Free ECCouncil 312-50v13 Practice Exam with Questions & Answers | Set: 5

The correct answer is B. Analyzing Response Time because the scenario explicitly describes Mia’s method as repeatedly sending crafted queries and comparing the speed and consistency of responses with other production servers. In CEH-aligned honeypot and deception detection concepts, one practical way to suspect a decoy environment is to measure how it behaves under interaction and whether that behavior differs from real production systems. Honeypots are often instrumented to monitor attacker activity and may run simplified stacks, isolated resources, or simulated services. This can produce response characteristics that are noticeably different—such as responses that are too fast, too consistent, or unusually uniform even under varying query conditions—because the system may be returning pre-generated or emulated outputs rather than processing real workloads.

Real production servers typically show natural variance in response time due to legitimate traffic load, database I/O, caching effects, rate limiting, and resource contention. When a target consistently responds with minimal jitter and unusually stable latency, it can indicate a controlled or simulated environment designed for observation rather than normal business operations. By baselining and comparing response timing across multiple hosts, Mia is using timing behavior as a distinguishing signal to assess whether the server is behaving like a genuine production system or a monitored decoy.

Why the other options are less correct: Analyzing MAC Address is generally a local-network technique and not a primary way to validate honeypot behavior for an external-facing transaction server; it also does not align with the described repeated query timing. Fingerprinting the running service can help identify service type/version, but the question centers on consistency and speed rather than identifying signatures. Analyzing system configuration and metadata would involve inspecting headers, banners, OS/service metadata, or environment artifacts; useful, but not what Mia is doing here.

Therefore, Mia is most likely using response time analysis to assess whether the server behaves like a honeypot.

In CEH-aligned cloud security discussions, protecting data across its lifecycle is a primary requirement, and a major risk area is how data moves between clients, applications, and cloud services. The scenario states the exposure occurred because there was no encryption during transmission between user devices and cloud storage. That maps directly to the Service and Data Integration risk area because it focuses on the security controls applied when cloud services exchange data with users and with other services, including secure communication channels, API protection, and proper cryptographic enforcement for data in transit.

When data is transmitted without TLS or with weak or misconfigured TLS, it becomes vulnerable to interception and manipulation through man in the middle attacks, traffic sniffing, SSL stripping, or downgrade attacks. In regulated environments such as healthcare, HIPAA expectations strongly align with implementing strong encryption in transit and ensuring secure session establishment, certificate validation, and modern cipher suites. This is not primarily a multi tenancy or physical security issue, which relates to isolation between tenants and the provider’s datacenter controls. It is also not primarily an incident analysis and forensic support issue, which concerns detection, logging, evidence collection, and investigative capability after events occur. Infrastructure security is broader and can include network protections, but the question is specifically about preventing exposure during transmission, which is most precisely addressed by service and data integration controls.

Correct remediation typically includes enforcing HTTPS with modern TLS, enabling HSTS, disabling legacy protocols and weak ciphers, ensuring correct certificate management, using mutual TLS where appropriate, and securing cloud storage access through authenticated, encrypted endpoints and properly secured APIs.

According to the Certified Ethical Hacker (CEH) IoT, OT, and SCADA Security module, side-channel attacks exploit indirect information leaks such as power consumption, electromagnetic emissions, timing variations, or thermal output rather than software vulnerabilities.

Option A is correct because monitoring hardware-level anomalies is the primary method for detecting side-channel exploitation. CEH materials emphasize that these attacks bypass traditional security controls.

Option B relates to cryptographic weaknesses, not side-channel analysis.

Option C addresses interface misuse, not covert data leakage.

CEH highlights that SCADA systems are especially vulnerable due to legacy hardware and limited monitoring capabilities.

The correct answer is B. Launching SQL Injection Attacks because the scenario describes moving beyond merely locating inputs or detecting error behavior and into actively sending injection payloads that successfully alter query logic and change returned results. In a typical CEH-aligned SQL injection workflow, testers begin by identifying where user-controlled input enters the application (forms, URL parameters, cookies, headers), then perform basic tests to detect whether inputs affect backend SQL processing. Once a suspected injection point is found, the next step is to launch SQL injection attempts using crafted inputs designed to manipulate the query and demonstrate impact.

In this case, you “craft and submit multiple malicious inputs,” and one payload “successfully manipulates the backend query,” causing the application to return “additional appointment data that was not intended to be displayed.” That outcome is a clear indicator that exploitation is underway: the injection is not hypothetical—it is functioning and changing the application’s behavior in a way that reveals unauthorized data. This is characteristic of executing an SQL injection attack (in-band exploitation), such as using boolean logic manipulation (e.g., conditions that expand result sets) or other query-altering techniques. The emphasis is on the successful manipulation and unauthorized data exposure, which aligns with the attack execution phase.

Why the other options are less correct: Identifying Data Entry Paths would be earlier, when you locate the patient search field as a candidate parameter. Information Gathering and Vulnerability Detection generally refers to discovering and confirming the presence of weaknesses (often via initial probes, errors, or abnormal responses) rather than a confirmed payload that already returns unauthorized data. Database Enumeration is typically the follow-on step once exploitation is confirmed, where the tester extracts metadata such as database names, tables, columns, users, and versions. Here, you are demonstrating the injection’s ability to retrieve extra records, which is the exploitation/attack-launch stage, not full enumeration yet.

Therefore, the step being performed is Launching SQL Injection Attacks.

The correct answer is C. Maintaining Access.

The red team has already gained administrative access. Installing a backdoor to preserve continued access after the initial vulnerability is remediated represents the Maintaining Access phase.

CEH methodology identifies five hacking phases: Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Clearing Tracks. It explains that Maintaining Access is the phase where an attacker tries to maintain ownership and control over compromised systems, commonly using backdoors, rootkits, or Trojans to retain access . Another EC-Council-aligned reference states that Maintaining Access refers to retaining ownership of the system and securing continued access with backdoors, rootkits, Trojans, or Trojan horse backdoors .

Option A. Reconnaissance is incorrect because reconnaissance occurs before exploitation and focuses on information gathering.

Option B. Vulnerability Scanning is incorrect because scanning identifies weaknesses but does not involve installing persistence.

Option D. Clearing Tracks is incorrect because clearing tracks involves hiding evidence, altering logs, or avoiding detection.

Option C. Maintaining Access is correct because the backdoor is installed to preserve long-term access.

Therefore, the best answer is C. Maintaining Access.

IoT devices that transmit data without encryption expose all communication to interception. CEH explains that attackers can position themselves between the IoT device and cloud service to manipulate or capture traffic. A MitM attack enables interception of commands, credentials, and firmware data due to the absence of TLS protections.

The best answer is D. Insecure routing protocols because the scenario describes legacy neighbor-to-neighbor device communications that lack encryption and integrity validation, allowing operational routing data to be exchanged without verification. In CEH-aligned network hacking concepts, this is a classic weakness of older or improperly secured routing protocols (and related network control-plane exchanges) where routers trust updates from neighbors and do not cryptographically validate the authenticity and integrity of routing information.

When routing updates are accepted without strong verification, an attacker who can position themselves on the same segment (or spoof a trusted neighbor) may inject or manipulate routing information. This can enable attacks such as route injection, route poisoning, man-in-the-middle (MITM) traffic redirection, blackholing traffic, or causing instability/denial of service by continuously advertising bad routes. The mention of “neighboring systems” and “operational data” strongly maps to routing adjacencies where devices exchange reachability and topology information. The absence of integrity checks makes it feasible to alter routing messages in transit or forge them, and the absence of encryption can expose routing details that further assists reconnaissance and targeted manipulation.

Why the other options are less accurate:

Firewall vulnerabilities relate to filtering and policy enforcement, but the core issue here is the trust model and protection of routing/control messages, not firewall rule flaws.

Lack of password protection is too generic and typically refers to weak/no credentials on management access, not unauthenticated routing exchanges.

Lack of authentication is conceptually related, but the question asks for the type of vulnerability most clearly present given “legacy communication mechanisms” between neighbors carrying operational data—this is most specifically categorized in CEH terms as insecure routing protocols (i.e., routing updates lacking authentication/integrity and sometimes encryption).

In practice, organizations mitigate this by enabling routing protocol authentication (where supported), using cryptographic integrity protections, restricting routing adjacencies, and segmenting or filtering routing/control-plane traffic to trusted peers only.

CEH reconnaissance and enumeration modules explain that LDAP services often support anonymous binding by default unless explicitly disabled. Anonymous bind allows unauthenticated users to query certain directory attributes, which can lead to disclosure of usernames, organizational hierarchy, and email addresses—critical information for password attacks, phishing campaigns, and privilege escalation planning. In the scenario described, the tester obtained directory data without providing any credentials, demonstrating that anonymous bind permissions were enabled. LDAPS requires TLS encryption and authentication, which contradicts the observed access. Kerberos authentication mandates valid credentials. LDAP via RADIUS is used for authentication integration, not for information disclosure. Since the query was successful with no authentication and no access controls triggered, this aligns exactly with CEH’s description of anonymous LDAP binding.

The correct answer is Nikto. CEH web server security coverage identifies Nikto as a specialized open-source web server vulnerability scanner designed to assess HTTP and HTTPS services for dangerous files, insecure default content, outdated server versions, and version-specific problems. The scenario mentions examination of server headers, detection of installed web server software, checks for outdated components, identification of dangerous files and misconfigurations, SSL support, and exportable reporting. Those characteristics align closely with Nikto’s typical use in CEH-style web server assessments. OpenVAS, Nessus, and Qualys VM are broad vulnerability management platforms with much wider enterprise coverage, but the question describes a focused HTTP-server scanner rather than a full-spectrum infrastructure scanner. CEH materials frequently present Nikto in the context of web server enumeration and vulnerability discovery after the tester has identified the target web platform. It is especially useful for quickly checking internet-facing servers for known risky files, weak configurations, and outdated software. Because the assessment is centered on the specific exposure of web servers and matches the recognized feature set of Nikto, option D is the best answer.

According to CEH v13 Web Application and Server Security, regular patching and updates are the most effective way to reduce server attack surfaces. Vulnerabilities in web servers, proxies, and supporting services are frequently exploited if patches are delayed.

While architectural choices and directory placement influence organization, they do not mitigate known vulnerabilities. Changing IP addresses does not prevent exploitation, and moving directories does not address underlying software flaws.

CEH v13 consistently emphasizes patch management as a primary defensive control. Therefore, Option C is correct.

This is a textbook case of Intranet DNS Poisoning, often combined with ARP spoofing, as described in CEH v13 Network Sniffing and MITM Attacks. The attacker positions themselves inside the local network, intercepts DNS requests, and responds faster than the legitimate DNS server.

ARP spoofing enables the attacker to perform a Man-in-the-Middle attack, allowing sniffing and modification of DNS traffic. CEH v13 notes that faster rogue responses are a strong indicator of local DNS poisoning.

Passive reconnaissance focuses on collecting information without directly touching or interacting with the target’s systems. CEH materials stress that any action that sends network traffic to the target—such as scanning, probing, fingerprinting, or enumeration—creates logs and increases the risk of detection. Email headers, however, are considered an excellent source of passive intelligence because they reveal internal IP structures, routing paths, mail server hostnames, internal domain formats, and technology stacks without requiring interaction with the target environment. Since these headers are already in the possession of the ethical hacker through legitimate communication records, examining them does not generate traffic or trigger monitoring systems. SSL certificates and WHOIS data provide valuable external information, but they rarely disclose internal addressing schemes. Active scanning tools, such as Nmap, would immediately violate the requirement to avoid detection. Therefore, analyzing previously received email headers is the most effective and covert method for extracting internal network details during the reconnaissance phase.

CEH v13 explains that a keylogger is a type of spyware designed to capture user input covertly, often storing or transmitting captured data—such as passwords, emails, chat messages, and financial information—to an attacker. Keyloggers can be implemented as software, firmware, or hardware, and they operate silently in the background without affecting system performance, making them ideal for credential theft. CEH categorizes keyloggers under spying and monitoring malware frequently used in the System Hacking phase to escalate privileges or move laterally once credentials are harvested. Unlike rootkits, which hide processes, or ransomware, which encrypts files, a keylogger’s main purpose is passive surveillance. CEH emphasizes how attackers deploy keyloggers post-compromise or use phishing/social engineering to trick victims into installing them. Their covert nature and ability to bypass traditional AV solutions by masquerading as legitimate processes make identifying them crucial during forensics and incident response activities.

The correct answer is B, Buffer overflow. In CEH vulnerability and exploitation concepts, a buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it was designed to hold. The excess data can overwrite adjacent memory, corrupt control data, crash the application, or allow attacker-controlled code execution. CEH-related material describes buffer overflow as writing too much data into an application’s allocated buffer, potentially overwriting adjacent memory, executing code, or crashing the system. It also explains that buffer overflow attacks rely on lack of boundary testing and, in stack-based cases, may overwrite a return pointer so execution flow switches to malicious code. XSS injects malicious scripts into web pages, CSRF tricks an authenticated user into performing unwanted actions, and SQL injection manipulates database queries. These do not primarily exploit memory corruption. Therefore, the vulnerability associated with memory corruption is buffer overflow.

The CEH v13 content explains that stealth scanning involves modifying scan timing parameters to reduce packet frequency, randomize intervals, and avoid recognizable patterns typically flagged by intrusion detection systems. Slow, randomized timing—often achieved with Nmap’s T0 or T1 timing templates—prevents bursts of traffic and allows scans to blend into normal network noise. IDS/IPS systems tuned for high-volume events may fail to detect such gradual reconnaissance. Fast SYN scans generate distinctive patterns easily identified by security monitoring tools. UDP scans, especially across all ports, produce high traffic volume and are extremely noisy. Xmas scans, although sometimes used for stealth against stateless filters, are still signature-detectable and inappropriate when stealth over time is required. Therefore, applying slow, randomized timing options aligns with CEH-approved reconnaissance techniques for evading detection while enumerating open ports.