Pass the ECCouncil CEH v13 312-50v13 Questions and answers with ExamsMirror

The correct answer is B because massive outbound HTTPS traffic is a strong indicator of data exfiltration, especially when it is designed to blend into normal web traffic. In CEH attack lifecycle concepts, exfiltration occurs after an attacker gains access and can quietly extract protected resources or sensitive data from the environment. The retrieved CEH-aligned material describes exfiltration as the phase where an attacker with elevated access can “quietly extract data,” and notes that exfiltration can occur silently. HTTPS is commonly allowed outbound in enterprise networks, so attackers may use it as a covert or low-noise channel to move stolen files, credentials, database dumps, or archives to an external server. The guide material also notes that malware often uses SSL over port 443 or other easy- to-hide mechanisms rather than obvious suspicious ports. DoS usually creates service disruption, scanning generates probing patterns, and reconnaissance focuses on information gathering. Massive hidden outbound HTTPS most likely indicates data exfiltration.

According to CEH v13, one of the most effective defenses against rogue DHCP servers is DHCP snooping, a Layer 2 security feature that classifies switch ports as either trusted or untrusted. DHCP responses are permitted only on trusted ports, typically those connected to legitimate DHCP servers. Any DHCP OFFER or ACK originating from an untrusted port is dropped automatically. In the scenario, the rogue DHCP server is sending unauthorized configuration settings because the switch is forwarding DHCP messages from all ports without restriction. CEH specifically warns that unmanaged or misconfigured switches allow rogue DHCP servers to assign malicious DNS, gateway, or IP configurations, enabling traffic redirection, interception, or man-in-the-middle attacks. ARP inspection (Option B) protects against ARP spoofing but not DHCP abuses. Port security (Option C) prevents MAC flooding, not DHCP impersonation. Static reservations (Option D) do not scale and do not stop rogue DHCP servers. DHCP snooping directly mitigates this threat.

Tautology-based SQL injection tests, such as using ' OR ' 1 ' = ' 1, are safe and effective methods to verify whether SQL queries are being manipulated by user input. CEH emphasizes avoiding destructive queries and using logical expressions that return all rows if injection is successful.

Blowfish is the only option that matches all the technical characteristics described. In CEH cryptography concepts, symmetric algorithms are commonly distinguished by their structure (block cipher versus stream cipher), block size, and supported key lengths. The question states the algorithm encrypts data in 64-bit blocks and supports a variable key size ranging from 32 bits up to 448 bits, and it was introduced as a replacement for DES. Blowfish fits precisely: it is a symmetric block cipher with a 64-bit block size and a configurable key length from 32 to 448 bits, designed to be fast in software and positioned historically as an alternative to older ciphers such as DES.

The other choices do not align with these identifying properties. RC4 is a stream cipher and does not operate on fixed-size blocks, so it cannot match the 64-bit block requirement. AES is a block cipher but uses a 128-bit block size with fixed key sizes of 128, 192, or 256 bits, not 32 to 448 bits. Twofish, while related historically as a successor-era design, also uses a 128-bit block size and fixed key sizes up to 256 bits, so it does not match either.

From a CEH perspective, the mention of variable key sizes also hints at risk evaluation: shorter keys in any cipher can be brute-forced, so secure deployments require strong key length selection and proper key management. Additionally, Blowfish’s 64-bit block size can be a concern in large-volume encryption scenarios due to block collision risks, which is why modern systems often prefer 128-bit block ciphers for new designs.

This activity clearly indicates a TCP SYN scan, also known as a half-open scan, which is a commonly used stealth scanning technique discussed in CEH v13 Reconnaissance and Network Scanning. In a SYN scan, the attacker sends TCP SYN packets to target ports and observes the responses without completing the TCP three-way handshake.

If the port is open, the target responds with a SYN/ACK packet. The scanner then immediately sends a RST packet instead of the final ACK, leaving the connection half-open. This behavior allows attackers to identify open ports while minimizing log entries and reducing detection by security monitoring tools.

The absence of ACK packets in logs supports this explanation, as the handshake is never completed.

Other options are incorrect because:

XMAS scans send packets with multiple flags set.

SYN/ACK scans are primarily used for firewall rule discovery.

TCP Connect scans complete the full handshake and generate ACKs.

CEH v13 emphasizes that SYN scans are widely used because they balance accuracy and stealth, making them a preferred reconnaissance method for attackers.

Mobile Remote Access Trojans (RATs) are highlighted in CEH v13 Mobile Platform Hacking as one of the most dangerous threats. Once installed, a mobile RAT provides attackers persistent, covert access to devices, allowing screen capture, keystroke logging, microphone activation, and data exfiltration.

Unlike MitM or clickjacking, RATs operate post-compromise, often disguised as legitimate apps. Jailbreaking is detectable via integrity checks, but RATs can remain hidden even on non-rooted devices.

CEH v13 emphasizes that RATs bypass traditional defenses, including antivirus and MDM, making them extremely difficult to detect. Hence, Option C is correct.

According to the Certified Ethical Hacker (CEH) IoT, OT, and SCADA Security module, side-channel attacks exploit indirect information leaks such as power consumption, electromagnetic emissions, timing variations, or thermal output rather than software vulnerabilities.

Option A is correct because monitoring hardware-level anomalies is the primary method for detecting side-channel exploitation. CEH materials emphasize that these attacks bypass traditional security controls.

Option B relates to cryptographic weaknesses, not side-channel analysis.

Option C addresses interface misuse, not covert data leakage.

CEH highlights that SCADA systems are especially vulnerable due to legacy hardware and limited monitoring capabilities.

The correct answer is B because scheduled tasks are commonly abused for persistence. In system hacking and post-exploitation phases, persistence means maintaining access to a compromised system even after reboot, logoff, or temporary session loss. Attackers may abuse Windows Task Scheduler or Linux cron jobs to automatically run malware, scripts, callbacks, or backdoors at specific intervals, during startup, or when a user logs in. The retrieved guide material shows scheduled-task usage for recurring execution and also references persistence-focused modules such as post/windows/manage/persistence, which aligns with the CEH concept of maintaining access after compromise. Reconnaissance is information gathering before attack, sniffing captures network traffic, and DoS attempts to disrupt availability. Those do not specifically describe abusing scheduled tasks. Defensively, administrators should audit scheduled jobs, monitor task creation events, restrict task-creation privileges, and investigate unknown startup or recurring tasks.

The correct answer is B. Pharming.

The scenario describes users being directed to a fraudulent website that closely resembles the legitimate portal and then being prompted to submit credentials. Among the available options, this best aligns with pharming because the key behavior is redirection or misdirection of users’ web traffic to a fake website designed to harvest credentials.

CEH-aligned social engineering material describes pharming as a phishing-related variant involving redirection of a user’s web traffic and refers to it as “phishing without a lure.” The same reference distinguishes spimming as spam over instant messaging and whaling as a phishing attack targeting high-level executives . CEH web attack material also explains that attackers may use fake websites that look legitimate to extract login details from victims .

Option A. Whaling is incorrect because whaling targets senior executives or high-value individuals.

Option C. Spear Phishing is incorrect because spear phishing is a targeted phishing message sent to a specific individual or small group, usually through email.

Option D. Spimming is incorrect because spimming involves spam messages sent over instant messaging platforms.

Option B. Pharming is the best answer because the attack directs users to a fake portal where credentials are harvested.

Therefore, the best answer is B. Pharming.

The correct answer is A. LDAP Injection.

The scenario describes malicious input being inserted into directory-based search logic used to validate identities. LDAP is commonly used for centralized directory authentication and account lookups. When user input is embedded directly into LDAP filters without proper validation, an attacker can alter the filter logic using operators, wildcards, and special LDAP syntax.

CEH-aligned material states that LDAP injection takes advantage of non-validated input and that an attacker may access information by using an LDAP filter to search the directory database . Another CEH exam reference explains that LDAP injection exploits applications that construct LDAP statements based on user input and pass that input directly into LDAP queries .

Option B. OS Command Injection is incorrect because the scenario does not involve operating system commands.

Option C. SQL Injection is incorrect because the backend lookup is directory-based, not relational database SQL.

Option D. XPath Injection is incorrect because XPath injection targets XML query expressions, not LDAP directory filters.

Therefore, the best answer is A. LDAP Injection.

In CEH v13 Cryptography, this threat is formally referred to as “Harvest Now, Decrypt Later” (HNDL). It describes a long-term cryptographic risk where adversaries intercept and store encrypted communications today, even though they cannot decrypt them with current computational capabilities. The expectation is that future quantum computers will be powerful enough to break widely used public-key cryptographic algorithms.

CEH v13 emphasizes that quantum algorithms such as Shor’s Algorithm can theoretically break RSA, DSA, and ECC by efficiently solving integer factorization and discrete logarithm problems. However, the defining feature of this threat is not the act of breaking encryption itself, but rather the strategic collection and storage of encrypted data in advance.

Option C is incomplete because it focuses only on the cryptographic mechanism rather than the threat model. Options B and D are unrelated to the scenario described and refer to quantum communication integrity issues, not long-term cryptographic exposure.

CEH v13 highlights that sensitive data with long confidentiality lifetimes—such as government records, financial data, healthcare information, and intellectual property—is especially vulnerable to this threat. As a result, organizations are encouraged to adopt quantum-resistant (post-quantum) cryptographic algorithms proactively.

Thus, Option A accurately describes the threat model and aligns with CEH v13’s treatment of future cryptographic risks.

Fileless malware is the best match because the scenario highlights memory-resident execution with no malicious files written to disk and activity that disappears after a reboot. In CEH-aligned malware concepts, fileless attacks commonly leverage legitimate system tools and trusted processes, often called living off the land, to execute malicious logic without dropping traditional executables. PowerShell is one of the most frequently abused components for this purpose because it can download, decode, and run scripts directly in memory, including obfuscated commands that evade simple signature-based scans. The prompt explicitly states that endpoint scanners find no malicious files on disk, yet telemetry detects a trusted process executing obfuscated PowerShell commands in memory. That combination strongly indicates fileless behavior.

The fact that the anomaly vanishes on reboot also fits fileless techniques that rely on volatile memory artifacts rather than persistent file-based implants. While fileless attacks can establish persistence through registry run keys, scheduled tasks, WMI, or other mechanisms, the question emphasizes no footprint and reboot clearing the activity, which is consistent with a purely in-memory foothold or a short-lived execution chain.

A worm is characterized by self-replication across systems, which is not described. A trojan usually involves a malicious file disguised as legitimate software, conflicting with the “no files on disk” observation. A rootkit focuses on stealth and hiding by modifying system internals and can persist, but the scenario’s defining indicators are PowerShell in-memory execution and lack of disk artifacts, which aligns most directly with fileless malware.

The correct answer is C because an SMB relay attack is best classified as a Man-in-the-Middle attack. In this attack, the attacker positions a fraudulent SMB server or relay between a victim client and a legitimate target server. When the victim attempts Windows/SMB authentication, the attacker does not simply replay old traffic later; instead, the attacker relays the live authentication exchange to the real target server and uses the resulting authenticated connection. EC-Council material describes SMBRelay as an SMB server that can capture usernames and password hashes from incoming SMB traffic and states that it can perform man-in-the-middle attacks. It also describes a scenario where the victim thinks they are connecting to the target, while the MITM server intercepts the call and passes the connection to the target server. Replay is a related concept, but replay usually means capturing authentication data and reusing it later. SMB relay is specifically a live MITM relay technique, so option C is the most accurate.

The correct answer is D. Botnet Agents.

The scenario describes multiple infected machines that periodically contact a central command server, receive instructions, and generate coordinated traffic when directed. These compromised systems are functioning as botnet agents, also called bots or zombies.

CEH-aligned DoS/DDoS material explains that a botnet is typically created by installing a bot on a victim system using a Trojan horse. Once executed, the victim system becomes infected and waits for instructions from a command-and-control handler. The handler then sends instructions to infected systems to perform attacks . Another reference explains that botnets are networks of hacked machines controlled remotely without the owners’ knowledge and used like an army to launch attacks against targets .

Option A. Spyware is incorrect because spyware primarily gathers user activity or sensitive data.

Option B. Scareware is incorrect because scareware tricks users with fake warnings to make them install software or pay for fraudulent services.

Option C. Potentially Unwanted Applications (PUAs) is incorrect because PUAs may be unwanted or intrusive, but they do not necessarily act as remotely controlled attack agents.

Option D. Botnet Agents is correct because the infected endpoints receive commands from a central controller and participate in coordinated activity.

Therefore, the best answer is D. Botnet Agents.

An Application-Level Firewall, commonly called an application-level gateway or proxy firewall, inspects traffic at the application layer and enforces rules based on specific application protocols and commands. In CEH-aligned coverage of perimeter defenses, this firewall type is distinguished by its ability to understand protocol behavior and content for services such as DNS and SSH, rather than relying only on IP addresses, ports, and basic connection state.

The question states the filtering system “analyzes incoming SSH and DNS requests to block unauthorized access attempts.” That wording points directly to application-aware inspection: it is evaluating protocol-specific requests, not merely allowing or denying traffic based on port numbers. A packet filtering firewall generally makes decisions using network and transport layer information such as source and destination IP, protocol, and port, without parsing DNS queries or SSH negotiation details. A circuit-level gateway firewall focuses on validating session establishment and connection properties, typically without deep inspection of the application commands inside the session. A stateful multilayer inspection firewall can track connection state and sometimes incorporate deeper inspection, but the strongest and most explicit match to “analyzes SSH and DNS requests” in CEH terminology is the application-level firewall, which uses proxies or protocol engines to parse and filter application traffic.

From an ethical testing perspective, attempts to “craft specific payloads” often involve probing how the firewall validates protocol fields, handles malformed requests, or enforces policy on application commands. Defenders mitigate these risks through strict proxy policy configuration, robust protocol validation, patching, logging, and limiting exposed services to only what is required.

Ethical hacking, as defined throughout CEH courseware, is the authorized and legitimate process of identifying vulnerabilities, weaknesses, and misconfigurations in information systems. The primary objective is to strengthen security by discovering issues before malicious actors can exploit them. Ethical hackers follow strict legal guidelines, obtain written permission, and operate within a defined scope to ensure their activities contribute positively to the organization’s security posture. Unlike malicious hacking, the intent is not to steal data, cause harm, or disrupt operations. Ethical hackers use the same tools, techniques, and methodologies that attackers use, but with the purpose of remediation and risk reduction. CEH emphasizes that ethical hacking supports defense-in-depth strategies by enabling organizations to harden their environments and proactively mitigate threats. Therefore, identifying and fixing vulnerabilities is the central mission of ethical hacking.

Ransomware encrypts user data and extorts payment for restoration. CEH covers ransomware as a major threat in system hacking, highlighting encryption-based extortion as its defining behavior.

The correct answer is D, Rules of engagement. In CEH pre-engagement concepts, the rules of engagement document defines the authorized boundaries of a penetration test before any testing begins. It specifies what testing techniques are permitted, which systems or networks may be tested, when testing may occur, what actions are prohibited, whom to contact during emergencies, and how incidents such as service disruption should be handled. It also helps protect the penetration tester by documenting client approval and limiting liability when the tester acts within the agreed boundaries. A project scope may list targets, IP ranges, applications, or business units included in testing, but it does not fully cover operational permissions and liability terms by itself. A nondisclosure agreement protects confidential information discovered during the engagement. A service-level agreement defines service expectations such as uptime, response time, or support obligations. Therefore, the document that best matches allowed testing, timing, and tester liability limits is the Rules of engagement.

CEH v13 identifies encrypted communication channels as one of the most common and effective firewall evasion techniques. Firewalls that rely on packet inspection or signature-based filtering often cannot inspect encrypted payloads without SSL/TLS interception capabilities.

By encrypting malicious traffic—using HTTPS, VPN tunnels, or encrypted C2 channels—attackers can bypass firewall rules that inspect packet contents. CEH v13 emphasizes that this technique is widely used in malware communication, data exfiltration, and command-and-control operations.

IP spoofing (Option A) is limited by ingress and egress filtering and is less effective against modern firewalls. Open-source operating systems (Option B) do not inherently evade firewalls. Social engineering (Option D) targets users, not firewalls.

Therefore, Option C is the correct and CEH-aligned answer.

According to CEH v13, black box testing refers to a testing approach where the ethical hacker has no prior knowledge of the internal structure, source code, or configuration of the system.

The attacker simulates a real-world external attacker, relying solely on discovery and exploitation techniques.

White box testing = full knowledge

Gray box testing = partial knowledge