reconnaissance as a key phase, where testers gather publicly available information before attempting exploitation. Robots.txt is commonly used by administrators to instruct web crawlers about which directories should not be indexed. CEH emphasizes that attackers regularly review robots.txt because it often exposes sensitive directories unintentionally, providing valuable intelligence about internal structure, configuration paths, administrative pages, and potential weak points. In this scenario, the tester observes “Disallow” entries and then discovers the directories are not protected by authentication, allowing direct access to sensitive files. This falls under information gathering through exposed indexing instructions rather than directory traversal, which involves path-manipulation exploits. The tester is not altering file paths or inserting traversal sequences; instead, they are reviewing publicly available indexing instructions and discovering misconfigured access controls. This perfectly aligns with the reconnaissance phase of the CEH methodology, where attackers learn about server architecture using passive or minimally intrusive techniques.

Pretexting is defined in CEH v13 Social Engineering as an attack where the attacker fabricates a believable scenario and impersonates a trusted individual to gain sensitive information.

This differs from phishing (mass messaging), baiting (malicious incentives), and quid pro quo (exchange of favors).

The correct answer is C. Maintaining Access.

The red team has already gained administrative access. Installing a backdoor to preserve continued access after the initial vulnerability is remediated represents the Maintaining Access phase.

CEH methodology identifies five hacking phases: Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Clearing Tracks. It explains that Maintaining Access is the phase where an attacker tries to maintain ownership and control over compromised systems, commonly using backdoors, rootkits, or Trojans to retain access . Another EC-Council-aligned reference states that Maintaining Access refers to retaining ownership of the system and securing continued access with backdoors, rootkits, Trojans, or Trojan horse backdoors .

Option A. Reconnaissance is incorrect because reconnaissance occurs before exploitation and focuses on information gathering.

Option B. Vulnerability Scanning is incorrect because scanning identifies weaknesses but does not involve installing persistence.

Option D. Clearing Tracks is incorrect because clearing tracks involves hiding evidence, altering logs, or avoiding detection.

Option C. Maintaining Access is correct because the backdoor is installed to preserve long-term access.

Therefore, the best answer is C. Maintaining Access.

The correct answer is B. In CEH ethical hacking and penetration-testing guidance, testers must operate strictly within the authorized scope, agreement, and reporting procedures. When sensitive data such as credit card numbers and PII is unexpectedly discovered, the tester should not copy, move, examine further, or continue testing as though it were a normal finding. CEH-aligned guidance specifically warns that when illegal or highly sensitive material is encountered, it should not be copied to the tester’s own device, and the tester must follow team guidance and remain within the engagement agreement. Continuing the test could increase exposure, disturb evidence, or violate PCI-DSS and privacy handling requirements. Making a local copy is especially wrong because it creates another unauthorized location for regulated data. Contacting the employee directly is also improper because escalation should go through the approved client point of contact or management. Therefore, the best course of action is to stop the test immediately and contact management.

CEH v13 explains that SQL injection typically occurs when user inputs are concatenated into SQL queries without proper validation or parameterization. The login form is one of the most common injection targets, and testers use specific test payloads designed to manipulate the authentication query. A classic test string such as ' OR ' 1 ' = ' 1 exploits conditional logic to force the SQL statement to evaluate as true, effectively bypassing authentication if the application is vulnerable. CEH notes that this technique is a standard initial test because it is low-risk, easily detectable if vulnerable, and directly confirms improper sanitization. JavaScript injection (Option A) tests for XSS, not SQLi. Directory traversal (Option C) targets file path vulnerabilities rather than SQL queries. Brute-force attacks (Option D) rely on guessing credentials and do not test input sanitization. Therefore, using a logical SQL injection payload is the most appropriate and CEH-aligned method.

Ethical hacking, as defined throughout CEH courseware, is the authorized and legitimate process of identifying vulnerabilities, weaknesses, and misconfigurations in information systems. The primary objective is to strengthen security by discovering issues before malicious actors can exploit them. Ethical hackers follow strict legal guidelines, obtain written permission, and operate within a defined scope to ensure their activities contribute positively to the organization’s security posture. Unlike malicious hacking, the intent is not to steal data, cause harm, or disrupt operations. Ethical hackers use the same tools, techniques, and methodologies that attackers use, but with the purpose of remediation and risk reduction. CEH emphasizes that ethical hacking supports defense-in-depth strategies by enabling organizations to harden their environments and proactively mitigate threats. Therefore, identifying and fixing vulnerabilities is the central mission of ethical hacking.

This scenario clearly describes the need for Time-Based Blind SQL Injection, an advanced SQL injection technique covered in the CEH v13 Web Application Hacking module. Blind SQL injection is used when an application does not return database errors or visible output, making traditional techniques ineffective.

According to CEH v13, Time-Based Blind SQL Injection is particularly useful when:

The backend database type is unknown

Error messages are suppressed

UNION queries fail

No direct data is returned in responses

In this technique, attackers inject SQL statements that deliberately introduce time delays using database-specific functions such as SLEEP(), WAITFOR DELAY, or BENCHMARK(). The ethical hacker then observes the application’s response time to determine whether the injected condition is true or false.

For example:

' OR IF(1=1, SLEEP(5), 0) --

If the application response is delayed, it confirms that the injected SQL statement was executed successfully. CEH v13 categorizes this method as behavioral-based inference, where the attacker extracts information one bit at a time by analyzing timing differences.

Other options are incorrect because:

Content-Based Blind SQL Injection relies on visible differences in responses, which the question states are unavailable.

Union-Based SQL Injection requires knowing column count and data types.

Error-Based SQL Injection depends on database error messages being displayed.

CEH v13 emphasizes Time-Based Blind SQL Injection as a last-resort yet highly effective technique when dealing with hardened applications that suppress output, making it a frequent exam-tested concept.

The Certified Ethical Hacker (CEH) Cryptography and Quantum Computing section introduces the concept known as “Harvest Now, Decrypt Later”. This threat model describes adversaries capturing encrypted data today, even if they cannot decrypt it immediately, with the expectation that future quantum computers will be able to break currently secure public-key algorithms such as RSA and ECC.

Option A accurately reflects this concept.

Option B describes a method (Shor’s algorithm) but not the threat model itself.

Option C is unrelated to cryptographic attacks.

Option D refers to quantum communication attacks, not classical encrypted data harvesting.

CEH emphasizes post-quantum cryptography as a mitigation strategy.

This scenario aligns with a Golden SAML attack because the attacker is not stealing a user password or bypassing MFA directly; instead, the attacker compromises the identity trust mechanism itself and forges valid authentication assertions. In federated cloud environments, the identity provider issues signed assertions that cloud services trust. Once the signing material is obtained, an attacker can create forged SAML tokens that appear fully legitimate to the relying cloud applications. That is why the access in logs appears normal and why no credential replay or multifactor prompt is required. This distinguishes the technique from Man-in-the-Cloud, which commonly abuses synchronization tokens, and from Cloud Hopper, which is associated with service-provider pivoting and long-term intrusion campaigns. CEH cloud coverage emphasizes that cloud trust relationships, identity infrastructure, and the mechanisms used to broker access are critical attack surfaces because compromise at that layer can grant broad service access with little visible anomaly. In practical defensive terms, protecting token-signing infrastructure is as important as protecting privileged user credentials in a cloud identity architecture.

The correct answer is A because allowing execution from /tmp creates a direct risk that an attacker can place and run malicious binaries, scripts, droppers, or payloads from a temporary directory. In Linux, /tmp is commonly used for temporary files, and if execution is permitted, it becomes an attractive staging location after compromise. CEH malware concepts define malware as malicious software designed to gain access to target machines, steal information, harm systems, or give control to an attacker. CEH system-hacking concepts also describe malicious application execution after access, including installing malware, setting up backdoors, password crackers, and keyloggers. This risk is not SQL injection or XSS, because those are web application input attacks. It is also not primarily DoS, although malware could later cause denial of service. The immediate and best answer is malware execution because executable temporary directories let attackers run hostile code from a writable location.

CEH v13 clarifies that nbtstat is used only for NetBIOS name table enumeration, not for listing shared resources. Tags such as < 20 > indicate file server services, but share enumeration requires tools like net view or SMB enumeration utilities.

Thus, the inability to list shares is due to tool limitation, not service configuration. Option C is correct.

The firewall described is doing more than simple header checks: it is validating session state and also performing some application-level analysis. That combination is characteristic of a Stateful Multilayer Inspection Firewall. This firewall type expands beyond traditional packet filtering by tracking the state of network connections (e.g., TCP handshake progression, established sessions, expected flags and sequence behavior) and applying inspection across multiple OSI layers. Because it understands whether traffic belongs to a legitimate, established session, it can block many spoofed or out-of-context packets that might pass a stateless filter.

The mention of being harder to bypass with fragmentation or tunneling attacks further supports this. Stateless packet-filtering firewalls mainly rely on source/destination IP, port, and protocol fields. Attackers may attempt fragmentation to split payloads across packets and evade simplistic inspection, or use tunneling to encapsulate traffic to hide prohibited content. A stateful multilayer firewall, by maintaining connection tables and reassembling or correlating traffic with session context, is better equipped to detect anomalies that do not align with valid session behavior and to apply deeper inspection policies.

Why the other choices are less fitting:

A Packet Filtering Firewall (A) focuses on basic header fields and is typically stateless, matching the opposite of what Mia observed.

An Application-Level Firewall (C) (proxy firewall) can do deep application inspection, but the scenario emphasizes a multilayer approach combining state tracking with application-level checks—more aligned with stateful multilayer inspection than a pure application proxy model.

A Circuit-Level Gateway Firewall (D) validates session establishment (e.g., TCP handshakes) and creates virtual circuits, but it generally does not perform meaningful application-level analysis of the content.

Therefore, the best match is B. Stateful Multilayer Inspection Firewall.