312-50v13 Exam Dumps - ECCouncil CEH v13 Questions and Answers

The correct answer is C. Whois lookup because the scenario describes retrieving publicly available domain registration records using an online service without directly interacting with the target organization’s infrastructure. In CEH-aligned reconnaissance (footprinting) techniques, WHOIS is a foundational passive information-gathering method used to identify details tied to a domain name, such as the registrant/organization, administrative and technical contacts, registration and expiration dates, and the authoritative name servers associated with the domain. These details are commonly used to establish ownership context, map the organization’s external footprint, and identify potential points of contact for administrative or security coordination.

The prompt emphasizes that the ethical hacker wants “details about the organization’s domain ownership” and “points of contact.” That is precisely the kind of information WHOIS is intended to provide. It also explicitly notes “without direct interaction with the target,” which aligns with WHOIS being passive: queries are made to registries/registrars or WHOIS aggregation services rather than probing the target’s servers.

Why the other options are less correct: Email footprinting focuses on collecting email addresses, formats, mail servers, and potentially related metadata, but it is not the primary method for domain ownership/registrant contact records. Network footprinting is broader and often involves identifying IP ranges, network blocks, technologies, and topology—potentially including active probing. DNS interrogation (such as querying A, MX, NS, TXT records) can reveal technical DNS data and infrastructure mapping, but it typically does not provide the domain’s registrant ownership details and formal contact records; that role is handled by WHOIS and registry data.

Therefore, the method most likely used here is a WHOIS lookup to obtain public domain registration and contact information.

The correct answer is D. XMAS Scan.

An XMAS scan sends TCP packets with multiple flags set, commonly FIN, URG, and PSH. In RFC 793-style behavior, closed ports respond with RST, while open ports often return no response.

CEH scanning material describes inverse TCP flag scanning as sending TCP probes with flags such as FIN, URG, and PSH. It identifies probes with these flags as XMAS scanning and explains that a closed port responds with an RST packet, while open ports may ignore or drop the abnormal packet combination .

Option A. FIN Scan is incorrect because a FIN scan uses only the FIN flag, while the scenario specifies an uncommon combination of multiple TCP control bits.

Option B. UDP Scan is incorrect because the probes are TCP packets, not UDP packets.

Option C. TCP Connect Scan is incorrect because a TCP connect scan completes the normal three-way handshake.

Option D. XMAS Scan is correct because it uses multiple TCP flags and produces the open/closed behavior described.

Therefore, the best answer is D. XMAS Scan.

The correct answer is D. Ethical hackers use the same methods but strive to do no harm. CEH-aligned guidance emphasizes that a Certified Ethical Hacker understands weaknesses and vulnerabilities and uses the same knowledge and tools as a malicious hacker, but in a lawful and legitimate manner to assess the security posture of target systems. The key difference is not the toolset or technical method; it is authorization, purpose, scope, and intent. Ethical hackers operate with the customer’s approval, follow rules of engagement, document findings, and work to improve security. Malicious hackers use similar skills and tools for personal gain, destruction, data theft, or activity outside the owner’s interest. Option A is incorrect because ethical and malicious hackers may use the same tools. Option B is misleading because ethical hackers do not obtain permission to steal data or intentionally bring down systems outside agreed scope. Option C is incorrect because malicious hackers are not inherently more advanced. Therefore, D is the best answer.

TCP 139 and UDP 137 and 138 correspond to NetBIOS over TCP/IP services that are closely associated with Windows file and printer sharing and legacy SMB browsing. In CEH methodology, these ports are high-value enumeration targets because NetBIOS name service and datagram service can disclose hostnames, domain or workgroup names, logged-in users, and shared resource details, often before any strong authentication occurs. UDP 137 is used for NetBIOS Name Service, which supports name registration and lookup. UDP 138 supports NetBIOS Datagram Service, commonly tied to browsing and announcement traffic. TCP 139 supports NetBIOS Session Service, historically used to establish sessions for SMB traffic and to query share and user-related information when configurations are weak.

In real environments, misconfigurations such as permissive share settings, legacy protocols, or anonymous and guest-access allowances can allow an attacker to enumerate user accounts, groups, and policies indirectly through browsing data, share lists, and RPC-related exposure that frequently accompanies SMB environments. CEH training emphasizes prioritizing enumeration against Windows networking services because the information gained can rapidly support follow-on attacks such as password spraying, targeted phishing, lateral movement, and privilege escalation planning.

The other choices include TCP 21 FTP, TCP 23 Telnet, and TCP 25 SMTP, which may expose banners or allow limited user enumeration in specific configurations, but they are not the primary ports associated with classic Windows user and group enumeration. UDP 133 is not a standard enumeration target in this context. Therefore, TCP 139 with UDP 137 and 138 is the best priority set for username and group-related enumeration.

The CEH IDS/IPS Evasion module describes packet fragmentation as a common evasion technique used to bypass signature-based detection.

Option B is correct.

Other options represent different attack categories.

CEH highlights reassembly normalization as a countermeasure.

The finding described maps directly to Insecure Data Storage. In CEH-aligned mobile security guidance and OWASP Mobile risk discussions, insecure data storage occurs when a mobile application saves sensitive information locally in a way that can be easily recovered by an attacker, especially on a rooted or jailbroken device where sandbox protections can be bypassed. Storing usernames and passwords in plain text is a high-severity example because it allows immediate account takeover and enables access to protected client records, case notes, and other confidential material.

Mobile devices routinely store app data in local file systems, shared preferences, databases, logs, or cached content. If sensitive data is stored without proper protections, an attacker with physical access, malware, backup extraction capability, or root access can read it directly. CEH materials emphasize that rooting dramatically increases attacker capability by permitting access to app directories and system areas that would otherwise be restricted. That is exactly what the scenario shows: credentials are recovered from the device once root access is available.

The best practice mitigation is to never store credentials in plain text. Use secure, OS-provided storage such as Android Keystore or iOS Keychain, apply strong encryption with keys protected by hardware-backed mechanisms when available, minimize what is stored locally, and ensure secrets are not written to logs or debug artifacts. Insecure Communication would involve weak transport protections, and Improper Credential Usage can include hardcoded credentials or poor authentication handling, but the specific issue here is plainly unsafe local storage of credentials, so Insecure Data Storage is the correct choice.

The correct answer is B, Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an attacker or ethical hacker collects as much data as possible about a target before deeper technical testing or attack activity. The retrieved CEH-related material describes reconnaissance as gathering information about the target using active or passive means, and it specifically includes collecting initial information about the target system or organization. Visiting an organization’s public website to collect employee names, email addresses, and phone numbers is passive information gathering because the tester is using publicly available sources rather than directly probing systems. Footprinting, which is part of reconnaissance, can include gathering employee information, phone numbers, and emails. Fingerprinting is more specific to identifying systems, services, or operating systems. Scanning and enumeration involve actively probing hosts, ports, and services. Gaining access occurs later, when vulnerabilities are exploited. Therefore, this activity corresponds to reconnaissance.

The correct answer is B. Distributed Reflection Denial-of-Service (DRDoS) because the scenario describes the two defining elements of DRDoS: reflection and amplification at scale using third-party systems. Maria “forges requests” (i.e., spoofs the victim’s IP address as the source) to “multiple open services across the internet.” Those services then send their replies to the spoofed source—the victim—so the victim receives a large volume of unsolicited responses. This is reflection: the attacker does not attack the victim directly; instead, the attacker reflects traffic off other servers. The “multiplying the amount of traffic” indicates amplification: many protocols/services respond with packets significantly larger than the request, so the attacker’s small outbound traffic results in a much larger inbound flood against the target.

The mention of “multiple open services” and being overwhelmed by a “flood of responses” is classic DRDoS behavior. From a defender’s perspective, DRDoS attacks are difficult because the traffic often appears to come from legitimate servers, and the victim is receiving replies to requests it never sent. Mitigations include source address validation (BCP 38 anti-spoofing), rate limiting, filtering/ACLs for abused UDP services, and upstream scrubbing/CDN or DDoS protection.

Why the other options are less accurate: Smurf is a specific reflection/amplification attack using ICMP to a broadcast address (now largely mitigated by disabling directed broadcasts). Botnet describes the attacker’s infrastructure (many compromised machines) but not the reflection/amplification mechanism; a botnet can be used to launch many types of DDoS attacks. NTP amplification is one specific DRDoS variant using misconfigured NTP servers (UDP/123). The question describes the broader technique across “multiple open services” rather than naming NTP specifically, so the best match is the general category DRDoS.

Therefore, Maria is demonstrating a Distributed Reflection Denial-of-Service (DRDoS) attack.

CEH v13 classifies state-sponsored hackers as highly skilled professionals who operate under government direction to conduct espionage, intelligence gathering, sabotage, or cyber warfare. These attackers often target foreign governments, critical infrastructure, and strategic industries.

The defining characteristics are:

Government backing

National or geopolitical objectives

Advanced resources and long-term campaigns

Options B, C, and D do not fit. Organized hackers are typically financially motivated cybercriminal groups. Gray hats operate without authorization but not for national interests. Hacktivists pursue ideological or political causes independently.

CEH v13 explicitly associates covert intelligence operations with state-sponsored actors, making Option A correct.

The correct answer is D. Integrity. In the CIA triad, integrity refers to protecting information from unauthorized alteration, modification, or revision, whether the data is stored at rest or moving across a network. CEH-aligned material explains that integrity ensures data received is exactly the same as the data originally sent, and any addition, deletion, or alteration means integrity has been compromised. The question states that an attack altered the contents of two critical files, which directly indicates unauthorized modification of data. This is an integrity violation because the trustworthiness, accuracy, and reliability of those files can no longer be guaranteed. Availability is incorrect because availability concerns whether systems or data are accessible when needed. Authentication is incorrect because it verifies the identity of a user, device, or process. Confidentiality is also incorrect because confidentiality focuses on secrecy and preventing unauthorized disclosure, not file modification. Therefore, an attack that changes critical file contents is best described as an integrity attack.

Comprehensive Explanation from CEH v13 Courseware:

CEH v13 identifies XML Signature Wrapping (XSW) attacks, also known simply as Wrapping attacks, as a major threat against SOAP-based web services. These attacks exploit weak XML parsing and insufficient validation of signed message components. SOAP messages often include digitally signed sections, but if the server validates the signature without confirming the correct position or structure of the signed elements, attackers can duplicate, move, or wrap signed content inside a modified XML envelope. This allows an attacker to inject malicious payloads while still presenting a valid signature. CEH details how this can lead to unauthorized execution, privilege escalation, or bypassing authentication controls in SOAP APIs. Cloud snooping, cryptanalysis, and IMDS abuse do not involve message duplication or signature misplacement. The scenario precisely matches CEH’s definition of a Wrapping Attack in SOAP/XML security.

This scenario describes a worm infection, as defined in CEH v13 Malware Threats. Worms are self-replicating malware that spread autonomously across networks without user interaction. Their propagation often results in excessive network traffic, system crashes, and resource exhaustion, which aligns with the symptoms described.

CEH v13 differentiates worms from other malware:

Ransomware encrypts data but does not self-propagate aggressively.

Trojans require user execution.

Rootkits focus on stealth and persistence rather than replication.

The appropriate response prioritizes containment and eradication. Quarantining affected systems prevents further spread. A network-wide antivirus sweep with updated signatures removes known worm variants. Updating operating systems closes vulnerabilities that worms exploit for propagation.

CEH v13 stresses rapid isolation and patching as critical measures to control worm outbreaks and restore network stability. Therefore, Option A is correct.

In the CEH SQL injection methodology, the initial stages focus on understanding where and how user-controlled input enters the application and reaches backend components such as database queries. The activity described is reconnaissance and mapping of input vectors: Rachel is observing the shipment search function, watching HTTP GET parameters, and determining whether those parameters are processed in a way that could influence SQL logic. This directly corresponds to the phase commonly described as identifying data entry paths, where the tester locates all possible points of injection such as URL query strings, form fields, cookies, HTTP headers, and API parameters.

At this stage, the ethical hacker is not yet executing payloads to exploit the database. Instead, they are profiling the request structure, parameter names, values, and server responses to understand how the application behaves when supplied with different inputs. CEH guidance emphasizes that effective SQL injection testing begins by enumerating input sources and determining which of them appear to be reflected in server-side operations. Monitoring HTTP GET requests is a typical technique because query string parameters often map to backend search queries, filters, or record lookups, making them frequent injection candidates if server-side validation and query construction are weak.

The other options occur later. Launching SQL injection attacks involves actively injecting test characters and payloads to confirm injection. Database enumeration happens after a vulnerability is confirmed, to extract schema information and data. Advanced SQL injection refers to more specialized techniques such as out-of-band, time-based blind, or WAF evasion. Since the task here is identifying and assessing potential injection points, the correct step is identifying data entry paths.

According to CEH v13 Network Scanning Techniques, a FIN scan is a stealth scanning method that sends TCP packets with only the FIN flag set. Its behavior relies on RFC 793, which specifies that closed ports must respond with a TCP RST, while open ports should silently drop the packet.

However, modern firewalls, IDS/IPS systems, and hardened TCP/IP stacks often filter or silently drop FIN packets regardless of port state. Therefore, when a FIN scan results in no response from a large number of ports, it does not conclusively indicate that the ports are open. Instead, CEH v13 stresses that this behavior commonly points to packet filtering by firewalls or security controls.

Option A is incorrect because a lack of response does not definitively mean ports are closed. Option B is an overreaction; stealth scan anomalies alone do not indicate a breach. Option C is unlikely because congestion would impact multiple protocols, not selectively suppress FIN responses.

CEH v13 recommends that when FIN scans produce ambiguous results, analysts should correlate findings using additional scan types (such as SYN scans) and investigate firewall rules and filtering behavior. Thus, option D is the most accurate interpretation and aligns with CEH guidance.

This scenario describes Platform as a Service (PaaS) because the provider delivers a managed platform where developers can deploy and run custom applications while the provider manages the underlying infrastructure components—servers, operating systems, storage, and often middleware/runtime components. The customer is responsible for application code and logic (and usually data and application configuration), but not for provisioning or maintaining the base compute and OS layers.

The key phrasing is: “developers can deploy and test custom applications without managing the underlying servers, operating systems, or storage,” and “the firm controls the application logic but not the runtime infrastructure.” That is the hallmark responsibility split of PaaS: the provider handles infrastructure and platform operations, enabling rapid development and deployment through managed runtimes, build/deploy pipelines, and scalable services.

Why the other models don’t fit:

IaaS (A) would require the customer to manage the OS and many platform components (patching, runtime configuration, middleware), even though the provider supplies the virtualized infrastructure. The scenario explicitly says they do not manage OS or servers.

SaaS (C) provides a complete finished application that the customer uses; customers typically cannot deploy their own custom application logic onto it in the way described.

XaaS (D) is a broad umbrella term, not the specific NIST-style service model classification being asked.

Therefore, the correct answer is B. Platform as a Service (PaaS).