312-50v13 Exam Dumps - ECCouncil CEH v13 Questions and Answers

In the CEH Denial-of-Service and Network Attacks coverage, a SYN flood is a classic TCP-based DoS technique that exploits the TCP connection establishment process. In a normal handshake, the client sends SYN, the server replies SYN/ACK, and the client completes with ACK. A SYN flood deliberately sends a high volume of SYN packets (often spoofed) but never completes the final ACK. As CEH describes, this leaves the server holding many half-open connections in SYN_RECEIVED, consuming memory and connection table resources (backlog queue). When the backlog fills, legitimate clients cannot establish connections, degrading availability.

The indicators in your scenario align exactly with CEH’s SYN flood fingerprints: incomplete handshakes and accumulation of half-open connections. The goal is resource exhaustion at the connection-management layer rather than bandwidth saturation.

Option B (Ping of Death) involves malformed/oversized ICMP packets and does not match SYN_RECEIVED behavior. Option C (UDP flood) targets UDP services/ports and creates different symptoms (high UDP traffic, ICMP unreachable messages, service degradation) without half-open TCP states. Option D (Smurf) is ICMP-based amplification via broadcast addresses—again unrelated to incomplete TCP handshakes.

CEH also notes mitigations such as SYN cookies, increasing backlog, reducing SYN-RECEIVED timers, rate limiting, and upstream filtering—further reinforcing that the described event is a SYN flood.

CEH describes FIN scans as stealthy scans that send packets with the FIN flag without initiating a TCP handshake. According to TCP RFC behavior, closed ports respond with RST packets while open ports ignore the probe, producing no response. This allows enumeration of port states while evading IDS systems that typically monitor SYN-based scans.

The CEH Mobile Platform Security module explains that mobile antivirus solutions rely heavily on signatures and known exploit patterns. A custom exploit with obfuscation is far more likely to bypass detection.

CEH explicitly teaches that:

Zero-day or unpatched vulnerabilities

Custom, obfuscated payloads

Minimal use of known frameworks

are the most effective for bypassing endpoint defenses during controlled testing.

Option A is correct.

Options B and C are easily detected.

Option D is social engineering, not a technical exploit.

The correct answer is B. Social Engineering because the attacker’s primary method is manipulating people—not exploiting a technical vulnerability—to obtain information that can enable initial access. In CEH-aligned security concepts, social engineering is defined by the use of deception, impersonation, and psychological influence to persuade victims to reveal sensitive information, perform actions, or bypass normal security procedures. Here, the ethical hacker “poses as a recruiter” on a professional networking site, which is a classic impersonation / pretexting approach. The goal is to build credibility and trust so employees voluntarily disclose internal details that should not be shared externally.

The information gathered—“internal software and VPN setup”—is exactly the sort of intelligence attackers seek during reconnaissance and pre-attack planning. VPN details, remote access workflows, authentication methods, and internal tooling can be used to craft highly convincing phishing messages, identify weak points (such as outdated clients or exposed portals), or target specific employees and administrators. In a real intrusion, this social engineering-driven intelligence collection often precedes credential harvesting, password spraying, MFA fatigue attempts, or tailored malware delivery.

Why the other options are less correct: System and Network Attacks refer to direct technical exploitation such as scanning, sniffing, or attacking services and protocols; the scenario contains none of that. Information Leakage describes the condition where sensitive data is exposed (for example, public documents, misconfigured repositories, error messages), but the scenario focuses on active interpersonal manipulation to extract information. Corporate Espionage is a broader motive/category describing theft of trade secrets, often by competitors or nation-state actors; while social engineering can be used in espionage, the question asks about the method of information gathering, which is clearly social engineering.

Therefore, the threat method demonstrated is social engineering (pretexting/impersonation via a recruiter persona).

Side-channel attacks, as explained in CEH v13 OT and SCADA Security, extract sensitive information by observing physical characteristics of a system rather than exploiting software flaws directly. These characteristics may include power consumption, electromagnetic emissions, timing variations, or thermal output.

In SCADA environments, side-channel attacks are especially dangerous because they bypass traditional network defenses. The most reliable way to confirm such an attack is by analyzing hardware-level anomalies—such as unexpected power usage spikes or irregular signal emissions during normal device operations.

Option B directly aligns with CEH v13 guidance.

Options A, C, and D focus on software, cryptography, or network behavior, which are not primary indicators of side-channel exploitation.

Therefore, Option B is correct.

The correct answer is B because credential stuffing uses previously leaked or stolen username-password pairs against other services, relying on the common user behavior of reusing passwords across multiple platforms. In CEH authentication and password-attack concepts, weak password practices and compromised credentials are major causes of unauthorized access. The CEH-aligned material notes that weak password policies allow attackers to bypass weak credentials, and credentials exposed through insecure channels can lead to compromise. Credential stuffing differs from brute force because the attacker is not trying every possible password combination. It also differs from a dictionary attack because the attacker is not testing dictionary words; instead, they are testing known leaked credentials. Replay attacks reuse captured authentication data or session tokens, but the question specifically mentions weak password reuse across services using leaked credentials. Therefore, the best and most precise answer is credential stuffing.

The correct answer is Inference-Based Assessment. CEH vulnerability assessment material explains that some scanning approaches do not blindly run every possible test against a host. Instead, they infer what checks are appropriate by first identifying protocols, ports, and services, then dynamically selecting tests that are relevant to those discoveries. The scenario describes exactly that behavior: the platform catalogs communication protocols, determines which services are associated with the observed ports, and automatically adjusts the vulnerability tests during execution. This inference-driven logic improves efficiency and reduces unnecessary probing because the scanner tailors its checks to the environment it discovers. Service-based and product-based phrasing may sound plausible, but the question is specifically about the scanning logic and decision model rather than the type of vendor offering. Tree-based assessment does not best describe the sequence presented. CEH guidance uses inference-based assessment to describe scanners that progressively refine their actions using information learned during earlier scanning stages. Because the selection of tests depends on discovered service characteristics and adapts as the scan proceeds, Inference-Based Assessment is the most accurate answer.

This scenario best illustrates impersonation. In CEH-aligned social engineering concepts, impersonation occurs when an attacker assumes the identity of a legitimate person, such as an employee, contractor, executive, or vendor, to exploit trust and bypass established procedures. Rachel explicitly “poses as a stressed employee named Laura Bennett” and uses a believable workplace pretext such as a slow laptop and a tight deadline. This is a classic pressure-and-urgency tactic used to lower skepticism and push the target into breaking policy, such as skipping identity verification or accepting unsafe troubleshooting steps.

Although the interaction happens over the phone, the defining technique being tested is not merely the communication channel but the identity deception. Vishing is phone-based phishing, and while the call could be described as vishing in a broad sense, the prompt emphasizes the assumed identity and the help desk’s verification controls, which is the hallmark of impersonation. Quid pro quo typically involves offering a benefit or service in exchange for information; here, the core mechanic is Rachel’s false identity and her attempt to get the help desk to accept credential sharing as part of support. Shoulder surfing is unrelated because it involves physically observing someone’s screen or keystrokes.

CEH best practices to mitigate impersonation include strict caller verification, callback procedures to known numbers, ticket validation, prohibiting password sharing, requiring multi-factor authentication resets via approved workflows, and training help desk staff to recognize urgency-based manipulation and escalate suspicious requests.

The correct answer is B, 2. A multihomed firewall is a firewall system connected to more than one network through multiple network interfaces. In CEH firewall architecture concepts, a multihomed firewall is described as connecting two or more networks, with each interface connected to its own network segment. Therefore, the minimum number of network connections required is two: one interface facing one network, such as the external or untrusted network, and another interface facing another network, such as the internal or trusted network. A firewall with three interfaces is commonly associated with a screened subnet or DMZ design, where one interface connects to the Internet, one to the internal network, and one to the DMZ. However, the question asks for the minimum, not a typical DMZ design. Since “multi” means more than one, the smallest valid number of network connections for a multihomed firewall is two.

The correct answer is A. Passive Online Attack.

The analyst is not directly guessing passwords, forcing authentication, or stealing a password database for later cracking. Instead, he is positioned on the network and sniffing authentication exchanges while legitimate users authenticate normally.

CEH-aligned password attack material defines a passive online attack as sniffing network traffic in the hope of intercepting a clear-text password, capturing authentication material, replaying authentication, or performing man-in-the-middle activity . Another CEH reference states that passive online password hacking can be performed by sniffing packets and capturing clear-text passwords or hashes for later analysis .

Option B. Non-Electronic Attack is incorrect because non-electronic attacks include methods such as shoulder surfing, dumpster diving, and social engineering.

Option C. Active Online Attack is incorrect because active online attacks involve directly communicating with the victim system, such as password guessing or brute-force attempts.

Option D. Offline Attack is incorrect because offline attacks involve stealing password hashes or files and cracking them separately.

Option A. Passive Online Attack is correct because the analyst captures authentication traffic by monitoring the network.

Therefore, the best answer is A. Passive Online Attack.

The Certified Ethical Hacker (CEH) Cloud Computing module emphasizes that serverless environments rely heavily on granular permission models. Attacks involving compromised APIs often succeed because functions are granted excessive privileges.

Option D is correct because enforcing function-level permissions and the principle of least privilege directly limits what a compromised function can execute. CEH documentation states this is the primary defense against serverless abuse.

Option A is beneficial but reactive.

Option B focuses on SaaS governance rather than FaaS execution control.

Option C provides visibility but does not directly prevent privilege misuse.

CEH highlights identity and access management (IAM) as critical in serverless security.

According to the CEH IDS/IPS module, false positives occur when legitimate activity is incorrectly flagged as malicious. The most common cause is overly sensitive IDS rules or thresholds.

Option D correctly identifies this issue.

Option A describes the symptom, not the root cause.

Option B is unrelated to IDS alert behavior.

Option C can cause missed detections, not excessive alerts.

CEH recommends proper tuning and baseline profiling.

The correct answer is C because banner grabbing is used for identification during reconnaissance, scanning, and enumeration. Banner grabbing collects information returned by a service when a connection is made to an open port. This banner may disclose the application name, service type, operating system, software version, web server details, mail server details, or firmware/vendor information. CEH scanning methodology associates banner grabbing and OS fingerprinting with identifying the operating system and services running on target machines. The material also defines banner grabbing as an enumeration technique used to provide information about a computer system, generally for operating system identification or fingerprinting. It is not sniffing, because sniffing captures network traffic. It is not cracking, because cracking attempts to break passwords or protections. It is also not exploitation, although the information discovered may later help select an exploit. Therefore, the main purpose of banner grabbing is identification.

The correct answer is A, Data scraping. When a web application or API does not restrict request frequency, attackers can automate high-volume requests to collect large amounts of data from exposed endpoints. In CEH web application hacking concepts, APIs and web services are important attack surfaces, and weak API controls can allow attackers to bypass intended policies or abuse application functionality. Lack of rate limiting also allows repeated application-layer requests that may appear legitimate but are performed at abusive scale. CEH DoS material explains that large volumes of requests can overload web applications or services, and application-layer attacks often resemble normal website traffic. Among the choices, data scraping is the best fit because unrestricted API calls allow automated harvesting of user records, product data, pricing, messages, or other exposed information. CSRF requires tricking an authenticated user into sending requests, XSS involves script injection, and SQLi targets database query manipulation. The key issue here is missing request throttling, so the risk is data scraping.

CEH v13 explains that a keylogger is a type of spyware designed to capture user input covertly, often storing or transmitting captured data—such as passwords, emails, chat messages, and financial information—to an attacker. Keyloggers can be implemented as software, firmware, or hardware, and they operate silently in the background without affecting system performance, making them ideal for credential theft. CEH categorizes keyloggers under spying and monitoring malware frequently used in the System Hacking phase to escalate privileges or move laterally once credentials are harvested. Unlike rootkits, which hide processes, or ransomware, which encrypts files, a keylogger’s main purpose is passive surveillance. CEH emphasizes how attackers deploy keyloggers post-compromise or use phishing/social engineering to trick victims into installing them. Their covert nature and ability to bypass traditional AV solutions by masquerading as legitimate processes make identifying them crucial during forensics and incident response activities.