Pass the ECCouncil CEH v13 312-50v13 Questions and answers with ExamsMirror

According to CEH v13 Module 04: Enumeration and Module 08: Sniffing, packet sniffers such as Wireshark, tcpdump, and EtherApe are designed to capture and analyze network traffic at the data link (Layer 2) and network (Layer 3) layers of the OSI model.

At Layer 2 (Data Link), sniffers capture Ethernet frames, including MAC addresses and frame type.

At Layer 3 (Network), sniffers interpret IP headers, IP addresses, and transport layer protocols (TCP, UDP).

They do not operate at Layer 1 (Physical) as they do not deal with raw electrical signals.

Packet sniffers also do not manipulate traffic but passively monitor and capture packets that traverse the network.

Therefore, the correct statement is:

Packet Sniffers operate on both Layer 2 & Layer 3 of the OSI model.

Option Analysis:

A. Layer 1: ❌ Incorrect. Layer 1 is the physical layer (electrical, optical signals).

B. Layer 2: ❌ Partially correct but incomplete.

C. Both Layer 2 & Layer 3: Correct. Full coverage of packet sniffing capabilities.

D. Layer 3: ❌ Partially correct but incomplete.

Reference from CEH v13 Courseware:

Module 08 – Sniffing, Section: How Packet Sniffers Work

CEH iLabs: Capturing Ethernet Frames and IP Packets Using Wireshark

OSI Model Mapping in CEH Official eBook

The best security practice in this scenario is to implement IEEE 802.1X. This is a port-based Network Access Control (NAC) protocol that provides authentication for devices before they are allowed to transmit traffic on the network. It ensures that only authorized users/devices can access the network through physical (wired) or wireless connections.

CEH v13 Official Courseware states:

“802.1X provides a framework for authenticating and authorizing devices attached to a LAN port, enforcing port-based network access control. It helps prevent unauthorized users from connecting to an internal network, particularly in environments where physical access to network jacks cannot be fully controlled.”

Incorrect Options:

A. Disabling unused ports is a good practice, but students may still use open ports intended for authorized personnel. It does not scale or provide identity-based access control.

B. Separating users in VLANs helps in segmentation, but it does not prevent unauthorized physical access to ports.

D. Asking students to use wireless is administrative, not a technical enforcement measure.

Reference – CEH v13 Guide:

Module 04: Enumeration

Topic: Network Access Control (802.1X) and Switch Port Security

===========

File system permissions

Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.

A Kerberoasting attack is a technique that exploits the Kerberos authentication protocol to obtain the password hash of a service account that has a Service Principal Name (SPN). An attacker can request a service ticket (TGS) for the SPN using a valid user’s ticket (TGT) and then attempt to crack the password hash offline. To prevent the attacker from using the TGS to access the service, the system administrator should invalidate the TGS as soon as possible. This can be done by changing the password of the service account, which will generate a new password hash and render the old TGS useless. Alternatively, the system administrator can use tools like Mimikatz to purge the TGS from the memory of the domain controller or the client system. Performing a system reboot, deleting the compromised user’s account, or changing the NTLM password hash used to encrypt the ST are not effective ways to invalidate the TGS, as they do not affect the encryption of the TGS or the validity of the TGT. References:

EC-Council CEHv12 Courseware Module 11: Hacking Webservers, page 11-24

What is a Kerberoasting Attack? – CrowdStrike

How to Perform Kerberoasting Attacks: The Ultimate Guide - StationX

An untethered jailbreak is one that allows a telephone to finish a boot cycle when being pwned with none interruption to jailbreak-oriented practicality.

Untethered jailbreaks area unit the foremost sought-after of all, however they’re additionally the foremost difficult to attain due to the powerful exploits and organic process talent they need. associate unbound jailbreak is sent over a physical USB cable association to a laptop or directly on the device itself by approach of associate application-based exploit, like a web site in campaign.

Upon running associate unbound jailbreak, you’ll be able to flip your pwned telephone off and on once more while not running the jailbreak tool once more. all of your jailbreak tweaks and apps would then continue in operation with none user intervention necessary.

It’s been an extended time since IOS has gotten the unbound jailbreak treatment. the foremost recent example was the computer-based Pangu break, that supported most handsets that ran IOS nine.1. We’ve additionally witnessed associate unbound jailbreak within the kind of JailbreakMe, that allowed users to pwn their handsets directly from the mobile campaign applications programme while not a laptop.

Guardster is an anonymizing proxy service that allows users to:

Mask their real IP address

Bypass content filters and access restricted websites

Maintain anonymity while browsing or engaging in online activities

It functions as a middleman between the user and target sites, hiding user identities.

Incorrect Options:

A. Baidu is a Chinese search engine.

C. WolframAlpha is a computational search engine.

D. Karma Decay is a reverse image search engine for Reddit.

Reference – CEH v13 Official Courseware:

Module 02: Footprinting and Reconnaissance

Section: “Anonymous Browsing Tools and Techniques”

Subsection: “Proxy and Anonymizing Services”

Censys is a powerful Internet-wide scanning tool that allows users to:

Discover and analyze devices and services exposed to the public internet

Enumerate connected IoT devices, open ports, software versions

Provide structured and searchable reports for vulnerability analysis

According to CEH v13:

Censys continuously scans the IPv4 address space and maintains up-to-date databases of connected devices and their metadata.

Incorrect Options:

B. Wapiti is a web application vulnerability scanner.

C. NeuVector is a container security solution.

D. Lacework is a cloud workload protection platform, not focused on IoT enumeration.

Reference – CEH v13 Official Courseware:

Module 18: IoT and OT Hacking

Section: “IoT Discovery Tools”

Tool Focus: Censys, Shodan

===========

https://en.wikipedia.org/wiki/Nikto_(vulnerability_scanner)

Nikto is a free software command-line vulnerability scanner that scans web servers for dangerous files/CGIs, outdated server software, and other problems. It performs generic and server types specific checks. It also captures and prints any cookies received. The Nikto code itself is free software, but the data files it uses to drive the program are not.

Ettercap is a comprehensive MITM attack tool that supports live traffic interception and content injection. It can modify HTTP streams in real time and inject malicious payloads, such as JavaScript or applets, into web traffic.

Reference – CEH v13 Official Study Guide:

Module 8: Sniffing

Quote:

“Ettercap allows attackers to intercept, analyze, and alter data on the fly, including injecting malicious content like Java applets in HTTP sessions during MITM attacks.”

Incorrect Options Explained:

A & D. Wireshark and Tcpdump are passive sniffers with no injection capability.

C. Aircrack-ng is for Wi-Fi key cracking, not traffic manipulation.

===========

Objectives of Footprinting Draw Network Map - Combining footprinting techniques with tools such as Tracert allows the attacker to create diagrammatic representations of the target organization’s network presence. Specficially, it allows attackers to draw a map or outline of the target organization’s network infrastructure to know about the actual environment that they are going to break into. These network diagrams can guide the attacker in performing an attack. (P.114/98)

The most effective long-term strategy to reduce the gap between black hats and white hats is through education. Training individuals in areas such as:

Risk analysis

Vulnerability identification

Defensive mechanisms and countermeasures

helps foster a deeper understanding of cybersecurity and ethical responsibilities.

From CEH v13 Official Guide:

Module 1: Introduction to Ethical Hacking

Section: Ethics and Legal Issues

Subsection: Bridging the Hacker Mindset

The guide states:

“Educating individuals on proper cybersecurity techniques and the consequences of malicious hacking is critical to transforming the skillset of potential black hats into productive white hat professionals. Providing structured knowledge through training, books, and ethical hacking certifications empowers aspiring hackers to use their skills positively.”

Incorrect Options:

B: Useful for operations, but doesn’t bridge a knowledge gap.

C: Lowering certification standards can reduce industry credibility.

D: Involves a specific audience and doesn't address the broader knowledge gap.

The security strategy that you would likely suggest is to adopt a Continual/Adaptive Security Strategy involving ongoing prediction, prevention, detection, and response actions to ensure comprehensive computer network defense. This strategy is based on the concept of continuous monitoring and improvement of the security posture of an organization, using a feedback loop that integrates various security activities and technologies. A Continual/Adaptive Security Strategy aims to proactively identify and mitigate emerging threats, vulnerabilities, and risks, as well as to respond effectively and efficiently to security incidents and breaches. A Continual/Adaptive Security Strategy can help enhance the organization’s security stance by providing the following benefits12:

It can reduce the attack surface and the exposure time of the organization’s network infrastructure, by applying timely patches, updates, and configurations, as well as by implementing security controls and policies.

It can increase the visibility and awareness of the organization’s network activity and behavior, by collecting, analyzing, and correlating data from various sources, such as logs, sensors, alerts, and reports.

It can improve the detection and prevention capabilities of the organization, by using advanced tools and techniques, such as artificial intelligence, machine learning, threat intelligence, and behavioral analytics, to identify and block malicious or anomalous patterns and indicators.

It can enhance the response and recovery processes of the organization, by using automated and orchestrated actions, such as isolation, quarantine, remediation, and restoration, to contain and resolve security incidents and breaches, as well as by conducting lessons learned and root cause analysis to prevent recurrence.

The other options are not as appropriate as option C for the following reasons:

A. Develop an in-depth Risk Management process, involving identification, assessment, treatment, tracking, and review of risks to control the potential effects on the organization: This option is not sufficient because risk management is only one aspect of a comprehensive security strategy, and it does not address the dynamic and evolving nature of cyber threats and vulnerabilities. Risk management is a process of identifying, analyzing, evaluating, and treating the risks that may affect the organization’s objectives and operations, as well as monitoring and reviewing the effectiveness of the risk treatment measures3. Risk management can help the organization prioritize and allocate resources for security, but it cannot guarantee the prevention or detection of security incidents and breaches, nor the response and recovery from them.

B. Establish a Defense-in-Depth strategy, incorporating multiple layers of security measures to increase the complexity and decrease the likelihood of a successful attack: This option is not optimal because defense-in-depth is a traditional and static approach to security, and it may not be able to cope with the sophisticated and persistent attacks that exploit unknown or zero-day vulnerabilities. Defense-in-depth is a strategy of implementing multiple and diverse security controls and mechanisms at different layers of the organization’s network infrastructure, such as perimeter, network, endpoint, application, and data, to provide redundancy and resilience against attacks4. Defense-in-depth can help the organization protect its assets and systems from unauthorized access or damage, but it cannot ensure the timely detection and response to security incidents and breaches, nor the continuous improvement of the security posture.

D. Implement an Information Assurance (IA) policy focusing on ensuring the integrity, availability, confidentiality, and authenticity of information systems: This option is not comprehensive because information assurance is a subset of cybersecurity, and it does not cover all the aspects of a holistic security strategy. Information assurance is a discipline of managing the risks associated with the use, processing, storage, and transmission of information and data, and ensuring the protection of the information and data from unauthorized access, use, disclosure, modification, or destruction5. Information assurance can help the organization safeguard its information and data from compromise or loss, but it does not address the prevention, detection, and response to security incidents and breaches, nor the adaptation and innovation of the security technologies and processes.

WS-Address provides additional routing information in the SOAP header to support asynchronous communication. This technique allows the transmission of web service requests and response messages using different TCP connections

https://www.google.com/search?client=firefox-b-d &q=WS-Address+spoofing

CEH V11 Module 14 Page 1896

The scenario describes a decentralized cryptographic trust model where each user maintains a ring or database of public keys, and communications are encrypted using the recipient’s public key. This aligns precisely with the Web of Trust (WOT) model.

According to the CEH v13 Official Courseware:

Web of Trust (WOT) is a decentralized trust model used primarily in PGP (Pretty Good Privacy) environments.

In WOT:

Each user maintains a local keyring of trusted public keys.

There is no central Certificate Authority (CA).

Trust is built based on mutual verification and endorsement of public keys among users.

It uses asymmetric cryptography: messages are encrypted using the receiver's public key and decrypted using the corresponding private key.

This model provides authentication (via digital signatures) and message integrity (via cryptographic hash functions).

Incorrect Options:

A. Zero Trust Network is a security architecture that enforces strict access control but is not a cryptographic trust model.

B. TLS (Transport Layer Security) is a protocol for securing data in transit, commonly used in HTTPS, and relies on the PKI trust model (not WOT).

C. SSL (Secure Socket Layer) is an outdated version of TLS, also based on centralized certificate authorities.

Reference – CEH v13 Official Courseware:

Module 20: Cryptography

Section: “Public Key Infrastructure (PKI) and Trust Models”

Subsection: “Web of Trust (WOT) Model”

Study Guide Table: Comparison of Trust Models – PKI vs WOT vs Hybrid

Lab references in CEH Engage may also cover key signing and verifying concepts in decentralized environments.

https://en.wikipedia.org/wiki/Sniffing_attack

To prevent networks from sniffing attacks, organizations and individual users should keep away from applications using insecure protocols, like basic HTTP authentication, File Transfer Protocol (FTP), and Telnet. Instead, secure protocols such as HTTPS, Secure File Transfer Protocol (SFTP), and Secure Shell (SSH) should be preferred. In case there is a necessity for using any insecure protocol in any application, all the data transmission should be encrypted. If required, VPN (Virtual Private Networks) can be used to provide secure access to users.

NOTE: I want to note that the wording "best option" is valid only for the EC-Council's exam since the other options will not help against sniffing or will only help from some specific attack vectors.

The sniffing attack surface is huge. To protect against it, you will need to implement a complex of measures at all levels of abstraction and apply controls at the physical, administrative, and technical levels. However, encryption is indeed the best option of all, even if your data is intercepted - an attacker cannot understand it.