Free ECCouncil 312-50v13 Practice Exam with Questions & Answers | Set: 10

The CEH Web Application Security module explains that race conditions occur when systems improperly handle simultaneous requests, leading to unexpected behavior. In token-based authentication systems, poor synchronization between token expiration checks and validation logic can allow attackers to exploit timing gaps.

The observed pattern—failed attempts with expired tokens followed by successful access—suggests the attacker exploited a race condition where the application inconsistently validated token state.

Option C is correct.

Option A would not involve expired tokens.

Option B is highly impractical given secure token entropy.

Option D typically succeeds without repeated failures.

CEH highlights race conditions as subtle but dangerous logic flaws.

The correct answer is A. Insecure Ecosystem Interfaces.

The weakness involves externally reachable components that interact with management platforms and expose administrative configuration functions. These components also suffer from insufficient input validation and weak authentication controls. This aligns with Insecure Ecosystem Interfaces, which covers insecure web, cloud, mobile, API, and backend interfaces that form part of the IoT device ecosystem.

CEH-aligned IoT material identifies vulnerable interfaces as a major IoT challenge and lists OWASP IoT categories including insecure web, cloud, and mobile interfaces, insufficient authentication/authorization, and insecure network services . It also explains that insecure cloud and mobile interfaces are associated with weak credentials, account enumeration, and poor interface protection . In the newer OWASP IoT wording, these interface weaknesses are commonly grouped under Insecure Ecosystem Interfaces.

Option B. Insecure Default Settings is incorrect because the scenario does not focus on default passwords, default configurations, unnecessary enabled services, or insecure factory settings.

Option C. Insecure Network Services is incorrect because that category focuses on vulnerable network services exposed by the device, such as services susceptible to buffer overflow or denial-of-service conditions. The scenario emphasizes external ecosystem components and management interfaces.

Option D. Lack of Device Management is incorrect because the scenario does not describe missing inventory, missing update management, missing decommissioning, or inability to monitor device lifecycle.

Therefore, the best answer is A. Insecure Ecosystem Interfaces.

The observed behavior most closely matches the Digital Signature Algorithm (DSA). The strongest indicators are: (1) a fresh random value is generated for each signature operation, and (2) the math operates in a subgroup defined by public domain parameters using modular arithmetic, and (3) signatures are verified using a public verification key, not by “decrypting” the message.

DSA is a signature-only asymmetric algorithm derived from discrete logarithm principles. It uses public domain parameters commonly represented as (p, q, g), where p is a large prime, q is a prime divisor of p−1, and g is a generator of a subgroup of order q. For each signature, DSA requires a unique per-message secret random number k. This ephemeral k is crucial: reusing it (or generating it predictably) can expose the private key. The scenario’s emphasis on “fresh random value for each signature operation” aligns directly with this core DSA requirement.

By contrast, RSA signatures can be implemented in different ways (often involving modular exponentiation with padding) and do not inherently require a fresh random per-signature secret like DSA’s k (although some padding schemes may involve randomness). Diffie-Hellman is primarily a key exchange algorithm, not a signing algorithm. ElGamal can be used for signatures and also uses randomness, but the mention of “subgroup defined by public domain parameters” and the classic per-signature random value requirement most strongly aligns with the standard description of DSA used in many security curricula and assessments.

Therefore, based on the signature process characteristics described, the best match is A. DSA.

CEH v13 identifies Man-in-the-Browser (MitB) attacks as one of the most dangerous and difficult-to-detect session hijacking techniques, especially in online banking environments. In MitB attacks, malware operates inside the user’s browser, intercepting and manipulating transactions in real time.

Unlike XSS or session fixation attacks, MitB bypasses server-side security controls entirely. Even strong encryption, multi-factor authentication, and secure cookies are ineffective because the attack occurs after authentication, within a trusted session.

Passive sniffing is limited by encryption, and session fixation relies on poor session management. Covert XSS requires injection points and is more easily mitigated.

CEH v13 emphasizes that MitB attacks can modify transaction details without user awareness, making detection extremely difficult. Therefore, Option B is correct.

Tautology-based SQL injection tests, such as using ' OR ' 1 ' = ' 1, are safe and effective methods to verify whether SQL queries are being manipulated by user input. CEH emphasizes avoiding destructive queries and using logical expressions that return all rows if injection is successful.

The correct choice is D because the question is specifically about disrupting ICMP-based discovery by preventing error messages from being returned. In ICMP reconnaissance, attackers often rely not only on ICMP Echo (ping) but also on ICMP error messages to infer host availability, filtering behavior, and port reachability. A key ICMP error category is ICMP Type 3: Destination Unreachable, which includes several codes (for example, “port unreachable” and “communication administratively prohibited”) that can reveal whether a host exists, whether a firewall is filtering traffic, and whether specific ports are reachable or blocked. When these ICMP Type 3 messages are allowed to leave the network, they provide valuable feedback that helps attackers map the environment accurately.

By blocking inbound ICMP message types (to reduce direct ICMP probing) and blocking outbound ICMP Type 3 unreachable messages, the organization reduces the “informational signals” that external scanners can use to distinguish between live hosts, filtered hosts, and closed ports. This directly aligns with the requirement in the prompt: stopping ICMP discovery by preventing error messages from being returned.

Why the other choices are less precise:

A and C focus on general hardening (port/service reduction), which is good practice but does not directly address ICMP error-message feedback.

B (firewall/IDS detection) is helpful, but the prompt asks for an action that specifically disrupts ICMP discovery traffic by suppressing error responses, which is more directly achieved via ICMP filtering rules.

Operational note: while blocking ICMP Type 3 can reduce reconnaissance visibility, organizations should apply this carefully because some ICMP is important for normal network operations and troubleshooting.

The CEH IoT and APT Threat modules describe APT groups as highly skilled adversaries that favor stealth, persistence, and advanced exploitation techniques. IoT environments are particularly attractive due to:

Limited monitoring

Infrequent firmware updates

Weak or proprietary security mechanisms

CEH highlights that APT actors often exploit zero-day vulnerabilities in firmware to gain long-term, covert access to IoT systems. Firmware-level exploitation allows attackers to maintain persistence while evading traditional security controls.

Option C is correct.

Option A is noisy and short-term.

Option B is common but less sophisticated for APTs.

Option D is possible but secondary compared to firmware exploitation.

CEH emphasizes firmware security as a critical concern in IoT deployments.

The CEH Malware Threats module defines polymorphic malware as malicious code that mutates its appearance (code, encryption, packing) each time it propagates, making signature-based detection ineffective. Dormancy and trigger-based activation are also common characteristics.

CEH emphasizes that behavior-based detection, sandboxing, and heuristic analysis are the most effective countermeasures against polymorphic threats.

Option D is correct.

Options A, B, and C do not address polymorphic evasion techniques.

The capabilities described match an enterprise Wireless Intrusion Prevention System (WIPS) tightly integrated with WLAN infrastructure: it uses access points as sensors (placing selected APs into passive scan/monitor mode), correlates and aggregates alarms from multiple controllers into a central engine for analysis and forensic retention, and can push automated countermeasures across the campus (such as coordinated channel scanning and remote configuration enforcement) when a device is classified as malicious. This is most consistent with Cisco Adaptive Wireless IPS.

Cisco’s adaptive WIPS model uses the existing Cisco wireless architecture (controllers and APs) to provide campus-wide monitoring and enforcement. The phrase “selected APs into a passive scan mode” is a strong indicator of adaptive sensor use—APs can be dedicated or time-sliced for scanning, and the system can coordinate coverage across channels. The centralized engine concept also aligns with enterprise WIPS deployments that collect events and alarms from multiple controllers for correlation and long-term storage, supporting incident investigation and compliance.

Why the other options are less fitting:

Fern WiFi Cracker (C) is an attack/assessment tool, not a production defensive platform, and it does not provide centralized alarm aggregation and automated enterprise countermeasures.

RFProtect (B) is a known wireless security/WIPS solution family, but the question’s feature set and wording (“adaptive,” APs used for passive scanning, controller-integrated countermeasures) most closely matches Cisco’s adaptive WIPS concept.

WatchGuard Wi-Fi Cloud WIPS (A) is a vendor-managed WIPS offering; while it can provide monitoring, the scenario stresses multi-controller aggregation into a central engine and coordinated campus countermeasures via WLAN infrastructure—again aligning best with Cisco’s controller/AP ecosystem.

Therefore, the best answer is D. Cisco Adaptive Wireless IPS.

The correct answer is A, Lateral movement. Lateral movement occurs after initial compromise, when an attacker moves from one system to other internal hosts, accounts, or resources. This phase is especially difficult to detect without centralized logging because evidence is scattered across many endpoints, servers, authentication systems, and network devices. CEH incident response and SOC concepts emphasize SIEM functions such as identifying, monitoring, recording, auditing, and analyzing security incidents, which depend heavily on centralized log collection and correlation. CEH foundation material also notes that when audit/event logs are not properly configured or maintained, incident investigation becomes extremely difficult. In hacking methodology, expanding control from one host to other hosts in the network is described as takeover, which maps closely to lateral movement. Recon, delivery, and initial access may be visible at perimeter or endpoint controls, but lateral movement requires cross-system correlation, making it the hardest phase to detect without centralized logs.

Port scanning is the CEH-aligned technique used to identify available access points into systems, where “access points” refers to open TCP and UDP ports and the services listening on them. In the reconnaissance and scanning phases described in CEH methodology, testers first enumerate live hosts and then perform port scanning to discover which network services are reachable, such as HTTP on 80 or 443, SSH on 22, RDP on 3389, DNS on 53, and many others. This information directly guides the next steps of analysis by revealing the attack surface: what services are exposed, which systems are running them, and which ports may permit remote interaction.

Vulnerability scanning is different because it attempts to identify known weaknesses or misconfigurations and typically requires service detection, versioning, and signature or configuration checks. It is usually performed after ports and services are discovered, not as the first method for finding “available access points.” Topology mapping focuses on understanding how the network is structured, including routing paths, device relationships, and segmentation boundaries. Network scanning is a broader term that can include host discovery and other probes, but it is less precise than port scanning for identifying the specific entry points that an attacker could use to connect.

Under ethical guidelines, port scanning is conducted with proper authorization, scoped targets, controlled timing to avoid disruption, and clear reporting of open ports, detected services, and risk implications so defenders can reduce exposure by closing unnecessary ports and hardening required services.

The correct answer is C because banner grabbing is used for identification during reconnaissance, scanning, and enumeration. Banner grabbing collects information returned by a service when a connection is made to an open port. This banner may disclose the application name, service type, operating system, software version, web server details, mail server details, or firmware/vendor information. CEH scanning methodology associates banner grabbing and OS fingerprinting with identifying the operating system and services running on target machines. The material also defines banner grabbing as an enumeration technique used to provide information about a computer system, generally for operating system identification or fingerprinting. It is not sniffing, because sniffing captures network traffic. It is not cracking, because cracking attempts to break passwords or protections. It is also not exploitation, although the information discovered may later help select an exploit. Therefore, the main purpose of banner grabbing is identification.

According to the CEH Sniffing and Network Protocol Attacks module, covert channels represent one of the most sophisticated and difficult-to-detect data interception techniques. These channels hide malicious communication within legitimate protocol behavior, making them extremely challenging for traditional IDS/IPS and packet inspection tools to identify.

Industrial and legacy protocols such as Modbus, widely used in OT and legacy enterprise environments, lack encryption and authentication by design. CEH documentation highlights that attackers can manipulate unused or poorly validated Modbus fields to covertly transmit or intercept data while appearing as normal control traffic.

Option D is correct because covert channels over trusted legacy protocols blend seamlessly with legitimate traffic and bypass many security controls.

Option A is not a sniffing technique but a data-hiding method.

Option B describes exploitation, not sniffing.

Option C is a theoretical evasion method but is more detectable through reassembly.

CEH emphasizes covert channels as one of the most formidable sniffing challenges.

The correct answer is B because an attack that abuses the intended workflow, rules, or assumptions of an application is classified as a logic flaw or business logic flaw. In web application hacking, business logic defines how the application should behave, such as pricing rules, transaction sequencing, authorization decisions, coupon use, fund transfer limits, or approval workflows. A business logic flaw occurs when those rules are incomplete, poorly enforced, or can be manipulated by an attacker. The CEH web application material explains that business logic flaws exist when the application’s core rules are not foolproof and can be exploited to compromise the application; these flaws often require careful review of architecture and design because automated scanners may not detect them reliably. XSS abuses improper output/input handling to run scripts in a browser. CSRF abuses a user’s authenticated session. SQLi abuses database query construction. The option that directly matches abusing business logic is Logic flaw.

This scenario describes Linear Cryptanalysis, a technique detailed in CEH v13 Cryptography. Linear cryptanalysis involves finding linear approximations that relate plaintext bits, ciphertext bits, and key bits using XOR operations. By analyzing a large number of known plaintext–ciphertext pairs, attackers can identify statistical biases that reveal information about the secret key.

CEH v13 explains that linear cryptanalysis differs from differential cryptanalysis in its approach. While differential cryptanalysis studies how differences in plaintext affect differences in ciphertext, linear cryptanalysis focuses on linear relationships and probability distributions.

The mention of XOR combinations and statistical analysis of plaintext–ciphertext pairs directly aligns with linear cryptanalysis. Brute-force attacks attempt all keys without analysis. Differential cryptanalysis focuses on input differences, not linear equations. Side-channel attacks exploit physical characteristics such as power consumption or timing.

Modern block ciphers like AES are designed to resist linear cryptanalysis by ensuring that linear approximations occur with probabilities close to random. CEH v13 highlights linear cryptanalysis as a foundational attack method used to evaluate cipher strength.

Therefore, Option C is correct.