312-50v13 Exam Dumps - ECCouncil CEH v13 Questions and Answers

The correct answer is RSA. CEH cryptography coverage describes RSA as a widely used asymmetric algorithm that supports encryption and digital signatures and is commonly deployed in public-key infrastructures. The question states that the transaction data is hashed, the hash is signed with the sender’s private key, and the recipient verifies the signature with the matching public key. That is the classic RSA signature model presented in CEH materials. The additional clue is that the same algorithm is said to support encryption, digital signatures, and secure communications use cases. Diffie-Hellman is mainly a key exchange mechanism and is not used for digital signatures in the way described here. DSA is designed for digital signatures, but not for general encryption. ElGamal can support encryption and signatures, but CEH exam framing most strongly associates this full combination of encryption plus digital-signature verification with RSA. CEH references repeatedly emphasize RSA as the standard asymmetric cryptosystem for confidentiality, authentication, integrity, and nonrepudiation in enterprise communications. Because the described implementation combines hashing, private-key signing, and public-key verification within a broad asymmetric framework, RSA is the most accurate answer.

According to CEH v13 Security Operations and Incident Response, the first step in incident handling is identification and analysis, not immediate containment or remediation. The observed sequence—failed logins followed by abnormal outbound traffic—suggests a potential compromise, but the exact nature, scope, and impact are still unknown.

Option C aligns precisely with CEH v13’s incident response lifecycle. Real-time monitoring and detailed log analysis allow the analyst to determine whether the activity represents credential stuffing, brute-force compromise, malware-based exfiltration, or a false positive. This step preserves evidence, establishes timelines, and helps identify indicators of compromise (IOCs).

Immediately disconnecting the server (Option B) may be necessary later, but doing so prematurely can destroy volatile forensic evidence, disrupt business operations, and alert the attacker. Auditing outbound traffic alone (Option A) is too narrow and skips proper correlation of authentication logs, system logs, and process activity. Forcing credential changes (Option D) without understanding the attack vector may fail to stop malware-based persistence.

CEH v13 emphasizes that containment actions must be informed by analysis, otherwise organizations risk responding to symptoms rather than root causes. Therefore, the correct initial action is to observe, analyze, and identify, making Option C the correct answer.

The behavior described most closely matches an insider attack, because the actor is a temporary contractor who has physical proximity and implicit access to internal areas where employees work and handle sensitive information. In CEH guidance, an “insider” is not limited to permanent employees; it includes contractors, vendors, interns, and any trusted or semi-trusted individuals who can enter facilities or access internal environments. The attack combines two common insider-facilitated techniques: shoulder surfing and dumpster diving. Recording employees entering passwords is a form of shoulder surfing, where credentials are harvested by observing or capturing authentication entry through direct viewing or recording devices. Finding sensitive documents in a trash bin indicates dumpster diving, where attackers recover confidential information from improperly disposed materials.

These actions are typically feasible because the attacker is already inside the perimeter and can exploit weak operational security practices, such as lack of clean-desk enforcement, inadequate shredding policies, and insufficient physical monitoring of visitor or contractor activity. CEH materials emphasize that insider threats are particularly dangerous because they bypass many external perimeter controls and can blend into normal workplace behavior.

The other options do not fit. A distribution attack generally refers to compromise introduced through supply chain or third-party distribution channels, not on-site observation and trash retrieval. A passive attack is too generic and does not capture the key element of an authorized or trusted presence enabling the compromise. “Cisco-in attack” is not a standard CEH attack category for this scenario. Therefore, the most accurate classification is an insider attack.

The correct answer is D. Hoax Letters that Spread False Security Warnings.

The message is designed to create fear and urgency through false or unverifiable claims about a malware outbreak. It does not contain a malicious attachment, does not ask for credentials, and does not directly request payment. Its purpose is to spread a false warning and cause disruption or unnecessary concern.

CEH-aligned social engineering material lists Hoax letters, Chain letters, and Spam as forms of computer-based social engineering delivered through email and messaging channels .

Option A. Scareware is incorrect because scareware usually tricks users into installing rogue software or paying for fake protection.

Option B. Spam Email is too broad; spam refers to unsolicited bulk email, while the content here is specifically a false warning.

Option C. Chain Letters is close because the message encourages forwarding, but the stronger classification is hoax letter because it spreads a false security warning.

Option D. Hoax Letters is correct because the message relies on fabricated security claims to trigger fear and forwarding behavior.

Therefore, the best answer is D. Hoax Letters that Spread False Security Warnings.

CEH v13 highlights behavioral analytics as one of the most effective techniques for identifying ambiguous or stealthy threats such as data exfiltration, command-and-control traffic, and insider abuse. When interactions appear suspicious but not definitively malicious, behavioral profiling provides the most direct visibility.

Behavioral analytics tools establish a baseline of normal system and network behavior, including typical communication patterns, data transfer volumes, destinations, and timing. Deviations from this baseline trigger alerts, allowing analysts to detect previously unknown threats without relying on signatures.

Option C is the most appropriate because it both identifies anomalies and supports continuous mitigation. A full zero-trust shutdown (Option A) is disruptive. Forensics (Option B) is reactive and better suited after confirmation of compromise. Training (Option D) does not address system-level interactions.

CEH v13 emphasizes that modern attacks often blend into normal traffic, making behavioral analysis essential. Therefore, Option C is the correct answer.

TCP port 1433 is the well-known default port for Microsoft SQL Server, formally registered as ms-sql-s. In CEH network and perimeter security coverage, identifying services by their default port assignments is a critical reconnaissance and defensive skill. When reviewing firewall rules and exposed services, analysts correlate open ports with their associated protocols to determine risk exposure. Port 1433 is widely recognized as the primary listening port for Microsoft SQL Server instances configured with default settings.

The presence of an undocumented virtual machine actively handling traffic on port 1433 is particularly concerning because database services often store sensitive operational or customer data. If exposed unnecessarily, SQL Server can be targeted for brute-force authentication attacks, SQL injection exploitation, misconfiguration abuse, or exploitation of unpatched vulnerabilities. CEH materials emphasize that database services should not be directly exposed to the internet unless absolutely necessary and must be protected by strict access controls, segmentation, encryption, and monitoring.

Option B, SqlNet, typically refers to Oracle database communication over port 1521. Option D, ms-sql-m, is associated with SQL Server Browser service over UDP 1434, not TCP 1433. Option A, sqlsrv, is not the formal IANA-registered service name for port 1433. Because ms-sql-s is the standard designation for Microsoft SQL Server on TCP port 1433, and given the risk of exposing database services, this finding warrants immediate escalation and review.

The correct answer is D. Expansion because the scenario emphasizes that, after the initial foothold, the attacker harvests credentials and moves laterally to compromise additional systems—routers, printers, and file servers—thereby broadening control across the internal environment. In CEH-aligned APT lifecycle descriptions, this stage is commonly associated with internal reconnaissance, privilege/credential access, lateral movement, and widening the foothold to increase resilience and reach. The attacker is no longer limited to the original compromised endpoint; instead, they are deliberately spreading to other networked assets to build operational advantage.

The sequence in the prompt is important. Initial Intrusion (A) already occurred via spear-phishing delivering the first payload to the manager’s laptop. The question asks what phase is being simulated at this point, after access is gained and the attacker is actively moving through the network. Persistence (B) refers to establishing mechanisms to maintain access (e.g., backdoors, scheduled tasks, services, persistence in credentials/accounts) so the attacker can survive reboots, password changes, or cleanup attempts. While an attacker might establish persistence during expansion, the defining action here is lateral movement and compromise of multiple internal systems, which is more directly expansion than persistence.

Search & Exfiltration (C) would involve identifying and collecting target data (in this case, sensitive research data) and transferring it out of the environment. The prompt explicitly states Alex has not yet targeted sensitive research data, which rules out the search/exfiltration phase as the primary activity being simulated right now.

Therefore, the phase of the APT lifecycle best matching credential harvesting followed by lateral movement and compromise of multiple internal devices/servers to build a broader foothold is Expansion.

The correct answer is A because the description matches promiscuous mode. In normal operation, a network interface card processes frames addressed to its own MAC address, broadcast frames, or relevant multicast frames, while ignoring frames not intended for it. In promiscuous mode, the NIC passes all received frames up to the operating system or packet-capture tool for inspection. CEH sniffing concepts describe this as a key requirement for sniffers: the NIC is placed into promiscuous mode so it can listen to all data transmitted on its segment, even when the traffic is not addressed to that NIC. CEH-aligned material also states that a sniffer needs the card to run in promiscuous mode so the NIC grabs frames regardless of address. Port forwarding redirects traffic between ports or hosts, WEM is not the described network-interface behavior, and multicast mode only handles multicast traffic.

The correct answer is C because DEP, or Data Execution Prevention, is a memory-protection control that prevents code from executing from memory regions intended only for data storage, such as stack or heap/data memory. In CEH system exploitation and buffer overflow concepts, attackers may try to inject malicious shellcode into a buffer and then redirect program execution to that injected code. The CEH-aligned material explains that buffer overflow attacks can overwrite adjacent memory and allow different executable code to run; it also notes that ASLR and DEP are common defenses against these memory-management attacks. EC-Council material also states that buffer overflow exploitation depends on a machine being able to execute code in the data/stack segment, and lists disabling stack execution as a defense. Therefore, DEP does not block encryption, logging, or scanning. It specifically blocks execution from data memory areas.

The correct answer is C. Ettercap. Ettercap is a well-known Man-in-the-Middle (MITM) attack framework frequently covered in CEH wireless and network attack concepts. It supports ARP poisoning, traffic interception, packet manipulation, content filtering, and HTTP injection, making it capable of modifying web traffic in transit.

In the scenario, the attacker established a rogue wireless access point and intercepted users ' HTTP traffic. By positioning himself between the victim and the destination website, the attacker could modify the HTTP response and inject malicious HTML code containing a Java applet or script. Ettercap includes filtering capabilities that allow attackers to alter web pages before they reach the victim, making it the most appropriate tool for this attack.

The other options are less suitable. Wireshark and Tcpdump are packet capture and analysis tools used primarily for monitoring network traffic, not for modifying or injecting content. Aircrack-ng focuses on wireless security assessment tasks such as packet capture, wireless reconnaissance, and cracking WEP/WPA keys, but it is not designed for HTTP content injection.

CEH Exam Tip:

Ettercap = MITM + ARP Poisoning + Traffic Manipulation + HTTP/HTML Injection.

The correct answer is A. Administrative safeguards because risk assessment is a fundamental component of an organization ' s security management process and is closely associated with identifying, evaluating, and managing risks through administrative, technical, and physical controls. Administrative safeguards include security policies, procedures, risk management processes, security awareness training, personnel security, incident response planning, and governance mechanisms. These safeguards help organizations identify threats, assess vulnerabilities, determine risk levels, and implement appropriate controls to reduce risk to an acceptable level.

In CEH information security concepts, risk assessment is used to determine the likelihood and impact of threats against organizational assets. Administrative safeguards are a key part of this process because they define how security is managed and enforced throughout the organization. Physical security is a security control category rather than a risk assessment component itself, while a DMZ is a network architecture element used to isolate public-facing systems. A logical interface refers to a technical system component and is not part of the risk assessment framework. Therefore, Administrative safeguards represent the best answer because they directly support risk identification, evaluation, and management activities within an organization ' s overall security program.

This scenario best illustrates impersonation, which is a core social engineering technique emphasized in CEH under pretexting and physical security testing. Impersonation occurs when an attacker assumes a believable identity, such as an IT technician, vendor, maintenance worker, or delivery person, to gain trust and bypass access controls. In the prompt, the red team member adopts a third-party IT technician role and is granted entry because the receptionist assumes the visit is legitimate and does not verify credentials. That is the defining moment of impersonation: exploiting human trust and procedural gaps to obtain unauthorized physical access.

While the attacker later observes open terminals, unattended printouts, and sticky notes, those observations are opportunistic data collection that becomes possible only after successful impersonation. Shoulder surfing is specifically observing a user entering credentials or viewing a screen while standing nearby, typically during active use. Eavesdropping focuses on capturing spoken or transmitted information, such as listening to conversations or intercepting communications. Dumpster diving involves retrieving sensitive information from trash or discarded materials in waste bins, not simply seeing sticky notes left on desks.

CEH guidance highlights that impersonation often succeeds when organizations lack visitor verification, badge enforcement, escort policies, and security awareness training. Controls include validating work orders, requiring government-issued ID, issuing visitor badges, escorting visitors, enforcing clean desk practices, locking workstations, and secure printing to prevent exposure of credentials and sensitive data.

The scenario describes a Layer 7 (application-layer) denial-of-service pattern: Javier sends a wave of repetitive web requests that specifically overload backend scripts responsible for search queries and form submissions. This is characteristic of an HTTP GET/POST attack, where the attacker floods a web application with large volumes of HTTP requests—commonly GET requests for pages/resources and POST requests that trigger server-side processing (login, checkout, searches, form handlers). Because these requests can be syntactically valid and target costly operations, they can quickly exhaust CPU, memory, threads, database connections, or application worker pools, resulting in slow responses and timeouts for legitimate users—exactly what the customers experience here.

Why the other options don’t fit as well:

Slowloris (A) is also an application-layer technique, but it works differently: it holds many connections open by sending partial HTTP headers very slowly, aiming to exhaust the server’s concurrent connection capacity. The question emphasizes repetitive requests overloading backend scripts, not slow, incomplete requests holding sockets open.

UDP Flood (B) is a network/transport-layer volumetric attack that sends massive UDP packets to random or targeted ports, consuming bandwidth and host resources. It doesn’t specifically target web scripts handling search/forms.

Peer-to-Peer Attack (C) typically involves abusing P2P networks or reflection/amplification through distributed peers; it’s not described as direct repetitive web requests to application endpoints.

The key indicators are: (1) web requests (2) targeting script-driven functions like search and form submissions, and (3) resulting in user-facing slowness/timeouts due to overwhelmed application processing. These align most directly with D. HTTP GET/POST Attack.

The correct answer is D because Windows null sessions are tied to SMB/CIFS and NetBIOS-based access to the IPC$ administrative share. CEH enumeration content describes null sessions as unauthenticated connections to Windows NT/2000/XP systems using a null username and password, allowing attackers to enumerate users, groups, shares, machines, and SIDs. The same CEH material states that null sessions require access to TCP 139 and/or TCP 445 ports. TCP 139 is NetBIOS Session Service, traditionally used for SMB over NetBIOS, while TCP 445 is direct-hosted SMB over TCP. CEH enumeration tables also list TCP 139 as NetBIOS Session Service and TCP 445 as SMB over TCP/direct host communication. Port 443 is HTTPS and unrelated to null sessions. Port 137 supports NetBIOS Name Service but is not the main null-session connection port. Therefore, the best answer is 139 and 445.

The scenario clearly indicates session hijacking risk caused by interception of session IDs over unsecured connections. In CEH-aligned web security, when session tokens are transmitted without strong transport encryption, an attacker positioned on the same network path can sniff traffic and capture cookies or URL-based session IDs, then reuse them to impersonate the victim. The most effective control that directly addresses interception in transit across the entire portal is enforcing SSL/TLS for all session-related communications, meaning every page and request that could carry authentication state is protected by HTTPS. This prevents passive eavesdropping and significantly reduces the feasibility of man-in-the-middle capture of session identifiers during normal user interactions.

Option A, regenerating the session ID after login, is an important defense against session fixation, but it does not stop an attacker from stealing the new session token if it is later transmitted over plaintext HTTP. Option C, cache-control directives, helps prevent sensitive pages from being stored in shared caches or browser history, but it does not protect session IDs from network sniffing. Option D, avoiding sessions for unauthenticated users, can reduce some tracking exposure, yet the core issue here is hijacking of authenticated sessions due to unencrypted transport.

Therefore, implementing SSL/TLS across the portal, typically combined with secure cookie flags and strict HTTPS enforcement, is the correct countermeasure for the described interception-based session hijacking.