support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 17 )

Updated On: 31-Jul-2026
Page 17 of 133
PDF with 1065 Questions

During the enumeration phase, Lawrence performs banner grabbing to obtain information such as OS details and versions of services running. The service that he enumerated runs directly on TCP port 445.
Which of the following services is enumerated by Lawrence in this scenario?

  1. Remote procedure call (RPC)
  2. Telnet
  3. Server Message Block (SMB)
  4. Network File System (NFS)

Answer(s): C

Explanation:

C: Server Message Block (SMB) is the correct answer because it operates over TCP port 445 and is commonly used for file sharing and network resource access in Windows environments.
The enumeration of services running on a specific TCP port is crucial in ethical hacking to identify potential vulnerabilities. TCP port 445 is specifically associated with SMB, a protocol enabling shared access to files, printers, and other network resources. Banner grabbing techniques can reveal configuration details that provide insights into the operational environment, including the version of SMB being utilized. This is particularly important in identifying vulnerable versions of protocols that may be susceptible to exploits.
Critical Evaluation of Incorrect Options:

A: Remote Procedure Call (RPC) : While RPC does utilize network communications, it typically operates over multiple ports, including 135, and is not directly associated with port 445, making it an unsuitable choice for this enumeration scenario.
B: Telnet : This protocol runs on TCP port 23, focusing on terminal emulation and remote command execution. It does not relate to port 445, which is exclusively for file and resource sharing, thus disqualifying it from being the enumerated service.
D: Network File System (NFS) : Although NFS serves a similar purpose as SMB regarding file sharing, it predominantly operates over TCP port 2049. Since NFS does not listen on port 445, it cannot be considered as the service Lawrence evaluated during his enumeration.
For further reading:
https://docs.microsoft.com/en-us/windows/win32/learnwin32/understanding-server-message-blocks https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/what-is-smb/prod_white_paper0900aecd81b4ce3a.html https://www.owasp.org/index.php/Remote_Procedure_Call_Risks_and_Exploits



Jane invites her friends Alice and John over for a LAN party. Alice and John access Jane’s wireless network without a password. However, Jane has a long, complex password on her router.
What attack has likely occurred?

  1. Wardriving
  2. Wireless sniffing
  3. Evil twin
  4. Piggybacking

Answer(s): C

Explanation:

C is correct because Jane's wireless network appears to have been compromised through an Evil Twin attack, allowing Alice and John to connect without a password.
An Evil Twin attack occurs when an attacker sets up a rogue wireless access point that mimics a legitimate one. In this scenario, it's plausible that either Alice or John could have created an unauthorized access point that deceived Jane’s friends into connecting to it instead of Jane’s secure network. This explains how they could access the network without knowing the complex password.
Option A, Wardriving, refers to the act of searching for Wi-Fi networks while driving around with a laptop or another device.
While it can identify network vulnerabilities, it doesn't inherently provide access to a secure network or imply a connection without a password.
Option B, Wireless sniffing, involves capturing data packets that are transmitted over a wireless network. Although this could potentially identify credentials or sensitive information, it does not imply unauthorized access directly to the network without the correct password.
Option D, Piggybacking, describes an individual gaining unauthorized access by following someone who is already authorized. This is not applicable here, as Alice and John connected to the network directly without any indication of prior authentic users aiding them, suggesting a more proactive attack like an Evil Twin setup instead.
https://www.tldp.org/LDP/lkddb/2.6/doc/html/security/evil_twin.html https://www.networkworld.com/article/2692420/what-is-evil-twin.html https://www.csoonline.com/article/3252711/the-evil-twin-attack-how-it-works-and-what-you-can-do-about-it.html



Which file is a rich target to discover the structure of a website during web-server footprinting?

  1. domain.txt
  2. Robots.txt
  3. Document root
  4. index.html

Answer(s): B

Explanation:

B is correct as it explicitly outlines access restrictions and the structure of web directories which are invaluable during reconnaissance.
Robots.txt is a standard used by websites to communicate with web crawlers, indicating which parts of the website should not be accessed or indexed. This file can reveal the existence of hidden directories and files, thereby facilitating targeted attacks or further reconnaissance. The content of a Robots.txt file may highlight areas that may not be designed for public viewing but could contain exploitable resources, representing a 'rich target' for hackers conducting footprinting.
In contrast, the other options possess limitations:

A: domain.txt: This file does not typically exist in the context of standard web architecture and may not provide information specific to the web server’s structure.
C: Document root: While critical for understanding where files are served from, it often lacks actionable details about restricted areas that are not intended for public access. Furthermore, the document root's exposure may also depend on server configuration, limiting its utility.
D: index.html: Although this file contains the homepage of the website, it generally provides limited insights into the site’s organizational structure. Instead, it showcases content rather than mapping out directory structure or access controls.
In conclusion, Robots.txt serves as a critical resource for understanding the topology of web assets, making it the superior choice for web-server footprinting.


Reference:

https://developers.google.com/search/docs/crawling-indexing/robots.txt " target="_blank"> https://developers.google.com/search/docs/crawling-indexing/robots.txt https://www.w3.org/Submission/robots-txt/ " target="_blank"> https://www.w3.org/Submission/robots-txt/ https://owasp.org/www-community/OWASP_Robots_txt_Validation
" target="_blank"> https://owasp.org/www-community/OWASP_Robots_txt_Validation



John, a professional hacker, decided to use DNS to perform data exfiltration on a target network. In this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique, John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server.
What is the technique employed by John to bypass the firewall?

  1. DNSSEC zone walking
  2. DNS cache snooping
  3. DNS enumeration
  4. DNS tunneling method

Answer(s): D

Explanation:

D: DNS tunneling method is correct as it allows John to embed malicious data within DNS packets, facilitating data exfiltration while evading conventional security measures.
Justification for Correct Answer:
DNS tunneling leverages the DNS protocol to encapsulate non-DNS traffic within DNS queries and responses. By encoding payload data as DNS queries, this method can bypass firewalls that typically monitor HTTP or other more common protocols for unusual activity. Such evasion is particularly effective because DNS traffic is generally given less scrutiny, allowing John to maintain covert communication with a Command and Control (C&C) server.
Evaluation of Incorrect Options:

A: DNSSEC zone walking : This refers to a method of querying DNS zones that use DNSSEC (Domain Name System Security Extensions) but is focused on collecting information about a domain's DNS records. It does not involve embedding malicious payloads or maintaining communication with external servers, making it irrelevant to the scenario presented.
B: DNS cache snooping : This technique involves checking what DNS records are cached on a resolver to infer information about DNS queries.
While this method helps in reconnaissance, it does not facilitate data exfiltration or communication with a malicious server, thus failing to meet the criteria of the scenario.
C: DNS enumeration : Similar to cache snooping, DNS enumeration is about gathering information from DNS records to map out a target environment.
While it aids in offensive operations, it does not inherently provide a method for embedding data into DNS queries to bypass firewalls.
References:
https://www.cloudflare.com/learning/security/glossary/dns-tunneling/ https://www.imperva.com/learn/application-security/dns-tunneling/ https://www.cisecurity.org/white-papers/dns-tunneling-and-how-to-detect-it/


Reference:

References:
https://www.cloudflare.com/learning/security/glossary/dns-tunneling/ https://www.imperva.com/learn/application-security/dns-tunneling/ https://www.cisecurity.org/white-papers/dns-tunneling-and-how-to-detect-it/



There have been concerns in your network that the wireless network component is not sufficiently secure. You perform a vulnerability scan of the wireless network and find that it is using an old encryption protocol that was designed to mimic wired encryption.
What encryption protocol is being used?

  1. RADIUS
  2. WPA
  3. WEP
  4. WPA3

Answer(s): C

Explanation:

C is correct because WEP (Wired Equivalent Privacy) was designed to provide a wireless security mechanism that mimics the security of a wired network.
WEP utilizes the RC4 stream cipher for encryption, which is fundamentally flawed due to weak key management and poor integrity checks, thus rendering it vulnerable to various attack vectors such as packet sniffing and injection. Its reliance on static keys contributes to its inadequacy in modern environments necessitating robust security measures.
Evaluation of Other Options:

A: RADIUS is not an encryption protocol but an authentication protocol that facilitates secure communication between the user and network via a centralized server. It can complement encryption protocols but does not itself provide encryption.
B: WPA (Wi-Fi Protected Access), the successor to WEP, improves security by implementing TKIP (Temporal Key Integrity Protocol) and is more robust against the vulnerabilities WEP exhibits. However, WPA is clearly a step forward from WEP, making it an incorrect answer in the context of identifying a legacy encryption standard.
D: WPA3 further enhances security over WPA2 and is considered the state-of-the-art for wireless encryption. It uses more robust encryption methods and is not suitable for identifying an older and less secure protocol like WEP.
In summary, the defining characteristic of WEP as an encryption protocol that mimics wired encryption confirms its classification as outdated and insufficient for contemporary security needs.


Reference:

https://www.cisecurity.org/white-papers/wi-fi-security-best-practices https://www.nist.gov/publications/nist-special-publication-800-97 https://csrc.nist.gov/publications/detail/sp/800-127/vol-1/final



You are a cybersecurity specialist at CloudTech Inc., a company providing cloud-based services. You are managing a project for a client who wants to migrate their sensitive data to a public cloud service. To comply with regulatory requirements, the client insists on maintaining full control over the encryption keys even when the data is at rest on the cloud.
Which of the following practices should you implement to meet this requirement?

  1. Encrypt data client-side before uploading to the cloud and retain control of the encryption keys.
  2. Use the cloud service provider's encryption services but store keys on-premises.
  3. Rely on Secure Sockets Layer (SSL) encryption for data at rest.
  4. Use the cloud service provider's default encryption and key management services.

Answer(s): A

Explanation:

A is correct because encrypting data client-side before uploading it to the cloud ensures that encryption keys remain under the control of the client, thereby adhering to regulatory requirements.
Client-side encryption allows the client to encrypt sensitive data prior to transmission, guaranteeing that unencrypted data does not exist in the cloud provider’s infrastructure. This minimizes data compromise risks, aligns with the principle of least privilege, and upholds strong data governance frameworks. Retaining control over encryption keys directly mitigates the risk of unauthorized access by the cloud service provider,
enhancing compliance with regulations such as GDPR and HIPAA.
Evaluation of Other Options:
B: Using the cloud service provider's encryption services but storing keys on-premises poses risks.
While it appears to maintain control over encryption keys, this model can lead to challenges in key management and operational complexity. If not properly managed, it could still expose sensitive data if cloud provider policies fail.
C: Relying on Secure Sockets Layer (SSL) encryption for data at rest is inadequate. SSL primarily protects data in transit, not at rest. Additionally, this approach does not empower the client to manage encryption keys, risking compliance violations.
D: Utilizing the cloud service provider's default encryption and key management services does not satisfy the client's requirement for control. Default solutions typically grant the service provider full access to the keys, creating potential vulnerabilities and compliance issues.
https://www.nist.gov/publications/detail/nist-special-publication-800-111https://www.owasp.org/index.php/Cloud_Security_Top_10https://www.iso.org/standard/75117.html



In an advanced persistent threat scenario, an adversary follows a detailed set of procedures in the cyber kill chain. During one such instance, the adversary has successfully gained access to a corporate network and now attempts to obfuscate malicious traffic within legitimate network traffic.
Which of the following actions would most likely be part of the adversary's current procedures?

  1. Employing data staging techniques to collect and aggregate sensitive data.
  2. Initiating DNS tunneling to communicate with the command-and-control server.
  3. Establishing a command-and-control server to communicate with compromised systems.
  4. Conducting internal reconnaissance using PowerShell scripts.

Answer(s): B

Explanation:

B is correct because DNS tunneling effectively obfuscates malicious traffic within legitimate DNS requests, allowing covert communication with command-and-control servers.
The adversary in an advanced persistent threat (APT) scenario aims to minimize detection while maintaining access to compromised networks. Initiating DNS tunneling allows data to be exfiltrated and instructions to be sent back to the adversary through standard DNS queries, which are often overlooked by security systems, making this method particularly effective for hiding malicious activities.
Evaluation of Other Options:

A: Employing data staging techniques to collect and aggregate sensitive data.
While data staging is essential in data exfiltration strategies, it does not inherently involve obfuscating the traffic itself. It focuses more on collecting sensitive information rather than evading detection.
C: Establishing a command-and-control server to communicate with compromised systems. Establishing a command-and-control server is a preliminary step that typically occurs before obfuscating traffic. This action does not play a direct role in disguising malicious activity once access is gained; rather, it is foundational to communication tactics.
D: Conducting internal reconnaissance using PowerShell scripts. Conducting reconnaissance is crucial for gaining insights into the network's structure and vulnerabilities but does not pertain to the current need for obfuscation of traffic. This phase generally precedes actions aimed at maintaining stealth.
In summary, option B stands out as the most relevant action for an adversary seeking to conceal malicious communication within a corporate network.
References:
https://www.sans.org/blog/dns-tunneling-explained/ https://www.cybrary.it/0p3n-source/introduction-to-dns-tunneling https://www.imperva.com/learn/application-security/dns-tunneling-explained/


Reference:

References:
https://www.sans.org/blog/dns-tunneling-explained/ https://www.cybrary.it/0p3n-source/introduction-to-dns-tunneling https://www.imperva.com/learn/application-security/dns-tunneling-explained/



As a part of an ethical hacking exercise, an attacker is probing a target network that is suspected to employ various honeypot systems for security. The attacker needs to detect and bypass these honeypots without alerting the target. The attacker decides to utilize a suite of techniques.
Which of the following techniques would NOT assist in detecting a honeypot?

  1. Implementing a brute force attack to verify system vulnerability
  2. Probing system services and observing the three-way handshake
  3. Using honeypot detection tools like Send-Safe Honeypot Hunter
  4. Analyzing the MAC address to detect instances running on VMware

Answer(s): A

Explanation:

A is correct because implementing a brute-force attack primarily tests for password vulnerabilities rather than identifying the presence of honeypots.
The nature of a brute-force attack is aggressive and, thus, highly detectable, making it an unsuitable method for stealth operations against potential honeypots, which may be specifically designed to collect information on such activities. Honeypots often capture and report brute-force attempts, alerting the defenders.
Evaluation of Other Options:
B: Probing system services and observing the three-way handshake: This approach helps identify active listening ports and services configured on a target system. By effectively analyzing TCP handshakes, an attacker can discern normal network behavior from potentially anomalous responses indicative of honeypots. False positives, such as ports returning responses indicative of honeypots, can be detected and analyzed.
C: Using honeypot detection tools like Send-Safe Honeypot Hunter: This method leverages specialized tools designed to detect honeypots by examining various indicators like network anomalies, false services, and unexpected response behaviors. Such tools streamline the identification of honeypots, allowing for more targeted evasion tactics.
D: Analyzing the MAC address to detect instances running on VMware: By examining MAC addresses, an attacker can identify virtualized environments typically associated with honeypots. Specific MAC address patterns (prefixes) are associated with virtual machine software, providing insights that can signal the presence of a honeypot system.
All alternative methods (B, C, D) employ systematic and passive reconnaissance techniques or specialized tools designed to safely identify deceptive entrapments, unlike brute-force attacks that risk detection.
References:
https://www.csoonline.com/article/3532526/what-is-a-honeypot-and-how-does-it-work.html https://www.sans.org/white-papers/42336/ https://www.blackhat.com/presentations/bh-eu-10/Blanchard/BH-EU-10-Blanchard-Honeypot-Detection-Tools-WP.pdf


Reference:

References:
https://www.csoonline.com/article/3532526/what-is-a-honeypot-and-how-does-it-work.html https://www.sans.org/white-papers/42336/ https://www.blackhat.com/presentations/bh-eu-10/Blanchard/BH-EU-10-Blanchard-Honeypot-Detection-Tools-WP.pdf



  PDF
Viewing page 17 of 133
Viewing questions 129 - 136 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!