Free ECCouncil 312-50v13 Practice Exam with Questions & Answers | Set: 9

This scenario most closely matches spam and phishing delivered through social networking platforms, a technique emphasized in CEH social engineering coverage as social media phishing or spear phishing via professional networks. Nadia impersonates a trusted internal authority figure, a senior HR manager, and uses believable branding elements such as a stolen logo and accurate employee details to establish credibility. She then initiates contact through connection requests and funnels targets into a controlled space, a private group, where she requests sensitive information. Collecting a work email address and department role may appear harmless, but CEH guidance notes that attackers often start with small, plausible requests to build trust and assemble data for deeper compromise. Work emails and roles enable targeted spear phishing, business email compromise preparation, password reset targeting, and crafting convincing pretexts aligned to the victim’s function.

The core mechanics align with phishing: deception, impersonation, and a call to action designed to extract information. The “exclusive project updates” hook is a classic lure used to increase compliance. While the exercise could lead to involuntary data leakage as a downstream effect, the primary simulated threat is the phishing process itself, using social media as the delivery channel. Loss of productivity is not the intent here, and network vulnerability exploitation refers to technical system flaws rather than manipulating human trust. Therefore, the most accurate classification of Nadia’s drill is spam and phishing conducted through a social media pretext.

The weakness described is a classic online password-guessing condition: the application permits unlimited authentication attempts without any throttling, lockout, or challenge mechanism. In CEH guidance, this exposure enables brute-force attacks and automated credential stuffing, where attackers rapidly test many passwords or reused credential pairs until successful. A practical and commonly recommended control at the web application layer is adding CAPTCHA challenges to the login workflow, especially after a small number of failed attempts or when anomalous behavior is detected. CAPTCHA increases the cost of automation by forcing human interaction, directly disrupting high-speed scripted guessing against the admin portal.

While implementing MFA is an excellent additional safeguard and is strongly encouraged for privileged access, the question asks for the best countermeasure to address the specific issue of unlimited rapid attempts. CAPTCHA is a direct mitigation for automated login abuse, and CEH commonly pairs it with rate limiting, progressive delays, and account lockout policies. Periodic password changes do not prevent an attacker from guessing a password today, and CEH materials note that forced rotation can even reduce security if it drives predictable password patterns. Strong password hashing such as bcrypt, scrypt, or Argon2 is critical for protecting stored passwords if a database is compromised, but it does not stop online guessing against the login form itself. Therefore, the most fitting countermeasure for the identified vulnerability is using CAPTCHA challenges on login and registration pages, ideally combined with throttling and lockout for stronger defense in depth

This scenario is a classic example of DLL hijacking (also called DLL search order hijacking). On Windows, when an application attempts to load a required DLL without using a fully qualified path, the operating system searches for that DLL in a defined search order (including, in many cases, the application directory and other locations that may be writable by a low-privileged user). If an attacker can place a malicious DLL with the same name as the expected library into a directory that is searched before the legitimate DLL’s location, Windows will load the attacker’s DLL first. When the trusted application starts, the malicious DLL is loaded into the process, causing the attacker’s code to execute in the context and privileges of that application.

The question’s clues align tightly with DLL hijacking:

A “non-privileged process loaded a malicious library instead of the intended library” indicates a library preloading/search-order issue rather than exploiting a kernel bug.

The attacker “placed the rogue file in a directory Windows searched before the legitimate location,” which directly describes search order manipulation.

“When the trusted application started, the attacker’s code executed with the application’s privileges” reflects how DLL hijacking can lead to privilege escalation when the target process runs with higher privileges (e.g., as admin or SYSTEM).

“No registry changes … were involved” helps rule out techniques like certain COM hijacks or registry-based persistence and also points away from UAC bypass methods that often rely on registry keys or auto-elevated behaviors.

Why the other options don’t fit:

Exploiting vulnerabilities (A) is too generic and would typically reference a software flaw (buffer overflow, kernel exploit, etc.).

Access token manipulation (C) involves stealing/impersonating tokens, not DLL search order behavior.

Bypassing UAC (D) targets elevation prompts and auto-elevation mechanisms, not DLL loading precedence.

Therefore, the technique is B. Privilege Escalation Using DLL Hijacking.

The correct answer is C. Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an ethical hacker collects details about the target before deeper testing begins. CEH-aligned material defines reconnaissance as gathering information about a target using active or passive means, and it commonly includes discovering network ranges, live hosts, open ports, operating system details, services, and organizational information. Active reconnaissance involves direct interaction with the target, such as sending probes, scans, or packets, which can provide accurate information but may be detected. Passive reconnaissance collects information without directly contacting the target, often using public sources such as websites, social media, WHOIS, DNS records, and search engines. Obfuscation is related to hiding activity, exploitation refers to using a vulnerability to gain access, and denial of service focuses on disrupting availability. Therefore, the step known for active and passive information gathering is Reconnaissance.

Passive reconnaissance involves gathering information without directly interacting with the target. WHOIS, search engines, and social media are all passive techniques highlighted in CEH v13 Reconnaissance.

Nmap scanning, however, actively probes target systems and generates traffic that can be logged and detected. This makes it an active reconnaissance technique.

Therefore, Option D is least useful in a passive phase.

CEH v13 highlights that SNMPv1/v2 environments configured with default community strings such as " public " or " private " present significant security risks because they allow unauthorized users to query system information. SNMP enumeration can reveal processes, interfaces, routing tables, users, device configurations, and more. The snmp-processes Nmap NSE script is specifically designed to enumerate running processes on an SNMP-enabled host. It queries the Host Resources MIB (HR-MIB), which stores operational information about system processes, CPU usage, and memory consumption. This information provides attackers with insights into what services may be exploitable or misconfigured. CEH stresses that SNMPv2 is particularly vulnerable due to lack of encryption and authentication hardening. By enumerating processes, penetration testers can identify potential privilege escalation paths, outdated services, or rogue applications that may aid lateral movement. Other scripts such as snmp-sysdescr or snmp-interfaces retrieve system description or interface data but do not enumerate processes.

The correct answer is DNS interrogation. CEH reconnaissance guidance explains that active footprinting involves direct interaction with the target environment, which can generate logs or alerts. DNS interrogation is an active technique used to query name servers for information about domain structure, hostnames, mail servers, subdomains, and other records that reveal how public-facing systems are logically arranged. The question specifically says Justin is retrieving structural details about the organization’s public-facing systems and that his activity is logged by the target, which is consistent with active DNS queries. Network or port scanning is also active, but it focuses on discovering open ports and reachable services rather than the logical naming and organizational structure of public systems. Social engineering is human-focused, and user and service enumeration typically aims at accounts or system services rather than domain structure. CEH materials repeatedly emphasize DNS as a rich reconnaissance source because records such as A, MX, NS, TXT, and SOA can reveal infrastructure relationships and naming conventions. Since the goal is to understand how the organization’s internet-facing systems are organized and represented, DNS interrogation is the best fit.

Android Debug Bridge (ADB) is a powerful debugging interface that, if misconfigured, allows attackers to execute commands remotely. CEH v13 identifies exposed ADB as a critical mobile security risk, especially in enterprise environments.

The most effective countermeasure is to disable ADB entirely, except when explicitly required for development or troubleshooting, and only within tightly controlled environments. This directly removes the attack vector.

VPNs and biometrics improve security but do not prevent ADB abuse. Updating MDM systems is important but does not eliminate the risk if ADB remains enabled.

CEH v13 explicitly recommends strict ADB control as a best practice. Therefore, Option C is the correct answer.

This scenario describes an Android rooting approach where the attacker installs a rooting tool directly on the device as an APK and uses it to exploit vulnerabilities to gain elevated privileges. The key feature that makes this approach effective, as stated in the question, is that it works without requiring a computer connection. That aligns directly with option B: “It is an APK that can run directly on the device without a PC.”

Rooting tools packaged as APKs are effective in environments where physical access is limited to the device itself (or where connecting to a PC is impractical or would raise suspicion). Once installed, such an app can attempt privilege escalation by leveraging known weaknesses in the OS, drivers, or vendor components, aiming to obtain root-level access. From a security assessment standpoint, this demonstrates that mobile devices may be at risk if users can install untrusted applications, if the device is not fully patched, or if application controls (enterprise MDM policies, app allowlisting, unknown-sources restrictions) are weak.

The other options are inconsistent with Android APK-based rooting as described. “Tethered jailbreak” terminology applies to iOS jailbreaking, not Android rooting, and the scenario explicitly says no computer connection is required. Weak SSL validation relates to application-layer transport security issues rather than privilege escalation to root. Bluetooth pairing flaws are a different attack class and are not indicated here; the described method is an on-device exploit chain initiated by installing a rooting APK.

Therefore, the feature that makes this rooting approach effective in the scenario is B: it runs directly on the device as an APK without needing a PC.

According to the Certified Ethical Hacker (CEH) System Hacking and Session Hijacking module, sidejacking is a form of session hijacking where an attacker passively intercepts network traffic to capture unencrypted session cookies. These cookies are then reused to impersonate the authenticated user without needing credentials.

CEH documentation explains that sidejacking commonly occurs on unencrypted HTTP connections, public Wi-Fi networks, or improperly secured internal networks. Once the session cookie is stolen, the attacker can replay it to gain access to the victim’s active session.

Option B correctly describes this mechanism and directly matches CEH’s definition of sidejacking.

Option A refers to perimeter exploitation, not session hijacking.

Option C describes social engineering, which is unrelated to sidejacking.

Option D is an example of cross-site scripting (XSS), not sidejacking.

CEH emphasizes HTTPS enforcement and secure cookie attributes as key countermeasures.

The correct answer is Credentialed Scanning. CEH vulnerability assessment guidance explains that credentialed scans use authorized login access on the target system so the scanner can inspect the machine from the inside with a much higher level of accuracy and detail. That is why credentialed scanning can identify installed updates, local policy settings, configuration inconsistencies, file permissions, registry issues, and patch gaps that are not always visible from an external network perspective. The question specifically mentions granular host-level findings that required direct system-level inspection, which is a strong indicator that valid credentials were used to query the target systems. Non-credentialed scanning, by contrast, relies on remote observation and network-visible characteristics, so it generally cannot provide the same depth of internal host information. Automated scanning is too broad a label, and application scanning is limited to application-layer targets rather than host operating-system posture. CEH materials consistently note that credentialed scans produce more accurate vulnerability results and reduce false positives because the scanner can verify software versions, patch states, and security settings directly on the target machine rather than merely inferring them from banners or exposed services.

According to CEH v13 Mobile, IoT, and OT Hacking, Advanced Persistent Threat (APT) groups prioritize stealth, persistence, and long-term control. In IoT environments, the most attractive and effective entry point is firmware-level zero-day vulnerabilities.

IoT devices often:

Run outdated or proprietary firmware

Lack regular patching mechanisms

Operate with high privileges

Have minimal monitoring

Exploiting a zero-day vulnerability in firmware allows attackers to gain deep, persistent access that survives reboots and avoids traditional security controls. This aligns directly with APT objectives.

Credential theft (Option B) is common but less reliable for IoT systems. Encrypted MitM (Option C) is complex and less persistent. DDoS (Option D) disrupts services but does not provide control.

CEH v13 explicitly identifies firmware exploitation as the primary APT vector in IoT and OT environments. Therefore, Option A is correct.

The correct answer is B. Information Warfare.

The scenario describes the strategic use of information, communication systems, digital influence, and disruption of critical systems to gain an advantage over an opponent. This aligns with Information Warfare.

CEH-aligned material defines information warfare as the use of information and communication technology to gain an advantage over an opponent or enemy. It also explains that offensive information warfare prevents, modifies, or disrupts information and information-based processes by affecting confidentiality, integrity, and availability .

Option A. Cyber Espionage is incorrect because espionage focuses mainly on stealing information, not broadly manipulating perception and degrading infrastructure.

Option C. Hacktivism is incorrect because hacktivism is usually ideologically or politically motivated activism using hacking techniques.

Option D. Cyberterrorism is incorrect because cyberterrorism is intended to create fear, panic, or violence for political or ideological objectives. The broader coordinated use of information and communication capabilities is best classified as information warfare.

Therefore, the best answer is B. Information Warfare.

WEP is the only option that matches the combination of RC4 and a 24-bit initialization vector. In CEH materials, WEP is described as an early Wi-Fi security standard that uses the RC4 stream cipher together with a short 24-bit IV that is concatenated with a shared secret key to form the per-packet RC4 key stream. The critical weakness is that a 24-bit IV is far too small for busy networks. Because there are only about 16.7 million possible IV values, IV reuse occurs quickly, especially under high traffic. When IVs repeat, the same RC4 key stream can be reused, allowing attackers to apply statistical attacks against captured packets and recover the WEP key. CEH emphasizes that the problem is not only IV reuse but also weaknesses in how WEP uses RC4 with IVs, enabling practical key recovery using readily available tools once enough packets are collected.

WPA and WPA2 improved on WEP by introducing stronger key management and integrity protections. WPA uses TKIP, which still relies on RC4 in many deployments, but it does not use a simple 24-bit IV in the same weak manner as WEP and includes per-packet key mixing and additional integrity checks. WPA2 and WPA3 move away from RC4 entirely, using AES-based protections such as CCMP for WPA2 and more modern enhancements in WPA3. Therefore, the observed RC4 with a 24-bit IV precisely identifies WEP.

The correct answer is DNS Cache Poisoning. CEH network security material explains that cache poisoning occurs when a DNS server is tricked into storing fraudulent name-to-IP mappings in its cache. Once the poisoned entry is cached, many users querying that DNS service receive the same false resolution until the cache is flushed, expires, or the service is restarted. That maps directly to the scenario: multiple internal clients receive the same incorrect IP address for a legitimate domain, and the issue disappears after the organization’s name resolution service is restarted. Intranet DNS spoofing typically involves local interception and very fast forged replies on a LAN, while proxy server DNS poisoning changes browser-side proxy behavior, and internet DNS spoofing usually involves altering a host’s DNS configuration or redirecting it to a malicious resolver. The persistence across many users and the recovery after DNS service restart are the most important clues, because they indicate poisoned cached records on the resolver itself rather than isolated endpoint tampering. CEH guidance highlights that DNS cache poisoning can silently redirect users to counterfeit systems while appearing to resolve legitimate domain names normally.