support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 13 )

Updated On: 31-Jul-2026
Page 13 of 133
PDF with 1065 Questions

Attacker Rony installed a rogue access point within an organization’s perimeter and attempted to intrude into its internal network. Johnson, a security auditor, identified some unusual traffic in the internal network that is aimed at cracking the authentication mechanism. He immediately turned off the targeted network and tested for any weak and outdated security mechanisms that are open to attack.
What is the type of vulnerability assessment performed by Johnson in the above scenario?

  1. Wireless network assessment
  2. Application assessment
  3. Host-based assessment
  4. Distributed assessment

Answer(s): A

Explanation:

A is correct because the scenario specifically involves a rogue access point targeting the organization's wireless network security.
Johnson’s assessment focuses on identifying vulnerabilities within the wireless network, as the presence of a rogue access point indicates a potential exploitation of wireless communication channels. The unusual traffic aimed at cracking authentication mechanisms points to wireless-specific vulnerabilities, which necessitate an examination of the wireless infrastructure, protocols, and security measures in place.
Evaluation of Other Options:
B: Application assessment : This would assess software vulnerabilities and does not focus on network infrastructure or specific wireless protocols. Johnson's actions do not involve application-specific security issues, thus failing to fit this category.
C: Host-based assessment : This involves evaluating the security of individual devices or hosts within the network. Johnson's efforts to combat the rogue access point were directed at network traffic rather than specific device vulnerabilities, making this option inappropriate.
D: Distributed assessment : This typically entails assessing a network that spans multiple locations or involves multiple systems interacting with one another. Johnson's immediate context is a localized wireless network rather than a distributed system environment, which eliminates this option.
References:
https://www.cisecurity.org/white-papers/cis-controls-v8 https://www.nist.gov/itl/publications/nist-special-publication-800-115 https://www.sans.org/white-papers/35493/


Reference:

References:
https://www.cisecurity.org/white-papers/cis-controls-v8 https://www.nist.gov/itl/publications/nist-special-publication-800-115 https://www.sans.org/white-papers/35493/



In this attack, an adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying cryptographic handshake messages.
When the victim reinstalls the key, associated parameters such as the incremental transmit packet number and receive packet number are reset to their initial values.
What is this attack called?

  1. Evil twin
  2. Chop chop attack
  3. Wardriving
  4. KRACK

Answer(s): D

Explanation:

D is correct as it refers to the Key Reinstallation Attack (KRACK), which exploits vulnerabilities in the WPA2 protocol to manipulate cryptographic handshakes.
KRACK allows an adversary to intercept and re-inject cryptographic handshake messages, tricking a victim into reinstalling an already in-use key. This action resets critical parameters like the incremental transmit and receive packet numbers, enabling a replay of previously sent packets and leading to potential data exposure. The attack fundamentally breaches the confidentiality and integrity of the communication by reinitializing session keys that ought to maintain distinct state information.
Evaluation of Other Options:

A: Evil Twin : This attack involves creating a rogue access point that masquerades as a legitimate one, allowing interception of data and user credentials. However, it does not specifically target the reinstallation of keys or manipulation of handshake processes, making it fundamentally different from KRACK.
B: Chop chop attack : This method exploits the weaknesses in WEP (Wired Equivalent Privacy), primarily targeting the ability to decrypt packets. It does not involve the manipulation of key reinstallation processes and is thus unrelated to the mechanism described in the KRACK attack.
C: Wardriving : This involves searching for Wi-Fi networks by moving around in a vehicle and is primarily a reconnaissance tactic rather than an attack that exploits cryptographic vulnerabilities. It neither manipulates handshake messages nor resets any cryptographic parameters.
In summary, while the other options represent various forms of attack, they do not encompass the specific exploitative nature and methodology of the KRACK attack, which uniquely addresses vulnerabilities within the WPA2 framework concerning key reinstallation.
References:
1. https://www.krackattacks.com 2. https://csrc.nist.gov/publications/detail/sp/800-97/final 3. https://www.us-cert.cisa.gov/ncas/alerts/2017/10/16/key-reinstallation-attack-krack


Reference:

References:
1. https://www.krackattacks.com 2. https://csrc.nist.gov/publications/detail/sp/800-97/final 3. https://www.us-cert.cisa.gov/ncas/alerts/2017/10/16/key-reinstallation-attack-krack



After an audit, the auditors inform you that there is a critical finding that you must tackle immediately. You read the audit report, and the problem is the service running on port 389.
Which service is this and how can you tackle the problem?

  1. The service is NTP, and you have to change it from UDP to TCP in order to encrypt it.
  2. The service is LDAP, and you must change it to 636, which is LDAPS.
  3. The findings do not require immediate actions and are only suggestions.
  4. The service is SMTP, and you must change it to SMIME, which is an encrypted way to send emails.

Answer(s): B

Explanation:

The correct answer is B: The service is LDAP, and you must change it to 636, which is LDAPS.
LDAP (Lightweight Directory Access Protocol) operates over port 389 and is often utilized for directory services within organizations. However, it transmits data in plaintext, including sensitive information such as credentials, making it vulnerable to interception and unauthorized access. To mitigate this risk, it is essential to implement LDAPS (LDAP over SSL/TLS) on port 636. This approach encrypts the communication between client and server, ensuring data security and integrity during transmission.
Evaluation of Other Options:

A: The service is NTP, and you have to change it from UDP to TCP in order to encrypt it. This statement is incorrect because NTP (Network Time Protocol) typically operates over UDP on port 123, and changing it to TCP does not inherently provide encryption. NTP over TLS is still in development and not widely adopted, rendering this option ineffective for immediate critical remediation.
C: The findings do not require immediate actions and are only suggestions. This option is misleading as it minimizes the urgency associated with critical findings in security audits. The nature of port 389's vulnerability necessitates immediate action to secure sensitive information, thus making this response inappropriate in the context of an urgent audit finding.
D: The service is SMTP, and you must change it to SMIME, which is an encrypted way to send emails. This is incorrect as SMTP (Simple Mail Transfer Protocol) primarily operates over port 25 or 587 for encrypted communication using STARTTLS, not SMIME. SMIME is a standard for public key encryption and signing of MIME data, but it does not directly address the security of the services running on port 389.
For further reading on securing LDAP and directory service protocols:
https://www.ssl.com/article/secure-ldap-with-ldaps-tutorial https://www.cisecurity.org/white-papers/cis-benchmarks/ https://www.acs.com.hk/en/products/1153/amg-article-on-security-issues-with-ldap/



Mike, a security engineer, was recently hired by BigFox Ltd. The company recently experienced disastrous DoS attacks. The management had instructed Mike to build defensive strategies for the company's IT infrastructure to thwart DoS/DDoS attacks. Mike deployed some countermeasures to handle jamming and scrambling attacks.
What is the countermeasure Mike applied to defend against jamming and scrambling attacks?

  1. Allow the transmission of all types of addressed packets at the ISP level
  2. Disable TCP SYN cookie protection
  3. Allow the usage of functions such as gets and strcpy
  4. Implement cognitive radios in the physical layer

Answer(s): D

Explanation:

D is correct because implementing cognitive radios at the physical layer allows dynamic spectrum management and adaptation to circumvent jamming and scrambling attacks.
Cognitive radios enhance the resilience of wireless communications by adapting their transmission parameters based on the surrounding environment and interference patterns, thereby mitigating exposure to intentional disruptions such as jamming. They can detect the presence of unauthorized jamming signals and adjust their operating frequencies or protocols to maintain operational integrity.
In contrast:

A: Allowing the transmission of all types of addressed packets at the ISP level can lead to increased vulnerability, as it does not inherently provide filtering or mitigation against malicious traffic. This approach can exacerbate the impact of a DoS attack rather than prevent it.
B: Disabling TCP SYN cookie protection undermines a mechanism designed to prevent SYN flood attacks, a common type of DoS attack. This countermeasure is essential for maintaining server capacity under congestion and is therefore detrimental to network defense when disabled.
C: Enabling functions such as gets and strcpy presents security risks related to buffer overflow threats. These functions do not contribute to defending against jamming or scrambling; instead, they expose the system to exploitative attacks, jeopardizing its integrity.
Thus, among the provided options, implementing cognitive radios stands out as the most effective countermeasure against jamming and scrambling attacks, leveraging the adaptability and intelligence of wireless systems to secure communication.
References:
https://ieeexplore.ieee.org/document/6313679 https://link.springer.com/chapter/10.1007/978-3-642-22114-2_6 https://www.sciencedirect.com/science/article/pii/S1386372316307870


Reference:

References:
https://ieeexplore.ieee.org/document/6313679 https://link.springer.com/chapter/10.1007/978-3-642-22114-2_6 https://www.sciencedirect.com/science/article/pii/S1386372316307870



You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic. If you did not have a VPN, how would you identify whether someone is performing an ARP spoofing attack on your laptop?

  1. You should check your ARP table and see if there is one IP address with two different MAC addresses.
  2. You should scan the network using Nmap to check the MAC addresses of all the hosts and look for duplicates.
  3. You should use netstat to check for any suspicious connections with another IP address within the LAN.
  4. You cannot identify such an attack and must use a VPN to protect your traffic.

Answer(s): A

Explanation:

A is correct because examining the ARP table for duplicate IP-to-MAC address mappings is a direct method to identify ARP spoofing attacks, which occur when two different MAC addresses respond to the same IP,
misleading hosts on the network.
Reasoning: ARP spoofing allows an attacker to impersonate another device on the network by sending falsified ARP messages.
When a device checks its ARP table, it should find unique MAC addresses corresponding to IP addresses. If one IP address lists multiple MAC addresses, it indicates possible ARP spoofing, as multiple devices cannot legitimately use the same IP without conflict. This procedure is essential for quick detection in environments where traffic sniffing may otherwise go unnoticed.
Critical Evaluation of Other Options:
B: You should scan the network using Nmap to check the MAC addresses of all the hosts and look for duplicates.
While scanning with Nmap can provide a list of MAC addresses, it is a more indirect method of verifying an ARP spoofing attack. Additionally, Nmap may not detect ARP responses that are deceptive but still appear legitimate on the surface, therefore not providing specific insight into the ARP cache of an individual machine.
C: You should use netstat to check for any suspicious connections with another IP address within the LAN. Netstat is useful for identifying active connections, but it does not offer insights specifically tied to ARP spoofing. A connection might look legitimate even if spoofing occurs, as the attacker could forge a connection that appears normal, thus providing no actionable intelligence regarding ARP behavior.
D: You cannot identify such an attack and must use a VPN to protect your traffic. This assertion is incorrect because it dismisses the viable method of identifying ARP spoofing through ARP table analysis.
While a VPN helps secure traffic, it doesn't negate the possibility of detecting ARP spoofing through proper network analysis techniques.
References:
https://www.tcpipguide.com/free/t_tcpipaddressresolutionprotocolarp-2.htm https://www.cisecurity.org/white-papers/arp-spoofing/ https://www.sans.org/white-papers/37724/


Reference:

References:
https://www.tcpipguide.com/free/t_tcpipaddressresolutionprotocolarp-2.htm https://www.cisecurity.org/white-papers/arp-spoofing/ https://www.sans.org/white-papers/37724/



Lewis, a professional hacker, targeted the IoT cameras and devices used by a target venture-capital firm. He used an information-gathering tool to collect information about the IoT devices connected to a network, open ports and services, and the attack surface area. Using this tool, he also generated statistical reports on broad usage patterns and trends. This tool helped Lewis continually monitor every reachable server and device on the Internet, further allowing him to exploit these devices in the network.
Which of the following tools was employed by Lewis in the above scenario?

  1. NeuVector
  2. Lacework
  3. Censys
  4. Wapiti

Answer(s): C

Explanation:

C is correct because Censys is a powerful information-gathering tool specifically designed for scanning and analyzing devices connected to the Internet, particularly IoT devices.
Censys enables comprehensive visibility into the attack surface by identifying open ports, services, and vulnerabilities across a vast number of devices. Its ability to generate statistical reports on usage patterns demonstrates its utility in facilitating ongoing reconnaissance, a crucial step in penetration testing and ethical hacking. This aligns perfectly with Lewis's activities of monitoring and exploiting IoT devices.
Evaluation of Other Options:

A: NeuVector: NeuVector specializes in container security and network visibility for cloud-native environments.
While it can offer insight into containerized applications and microservices, it is not tailored for broad Internet-wide scanning or comprehensive analysis of IoT devices, making it unsuitable for the scenario described.
B: Lacework: Lacework focuses primarily on cloud security and workload protection.
While it provides threat detection and compliance monitoring for cloud environments, it does not serve the specific function of gathering extensive data on publicly accessible IoT devices or generating reports on broader usage trends.
D: Wapiti: Wapiti is a web application vulnerability scanner that tests web applications for vulnerabilities. It is not equipped to monitor all reachable servers and devices across the Internet or provide the extensive data analytics required for IoT devices, rendering it ineffective for the task at hand.
References:
https://censys.io https://www.neuvector.com https://www.lacework.com


Reference:

References:
https://censys.io https://www.neuvector.com https://www.lacework.com



Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered. John decided to perform a TCP SYN ping scan on the target network.
Which of the following Nmap commands must John use to perform the TCP SYN ping scan?

  1. nmap -sn -PO < target IP address >
  2. nmap -sn -PS < target IP address >
  3. nmap -sn -PA < target IP address >
  4. nmap -sn -PP < target IP address >

Answer(s): B

Explanation:

Option B, "nmap -sn -PS ", is correct as it initiates a TCP SYN ping scan, effectively probing the targeted ports with SYN packets to identify whether they are open.
The command includes the -sn flag, which instructs Nmap to perform a “ping scan,” thereby discovering active hosts without port scanning. The -PS option specifically indicates a TCP SYN scan, targeting a specific port or ports to ascertain their state. This method is particularly effective in circumventing firewall rules designed to block other types of ICMP echo requests, making it valuable for stealth assessments.
Evaluation of Incorrect Options:
1. Option A: "nmap -sn -PO "
The -PO flag invokes a different method of host discovery known as IP Protocol Ping Scan. This method sends packets with various IP protocols but does not perform a TCP SYN scan and is not tailored for identifying open TCP ports.
2. Option C: "nmap -sn -PA "
The -PA option conducts a TCP ACK scan instead of a TCP SYN scan.
While it can reveal whether a port is open or filtered, it is not optimized for a direct SYN ping as specified in the task, ultimately making it less appropriate for John’s objective.
3. Option D: "nmap -sn -PP "
The -PP flag engages in a timestamp ping scan, using IP timestamps rather than TCP methods. This approach does not provide the direct results regarding the open state of TCP ports, thereby failing to meet the requirements of John's task.
In summary, Option B is the only command configuration that directly accomplishes a TCP SYN ping scan, aligning perfectly with John’s goal to identify open ports in a potentially firewalled environment.
References:
1. https://nmap.org/book/man.html#man-packets 2. https://nmap.org/book/nmap-ping-scan.html 3. https://nmap.org/book/nmap-usage.html


Reference:

References:
1. https://nmap.org/book/man.html#man-packets 2. https://nmap.org/book/nmap-ping-scan.html 3. https://nmap.org/book/nmap-usage.html



Ricardo has discovered the username for an application in his target’s environment. As he has a limited amount of time, he decides to attempt to use a list of common passwords he found on the Internet. He compiles them into a list and then feeds that list as an argument into his password-cracking application.
What type of attack is Ricardo performing?

  1. Brute force
  2. Known plaintext
  3. Dictionary
  4. Password spraying

Answer(s): C

Explanation:

C is correct because Ricardo is utilizing a precompiled list of commonly used passwords to attempt to gain unauthorized access, which characterizes a dictionary attack.
In ethical hacking, a dictionary attack involves using a predefined set of potential passwords (dictionary) that are likely to be used by the target, thereby increasing the probability of success compared to random password attempts. This method specifically leverages the tendency for users to choose easy-to-remember passwords, often found in publicly available breach data. By feeding commonly used passwords into the application, Ricardo maximizes his chances of success in a constrained timeframe.
Evaluation of Incorrect Options:

A: Brute Force : This option involves systematically trying every possible combination of characters until the correct one is found. Unlike a dictionary attack, a brute force attack does not rely on preselected or commonly used passwords, making it typically more time-consuming.
B: Known Plaintext : This refers to scenarios where the attacker possesses both the plaintext and the corresponding ciphertext to decrypt or analyze the security of a system. This is unrelated to password attempts and focuses more on cryptographic contexts rather than user credential attacks.
D: Password Spraying : This technique involves attempting a small number of commonly used passwords across many accounts to avoid account lockouts.
While Ricardo's method shares some similarities, it is distinct because he is targeting a single username with an entire list of common passwords, which fits the definition of a dictionary attack rather than spreading attempts across multiple accounts.
References:
1. https://www.csoonline.com/article/3251947/what-is-a-dictionary-attack-how-to-protect-against-
it.html 2. https://www.kaspersky.com/resource-center/definitions/dictionary-attack 3. https://www.varonis.com/blog/dictionary-attack


Reference:

References:
1. https://www.csoonline.com/article/3251947/what-is-a-dictionary-attack-how-to-protect-against-
it.html 2. https://www.kaspersky.com/resource-center/definitions/dictionary-attack 3. https://www.varonis.com/blog/dictionary-attack



  PDF
Viewing page 13 of 133
Viewing questions 97 - 104 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!