Free ECCouncil 312-50v13 Practice Exam with Questions & Answers | Set: 3

This scenario describes fileless malware using covert command-and-control (C2) channels over commonly allowed protocols such as HTTP and DNS, a technique heavily emphasized in CEH v13 Malware Threats. Such malware avoids writing files to disk and instead leverages memory, legitimate system tools, and trusted protocols to evade traditional defenses.

Signature-based antivirus updates (Option A) are ineffective against fileless malware because there are no static artifacts to match. Blocking known malware ports (Option C) is also ineffective, as the malware intentionally uses ports 80 and 53, which must remain open for normal business operations. Restricting plain HTTP (Option B) may reduce visibility but does not stop DNS tunneling or encrypted malicious traffic.

CEH v13 identifies behavioral analytics as the most effective countermeasure against advanced malware. Behavioral solutions establish a baseline of normal system and network activity, then detect anomalies such as:

Unusual outbound DNS query patterns

Abnormal HTTP beaconing intervals

Legitimate applications behaving suspiciously

PowerShell or system tools generating network traffic unexpectedly

By monitoring how systems behave rather than what files exist, behavioral analytics can identify stealthy C2 communications and disrupt them early. Therefore, Option D is the most effective and CEH-aligned response.

The correct answer is C. DNSSEC (Domain Name System Security Extensions). DNSSEC is a collection of security extensions designed to protect the Domain Name System (DNS) from attacks such as DNS cache poisoning, DNS spoofing, and forged DNS responses. Traditional DNS was not originally designed with strong authentication mechanisms, making it vulnerable to attackers who could redirect users to malicious websites by manipulating DNS records.

DNSSEC addresses this weakness by using public key cryptography and digital signatures to verify the authenticity and integrity of DNS data. When a DNS resolver receives a response, it can validate the digital signature associated with the DNS record to ensure that the information originated from the legitimate DNS zone and has not been altered during transmission.

Option A (Resource transfer) is not a DNS security mechanism. Option B (Resource records) are standard DNS database entries such as A, AAAA, MX, and CNAME records. Option D (Zone transfer) is a DNS replication mechanism used between DNS servers and does not provide authentication or protection against spoofing.

CEH Exam Tip:

DNSSEC = DNS Authentication + Integrity Verification + Protection Against DNS Poisoning and Spoofing Attacks.

The ntpq utility provides detailed NTP peer information, synchronization states, offsets, delays, and strata. CEH specifically lists ntpq as the tool for querying NTP daemon status and enumerating peer relationships, making it essential for reconnaissance and lateral movement mapping.

The correct answer is B, Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an attacker or ethical hacker collects as much data as possible about a target before deeper technical testing or attack activity. The retrieved CEH-related material describes reconnaissance as gathering information about the target using active or passive means, and it specifically includes collecting initial information about the target system or organization. Visiting an organization’s public website to collect employee names, email addresses, and phone numbers is passive information gathering because the tester is using publicly available sources rather than directly probing systems. Footprinting, which is part of reconnaissance, can include gathering employee information, phone numbers, and emails. Fingerprinting is more specific to identifying systems, services, or operating systems. Scanning and enumeration involve actively probing hosts, ports, and services. Gaining access occurs later, when vulnerabilities are exploited. Therefore, this activity corresponds to reconnaissance.

Time-based blind SQL injection is used when applications suppress error messages and do not display query results. According to CEH v13, attackers rely on response time delays to infer whether injected SQL statements are executed.

The BENCHMARK() function forces the database to perform a CPU-intensive operation repeatedly, causing a noticeable delay if the injected condition is executed successfully. Option D explicitly introduces such a delay and is a textbook time-based blind SQL injection payload.

Options A, B, and C are used for union-based or boolean-based SQL injection and rely on visible output or content changes, which are ineffective in blind scenarios.

CEH v13 clearly states that time-delay functions such as SLEEP(), WAITFOR DELAY, and BENCHMARK() are the primary indicators for time-based blind SQL injection testing. Hence, Option D is correct.

The described action is classic web server footprinting through banner grabbing. In CEH reconnaissance methodology, banner grabbing is used to identify a target’s service details by eliciting and analyzing standard protocol responses. When Sofia sends a simple HTTP request such as GET / HTTP/1.0, the server often responds with HTTP headers that may include fields like Server and sometimes X-Powered-By, which can reveal the web server product and version, and occasionally information that hints at the underlying operating system or framework. This disclosure is valuable to attackers because it enables targeted exploitation: once the exact server and version are known, an attacker can correlate that information with known vulnerabilities, misconfigurations, and exploit code.

This is not information gathering from robots.txt, which is a web file used to suggest crawler behavior and sometimes reveals hidden paths but does not inherently expose server software versions. It is also not directory brute forcing, which involves systematically guessing directories and files to find hidden endpoints. Vulnerability scanning is broader and typically involves automated checks to detect vulnerabilities; while banner information can be an input to scanning, the technique shown here is specifically identification through response headers.

CEH-aligned mitigation includes disabling or minimizing server signature information, removing unnecessary headers, keeping server software patched, and using secure configurations and reverse proxies to reduce information leakage during reconnaissance.

An HTTP flood is an application-layer (Layer 7) DoS/DDoS technique that targets web application resources by sending large volumes of seemingly valid HTTP GET/POST requests. Because the traffic can look “legitimate” at the protocol level, controls that primarily focus on network/transport characteristics (such as basic firewalls) are often insufficient. The tool described in the scenario is explicitly inspecting and filtering malicious HTTP traffic while allowing legitimate customer requests—that behavior aligns most directly with a Web Application Firewall (WAF).

A WAF is designed to protect web applications by analyzing HTTP/S requests and responses, applying security rules that detect and block abnormal or malicious patterns. In an HTTP flood scenario, a WAF can enforce rate limiting, detect request anomalies (e.g., repeated requests to resource-intensive endpoints like checkout), identify bot-like behavior, and apply signatures/behavioral policies to mitigate attacks while continuing to permit valid users. The key clue is the focus on HTTP-level inspection and filtering to maintain service continuity—a classic WAF use case during Layer 7 attacks.

Why the other options are less suitable:

A Load Balancer (A) improves availability by distributing traffic across servers, but it does not inherently inspect and filter malicious HTTP requests. It can help absorb load, yet it’s not primarily a security inspection/filtering control.

An Intrusion Prevention System (C) can block malicious activity, but many IPS deployments are stronger at network/transport-layer patterns and may not provide the same depth of application-aware HTTP policy enforcement as a WAF for targeted web endpoints.

A traditional Firewall (D) mainly filters by IP/port/protocol and cannot reliably distinguish malicious vs legitimate HTTP GET/POST floods when they use allowed ports (80/443).

Outdated server software often contains memory corruption flaws. CEH notes that buffer overflow exploits are a primary method for compromising vulnerable server binaries, allowing remote code execution. This approach targets the underlying service rather than application-layer input validation issues.

Application Flaws is the best classification because the root cause is a coding error in the application’s input handling that results in a buffer overflow. In CEH-aligned vulnerability categorization, application flaws include implementation mistakes such as improper bounds checking, unsafe string handling, and inadequate input validation. The scenario explicitly states Lucas used fuzz testing against input validation logic and triggered a buffer overflow using malformed taxpayer ID strings, then observed unintended disclosure of payroll data due to unchecked data boundaries. Those details point to defective code behavior at runtime, not an administrative or configuration issue.

Poor Patch Management typically refers to failing to apply vendor patches or updates, leaving known vulnerabilities exploitable. The prompt does not indicate the issue was a previously known, patched defect that remained unpatched; instead, it describes a newly discovered weakness traced to an internal module and a “coding oversight.” Misconfigurations or weak configurations involve insecure settings such as overly permissive access controls, exposed services, default credentials, or insecure cloud storage policies. None of those are the trigger here; the trigger is malformed input causing memory corruption. Design Flaws relate to weaknesses in the system’s architecture or security model, such as missing authorization logic, flawed trust boundaries, or insecure workflows. While poor design can contribute to impact, the specific vulnerability mechanism described is an implementation-level memory handling failure.

Therefore, the correct classification is Application Flaws, because the vulnerability is fundamentally an input-processing and bounds-checking defect in the application code that results in a buffer overflow and data exposure.

CEH v13 highlights that multi-vector DDoS attacks require multi-layer DDoS mitigation services, often cloud-based, capable of analyzing, filtering, and scrubbing traffic across network, transport, and application layers. These providers maintain massive bandwidth capacity, global scrubbing centers, and behavioral analysis engines that distinguish legitimate sessions from malicious floods. SYN floods and HTTP GET floods require different mitigation techniques simultaneously, which typical firewalls or WAFs cannot handle without dropping legitimate traffic. Blocking SYN packets (Option A) would disrupt normal users. A WAF (Option C) handles only Layer 7 traffic and does not mitigate network-layer volumetric attacks. Increasing bandwidth (Option D) is ineffective against large botnet attacks. Therefore, deploying a multi-layer cloud DDoS protection service is the most effective solution for resilient, real-time mitigation.

The requirements map most directly to WPA3, because WPA3-Personal replaces the legacy WPA2-PSK handshake with SAE (Simultaneous Authentication of Equals). SAE is designed to resist offline dictionary attacks: even if an attacker captures the handshake, they cannot simply take it offline and test password guesses at high speed the way they can with WPA2-PSK handshakes. This directly addresses management’s concern that a captured handshake plus a weak passphrase could enable offline cracking and eventual session key recovery.

WPA3 also strengthens per-session protection by improving how keys are established and by supporting stronger cryptographic defaults. In enterprise contexts, WPA3 aligns with stronger authentication and encryption suites, and in IoT scenarios it supports modern onboarding and improved security posture compared to older WPA2/TKIP-era configurations. The “per-session encryption” and “stronger protection” goals are consistent with WPA3’s modern design focus.

Why the other options are less suitable:

MAC address filtering (A) is not a security control against credential capture or offline attacks; MACs are easily spoofed and do not provide cryptographic protection.

802.1X authentication (B) (WPA2/WPA3-Enterprise) is very strong and removes reliance on a single shared PSK by using per-user/device credentials and dynamic keys. However, the question’s key requirement explicitly calls out preventing offline dictionary attacks even if a handshake is captured—this is most directly the hallmark improvement of WPA3-Personal (SAE). (In practice, WPA3-Enterprise with 802.1X is also excellent, but “upgrade to WPA3” is the single best match to the stated offline dictionary concern.)

Disabling TKIP (D) is good hygiene (prefer AES/CCMP), but it does not prevent WPA2-PSK handshake capture and offline cracking if PSK is used.

Therefore, the best measure to meet the stated modernization goals is C. Upgrade to WPA3.

WPA2-Enterprise networks authenticate clients through 802.1X using a RADIUS server. A common attack method described in CEH training is to create an evil-twin access point broadcasting the same SSID as the legitimate one. Combined with de-authentication frames, clients are forced off the real AP and automatically reconnect to the stronger rogue AP. This allows the attacker to capture authentication exchanges for later misuse, including credential harvesting or EAP-based downgrade attacks.

The CEH Enumeration module explains that SMTP supports commands such as VRFY, EXPN, and RCPT TO, which can be abused to enumerate valid email users if not properly restricted.

In this scenario, the smtp-enum-users Nmap script successfully uses EXPN and RCPT, indicating that the server responds differently to valid and invalid usernames.

Option C is correct because unrestricted SMTP user verification allows attackers to harvest usernames for further attacks such as phishing or brute force.

Option A involves authentication, not enumeration.

Option B affects confidentiality, not user discovery.

Option D is unrelated to SMTP enumeration.

CEH strongly recommends disabling or restricting these SMTP commands.

The correct answer is D. TCP/IP Hijacking.

The scenario describes an attacker targeting an already established TCP session and injecting crafted packets into the communication stream. CEH-aligned material describes TCP/IP hijacking as a network-level attack on a TCP session in which the attacker predicts or uses sequence-number information and injects spoofed packets into the session. It also explains that sniffing tools may be used to capture packets and extract sequence-number information before injecting spoofed traffic .

Option A. UDP Hijacking is incorrect because the scenario specifically involves TCP communication, not UDP.

Option B. RST Hijacking is incorrect because RST hijacking involves sending spoofed reset packets to terminate or reset a TCP connection, not taking over the session to issue commands.

Option C. Blind Hijacking is incorrect because blind hijacking occurs when the attacker cannot capture return traffic. In this scenario, the consultant is monitoring internal traffic and injecting into the observed session.

Option D. TCP/IP Hijacking is correct because the consultant is manipulating an active TCP communication channel and injecting packets as part of the established session.

Therefore, the best answer is D. TCP/IP Hijacking.

The correct answer is A because a deauthentication attack is commonly used to force a connected wireless client to disconnect from an access point and then reconnect. During that reconnection process, the WPA/WPA2 authentication handshake can be captured and later used for offline password-cracking attempts. CEH wireless hacking concepts describe breaking WPA by capturing WPA/WPA2 authentication handshaking packets and forcing a connected client to disconnect and reconnect so authentication packets can be captured for Pairwise Master Key analysis. This matches the purpose of a deauth attack. Jamming is mainly an availability or denial-of-service attack that disrupts wireless communication, not a handshake-capture method. Spoofing means impersonating a device or MAC address, and replay means reusing captured traffic or authentication data. Although replay attacks can be part of wireless exploitation, the specific attack used to trigger a fresh handshake capture is deauthentication. Therefore, option A is the best CEH-aligned answer.