312-50v13 Exam Dumps - ECCouncil CEH v13 Questions and Answers

The correct answer is C. DNS Tunneling.

The scenario describes encoded data hidden inside outbound DNS query strings and sent to attacker-controlled external servers. This is the defining behavior of DNS tunneling, where DNS traffic is abused as a covert channel for command-and-control or data exfiltration.

CEH-aligned covert-channel material explains that tunneling allows one protocol to be carried over another protocol and that covert channels can hide data inside otherwise permitted traffic. It also notes that DNS query and reply traffic may be used to tunnel commands or data so that traffic appears ordinary to protocol analyzers .

Option A. TCP Parameter Manipulation is incorrect because the scenario does not describe hiding data in TCP header fields.

Option B. Reverse ICMP Tunnel is incorrect because the suspicious traffic is DNS name resolution traffic, not ICMP echo traffic.

Option D. Reverse HTTP Shell is incorrect because the activity is not HTTP/HTTPS-based command retrieval.

Therefore, the best answer is C. DNS Tunneling.

The correct answer is A because a deauthentication attack is commonly used to force a connected wireless client to disconnect from an access point and then reconnect. During that reconnection process, the WPA/WPA2 authentication handshake can be captured and later used for offline password-cracking attempts. CEH wireless hacking concepts describe breaking WPA by capturing WPA/WPA2 authentication handshaking packets and forcing a connected client to disconnect and reconnect so authentication packets can be captured for Pairwise Master Key analysis. This matches the purpose of a deauth attack. Jamming is mainly an availability or denial-of-service attack that disrupts wireless communication, not a handshake-capture method. Spoofing means impersonating a device or MAC address, and replay means reusing captured traffic or authentication data. Although replay attacks can be part of wireless exploitation, the specific attack used to trigger a fresh handshake capture is deauthentication. Therefore, option A is the best CEH-aligned answer.

The correct answer is A. Insecure Design.

The issue is not just a single input validation bug. The scenario describes recurring weaknesses across multiple applications, inconsistent controls between teams, and the need to standardize security requirements across future development efforts. That points to a design-level problem, not just a patching or configuration issue.

CEH-aligned secure development material emphasizes that threat modeling identifies and reviews threats, trust boundaries, data flows, vulnerabilities, and weaknesses in application security design . Web application mitigation guidance also identifies server-side validation, whitelisting or blacklisting of input characters, sanitization, output validation, encoding, prepared statements, parameterized queries, and bind variables as mitigations for input validation flaws .

Option B. Broken Access Control is incorrect because the scenario focuses on inconsistent input-handling and validation design, not unauthorized access to functions or objects.

Option C. Security Misconfiguration is incorrect because the root problem is not an incorrectly configured server or framework setting.

Option D. Cryptographic Failures / Sensitive Data Exposure is incorrect because the issue is not about weak encryption or exposure of protected data through cryptographic failure.

Therefore, the best answer is A. Insecure Design.

A NULL scan is a TCP port scanning technique in which the attacker sends a TCP packet with no flags set. This technique is commonly used during the network reconnaissance and port-scanning phase to identify open and closed ports while attempting to evade some security controls and logging mechanisms.

According to TCP/IP behavior defined in RFC 793 and discussed in CEH network scanning concepts, when a NULL packet is sent to a closed port, the target system should respond with a TCP RST (Reset) packet. The RST packet indicates that no service is listening on that port and that the connection attempt should be terminated immediately.

When the port is open, most UNIX/Linux systems generally do not respond to a NULL scan packet. Therefore, scanners such as Nmap interpret no response as either an open or filtered port and RST as a closed port.

Option A (No response) is associated with an open port in a typical NULL scan, not a closed one. Options B, D, E, and F are incorrect because FIN, SYN, ACK, and PSH are not the expected responses from a closed port during a NULL scan.

According to CEH v13 Network Scanning and Enumeration, ICMP Echo Requests (ping) are commonly filtered by firewalls and intrusion prevention systems to reduce network reconnaissance exposure. When ICMP Echo Replies are not returned but other services remain operational, the most likely explanation is ICMP filtering rather than host unavailability or compromise.

CEH v13 explicitly states that many organizations configure firewalls to block ICMP Echo Requests while allowing other ICMP types or higher-layer protocols. This practice helps prevent attackers from easily mapping live hosts during the reconnaissance phase.

The other options are incorrect because:

Unused IPs would not necessarily have active services.

A breach would typically present additional symptoms.

Network congestion would affect multiple protocols, not just ICMP.

Thus, blocked ICMP is the correct interpretation.

The scenario best illustrates loss of governance because the core problem is not a specific technical exploit but a failure in management oversight, accountability, and control assignment for cloud/serverless security responsibilities. The question describes “lack of defined responsibilities for monitoring, auditing, and securing serverless services,” resulting in critical functions being “unmanaged,” which led to downtime and delayed alerts. That is a governance failure: the organization did not establish clear ownership, policies, and operational processes to ensure cloud workloads—specifically serverless functions—were properly monitored, audited, and secured.

In cloud environments, governance includes defining roles and responsibilities (shared responsibility model understanding), establishing security baselines, ensuring logging/monitoring coverage, enforcing configuration management, and maintaining compliance oversight. When governance is weak, services may be deployed without consistent security controls, alerts may be misconfigured or ignored, and incident response can be delayed because no team is clearly accountable. Serverless increases this risk because it can be rapidly adopted by developers, spun up quickly, and overlooked by traditional infrastructure processes if the organization’s governance framework doesn’t explicitly include it.

While “insufficient logging and monitoring” (A) is closely related, the scenario frames the root cause as management’s lack of defined responsibilities, which is broader than missing logs. It’s about the absence of governance structures that ensure logging/monitoring are implemented and owned. Privilege escalation and side-channel attacks are technical attack categories not suggested by the description.

Therefore, the cloud threat illustrated is B. Loss of governance.

The correct answer is C, Parameter tampering. In web application hacking, hidden fields are HTML form fields used to pass values back to the server, but they are only hidden from normal browser display, not from the user or attacker. CEH web application material explains that hidden fields are embedded in HTML forms to maintain values sent back to the server, and attacks challenge the assumption that hidden fields cannot be viewed or modified by examining the HTML source and changing the request before it reaches the server. This directly matches parameter tampering because the attacker modifies client-side parameters such as form fields, cookies, query strings, or URL parameters to alter application behavior. CEH material also describes parameter/form tampering as manipulating parameters during client-server communication, including URL values and web page form fields. SQL injection targets database queries, XSS injects script into pages, and CSRF tricks authenticated users into submitting unwanted requests. Hidden-field manipulation is therefore a form of parameter tampering.

RST hijacking is a TCP session hijacking technique emphasized in CEH materials under network attacks against established communications. In TCP, a Reset flag packet is used to abruptly tear down a connection. If an attacker can observe the session and determine the correct parameters such as IP addresses, ports, and an in-window sequence number, they can forge a TCP RST packet that appears to come from one endpoint. This can force the victim side to drop the session, making the legitimate client suddenly lose responsiveness.

The key clue in the scenario is that Rachel “observes a client-server communication” and then injects crafted packets that disrupt the client while the server continues to communicate with Rachel’s system. That behavior matches the practical use of RST hijacking in demonstrations: terminate or desynchronize the victim endpoint while keeping the server-side session usable long enough for the attacker to inject traffic with valid sequence and acknowledgment values. In a switched LAN, this is often paired with sniffing or traffic visibility to reliably craft the reset packet and subsequent injected packets.

Blind hijacking is different because the attacker cannot see the traffic and must guess sequence numbers, which contradicts the “observes communication” detail. UDP hijacking is not applicable because UDP is connectionless and does not use session state or RST flags. “TCP/IP hijacking” is a broad category, but the question asks for the specific technique used to disrupt the client via crafted packets, which is best identified as RST hijacking.

The correct answer is A because AXFR is the DNS operation used for a full zone transfer. In DNS, a zone transfer copies DNS zone data from one DNS server to another, usually from a primary authoritative server to a secondary server for replication and redundancy. CEH DNS enumeration topics emphasize that zone transfers are valuable during reconnaissance because they can reveal DNS records, hostnames, mail servers, name servers, IP addresses, and other infrastructure details. The referenced CEH material identifies zone transfer as a DNS transfer where all SOA records are transmitted to the requester and states that the full zone transfer option uses opcode AXFR, while incremental transfer uses IXFR. It also shows the practical command pattern dig < domain.com > axfr for requesting a zone transfer. AXFR is not encryption, DNS tunneling, or normal DNS resolution; it specifically allows full DNS zone transfer.

The correct answer is A. IMDS Attack.

The scenario describes an attacker executing code from inside a cloud instance and retrieving temporary credentials associated with the instance role. This is characteristic of an Instance Metadata Service (IMDS) attack. Cloud platforms expose metadata services to instances so applications can retrieve configuration and role credentials. If an attacker gains code execution on the instance, they may query IMDS and steal temporary credentials.

A cloud security reference explains that when an EC2 instance is associated with an instance profile, temporary security credentials are automatically provided to the instance through the Instance Metadata Service (IMDS) . In the scenario, the tester abuses this behavior after gaining code execution through the vulnerable web application.

Option B. CPDoS Attack is incorrect because Cache Poisoned Denial-of-Service targets caching behavior to cause service denial.

Option C. Cloud Snooper Attack is incorrect because Cloud Snooper refers to bypassing firewall controls and command-and-control through cloud infrastructure paths.

Option D. Wrapping Attack is incorrect because wrapping attacks commonly target SOAP/XML signatures or request manipulation, not cloud instance metadata credentials.

Therefore, the best answer is A. IMDS Attack.

The correct answer is D. OS Command Injection in nginxWebUI.

The scenario describes user-controlled input being incorporated into backend processing routines and affecting system-level operations under the web service context. That is characteristic of OS command injection.

CEH-aligned web application material explains that injection flaws occur when untrusted input is processed without proper validation and that injection attacks include SQL injection, LDAP injection, and OS command injection . Another CEH source explains that command injection may occur when malicious commands are injected into application input fields instead of expected values, allowing commands to be passed to the server through poor input validation .

Option A. NULL Pointer Dereference in HTTP/3 is incorrect because the scenario does not describe HTTP/3 memory handling or service crashes caused by null pointer behavior.

Option B. Improper Certificate Validation is incorrect because the issue is not related to TLS certificate verification.

Option C. Server-Side Request Forgery (SSRF) is incorrect because SSRF involves causing the server to make unintended requests to internal or external resources.

Option D. OS Command Injection in nginxWebUI is correct because modified user input affects system-level commands executed by the web service.

Therefore, the best answer is D. OS Command Injection in nginxWebUI.

The correct answer is Checks for outdated versions of over 1,250 servers. In CEH vulnerability assessment coverage, Nessus Essentials is presented as a vulnerability scanning solution that can assess a wide variety of technologies, including operating systems, web servers, databases, network devices, and virtualized environments. Its core role is identifying weaknesses, missing patches, insecure configurations, and exposure conditions across supported platforms. The option about checking outdated versions across a very broad range of server technologies best reflects that scanner-oriented capability. Patch management is not the primary function of Nessus Essentials, because it identifies vulnerabilities rather than directly managing patch deployment. Agent-based detection may be used in some security products, but that is not the defining capability highlighted in this CEH-style framing. High-speed asset discovery is a feature associated more strongly with specialized discovery platforms, whereas Nessus is centered on vulnerability enumeration and assessment. CEH study material emphasizes understanding the purpose of common security tools, and Nessus is generally classified as a scanner that detects outdated software versions and known vulnerabilities so remediation can be prioritized across the environment. That is why option B is the most accurate fit.

The correct answer is A. Switch(config)# ip dhcp snooping because the question asks for the global setting that must be enabled first, before applying more specific (granular) DHCP Snooping controls. In Cisco switching, DHCP Snooping is the primary Layer 2 security feature used to mitigate rogue DHCP server attacks. Once enabled, the switch can distinguish between trusted ports (where legitimate DHCP server responses are allowed, typically uplinks toward the authorized DHCP server) and untrusted ports (typically access ports to end-user devices), where DHCP server responses (DHCPOFFER/DHCPACK) are filtered to prevent a rogue server from handing out malicious network configuration (gateway/DNS) to clients.

The scenario’s defense goal—“reject DHCP responses from untrusted ports”—is exactly what DHCP Snooping enforces after it is enabled and ports are assigned trust states. Conceptually, the workflow is:

Enable DHCP Snooping globally (feature activation),

Enable it for the relevant VLAN(s), and

Mark the legitimate DHCP-facing interface(s) as trusted so only those ports can send DHCP server responses.

Options C and D are part of the later, granular steps:

C enables DHCP snooping for a specific VLAN, which is necessary but is not the global prerequisite the question highlights.

D is applied under an interface to designate a port as trusted; again, this is granular and only meaningful after DHCP snooping is activated.

Option B is a different feature (Dynamic ARP Inspection) and is used to mitigate ARP spoofing/poisoning rather than rogue DHCP.

Therefore, the global command Jason should recommend first is Switch(config)# ip dhcp snooping.