312-50v13 Exam Dumps - ECCouncil CEH v13 Questions and Answers

In CEH v13, IDS effectiveness is closely tied to proper signature tuning and sensitivity thresholds. When IDS alerts are triggered by legitimate user behavior, the most common cause is overly sensitive configuration, resulting in false positives.

False positives occur when normal traffic patterns match intrusion signatures. CEH v13 emphasizes that IDS systems must be calibrated to the organization’s baseline traffic profile. Without tuning, IDS logs become noisy and reduce analyst effectiveness.

Firewall issues (Option A) and outdated IDS signatures (Option B) can cause missed detections, not excessive alerts. Users unintentionally triggering protocols (Option D) is not a root cause but a symptom of misconfiguration.

Thus, excessive IDS sensitivity is the correct explanation.

This activity most accurately describes a DHCP starvation attack. CEH network and sniffing coverage explains that DHCP starvation is a denial-of-service technique in which an attacker rapidly sends large numbers of DHCP requests, usually with spoofed MAC addresses, to consume all available IP addresses in the DHCP pool. Once the pool is exhausted, legitimate clients can no longer obtain valid leases, which produces exactly the symptoms described in the question: repeated address negotiation attempts, failure to receive configuration, and a burst of requests coming from a single interface. A rogue DHCP server is often paired with starvation later, but the key evidence here is the rapid exhaustion behavior rather than the distribution of malicious configurations. IRDP spoofing would manipulate gateway discovery, not primarily deplete DHCP leases, and MAC spoofing alone would not explain widespread address assignment failure across multiple hosts. CEH guidance presents DHCP starvation as both a network disruption issue and a stepping stone for further interception attacks, since denying legitimate DHCP service can set conditions for a rogue DHCP server to take over client configuration and redirect traffic.

The correct answer is B because an attack that abuses the intended workflow, rules, or assumptions of an application is classified as a logic flaw or business logic flaw. In web application hacking, business logic defines how the application should behave, such as pricing rules, transaction sequencing, authorization decisions, coupon use, fund transfer limits, or approval workflows. A business logic flaw occurs when those rules are incomplete, poorly enforced, or can be manipulated by an attacker. The CEH web application material explains that business logic flaws exist when the application’s core rules are not foolproof and can be exploited to compromise the application; these flaws often require careful review of architecture and design because automated scanners may not detect them reliably. XSS abuses improper output/input handling to run scripts in a browser. CSRF abuses a user’s authenticated session. SQLi abuses database query construction. The option that directly matches abusing business logic is Logic flaw.

The CEH Footprinting and Reconnaissance module describes DNS interrogation as a valuable technique for extracting publicly available infrastructure information such as A records, MX records, NS records, and subdomains.

DNS can reveal:

Subdomains (via zone transfers, brute forcing, or enumeration)

Mail server IP addresses (MX records)

Server locations inferred from IP geolocation

However, DNS does not store authentication credentials. Usernames and passwords are protected within authentication systems and directories, not DNS records.

Therefore, option A is correct.

CEH clearly states that DNS reconnaissance is limited to infrastructure metadata, not sensitive user credentials.

The correct answer is D because, in DNS, a zone is the administrative portion of the DNS namespace that contains DNS resource records for that portion of the domain tree. These records define how names are resolved and how services are located. Examples include A records for host-to-IP mapping, MX records for mail servers, NS records for name servers, CNAME records for aliases, PTR records for reverse lookups, and SOA records that identify the authoritative DNS server for the zone. In CEH reconnaissance and footprinting topics, DNS information is important because a DNS zone can reveal valuable network details such as hostnames, mail servers, name servers, and other infrastructure information. Option A is too broad because a zone is not merely a collection of domains. Option B is vague and does not define the zone itself. Option C is too narrow because alias records are only CNAME records, one type of DNS resource record. Therefore, a DNS zone is best defined as a collection of resource records.

The correct answer is A. A collision attack targets a hash function by attempting to find two different inputs that produce the same hash output. In CEH cryptography topics, hashing is a one-way mathematical function used mainly to verify integrity, not to encrypt data. A good hash should produce a unique fixed-length digest for each different input, and even a tiny change in the original data should create a very different hash value. CEH material states that, in hash algorithms, a collision occurs when two or more distinct inputs produce the same output. It also explains that collision attacks are attacks against hashing algorithms where two or more files create the same output, which should not normally happen. Option B is incorrect because public keys relate to asymmetric cryptography, not hash collisions. Options C and D are incorrect because collision attacks do not split hashes to recover plaintext or private keys.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is D. SYN. TCP (Transmission Control Protocol) establishes reliable communication between a client and a server through a process known as the three-way handshake. This mechanism ensures that both parties are ready to communicate and agree on sequence numbers before data transfer begins.

The three steps are:

SYN (Synchronize): The client initiates the connection by sending a TCP packet with the SYN flag set to the server. This packet contains the client ' s initial sequence number (ISN).

SYN-ACK (Synchronize-Acknowledge): The server responds with a packet containing both SYN and ACK flags. This acknowledges the client ' s request and provides the server ' s own sequence number.

ACK (Acknowledge): The client sends an ACK packet back to the server, confirming receipt of the server ' s sequence number. At this point, the TCP connection is established and data transmission can begin.

Option A (RST) is used to reset or terminate a connection. Option B (ACK) is used to acknowledge received packets but does not initiate a connection. Option C (SYN-ACK) is sent by the server as the second step of the handshake, not by the client to begin it.

Understanding the TCP three-way handshake is fundamental in CEH network security topics because many attacks, such as SYN flooding, exploit this connection establishment process. Therefore, the client begins the negotiation by sending a SYN packet.

CEH v13 explains that steganography-based exfiltration hides data within benign-looking files, making it extremely difficult to detect via firewalls or IPS alone. Blocking all outbound traffic is impractical, and IPS systems are not designed to analyze file content deeply for hidden data.

The most effective countermeasure is steganalysis, which involves inspecting files for statistical anomalies, altered pixel distributions, or hidden payload patterns. CEH v13 identifies steganalysis tools as the only reliable method to detect and decode hidden data.

Traffic monitoring (Option C) helps identify suspicious transfers but cannot confirm steganography. Therefore, Option D is correct.

CEH v13 highlights HTML smuggling as a modern technique used to bypass perimeter defenses by leveraging browser-side execution. Instead of downloading a malware file directly—which firewalls and IDS can detect—an attacker embeds obfuscated JavaScript or HTML within an attachment. When the victim opens the file, the browser reconstructs the payload locally using APIs like Blob or URL.createObjectURL. This method avoids external network transfers during the payload creation stage, allowing it to bypass content filters, sandboxing, and inline inspection tools. CEH emphasizes that HTML smuggling is especially dangerous because it operates within the browser environment, which security appliances implicitly trust. Port forwarding (Option B) relates to tunneling traffic, not file reconstruction. XSS (Option C) requires injecting scripts into web pages, not delivering malware. HTTP header spoofing (Option D) manipulates request metadata, not payload construction. Therefore, HTML smuggling precisely matches the described behavior.

The correct answer is C, Graphical Identification and Authentication DLL. GINA (Graphical Identification and Authentication) is a Microsoft Windows component historically responsible for handling interactive logon functions, including user authentication, secure attention sequences (such as Ctrl+Alt+Del), password changes, and user session management. In CEH system hacking and password attack topics, GINA is often discussed because attackers may attempt to replace or modify authentication-related components to capture user credentials. Malicious programs and credential-stealing tools have historically targeted the GINA mechanism to intercept usernames and passwords entered during the Windows logon process.

Understanding GINA is important in ethical hacking because it illustrates how authentication systems can be abused when attackers gain sufficient privileges on a system. Such attacks are closely related to credential theft, privilege escalation, keylogging, and persistence techniques. The other options are not valid security terms associated with Microsoft authentication architecture. Therefore, from a CEH perspective, GINA refers to the Graphical Identification and Authentication Dynamic Link Library used by older Windows operating systems to manage interactive authentication processes.

This scenario is a classic session fixation attack. In session fixation, the attacker sets or “fixes” a known session identifier (session ID) for the victim before the victim authenticates. The attacker then persuades the victim to use that predetermined session—often by embedding the session ID into a URL, link, or cookie setting mechanism. Once the victim logs in, the application incorrectly continues using the same session ID (rather than issuing a new one upon authentication). As a result, the attacker can reuse that known session ID to access the victim’s authenticated session context.

The described sequence matches session fixation exactly: James first crafts a session and obtains a session ID, then shares it with the victim via a link, the victim clicks and logs in, and “their activity is bound to the attacker’s pre-assigned session.” Later, James accesses the session and retrieves the victim’s input—demonstrating that authentication was tied to an attacker-controlled session token.

Why the other options do not fit:

Session replay (B) involves capturing a valid session token (e.g., via sniffing, XSS, or leakage) and replaying it, but it does not require pre-setting the token before the victim logs in.

Session prediction (C) is about guessing or calculating valid session IDs due to weak randomness. Here the attacker does not guess; he deliberately provides a session ID he already controls.

“Session donation (A)” is not the standard classification for this well-known web session weakness in CEH-style taxonomy; the described behavior aligns with fixation.

Therefore, the correct answer is D. Session Fixation Attack.

The most likely tool/command is dig @server axfr, which attempts a DNS zone transfer (AXFR) from a specified DNS server. In CEH-aligned reconnaissance and enumeration methodology, DNS is a high-value target because it reveals how an organization’s names map to systems. A successful zone transfer can expose an entire DNS zone database, often including hostnames (subdomains), mail exchanger (MX) records, canonical name (CNAME) aliases, and sometimes internal-facing entries if the zone is misconfigured. The scenario’s outcome—receiving “a full list of subdomains, MX records, and aliases”—matches exactly what an AXFR zone transfer can disclose when a DNS server is improperly configured to allow transfers to unauthorized hosts.

The clue about a “secondary server” is also significant. In DNS architecture, organizations frequently deploy primary (master) and secondary (slave) DNS servers. Secondary servers legitimately request zone transfers from the master to stay synchronized. If the secondary server is misconfigured (for example, allowing AXFR to any requester or to a broader range than intended), an attacker can exploit this and retrieve the zone file. This results in detailed visibility into the organization’s naming scheme and infrastructure layout—information that can be used to identify high-value targets (mail servers, VPN portals, admin hosts), locate staging points, and plan follow-on attacks such as credential harvesting, targeted exploitation, or social engineering.

Why the other options do not fit: smtp-user-enum.pl is used for enumerating valid users on SMTP servers, not DNS records. ldapsearch enumerates directory information from LDAP services, not DNS zones. nbtstat -A queries NetBIOS name tables for Windows hosts, which may reveal local names and shares but not DNS-wide subdomains and MX/CNAME records. Therefore, the enumeration described is most consistent with a DNS zone transfer using dig with AXFR.

The correct answer is C, Bypass filters. In wireless network security, access points may use MAC address filtering to allow only devices whose MAC addresses are listed in the access point’s whitelist. CEH wireless-hacking material explains that MAC spoofing can be used to change a wireless adapter’s MAC address so it matches an allowed MAC address in the access point’s whitelist, thereby bypassing the MAC filter. This does not provide encryption, because encryption protects data confidentiality using cryptographic algorithms. It is also not IDS, because an intrusion detection system monitors and alerts on suspicious activity. Logging records events and activities, which is unrelated to changing a MAC address. MAC spoofing is an impersonation technique: the attacker observes or obtains a valid MAC address and configures their own interface to use it. Therefore, in the context of CEH wireless attacks and access control weaknesses, MAC spoofing is primarily used to bypass MAC-based access filters.

The correct answer is B. MODBUS.

The defining indicators are TCP port 502, reading coil status, and writing register values. These are classic characteristics of Modbus/TCP, a widely used industrial control protocol.

CEH-aligned OT/ICS material identifies Modbus as a protocol used in industrial control systems and shows Modbus reconnaissance and interaction using port 502. It also describes Modbus function-code operations such as writing a single coil and reading input registers .

Option A. IEC 60870-5-104 is incorrect because IEC 104 is commonly associated with TCP port 2404, not port 502.

Option C. DNP3 is incorrect because DNP3 commonly uses TCP/UDP port 20000.

Option D. OPC UA is incorrect because OPC UA is not identified by Modbus coil/register operations on TCP 502.

Therefore, the best answer is B. MODBUS.

The correct answer is D. This message shows classic social engineering and smishing indicators: it arrives by mobile text, claims urgency with a “vital transaction,” impersonates a trusted organization, and asks Bob to contact a free public email address. A legitimate bank or financial institution would normally use an official corporate domain, not a generic @yahoo.com mailbox. Option A is weak because not knowing Scott alone does not prove fraud; the stronger evidence is the suspicious sender identity and unofficial contact channel. Option B is incorrect because the message only claims to represent a respectable organization; attackers often impersonate trusted brands. Option C is unsafe because replying to the provided address validates Bob as a target and may continue the scam. CEH social engineering guidance emphasizes verifying requests through trusted, independent channels and recognizing phishing/smishing attempts that exploit urgency, authority, and user trust. Therefore, the best answer is D.