support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 18 )

Updated On: 31-Jul-2026
Page 18 of 133
PDF with 1065 Questions

A skilled ethical hacker was assigned to perform a thorough OS discovery on a potential target. They decided to adopt an advanced fingerprinting technique and sent a TCP packet to an open TCP port with specific flags enabled. Upon receiving the reply, they noticed the flags were SYN and ECN-Echo.
Which test did the ethical hacker conduct and why was this specific approach adopted?

  1. Test 3: The test was executed to observe the response of the target system when a packet with URC, PSH, SYN, and FIN flags was sent, thereby identifying the OS
  2. Test 2: This test was chosen because a TCP packet with no flags enabled is known as a NULL packet and this would allow the hacker to assess the OS of the target
  3. Test 1: The test was conducted because SYN and ECN-Echo flags enabled to allow the hacker to probe the nature of the response and subsequently determine the OS fingerprint
  4. Test 6: The hacker selected this test because a TCP packet with the ACK flag enabled sent to a closed TCP port would yield more information about the OS

Answer(s): C

Explanation:

The correct answer is C, as the ethical hacker employed a TCP packet with SYN and ECN-Echo flags to probe the target's OS and interpret its response characteristics.
In TCP/IP stack fingerprinting, the SYN flag is pivotal for initiating a TCP connection, while the ECN-Echo flag serves to indicate the presence of Explicit Congestion Notification (ECN). This specific combination enables an ethical hacker to gather nuanced insights regarding the target's stack implementation and behavior, which are crucial for accurate OS fingerprinting. By evaluating the response to a SYN/ECN-Echo packet, the hacker can deduce whether the target's OS adheres to certain conventions or optimizations, thereby narrowing down the operating system variant.
Option A is incorrect because the test described involves mismatched flag utilization. It refers to a test with URG, PSH, SYN, and FIN flags, which would complicate the analysis rather than focusing exclusively on the SYN/ECN parameters that yield clearer OS data.
Option B is flawed as it describes a NULL packet, which lacks any flags.
While this method can sometimes identify OS characteristics, its reliance on an absence of flags limits its effectiveness in identifying nuances present in stack responses, making the SYN/ECN approach more informative.
Option D misrepresents the behavior of TCP communications. An ACK packet sent to a closed port primarily confirms whether the port is open or closed. Although this can provide some information, it does not yield the specific details about the OS implementation that a SYN/ECN approach provides.
These aspects of TCP/IP stack behavior inform the crucial distinctions in fingerprinting methods. For thorough and accurate OS discovery, advanced techniques that leverage specific flags, like those used in test C, are essential for ethical hacking.
References:
https://www.cylance.com/en_us/solutions/endpoint-security/advanced-packet-capture.html https://www.sans.org/white-papers/39599/ https://www.owasp.org/index.php/OS_Fingerprinting


Reference:

References:
https://www.cylance.com/en_us/solutions/endpoint-security/advanced-packet-capture.html https://www.sans.org/white-papers/39599/ https://www.owasp.org/index.php/OS_Fingerprinting



In an intricate web application architecture using an Oracle database, you, as a security analyst, have identified a potential SQL Injection attack surface. The database consists of 'x' tables, each with 'y' columns. Each table contains 'z' records. An attacker, well-versed in SQLi techniques, crafts 'u' SQL payloads, each attempting to extract maximum data from the database. The payloads include 'UNION SELECT' statements and 'DBMS_XSLPROCESSOR.READ2CLOB' to read sensitive files. The attacker aims to maximize the total data extracted 'E=xyz*u'. Assuming 'x=4', 'y=2', and varying 'z' and 'u', which situation is likely to result in the highest extracted data volume?

  1. z=600, u=2: The attacker devises 2 SQL payloads, each aimed at tables holding 600 records, affecting all columns across all tables.
  2. z=550, u=2: Here, the attacker formulates 2 SQL payloads and directs them towards tables containing 550 records, impacting all columns and tables.
  3. z=500, u=3: The attacker creates 3 SQL payloads and targets tables with 500 records each, exploiting all columns and tables.
  4. z=400, u=4: The attacker constructs 4 SQL payloads, each focusing on tables with 400 records, influencing all columns of all tables.

Answer(s): D

Explanation:

D is correct because it maximizes the extracted data volume through the highest combination of payloads and records.
To evaluate the options, we consider the formula (E = xyz \cdot u):
1. Option A: z=600, u=2
Calculation: (E = 4 \cdot 2 \cdot 600 \cdot 2 = 4800) While the record count (z) is maximized at 600, the number of payloads (u) is limited to 2, resulting in a lower total extracted data volume.
2. Option B: z=550, u=2
Calculation: (E = 4 \cdot 2 \cdot 550 \cdot 2 = 4400) Similar to Option A, although (z) is lower, the limiting factor remains (u = 2), which constricts potential extraction.
3. Option C: z=500, u=3
Calculation: (E = 4 \cdot 3 \cdot 500 \cdot 3 = 6000) This option provides a higher (u), but the reduced (z) ultimately results in a total that does not exceed Option D’s output.
4. Option D: z=400, u=4
Calculation: (E = 4 \cdot 4 \cdot 400 \cdot 4 = 6400) With both (u) and (z) optimized and (u) at its peak, this situation yields the highest total extracted data volume, thus establishing D as the optimal choice.
Each alternative fails to achieve the effective balance of maximizing both the number of payloads and the volume of records simultaneously to the extent D does.
References:
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet https://www.acs.com.hk/en/products/2002/acr38-smart-card-reader/ https://www.oracle.com/security-alerts/


Reference:

References:
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet https://www.acs.com.hk/en/products/2002/acr38-smart-card-reader/ https://www.oracle.com/security-alerts/



A large enterprise has been experiencing sporadic system crashes and instability, resulting in limited access to its web services. The security team suspects it could be a result of a Denial of Service (DoS) attack. A significant increase in traffic was noticed in the network logs, with patterns suggesting packet sizes exceeding the prescribed size limit.
Which among the following DoS attack techniques best describes this scenario?

  1. Smurf attack
  2. UDP flood attack
  3. Pulse wave attack
  4. Ping of Death attack

Answer(s): D

Explanation:

D is correct as the "Ping of Death" attack specifically involves sending oversized packets that can cause system instability and crashes.
The "Ping of Death" is a classic Denial of Service attack that exploits a vulnerability in systems whereby a malicious actor sends ICMP packets that exceed the maximum permissible size of 65,536 bytes. This attack can overwhelm a vulnerable target, causing it to crash or become unstable, which aligns well with the observed patterns of increased traffic and packet sizes exceeding limits in the given scenario. The perceived instability in web services and sporadic crashes further implies the target system’s efforts to handle excessive load—characteristic of a Ping of Death attack.
In contrast, the other options present distinct characteristics that do not fit the described situation as logically:

A: Smurf attack: This method amplifies traffic using ICMP echo requests sent to multiple devices, which then flood the target.
While it can indeed cause disruption, the key distinction here lies in it utilizing spoofed IP addresses and requiring a disparate targeting method differing from the described packet size and direct crashes.
B: UDP flood attack: This technique overwhelms a target with UDP packets, aiming to exhaust network resources. However, it typically involves sending a high volume of small packets rather than oversized packets, which does not match the specific scenario of packet sizes exceeding limits.
C: Pulse wave attack: Primarily involving volumetric attacks that create periodic spikes in traffic, this method does not focus on size violations like the Ping of Death and lacks the direct association with packet size and system crashes described.
Thus, the scenario provided most closely aligns with the characteristics of a Ping of Death attack rather than the other listed techniques.
References:
https://www.csoonline.com/article/3535795/a-guide-to-denial-of-service-dos-attacks.html https://www.cloudflare.com/learning/ddos/what-is-a-ping-of-death/ https://www.acs.com.hk/en/products/1410/acr38-smart-card-reader/


Reference:

References:
https://www.csoonline.com/article/3535795/a-guide-to-denial-of-service-dos-attacks.html https://www.cloudflare.com/learning/ddos/what-is-a-ping-of-death/ https://www.acs.com.hk/en/products/1410/acr38-smart-card-reader/



Your company has been receiving regular alerts from its IDS about potential intrusions. On further investigation, you notice that these alerts have been false positives triggered by certain goodware files. In response, you are planning to enhance the IDS with YARA rules, reducing these false positives while improving the detection of real threats. Based on the scenario and the principles of YARA and IDS, which of the following strategies would best serve your purpose?

  1. Writing YARA rules specifically to identify the goodware files triggering false positives
  2. Implementing YARA rules that focus solely on known malware signatures
  3. Creating YARA rules to examine only the private database for intrusions
  4. Incorporating YARA rules to detect patterns in all files regardless of their nature

Answer(s): A

Explanation:

A is correct because writing YARA rules specifically to identify the goodware files triggering false positives proactively eliminates their disruptive influence on the IDS.
Reasoning
Incorporating YARA rules that accurately define and identify legitimate goodware files allows for the refinement of intrusion detection systems (IDS). This approach minimizes false positives by clearly delineating acceptable versus malicious activity, thus improving the system’s overall accuracy and reliability. By focusing on the goodware files producing alerts, the organization can enhance the IDS’s sensitivity and specificity, ensuring that real threats are not overlooked while reducing unnecessary noise.
Evaluation of Other Options
B: Implementing YARA rules that focus solely on known malware signatures This approach would heighten detection rates for known threats but overlooks legitimate files that are misidentified as malicious. It does not address the root cause of the false positives, ultimately leading to continued alarm fatigue among security personnel.
C: Creating YARA rules to examine only the private database for intrusions This option narrows the scope of analysis and likely misses external threats that are not represented in the private database. An effective threat detection mechanism must consider a broader array of data sources to avoid blind spots.
D: Incorporating YARA rules to detect patterns in all files regardless of their nature Such a sweeping rule could overwhelm the IDS with alerts—some of which may be unrelated to actual threats —and exacerbate false positives. Without the precision of targeted rules, the effectiveness of the IDS could be substantially compromised.


Reference:

https://virustotal.github.io/yara/ https://www.blackhat.com/docs/eu-13/materials/eu-13-Riskin-Custom-IDS-Using-YARA-For-Malware-Detection-wp.pdf https://www.sans.org/white-papers/37171/



Jake, a network security specialist, is trying to prevent network-level session hijacking attacks in his company.
While studying different types of such attacks, he learns about a technique where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets.
Which of the following types of network-level session hijacking attacks is Jake studying?

  1. TCP/IP Hijacking
  2. RST Hijacking
  3. UDP Hijacking
  4. Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing

Answer(s): D

Explanation:

D: The Man-in-the-Middle Attack Using Forged ICMP and ARP Spoofing is correct because it explicitly involves inserting an attacker’s machine into the communication stream between a client and a server, giving the illusion that the data packets are flowing through an intended path.
The Man-in-the-Middle (MitM) attack provides an adversary access to the exchanged information between two parties without their knowledge. By using ARP spoofing, an attacker can mimic a legitimate device on the network, effectively rerouting traffic to themselves and enabling packet interception or manipulation. This practice is particularly insidious as it can occur over both wired and wireless networks, where the attacker impersonates network devices to intercept data. Forged ICMP packets can further facilitate communication hijacking by modifying or trapping traffic, thus exemplifying the nuanced nature of MitM attacks.
Why Other Options are Incorrect:

A: TCP/IP Hijacking : Although this method allows attackers to take over a session, it typically does not involve inserting themselves between two communicating parties in real-time. It generally exploits an existing connection rather than modifying ongoing communications.
B: RST Hijacking : This technique specifically involves sending forged TCP reset (RST) packets to terminate an existing session.
While it can disrupt communication, it does not inherently describe a method where the attacker actively intercepts and modifies the traffic flow between the two endpoints.
C: UDP Hijacking : This approach focuses on exploiting UDP packets, which are connectionless by design. It does not lend itself as effectively to session hijacking in the context of maintaining an established communication channel like TCP, making it less relevant in this specific scenario.
In summary, D encapsulates the characteristics and implications of the attack method described, while the other options fail to accurately represent the interception and manipulation of an existing communication stream.
References:
https://www.cisecurity.org/white-papers/the-truth-about-man-in-the-middle-attacks/ https://www.cisco.com/c/en/us/about/press/internet-protocols-and-security.html https://www.acs.com.hk/en/products/856/acr38-smart-card-reader/


Reference:

References:
https://www.cisecurity.org/white-papers/the-truth-about-man-in-the-middle-attacks/ https://www.cisco.com/c/en/us/about/press/internet-protocols-and-security.html https://www.acs.com.hk/en/products/856/acr38-smart-card-reader/



Given the complexities of an organization’s network infrastructure, a threat actor has exploited an unidentified vulnerability, leading to a major data breach. As a Certified Ethical Hacker (CEH). you are tasked with enhancing the organization's security stance. To ensure a comprehensive security defense, you recommend a certain security strategy.
Which of the following best represents the strategy you would likely suggest and why?

  1. Develop an in-depth Risk Management process, involving identification, assessment, treatment, tracking, and review of risks to control the potential effects on the organization.
  2. Establish a Defense-in-Depth strategy, incorporating multiple layers of security measures to increase the complexity and decrease the likelihood of a successful attack.
  3. Implement an Information Assurance (IA) policy focusing on ensuring the integrity, availability, confidentiality, and authenticity of information systems.
  4. Adopt a Continual/Adaptive Security Strategy involving ongoing prediction, prevention, detection, and response actions to ensure comprehensive computer network defense.

Answer(s): B

Explanation:

The establishment of a Defense-in-Depth strategy best addresses the complexities of an organization's infrastructure by providing multilayered security defenses.
Reasoning for Option B: A Defense-in-Depth approach is effective in thwarting sophisticated attacks by implementing multiple security controls at various layers, including physical, technical, and administrative measures. This strategy not only enhances the organization's resilience against diverse threats but also complicates the attacker's path to success, thereby reducing the likelihood of a data breach. Layers may include firewalls, intrusion detection systems, endpoint security, and employee training, collectively creating a robust security posture. Additionally, this strategy aligns with the "fail-safe" principle, wherein if one security control fails, others remain to protect critical assets.
Critique of Other Options:
Option A: While developing a comprehensive Risk Management process is essential for identifying and mitigating risks, it falls short of establishing immediate protective measures necessary for real-time defense. Risk management primarily focuses on assessment and treatment rather than active defense, which can lead to vulnerabilities being exploited before they are adequately addressed.
Option C: An Information Assurance policy is crucial for maintaining integrity, availability, confidentiality, and authenticity, but it lacks the proactive layers of protection. It predominantly addresses policy and procedural safeguards without implementing the multi-layered defense that can actively mitigate real-time threats.
Option D: An Adaptive Security Strategy emphasizes ongoing vigilance and response; however, it does not explicitly necessitate layered defenses that fundamentally complicate an attack vector. This strategy involves processes that are reactive in nature, which can leave vulnerabilities exposed if not coupled with preventive measures.
For these reasons, a Defense-in-Depth strategy represents the most effective and comprehensive approach to enhancing the organization's cybersecurity posture.
References:
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://www.isc2.org/News-and-Events/Blog/PostID/13644 https://www.cisa.gov/publications-library/architecture-defense-depth


Reference:

References:
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://www.isc2.org/News-and-Events/Blog/PostID/13644 https://www.cisa.gov/publications-library/architecture-defense-depth



As a cybersecurity professional, you are responsible for securing a high-traffic web application that uses MySQL as its backend database. Recently, there has been a surge of unauthorized login attempts, and you suspect that a seasoned black-hat hacker is behind them. This hacker has shown proficiency in SQL Injection and appears to be using the 'UNION' SQL keyword to trick the login process into returning additional data. However, your application’s security measures include filtering special characters in user inputs, a method usually effective against such attacks. In this challenging environment, if the hacker still intends to exploit this SQL Injection vulnerability, which strategy is he most likely to employ?

  1. The hacker tries to manipulate the 'UNION' keyword in such a way that it triggers a database error, potentially revealing valuable information about the database's structure.
  2. The hacker switches tactics and resorts to a 'time-based blind' SQL Injection attack, which would force the application to delay its response, thereby revealing information based on the duration of the delay.
  3. The hacker attempts to bypass the special character filter by encoding his malicious input, which could potentially enable him to successfully inject damaging SQL queries.
  4. The hacker alters his approach and injects a DROP TABLE' statement, a move that could potentially lead to the loss of vital data stored in the application's database.

Answer(s): C

Explanation:

C is correct because encoding malicious input is a common technique hackers use to bypass input filtering mechanisms that are designed to prevent SQL Injection attacks.
The ability to exploit SQL injection through encoding techniques, such as URL encoding or Unicode encoding, can allow hackers to mask their malicious payloads. Input filtering often operates on a whitelist basis, and if encoding is not thoroughly validated, the malicious code can bypass these filters. Hackers may also alter their payloads to use alternate character representations that the filtering logic does not recognize, making their attacks more effective.
Critical Evaluation of Other Options:

A: The strategy of manipulating the 'UNION' keyword to trigger a database error could potentially disclose schema information; however, seasoned hackers often prioritize gaining unauthorized access or data extraction rather than wasting time with error messages that have limited value. This method lacks the immediacy needed in a high-stakes environment.
B: Time-based blind SQL Injection is a valid tactic; however, it requires a more complex implementation and changes to the standard attack approach. In this context, where the hacker already exhibits proficiency with SQL Injection, they would likely opt for more direct methods like encoding to maximize efficiency and effectiveness.
D: Injecting a 'DROP TABLE' statement is an obvious destructive measure but does not align with the initial goal of unauthorized access. In scenarios focusing on data theft, generating such a catastrophic database change would often be counterproductive, as it could draw immediate attention and mitigate further exploitation.
In summary, option C encapsulates the adaptability and strategic thinking typical of proficient hackers, emphasizing a creative method to evade existing security measures while pursuing their objectives.
Authoritative References:
https://owasp.org/www-community/attacks/SQL_Injection https://cwe.mitre.org/data/definitions/89.html https://www.acs.com.hk/en/products/1216/acr39-nt-cryptographic-smart-card-reader/



You're the security manager for a tech company that uses a database to store sensitive customer data. You have implemented countermeasures against SQL injection attacks. Recently, you noticed some suspicious activities and suspect an attacker is using SQL injection techniques. The attacker is believed to use different forms of payloads in his SQL queries. In the case of a successful SQL injection attack, which of the following payloads would have the most significant impact?

  1. UNION SELECT NULL, NULL, NULL -- : This payload manipulates the UNION SQL operator, enabling the attacker to retrieve data from different database tables
  2. ' OR username LIKE '%': This payload uses the LIKE operator to search for a specific pattern in a column
  3. ' OR '1'='l: This payload manipulates the WHERE clause of an SQL statement, allowing the attacker to view unauthorized data
  4. ' OR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERE clause with a destructive action, causing data loss

Answer(s): D

Explanation:

D is correct because it combines an SQL injection attack that both manipulates data retrieval and executes a destructive command, leading to severe data loss.
The payload D (' OR 'a'='a; DROP TABLE members; --) illustrates a critical risk inherent in SQL injection vulnerabilities. This payload not only bypasses authentication checks through the tautology of the WHERE clause but also issues a command to drop a table from the database, which can result in irreversible data loss and operational disruption. The destructive nature of this command exemplifies the most significant impact an SQL injection attack can have, far surpassing merely unauthorized data retrieval.
In contrast, option A , UNION SELECT NULL, NULL, NULL --, allows data retrieval from different tables but does not cause immediate harm to the data structure itself.
While it poses a privacy risk, it lacks the immediate destructive capability. Option B , ' OR username LIKE '%' , utilizes pattern matching but similarly focuses on data access rather than destruction, representing less risk in critical contexts. Lastly, option C , '
OR '1'='1 , effectively manipulates authentication but is still limited to unauthorized data exposure, failing to demonstrate the potential for catastrophic consequences that D promotes.
In summary, option D combines exploitation and a destructive action, highlighting both the theft and the potential disruption of critical data systems, making it the option with the most severe consequences in a successful SQL injection attack.
References:
https://owasp.org/www-community/attacks/SQL_Injection https://www.securiteam.com/securityreviews/5LP0J1UQKA/payloads-sql-injection-attacks https://www.acunetix.com/vulnerability-scanner/sql-injection/


Reference:

References:
https://owasp.org/www-community/attacks/SQL_Injection https://www.securiteam.com/securityreviews/5LP0J1UQKA/payloads-sql-injection-attacks https://www.acunetix.com/vulnerability-scanner/sql-injection/



  PDF
Viewing page 18 of 133
Viewing questions 137 - 144 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!