Free ECCouncil 312-50v13 Practice Exam with Questions & Answers | Set: 13

Key observations in the packet capture:

Repeated 0x90 values indicate a NOP sled (No Operation instructions), commonly used in buffer overflow payloads to guide execution to the malicious shellcode.

The presence of "/bin/sh" in ASCII indicates that the attacker intends to launch a shell (command-line access) on the victim’s system once the overflow is successful.

The payload likely contains shellcode that spawns a shell, giving the attacker command-line access.

From CEH v13 Official Courseware:

Module 6: Malware Threats

Module 9: Denial-of-Service

Module 5: Vulnerability Analysis

CEH v13 Study Guide states:

“A buffer overflow exploit typically involves injecting a NOP sled followed by shellcode. The string '/bin/sh' is a tell-tale sign of shell-spawning code that aims to give the attacker command access.”

Incorrect Options:

A: There's no evidence the IDS blocked the attack—only that it logged it.

B: Creating a directory would not involve a NOP sled or spawn a shell.

C: We cannot confirm success; only the intent and method are clear.

18 U.S.C. §1030, also known as the Computer Fraud and Abuse Act (CFAA), is a broad federal statute that criminalizes unauthorized access to computers and related fraudulent activities—including phishing and email scams.

From CEH v13 Official Courseware:

Module 1: Introduction to Ethical Hacking

Topic: U.S. Laws Related to Cybercrime

CEH v13 Study Guide states:

“Email-based frauds such as phishing, spoofing, and other social engineering attacks fall under the Computer Fraud and Abuse Act (18 U.S.C. §1030), which criminalizes unauthorized access and fraudulent behavior in computing systems.”

Incorrect Options:

B: Relates to credit cards and access devices.

C: Covers interference with government communication systems.

D: Covers illegal wiretapping and eavesdropping.

To start the Computer Management Console from command line just type compmgmt.msc /computer:computername in your run box or at the command line and it should automatically open the Computer Management console.

Reconnaissance is the first phase of ethical hacking and also part of the cyber kill chain. It involves gathering publicly available information about a target, such as employee names, company structure, and branding, which is later used in social engineering or phishing attacks.

Reference – CEH v13 Official Study Guide:

Module 2: Footprinting and Reconnaissance

Quote:

“Reconnaissance involves gathering information from public sources such as websites, social networks, and press releases. This is used to craft targeted phishing messages or exploit organizational weaknesses.”

Incorrect Options Explained:

A & B. Not formal terms in ethical hacking.

D. Enumeration involves interacting with systems to extract technical data.

CEH v13 describes Cross-Site Request Forgery (CSRF) as a technique that forces authenticated users to unknowingly execute actions within a web application without their intent. Unlike session hijacking methods that require stealing or replaying session cookies, CSRF exploits the trust relationship that the server has with a user's browser. Even with HTTPS, secure cookies, and MFA, once a user is authenticated, the browser automatically sends session cookies with each request. If the attacker convinces the victim to load a maliciously crafted webpage or URL, the browser sends a forged request to the target application, executing actions under the user’s authenticated session. CEH notes that secure cookies and MFA do not stop CSRF because no credentials are stolen—only forced actions occur. This technique is sophisticated because it leaves minimal traces, avoids direct cookie manipulation, bypasses robust authentication mechanisms, and leverages design weaknesses rather than technical misconfigurations. Protection typically requires anti-CSRF tokens and proper origin validation.

Spear-phishing is a targeted form of phishing that uses personalized and context-rich information to increase credibility. CEH emphasizes that referencing specific internal projects, financial data, or organizational events significantly raises the success rate when attacking high-value targets such as executives. This tailored approach avoids suspicion and exploits trust more effectively than broad or generic phishing attempts.

While perimeter defenses like firewalls and IPS provide a layer of protection, internal systems (such as network elements) must also be hardened. This includes:

Enforcing strong authentication

Applying regular patches and updates

Conducting vulnerability assessments and security audits

Security should be layered (defense in depth), and reliance on perimeter defense alone is insufficient.

Reference – CEH v13 Official Study Guide:

Module 3: Scanning Networks / Module 18: Incident Response

Quote:

“Internal systems must be hardened with secure configurations and tested regularly. A layered security approach is required even in protected environments.”

Incorrect Options:

B & C. Relying only on perimeter or physical security is not sufficient

D. While backup sites are part of DR, they don’t replace proactive protection

===========

A DNS zone file contains resource records (RRs) that define mappings and configurations for domains and subdomains. The standard records found in a zone file include:

SOA (Start of Authority): Indicates the beginning of the zone file.

NS (Name Server): Specifies the authoritative name servers.

A (Address): Maps hostnames to IPv4 addresses.

MX (Mail Exchange): Specifies mail servers.

These records are essential for the DNS resolution process and mail routing.

From CEH v13 Official Courseware:

Module 3: DNS Enumeration

Topic: DNS Record Types

CEH v13 Study Guide states:

“A zone file contains all the resource records including SOA, NS, A, and MX. These define name server authority, IP resolution, and mail server routing.”

Incorrect Options:

A: DNS is a protocol, not a resource record.

B: PTR is for reverse DNS, typically in a separate reverse zone file.

C: AXFR is a DNS transfer mechanism, not an RR in the zone file.

Comprehensive and Detailed Explanation:

Social engineering is a psychological manipulation technique used by attackers to trick individuals into divulging confidential or personal information that may be used for fraudulent purposes.

It relies on human interaction and may involve tactics such as:

Impersonation

Pretexting

Phishing

Baiting

Rather than attacking systems directly, attackers exploit human trust and error.

From CEH v13 Courseware:

Module 7: Social Engineering

The scenario describes a situation where a hacker infects an internet-facing server and leverages it to perform malicious activities such as sending spam emails, participating in distributed denial-of-service (DDoS) attacks, or hosting spam content. This behavior is characteristic of a Botnet Trojan.

According to the CEH v13 Official Courseware and Study Guide:

A Botnet Trojan is a type of malware that transforms infected machines into bots (also called zombies), which can be remotely controlled by an attacker (bot herder or bot master).

These bots become part of a botnet — a network of compromised machines used for coordinated cyberattacks including:

Sending unsolicited spam emails (junk mail)

Participating in DDoS attacks

Hosting or distributing malware and phishing content

The infected machine can receive commands from a command-and-control (C&C) server and act in concert with other infected machines to amplify attacks or spread malware.

Incorrect Options:

B. Banking Trojans are designed specifically to steal financial data such as online banking credentials.

C. Turtle Trojans is not a valid classification in CEH v13 or cybersecurity literature (may be a distractor).

D. Ransomware Trojans encrypt data and demand a ransom for decryption, not typically used for junk mail or botnet activities.

Reference – CEH v13 Official Courseware:

Module 06: Malware Threats

Section: “Types of Trojans”

Subsection: “Botnet Trojans”

CEH v13 eBook or Study Guide — usually found under “Trojan Classifications by Payload”

Practical labs in CEH Engage and iLabs also demonstrate botnet functionality using tools like Zeus and Emotet in real-world botnet infection scenarios.

From CEH v13 Module 03: Scanning Networks, OS fingerprinting with Nmap (using the -O option) requires privileged access to craft raw packets (especially SYN, ACK, and ICMP). On Unix/Linux systems:

Root privileges are mandatory to perform TCP/IP stack fingerprinting.

If Nmap is run as a normal user, it fails to initiate OS scanning and exits with a message like “QUITTING!”.

So, in this case, the scan fails because the shell opened does not have elevated (root) privileges.

GINA stands for Graphical Identification and Authentication. It is a Windows component (a DLL) that provides the user interface for logging into a Windows system.

Located in msgina.dll (in legacy Windows)

Handles the Ctrl+Alt+Del screen

Collects credentials (username/password) and passes them to the Local Security Authority (LSA)

From CEH v13 Courseware:

Module 6: Malware Threats

Module 4: Windows Authentication Internals

CEH v13 Study Guide states:

“The Graphical Identification and Authentication (GINA) is a DLL that implements the authentication UI for Windows systems. Malicious actors can create custom GINA DLLs to capture login credentials.”

Launching Fileless Malware through Phishing Attackers commonly use social engineering techniques such as phishing to spread fileless malware to the target systems. Fileless malware exploits vulnerabilities in system tools to load and run malicious payloads on the victim’s machine to compromise the sensitive information stored in the process memory. (P.978/962)

The honey trap is a technique where an attacker targets a person online by pretending to be an attractive person and then begins a fake online relationship to obtain confidential information about the target company. In this technique, the victim is an insider who possesses critical information about the target organization.

Baiting is a technique in which attackers offer end users something alluring in exchange for

important information such as login details and other sensitive data. This technique relies on

the curiosity and greed of the end-users. Attackers perform this technique by leaving a physical

device such as a USB flash drive containing malicious files in locations where people can easily

find them, such as parking lots, elevators, and bathrooms. This physical device is labeled with a

legitimate company's logo, thereby tricking end-users into trusting it and opening it on their

systems. Once the victim connects and opens the device, a malicious file downloads. It infects

the system and allows the attacker to take control.

For example, an attacker leaves some bait in the form of a USB drive in the elevator with the

label "Employee Salary Information 2019" and a legitimate company's logo. Out of curiosity and

greed, the victim picks up the device and opens it up on their system, which downloads the

bait. Once the bait is downloaded, a piece of malicious software installs on the victim's system,

giving the attacker access.

https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/what-is-fileless-malware.html

Fileless malware can easily evade various security controls, organizations need to focus on monitoring, detecting, and preventing malicious activities instead of using traditional approaches such as scanning for malware through file signatures.Also known as non-malware, infects legitimate software, applications, and other protocols existing in the system to perform various malicious activities.It resides in the system’s RAM. It injects malicious code into the running processes. (P.966/950)