EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 16 )

Updated On: 31-Jul-2026

Which of the following Metasploit post-exploitation modules can be used to escalate privileges on Windows systems?

  1. getsystem
  2. getuid
  3. keylogrecorder
  4. autoroute

Answer(s): A

Explanation:

The correct answer is A, getsystem, as it effectively escalates privileges on Windows systems by exploiting various security mechanisms.
The getsystem module in Metasploit uses techniques such as exploiting the user’s session tokens and employing local system service exploit methods to elevate privileges to those of the SYSTEM account. Gaining SYSTEM level access is critical in post-exploitation scenarios, enabling deeper access to the operating system and sensitive data.
Evaluation of Other Options:
B: getuid - This module merely retrieves the user ID of the current session; it does not perform any actions to escalate privileges. It is primarily used to confirm the current user context rather than elevate it, thus lacking the intended functionality for privilege escalation.
C: keylogrecorder - While this module serves to log keystrokes on the compromised system, its primary purpose is information gathering rather than privilege escalation. It operates at the user level, which means it cannot elevate the current permissions or access level needed for extensive system control.
D: autoroute - This module allows for the manipulation of routing tables in penetration testing scenarios, but it does not interact with local user privileges. Its focus is on network capabilities rather than elevating the user’s permission level on the host system, resulting in it being ineffective for privilege escalation.
For detailed exploration of Metasploit and its capabilities, consider these references:
https://www.rapid7.com/products/metasploit/ https://www.offensive-security.com/metasploit-unleashed/privilege-escalation-in-windows/ https://www.cybintsolutions.com/what-is-metasploit-and-how-to-use-it/



Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network.
While performing the given task, Sam sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed.
What is the port scanning technique used by Sam to discover open ports?

  1. Xmas scan
  2. IDLE/IPID header scan
  3. TCP Maimon scan
  4. ACK flag probe scan

Answer(s): C

Explanation:

C is correct because the TCP Maimon scan utilizes FIN/ACK packets to probe the state of ports, revealing closed ports through RST responses.
The TCP Maimon scan works by sending a FIN/ACK packet to the target port. If the port is closed, the expected response is a TCP RST packet, which indicates that the port is not accepting connections. This method can be advantageous as it may go undetected by some security devices, as it mimics normal traffic behavior. In Sam's case, the receipt of an RST packet after sending the FIN/ACK indicates that the port is indeed closed, verifying the technique's effectiveness.
Evaluation of Other Options:

A: Xmas Scan : This technique sends packets with the FIN, URG, and PSH flags set. An open port typically responds with no packet, while a closed port responds with RST. Since Sam's method involved FIN/ACK, not the combination of flags, this option is incorrect.
B: IDLE/IPID Header Scan : This method involves manipulating the IP identification (ID) field of packets sent to a third-party host to infer the state of ports on the target host. It requires an intermediary and is not applicable in directly probing ports using FIN/ACK packets as Sam did.
D: ACK Flag Probe Scan : This scan sends packets with the ACK flag set to determine the state of ports based on response types—RST for closed ports and no response for open ports. However, Sam used FIN/ACK, not just ACK, making this option incorrect as well.
These distinctions reaffirm that the TCP Maimon scan is the appropriate choice based on Sam's method and the received response during port scanning.
References:
1. https://www.tcpipguide.com/free/t_tcpconnectionestablishmentandteardown-3.htm 2. https://www.cisecurity.org/white-papers/tcp-ports-and-sockets/ 3. https://www.verisign.com/en_US/resources/trends-and-reports/port-scanning/index.xhtml


Reference:

References:
1. https://www.tcpipguide.com/free/t_tcpconnectionestablishmentandteardown-3.htm 2. https://www.cisecurity.org/white-papers/tcp-ports-and-sockets/ 3. https://www.verisign.com/en_US/resources/trends-and-reports/port-scanning/index.xhtml



An organization has automated the operation of critical infrastructure from a remote location. For this purpose, all the industrial control systems are connected to the Internet. To empower the manufacturing process, ensure the reliability of industrial networks, and reduce downtime and service disruption, the organization decided to install an OT security tool that further protects against security incidents such as cyber espionage, zero-day attacks, and malware.
Which of the following tools must the organization employ to protect its critical infrastructure?

  1. Robotium
  2. BalenaCloud
  3. Flowmon
  4. IntentFuzzer

Answer(s): C

Explanation:

C: Flowmon is the correct choice as it offers advanced network monitoring and threat detection essential for securing industrial control systems.
Flowmon provides deep visibility into network traffic, enabling the detection of anomalies associated with zero-day attacks, cyber espionage, and malware. Its capabilities include behavior analysis and real-time monitoring which are pivotal for maintaining the integrity and availability of critical infrastructure. This tool aligns well with operational technology (OT) security needs by addressing the unique challenges posed by connecting industrial environments to the internet.
In contrast, option A, Robotium, is a test automation framework primarily designed for Android applications. It does not provide the security functionalities needed for protecting industrial control systems against cyber threats. B, BalenaCloud, focuses on managing and deploying applications in the IoT domain rather than providing specific cybersecurity measures. Its features do not encompass the holistic threat detection and network analysis necessary for OT security. Lastly, D, IntentFuzzer, is primarily a security testing tool for applications used to identify vulnerabilities through fuzz testing. However, it lacks the comprehensive network monitoring and real-time incident response capabilities required in industrial environments.
In summary, Flowmon uniquely fulfills the need for a dedicated OT security solution, addressing the complexities of interconnected industrial control systems while the other options fail to meet these specialized requirements.
References:
https://www.flowmon.com https://www.cisa.gov/publications-library https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-framework


Reference:

References:
https://www.flowmon.com https://www.cisa.gov/publications-library https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-framework



Heather’s company has decided to use a new customer relationship management tool. After performing the appropriate research, they decided to purchase a subscription to a cloud-hosted solution. The only administrative task that Heather will need to perform is the management of user accounts. The provider will take care of the hardware, operating system, and software administration including patching and monitoring.
Which of the following is this type of solution?

  1. IaaS
  2. SaaS
  3. PaaS
  4. CaaS

Answer(s): B

Explanation:

B is correct because the solution described is a Software as a Service (SaaS) model, where the provider manages the infrastructure and software, allowing users to focus solely on utilizing the application.
In a SaaS model, users access software applications over the internet on a subscription basis. The provider handles all aspects of management, including hardware, operating systems, and software maintenance, which is reflected in Heather's situation, where her sole responsibility is user account management. This model promotes efficiency and reduces administrative burdens for businesses, aligning well with modern organizational needs.
Evaluation of Other Options:

A: IaaS (Infrastructure as a Service) : IaaS provides fundamental computing resources like virtual machines and storage that must be managed by the user, including operating systems and applications. Given that Heather does not manage hardware or software, IaaS does not fit her scenario.
C: PaaS (Platform as a Service) : PaaS is intended for developers to build applications without managing the underlying infrastructure. Although some components are managed by the provider, extensive development and software management responsibilities still rest with the user, which is not applicable in Heather's case where user account management is the only task.
D: CaaS (Container as a Service) : CaaS focuses on managing containerized applications and requires knowledge in deployment and scaling of these applications. It is more developer-centric and involves intricate configurations that exceed Heather's administrative scope, as she is not involved in the underlying application or service management.
In conclusion, the characteristics of Heather's customer relationship management tool clearly align with the SaaS model, providing an optimal solution for businesses seeking to minimize administrative overhead.
References:
https://www.ibm.com/cloud/learn/saas https://www.cio.com/article/222841/what-is-saas-software-as-a-service.html https://www.microsoft.com/en-us/microsoft-365/enterprise/software-as-a-service


Reference:

References:
https://www.ibm.com/cloud/learn/saas https://www.cio.com/article/222841/what-is-saas-software-as-a-service.html https://www.microsoft.com/en-us/microsoft-365/enterprise/software-as-a-service



Juliet, a security researcher in an organization, was tasked with checking for the authenticity of images to be used in the organization's magazines. She used these images as a search query and tracked the original source and details of the images, which included photographs, profile pictures, and memes.
Which of the following footprinting techniques did Rachel use to finish her task?

  1. Google advanced search
  2. Meta search engines
  3. Reverse image search
  4. Advanced image search

Answer(s): C

Explanation:

C is correct because reverse image search allows Juliet to track the origins and details of images based on their visual content rather than textual attributes.
Justification: Reverse image search is a specialized technique that permits users to upload an image and receive details about its source, variations, or similar images across the web. By employing this method, Juliet could ascertain the authenticity of the images by tracing them back to their original sources, thereby validating their credibility for use in publication. This technique effectively differentiates between legitimate and manipulated or misappropriated images, enhancing the integrity of content in the organization’s magazines.
Evaluation of Other Options:

A: Google Advanced Search: While useful for filtering search results, it primarily relies on textual queries rather than image content. Juliet's primary requirement was to authenticate the images, which cannot be adequately fulfilled using only advanced text-based search parameters.
B: Meta Search Engines: These aggregates draw from multiple search engines to compile results. However, they do not inherently support image analysis or investigation into visual content authenticity. Their function is more aligned with text-based data aggregation, rather than validating images.
D: Advanced Image Search: Although this enabled refined queries for specific types of images, it lacks the direct capability to track the source and authenticity of an image solely based on its visual characteristics, making it less effective for Juliet's specific need to verify image origins.


Reference:

https://support.google.com/websearch/answer/132580?hl=en https://www.howtogeek.com/678593/how-to-use-a-reverse-image-search/ https://www.techradar.com/how-to/how-to-do-a-reverse-image-search



Mary, a penetration tester, has found password hashes in a client system she managed to breach. She needs to use these passwords to continue with the test, but she does not have time to find the passwords that correspond to these hashes.
Which type of attack can she implement in order to continue?

  1. Pass the hash
  2. Internal monologue attack
  3. LLMNR/NBT-NS poisoning
  4. Pass the ticket

Answer(s): A

Explanation:

A: Pass the hash is correct because it allows Mary to authenticate using the captured password hashes directly without needing to crack them into plaintext passwords.
The pass-the-hash (PtH) technique enables an attacker to authenticate to a network service by using the underlying hash values instead of cracking the hashes for their corresponding plaintext passwords. This is particularly advantageous in scenarios where time constraints limit the ability to perform password cracking. Since many systems still rely on weak security measures that do not adequately defend against PtH attacks, Mary can leverage this method to continue her penetration testing without delay.
Evaluation of Other Options:
B: Internal monologue attack: This term is not recognized in the context of penetration testing or security. Consequently, it does not provide a viable method of attack nor a valid alternative to PtH.
C: LLMNR/NBT-NS poisoning: This technique focuses on intercepting and responding to local name resolution requests. Although it can capture hashes, it requires a setup that may not be immediately applicable given that Mary already possesses the necessary hashes. Thus, it is not as expedient or relevant as PtH for immediate authentication.
D: Pass the ticket: This attack is specific to Kerberos environments where an attacker impersonates a user by using a Ticket Granting Ticket (TGT). It is irrelevant here, as Mary has password hashes rather than Kerberos tickets, making this method inapplicable for the current objective.
References:
https://www.microsoft.com/en-us/security/blog/2016/10/06/the-evolution-of-pass-the-hash-attacks/ https://www.sans.org/white-papers/37315/ https://www.cisecurity.org/white-papers/avoiding-pass-the-hash-attacks-in-the-enterprise/


Reference:

References:
https://www.microsoft.com/en-us/security/blog/2016/10/06/the-evolution-of-pass-the-hash-attacks/ https://www.sans.org/white-papers/37315/ https://www.cisecurity.org/white-papers/avoiding-pass-the-hash-attacks-in-the-enterprise/



Morris, a professional hacker, performed a vulnerability scan on a target organization by sniffing the traffic on the network to identify the active systems, network services, applications, and vulnerabilities. He also obtained the list of the users who are currently accessing the network.
What is the type of vulnerability assessment that Morris performed on the target organization?

  1. Credentialed assessment
  2. Internal assessment
  3. External assessment
  4. Passive assessment

Answer(s): D

Explanation:

D is correct because Morris performed a vulnerability assessment without actively engaging with the target systems, relying instead on passive techniques.
In passive assessments, the focus is on collecting information without direct interaction, such as sniffing network traffic to identify systems and vulnerabilities. Morris’s technique of monitoring existing traffic exemplifies this approach, as it involves analyzing data flows and identifying vulnerabilities and user activity without sending any probing requests or scans that could alter the environment.
Critique of Other Options:

A: Credentialed assessment – This requires authenticated access to system resources, which Morris did not utilize. The lack of direct system interaction eliminates this option as an appropriate classification.
B: Internal assessment – While this involves evaluating the security posture from within an organization, Morris’s method did not involve a direct examination of internal systems; therefore, it cannot be classified solely as internal.
C: External assessment – This involves probing systems from outside the network, which is not representative of Morris's method, as he operated within the existing network traffic without external probing.
References:
https://www.csoonline.com/article/3254863/what-is-vulnerability-assessment-how-it-works-and-the-main-types.html https://www.imperva.com/learn/data-security/vulnerability-assessment/ https://www.tenable.com/blog/what-is-a-vulnerability-assessment-and-how-is-it-different-from-pentesting


Reference:

References:
https://www.csoonline.com/article/3254863/what-is-vulnerability-assessment-how-it-works-and-the-main-types.html https://www.imperva.com/learn/data-security/vulnerability-assessment/ https://www.tenable.com/blog/what-is-a-vulnerability-assessment-and-how-is-it-different-from-pentesting



Which of the following protocols can be used to secure an LDAP service against anonymous queries?

  1. NTLM
  2. RADIUS
  3. WPA
  4. SSO

Answer(s): A

Explanation:

A: NTLM is correct because it provides authentication mechanisms that can restrict anonymous queries to an LDAP service.
NTLM (NT LAN Manager) is a Microsoft authentication protocol that can mitigate unauthorized access to directory services such as LDAP (Lightweight Directory Access Protocol). By requiring proper credentials via NTLM, LDAP implementations can effectively limit the visibility of directory queries to authenticated users only. This diminishes the risk of unauthorized or anonymous probing, thus enhancing security.
Critical Evaluation of Other Options:
B: RADIUS: While RADIUS (Remote Authentication Dial-In User Service) is a client-server protocol used for remote authentication and accounting purposes, it does not directly secure LDAP itself. RADIUS is typically employed for network access control rather than defending against LDAP-specific anonymous queries.
C: WPA: WPA (Wi-Fi Protected Access) is a security protocol designed for wireless networks. Its primary focus is on securing wireless communications and does not extend directly to the protection of services like LDAP against anonymous queries.
D: SSO: Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications with one set of login credentials.
While SSO can improve user experience and manage authentication across various services, it does not specifically address the issue of limiting anonymous access to an LDAP service.
In conclusion, NTLM offers a targeted approach to securing LDAP services by enforcing authentication, while the other protocols, although valuable in their respective domains, do not provide the same level of direct protection against anonymous LDAP queries.
References:
https://www.cio.com/article/286100/what-is-ntlm.html https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_chapter_011.html https://www.networkworld.com/article/2681393/radius-service-authentication.html


Reference:

References:
https://www.cio.com/article/286100/what-is-ntlm.html https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_chapter_011.html https://www.networkworld.com/article/2681393/radius-service-authentication.html



Viewing page 16 of 133
Viewing questions 121 - 128 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!