support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 11 )

Updated On: 31-Jul-2026
Page 11 of 133
PDF with 1065 Questions

Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mail servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API.
Which of the following tools is used by Wilson in the above scenario?

  1. Factiva
  2. ZoomInfo
  3. Netcraft
  4. Infoga

Answer(s): D

Explanation:

D is correct because Infoga is a tool specifically designed to gather intelligence about email addresses, including tracking email headers and checking for leaks.
Infoga excels in various functionalities that match Wilson's activities. It allows users to extract information from public sources, providing details like sender identities, IP addresses, and server information. Additionally, its capability to interface with haveibeenpwned.com, a widely recognized service for checking compromised credentials, aligns precisely with Wilson's intent to gather intelligence before executing a financial attack.
Evaluation of Incorrect Options:

A: Factiva: While Factiva is a robust tool for gathering news and business information, its primary function is not focused on email data extraction or cyber intelligence. It lacks the necessary capabilities for tracking email sender details or checking breach data effectively, making it unsuitable for Wilson's objective.
B: ZoomInfo: This platform specializes in providing professional contact information and business intelligence but does not serve for email forensic analysis or exposure checks on breached data. Its primary focus is on market intelligence rather than the specific information gathering required in this cyber attack scenario.
C: Netcraft: Netcraft is renowned for its internet infrastructure data and phishing detection, providing useful insights into website security. However, it does not specialize in direct email address tracking or breach checks, thus falling short of fulfilling Wilson's specific objectives involving email intelligence.
In conclusion, Infoga stands out as the most appropriate tool for email reconnaissance and exploitation in Wilson's malicious endeavors, while the other options lack the specific capabilities required for such targeted cyber activities.
Infoga Tool Have I Been Pwned Netcraft



David is a security professional working in an organization, and he is implementing a vulnerability management program in the organization to evaluate and control the risks and vulnerabilities in its IT infrastructure. He is currently executing the process of applying fixes on vulnerable systems to reduce the impact and severity of vulnerabilities.
Which phase of the vulnerability-management life cycle is David currently in?

  1. Remediation
  2. Verification
  3. Risk assessment
  4. Vulnerability scan

Answer(s): A

Explanation:

A is correct because David is actively applying fixes to address identified vulnerabilities, which defines the Remediation phase of the vulnerability management lifecycle.
In the vulnerability management process, remediation refers to the corrective actions taken to mitigate or eliminate identified vulnerabilities in systems. This phase is crucial as it involves implementing patches or configuration changes to strengthen the security posture. By prioritizing fixes based on risk assessments, organizations can effectively reduce exposure to potential threats.
Critical Evaluation of Other Options:
B: Verification : This phase occurs after remediation and involves validating that the applied fixes effectively addressed the vulnerabilities. Since David is still in the process of applying fixes, he has not yet moved to verification.
C: Risk assessment : This phase precedes remediation and involves identifying and evaluating the vulnerabilities within the IT infrastructure. David is no longer in this phase as he has progressed to addressing the vulnerabilities instead of merely assessing them.
D: Vulnerability scan : This initial phase involves scanning systems to detect vulnerabilities. Since David is focused on implementing fixes, this phase has already been completed prior to his current actions.
In summary, David’s activities align with the remediation phase, where action is taken to eliminate vulnerabilities, ultimately enhancing the security framework of the organization.
References:
https://www.nist.gov/publications/vulnerability-management https://www.sans.org/white-papers/40172/ https://www.isc2.org/News-and-Events/Blog/PostID/17145


Reference:

References:
https://www.nist.gov/publications/vulnerability-management https://www.sans.org/white-papers/40172/ https://www.isc2.org/News-and-Events/Blog/PostID/17145



Alice, a professional hacker, targeted an organization’s cloud services. She infiltrated the target’s MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization.
Which of the following cloud attacks did Alice perform in the above scenario?

  1. Cloud cryptojacking
  2. Man-in-the-cloud (MITC) attack
  3. Cloud hopper attack
  4. Cloudborne attack

Answer(s): C

Explanation:

C is correct because Alice's actions exemplify a Cloud Hopper attack, where an attacker exploits a third-party managed service provider (MSP) to infiltrate a targeted organization.
Justification for C (Cloud Hopper Attack): Alice initiated her attack by compromising an MSP through spear-phishing, thereby gaining unauthorized access to customer profiles in the target organization. This reflects the methodology of a Cloud Hopper attack, where credentials from a less secure provider are leveraged to access client resources, showcasing a dependency on third-party supply chains in cloud environments. By exfiltrating sensitive data and using it to further infiltrate the target organization, Alice demonstrates the key elements of a Cloud Hopper attack— transit between cloud infrastructures to conduct unauthorized activities.
Critical Evaluation of Other Options:

A: Cloud Cryptojacking: This attack involves unauthorized use of cloud resources for cryptocurrency mining, which is not applicable in this scenario as Alice's motive was data exfiltration and targeted attacks rather than resource exploitation for mining activities.
B: Man-in-the-Cloud (MITC) Attack: While resembling certain aspects of account compromise and session hijacking, MITC primarily focuses on manipulating cloud storage APIs to intercept communications. Alice's strategy centered on leveraging an MSP for deeper penetration rather than attempting to intercept cloud storage directly.
D: Cloudborne Attack: This term generally refers to attacks that originate from within the cloud environment (e.g., malware spreading within cloud resources). Alice’s attack vector, however, began with her infiltration of the MSP, showcasing exploitation of a third-party vendor rather than an inherent flaw in cloud applications themselves.


Reference:

https://www.csoonline.com/article/3392177/what-is-the-cloud-hopper-attack.html " target="_blank"> https://www.csoonline.com/article/3392177/what-is-the-cloud-hopper-attack.html https://www.cyber.gov.au/acsc/view-all-content/publications/cyber-security-in-cloud-computing " target="_blank"> https://www.cyber.gov.au/acsc/view-all-content/publications/cyber-security-in-cloud-computing https://www.securityweekly.com/2020/04/30/cloud-hopper-a-3rd-party-cyber-attack/
" target="_blank"> https://www.securityweekly.com/2020/04/30/cloud-hopper-a-3rd-party-cyber-attack/



Judy created a forum. One day, she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden behind those images:

What issue occurred for the users who clicked on the image?

  1. This php file silently executes the code and grabs the user’s session cookie and session ID.
  2. The code redirects the user to another site.
  3. The code injects a new cookie to the browser.
  4. The code is a virus that is attempting to gather the user’s username and password.

Answer(s): A

Explanation:

The JavaScript code writes clickable link to the web page (document.write()). The created link poiting to the .php script uses parameter "cookie" with user's current cookie (read by document.cookie function). This is how user's cookie can be sent to the attacker and hijacked user's session.



Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs.
Which two SQL injection types would give her the results she is looking for?

  1. Out of band and boolean-based
  2. Union-based and error-based
  3. Time-based and union-based
  4. Time-based and boolean-based

Answer(s): D

Explanation:

D is correct because time-based and boolean-based SQL injection techniques allow for precise evaluation of database responses to true or false conditions.
Reasoning: Time-based SQL injection entails injecting commands that delay the execution of queries, helping the attacker discover the presence of certain values by measuring response time. Conversely, boolean-based injection relies on logical conditions that directly evaluate the truthiness of the database queries, yielding explicit true or false responses.
When combined, these techniques provide a robust framework for ascertaining the state of user IDs in the database, allowing Jane to manipulate the outcome based on her input.
Critical Evaluation of Other Options:

A: Out of band and boolean-based: Out-of-band techniques are typically less reliable in environments with strict network policies, as they rely on external communication channels to gather data, making it challenging to assess response times directly. Thus, they do not yield precise evaluations like the required boolean method.
B: Union-based and error-based: Union-based injections can retrieve data across multiple database rows but do not inherently provide clear true or false evaluations essential for response time testing. Error-based methods exploit error messages rather than provide logical evaluations, failing to contribute to the true/false responses needed.
C: Time-based and union-based: While time-based methods can measure responses, union-based methods do not orient towards boolean evaluation and are predominantly employed for data extraction rather than logical testing, making this combination less effective for the intended purpose.
References:
https://owasp.org/www-community/attacks/SQL_Injection https://www.acs.com.hk/en/products/1044/acr38-smart-card-reader/ https://www.csoonline.com/article/3554604/sql-injection-prevention-methods.html


Reference:

References:
https://owasp.org/www-community/attacks/SQL_Injection https://www.acs.com.hk/en/products/1044/acr38-smart-card-reader/ https://www.csoonline.com/article/3554604/sql-injection-prevention-methods.html



Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/feed.php?url=externalsite.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server.
What is the type of attack Jason performed in the above scenario?

  1. Web server misconfiguration
  2. Server-side request forgery (SSRF) attack
  3. Web cache poisoning attack
  4. Website defacement

Answer(s): B

Explanation:

B is correct because Jason exploited a Server-Side Request Forgery (SSRF) vulnerability by manipulating an input URL to access internal resources.
In this scenario, Jason's alteration of the URL parameter allowed him to initiate requests from the server to an internal endpoint, thereby circumventing network security mechanisms. SSRF attacks typically exploit server functionality that fetches data from remote URLs; in this case, the server was tricked into accessing its own local resources instead of an external site. This highlights a critical misconfiguration where the web application does not properly validate or restrict internal requests.
Evaluation of Other Options:

A: Web server misconfiguration : While the attack exploited a misconfiguration, labeling it strictly as
"misconfiguration" does not encompass the mechanism of the attack, which involves server-side processing of requests.
C: Web cache poisoning attack : This term refers to an attack that exploits caching systems, often involving malicious input designed to alter cached responses. In Jason's case, the primary action was not to poison cached data, but to access internal resources directly.
D: Website defacement : This describes a scenario where an attacker alters the visual presentation of a website. Jason's actions did not modify the website's appearance but instead sought to gain unauthorized access to internal resources.
In conclusion, the precise nature of the attack, characterized by redirecting server requests, aligns with the definition of SSRF, making option B the most accurate representation of the scenario.
References:
https://owasp.org/www-community/attacks/Server_Side_Request_Forgery_SSRF https://portswigger.net/web-security/ssrf https://www.cissp.com/ssrf-server-side-request-forgery-explained/


Reference:

References:
https://owasp.org/www-community/attacks/Server_Side_Request_Forgery_SSRF https://portswigger.net/web-security/ssrf https://www.cissp.com/ssrf-server-side-request-forgery-explained/



George is a security professional working for iTech Solutions. He was tasked with securely transferring sensitive data of the organization between industrial systems. In this process, he used a short-range communication protocol based on the IEEE 203.15.4 standard. This protocol is used in devices that transfer data infrequently at a low rate in a restricted area, within a range of 10-100 m.
What is the short-range wireless communication technology George employed in the above scenario?

  1. LPWAN
  2. MQTT
  3. NB-IoT
  4. Zigbee

Answer(s): D

Explanation:

D is correct because Zigbee is specifically designed for low-rate, short-range communication in personal area networks, aligning with the requirements presented in the scenario.
Zigbee operates on the IEEE 802.15.4 standard, supporting low-power, low-data-rate applications typically required for industrial automation and home automation. Its effective range of 10-100 meters with a low frequency of data transfer makes it suitable for securely transmitting sensitive data between devices in a confined area. By utilizing mesh networking, Zigbee enhances reliability and range extension through device intercommunication, which is ideal for the described use case.
Evaluation of Incorrect Options:

A: LPWAN: Low-Power Wide Area Network (LPWAN) technologies, including LoRa and Sigfox, are designed for long-range communication over kilometers, thus contradicting the short-range requirement of the scenario.
B: MQTT: Although MQTT is a lightweight messaging protocol optimized for low-bandwidth and high-latency networks, it is fundamentally a protocol for communication rather than a physical layer wireless technology like Zigbee. It does not define a specific manner of how data is transmitted over short distances.
C: NB-IoT: Narrowband IoT is optimized for mobile networks and is intended for wide-range communication, making it unsuitable in scenarios requiring short-range data transfer. It focuses on low-bandwidth applications over long distances, which again opposes the scenario’s limitations.
In summary, Zigbee is the most appropriate technology for short-range, low-rate data transfer in industrial systems, as stipulated by the IEEE 802.15.4 standard.
References:
https://www.zigbee.org/zigbee-for-developers/what-is-zigbee/ https://www.lpwanworld.com/what-is-lpwan/ https://mqtt.org/what-is-mqtt/


Reference:

References:
https://www.zigbee.org/zigbee-for-developers/what-is-zigbee/ https://www.lpwanworld.com/what-is-lpwan/ https://mqtt.org/what-is-mqtt/



Eric, a cloud security engineer, implements a technique for securing the cloud resources used by his organization. This technique assumes by default that a user attempting to access the network is not an authentic entity and verifies every incoming connection before allowing access to the network. Using this technique, he also imposed conditions such that employees can access only the resources required for their role.
What is the technique employed by Eric to secure cloud resources?

  1. Demilitarized zone
  2. Zero trust network
  3. Serverless computing
  4. Container technology

Answer(s): B

Explanation:

B is correct as it embodies the principles of Zero Trust architecture, which emphasizes verifying every user and access request before granting permissions.
Zero Trust Network (ZTN) operates on the premise that threats can exist both outside and inside a network perimeter, requiring all users, regardless of their location, to undergo identity verification and strict access controls. By asserting that users must prove their authenticity for each access request, this model significantly mitigates risks associated with unauthorized access. Eric's approach, where access is granted based strictly on role and necessity, further strengthens the organization's security posture by minimizing the potential attack surface.
In contrast, the other options present limitations that make them inadequate for Eric's described scenario:

A: Demilitarized Zone (DMZ) : This approach is traditionally used to segregate public-facing services from internal IT resources.
While it provides a level of security, it does not inherently involve continuous verification of all access requests, focusing instead on network segmentation.
C: Serverless Computing : This model abstracts application hosting away from the management of servers, improving scalability and resource utilization. However, it does not provide specific mechanisms for implementing access control or continuous authentication, which are critical in the Zero Trust paradigm.
D: Container Technology : While beneficial for application isolation and deployment, container technology does not inherently enforce stringent access controls or continuous verification processes. Its primary function is more about packaging software rather than securing access.
Thus, Eric's implementation aligns closely with Zero Trust principles, making it the most appropriate choice for securing cloud resources.
1. https://www.cio.com/article/306282/what-is-zero-trust-the-security-model-protecting-the-modern-
enterprise.html 2. https://www.forbes.com/sites/bernardmarr/2021/04/26/a-complete-guide-to-zero-trust-security-
what-it-is-and-how-it-works/?sh=4a6be1c01e74 3. https://www.microsoft.com/en-us/security/business/zero-trust



  PDF
Viewing page 11 of 133
Viewing questions 81 - 88 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!