support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 19 )

Updated On: 31-Jul-2026
Page 19 of 133
PDF with 1065 Questions

A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for offline cracking. But the attacker was stopped before he could complete his attack. The system administrator needs to investigate and remediate the potential breach.
What should be the immediate step the system administrator takes?

  1. Perform a system reboot to clear the memory
  2. Delete the compromised user's account
  3. Change the NTLM password hash used to encrypt the ST
  4. Invalidate the TGS the attacker acquired

Answer(s): C

Explanation:

Correct Answer: C. Change the NTLM password hash used to encrypt the ST.
Changing the NTLM password hash is crucial because it directly mitigates the attack vector exploited during the Kerberoasting attack. The attacker has successfully obtained a Ticket Granting Service (TGS) ticket that can facilitate the generation of Service Tickets (ST). If the NTLM hash remains unchanged, the attacker could attempt to decrypt the ST offline, potentially gaining unauthorized access to sensitive resources. This action effectively severs the link between the compromised TGS ticket and the user's credentials, limiting the attacker's ability to leverage the stolen information.
Evaluation of Other Options:

A: Perform a system reboot to clear the memory – While this action might remove current memory artifacts, it does not address the core issue of retaining control over the compromised account. The attacker might retain access via the compromised ticket until the NTLM hash is changed.
B: Delete the compromised user's account – This step is drastic and may lead to further operational disruptions. Instead of deleting the account, altering the NTLM password hash allows continued legitimate use of the account while severing the attacker's access.
D: Invalidate the TGS the attacker acquired – Although invalidation can temporarily disrupt the attack, it does not nullify the risk associated with the user's password hash. The attacker could still exploit the system once the TGS tickets are regenerated without changing the underlying credentials.
Effective remediation always prioritizes safeguarding credentials over superficial fixes, ensuring that vulnerabilities are permanently addressed while maintaining operational integrity.
References:
https://www.microsoft.com/security/blog/2020/04/14/how-to-prevent-kerberoasting-in-active-directory/ https://www.csoonline.com/article/3058131/how-to-prevent-kerberoasting-what-cisos-need-to-know.html https://learn.microsoft.com/en-us/security/compass/kerberos-security-best-practices


Reference:

References:
https://www.microsoft.com/security/blog/2020/04/14/how-to-prevent-kerberoasting-in-active-directory/ https://www.csoonline.com/article/3058131/how-to-prevent-kerberoasting-what-cisos-need-to-know.html https://learn.microsoft.com/en-us/security/compass/kerberos-security-best-practices



You are a cybersecurity consultant for a healthcare organization that utilizes Internet of Medical Things (IoMT) devices, such as connected insulin pumps and heart rate monitors, to provide improved patientcare. Recently, the organization has been targeted by ransomware attacks.
While the IT infrastructure was unaffected due to robust security measures, they are worried that the IoMT devices could be potential entry points for future attacks.
What would be your main recommendation to protect these devices from such threats?

  1. Disable all wireless connectivity on IoMT devices.
  2. Regularly change the IP addresses of all IoMT devices.
  3. Use network segmentation to isolate IoMT devices from the main network.
  4. Implement multi-factor authentication for all IoMT devices.

Answer(s): C

Explanation:

C is correct because network segmentation creates a security barrier that limits the potential attack surface and restricts lateral movement within the organization’s infrastructure.
Network segmentation divides the broader network into isolated segments, thereby preventing compromised IoMT devices from gaining access to critical IT assets and sensitive data. This localized containment is essential for mitigating risks associated with IoMT devices, which may have inherent vulnerabilities due to limited processing capabilities and outdated firmware. By isolating these devices into a separate segment, security measures can be tailored specifically to the unique requirements and threats posed by IoMT technologies, thus enhancing overall resilience against ransomware and other attacks.
Critical Evaluation of Other Options:

A: Disable all wireless connectivity on IoMT devices.
While this may reduce the immediate attack vectors, it can hinder functionality and interoperability of devices. Many IoMT solutions rely on wireless connectivity for real-time data transmission essential for patient care. Complete disconnection may adversely impact their effectiveness.
B: Regularly change the IP addresses of all IoMT devices. Changing IP addresses may provide temporary obscurity, but it does not address fundamental vulnerabilities present in IoMT devices. Attackers can still gain access if security protocols are weak. This method is not sufficient as a standalone security measure and is more of an operational inconvenience than an effective strategy.
D: Implement multi-factor authentication for all IoMT devices.
While multi-factor authentication adds a layer of security, many IoMT devices may not support such features due to hardware limitations or lack of unified protocols across different devices. Without a robust foundational security architecture, relying solely on multi-factor authentication is insufficient for comprehensive protection.
In conclusion, while each alternative has merits under specific circumstances, network segmentation stands out as a holistic and practical approach for securing IoMT devices against evolving threats.
References:
https://www.cisco.com/c/en/us/solutions/internet-of-things/what-is-iot.html https://www.forbes.com/sites/bernardmarr/2021/01/02/the-3-biggest-cybersecurity-risks-to-internet-of-medical-things-devices/?sh=1615d5fcac5b https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7506495/


Reference:

References:
https://www.cisco.com/c/en/us/solutions/internet-of-things/what-is-iot.html https://www.forbes.com/sites/bernardmarr/2021/01/02/the-3-biggest-cybersecurity-risks-to-internet-of-medical-things-devices/?sh=1615d5fcac5b https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7506495/



You are a cybersecurity consultant for a global organization. The organization has adopted a Bring Your Own Device (BYOD)policy, but they have recently experienced a phishing incident where an employee's device was compromised. In the investigation, you discovered that the phishing attack occurred through a third-party email app that the employee had installed. Given the need to balance security and user autonomy under the BYOD policy, how should the organization mitigate the risk of such incidents? Moreover, consider a measure that would prevent similar attacks without overly restricting the use of personal devices.

  1. Provide employees with corporate-owned devices for work-related tasks.
  2. Require all employee devices to use a company-provided VPN for internet access.
  3. Implement a mobile device management solution that restricts the installation of non-approved applications.
  4. Conduct regular cybersecurity awareness training, focusing on phishing attacks.

Answer(s): D

Explanation:

D is correct because conducting regular cybersecurity awareness training empowers employees to recognize and defend against phishing attacks, thus enhancing the overall security framework without impeding individual autonomy.
Justification for Option D : Regular cybersecurity awareness training fosters a culture of security mindfulness among employees, equipping them with the knowledge to identify and report phishing attempts, even when using personal devices. This proactive approach addresses human factors in cybersecurity—often the weakest link— and can significantly reduce susceptibility to social engineering attacks.
Critique of Other Options :
Option A : Providing corporate-owned devices might ensure enhanced security but fails to address the practical realities of BYOD. Such an approach could lead to resistance, reduced employee productivity, and higher costs associated with purchasing and maintaining additional devices.
Option B : Requiring the use of a company-provided VPN can mitigate some risks; however, it does not fundamentally solve the problem of untrusted applications that could expose the organization to threats. Employees may still download malicious apps on their devices that circumvent VPN protections.
Option C : Implementing a mobile device management solution restricts installation of non-approved applications but can lead to employee dissatisfaction and a lack of engagement.
While this option provides a technical solution, it may inadvertently create friction between security policies and user autonomy, leading to non-compliance or attempts to circumvent controls.
In summary, training focuses on the human element in cybersecurity, while the other options either do not fully mitigate the risks associated with BYOD or may introduce new challenges.
Sources:
https://www.csoonline.com/article/3568139/how-to-create-an-effective-cybersecurity-training-program.html https://www.forbes.com/sites/bernardmarr/2020/02/17/the-importance-of-cybersecurity-awareness-training-in-the-modern-world/?sh=2f9627e8489c https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7351625/



XYZ company recently discovered a potential vulnerability on their network, originating from misconfigurations. It was found that some of their host servers had enabled debugging functions and unknown users were granted administrative permissions. As a Certified Ethical Hacker, what would be the most potent risk associated with this misconfiguration?

  1. An attacker may be able to inject a malicious DLL into the current running process
  2. Weak encryption might be allowing man-in-the-middle attacks, leading to data tampering
  3. Unauthorized users may perform privilege escalation using unnecessarily created accounts
  4. An attacker may carry out a Denial-of-Service assault draining the resources of the server in the process

Answer(s): C

Explanation:

C is correct because unauthorized users could exploit administrative permissions to escalate their privileges, gaining control over sensitive systems and data.
The misconfiguration of granting administrative permissions to unknown users is a critical security lapse. It directly enables unauthorized personnel to not only access sensitive resources but also manipulate configurations, potentially leading to significant data breaches or further exploitation. In such environments, privilege escalation becomes a tangible risk where users could leverage these permissions to execute arbitrary commands, tamper with data, or deploy malicious software without oversight. This issue underscores the necessity for strict access controls and regular audits of user permissions to mitigate risks.
Evaluation of Other Options:

A: An attacker may be able to inject a malicious DLL into the current running process: While DLL injection is a concern in environments with inadequate controls, the specific emphasis on misconfigured administrative permissions makes privilege escalation a more immediate and significant threat in this scenario.
B: Weak encryption might be allowing man-in-the-middle attacks, leading to data tampering: Although weak encryption poses serious threats to data integrity and confidentiality, this vulnerability does not relate to the identified misconfiguration of permissions or debugging functions, making it less relevant.
D: An attacker may carry out a Denial-of-Service assault draining the resources of the server in the process: While Denial-of-Service (DoS) attacks are damaging, the core problem of misconfigured permissions would primarily facilitate unauthorized access and privilege escalation rather than simply server resource exploitation.
References:
1. https://www.sans.org/white-papers/40383/ 2. https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html 3. https://www.nist.gov/itl/publications-initiatives/publications/800-53-revision-5-security-and-privacy-
controls-federal-information-systems-and-organizations


Reference:

References:
1. https://www.sans.org/white-papers/40383/ 2. https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html 3. https://www.nist.gov/itl/publications-initiatives/publications/800-53-revision-5-security-and-privacy-
controls-federal-information-systems-and-organizations



An organization suspects a persistent threat from a cybercriminal. They hire an ethical hacker, John, to evaluate their system security. John identifies several vulnerabilities and advises the organization on preventive measures. However, the organization has limited resources and opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability.
Which of the following statements best describes this scenario?

  1. The organization is at fault because it did not fix all identified vulnerabilities.
  2. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities.
  3. John is at fault because he did not emphasize the necessity of patching all vulnerabilities.
  4. The organization is not at fault because they used their resources as per their understanding.

Answer(s): A

Explanation:

A is correct because the organization failed to address all identified vulnerabilities, thereby exposing itself to risk.
The responsibility for securing an organization’s digital assets largely rests on its management, which must act upon the findings of security assessments. Ethical hackers like John provide critical insights into vulnerabilities; however, the organization's decision to prioritize only the most severe vulnerability demonstrates a lack of comprehensive risk management. The decision to leave other vulnerabilities unaddressed directly correlates with their subsequent breach, thereby establishing organizational fault.
Critique of Other Options:
B: This option implies shared responsibility, but it diminishes the primacy of the organization's role in vulnerability management.
While John’s advisory role is essential, the ultimate decision-making and prioritization of resource allocation lie with the organization. The organization's inaction on less severe vulnerabilities indicates a failure in their responsibility to ensure a holistic security posture.
C: This suggests John is solely at fault for inadequate communication, which overlooks the broader issue of organizational accountability.
While ethical hackers must emphasize the importance of addressing all vulnerabilities, John complied with the scope of his engagement and provided actionable insights. Ultimately, it was the organization's choice to disregard some vulnerabilities.
D: This downplays organizational accountability by framing resource utilization as sufficient justification for inadequate security. Understanding resources and making informed decisions based on risk assessments are part of the organization’s responsibilities. Neglecting identified vulnerabilities, regardless of resource limitations, reflects a failure in prioritizing security.
References:
1. https://www.isaca.org/resources/isaca-journal/issues/2019/volume-1/the-art-of-security-risk-
management 2. https://www.nist.gov/publications/security-and-risk-management 3. https://www.owasp.org/index.php/Risk_Management


Reference:

References:
1. https://www.isaca.org/resources/isaca-journal/issues/2019/volume-1/the-art-of-security-risk-
management 2. https://www.nist.gov/publications/security-and-risk-management 3. https://www.owasp.org/index.php/Risk_Management



An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?

  1. The SAM file has been encrypted using the SYSKEY function.
  2. The passwords exceeded 14 characters in length and therefore, the LM hashes were set to a “dummy" value.
  3. The Windows system is Vista or a later version, where LM hashes are disabled by default.
  4. The Windows system is using the Kerberos authentication protocol as the default method.

Answer(s): C

Explanation:

C is correct because Windows Vista and later versions have disabled the storage of LM hashes by default due to security concerns.
In Windows operating systems, Microsoft implemented security enhancements to mitigate vulnerabilities associated with the LM hashing algorithm. Starting from Windows Vista, the default configuration no longer generates LM hashes when user passwords exceed 14 characters, effectively nullifying the existence of LM hashes in the SAM file. This design choice aligns with a broader security posture to phase out outdated and insecure methodologies for managing password storage.
Evaluation of Other Options:

A: The SAM file has been encrypted using the SYSKEY function.
While SYSKEY does encrypt the SAM file, its primary focus is to secure the storage of user passwords, not specifically the existence of LM hashes. If the SAM file were encrypted, LM hashes would not appear as blank but rather would be inaccessible without the proper SYSKEY configuration.
B: The passwords exceeded 14 characters in length and therefore, the LM hashes were set to a “dummy" value. This option conflates the behavior regarding passwords.
While it is true that passwords exceeding 14 characters do not generate LM hashes, the accurate consequence of this is simply not generating any LM hash rather than being assigned a dummy value, leading to blank entries.
D: The Windows system is using the Kerberos authentication protocol as the default method.
While Kerberos is indeed a default authentication protocol in modern Windows systems, this option misrepresents the relationship between Kerberos and LM hashing. The presence of Kerberos does not influence the generation of LM hashes, which depend solely on the system's configuration regarding password lengths.


Reference:

https://docs.microsoft.com/en-us/windows/win32/seccrypto/ntlm " target="_blank"> https://docs.microsoft.com/en-us/windows/win32/seccrypto/ntlm https://www.csoonline.com/article/2874594/what-is-lm-hashing-and-why-should-you-care.html " target="_blank"> https://www.csoonline.com/article/2874594/what-is-lm-hashing-and-why-should-you-care.html https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/kerberos-authentication
" target="_blank"> https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/kerberos-authentication



A Certified Ethical Hacker (CEH) is given the task to perform an LDAP enumeration on a target system. The system is secured and accepts connections only on secure LDAP. The CEH uses Python for the enumeration process. After successfully installing LDAP and establishing a connection with the target, he attempts to fetch details like the domain name and naming context but is unable to receive the expected response. Considering the circumstances, which of the following is the most plausible reason for this situation?

  1. The system failed to establish a connection due to an incorrect port number.
  2. The enumeration process was blocked by the target system's intrusion detection system.
  3. The secure LDAP connection was not properly initialized due to a lack of 'use_ssl = True' in the server object creation.
  4. The Python version installed on the CEH's machine is incompatible with the Idap3 library.

Answer(s): C

Explanation:

C is correct because the secure LDAP connection likely failed due to improper initialization of the SSL settings within the Python code.
In secure LDAP (LDAPS), establishing a connection requires setting the parameter use_ssl=True in the creation of the LDAP server object, which ensures that the communication occurs over a secure channel. Failure to specify this parameter can result in an inability to retrieve directory information as the connection defaults to an insecure protocol, leading to potential failures in command execution.
Structural Evaluation of Incorrect Options:

A: Connector Issues: The system failed to establish a connection due to an incorrect port number.
While it is true that LDAPS typically operates on port 636, the question assumes a secure connection was established initially, hence this option does not explain the failure in fetching details after connection.
B: Intrusion Detection Systems (IDS): The enumeration process was blocked by the target system's intrusion detection system. If an IDS were actively blocking LDAP queries, there would likely be observable connection errors or timeouts rather than merely an inability to fetch specific details after a connection has been established.
D: Library Compatibility: The Python version installed on the CEH's machine is incompatible with the LDAP3 library. Incompatibility issues with the LDAP3 library would generally produce errors during the library calls or during the initialization process, not merely manifest as an inability to fetch data after a connection has been set up correctly.
References:
https://ldap.com/ldaps-ldap-over-ssl https://python-ldap.org/doc/html/ldap.html#ldap.initialize https://docs.python.org/3/library/ssl.html#ssl.SSLContext


Reference:

References:
https://ldap.com/ldaps-ldap-over-ssl https://python-ldap.org/doc/html/ldap.html#ldap.initialize https://docs.python.org/3/library/ssl.html#ssl.SSLContext



You are a cybersecurity consultant for a major airport that offers free Wi-Fi to travelers. The management is concerned about the possibility of "Evil Twin" attacks, where a malicious actor sets up a rogue access point that mimics the legitimate one. They are looking for a solution that would not significantly impact the user experience or require travelers to install additional software.
What is the most effective security measure you could recommend that fits these constraints, considering the airport's unique operational environment?

  1. Regularly change the SSID of the airport's Wi-Fi network
  2. Use MAC address filtering on the airport's Wi-Fi network
  3. Implement WPA3 encryption for the airport's Wi-Fi network
  4. Display a captive portal page that warns users about the possibility of Evil Twin attacks

Answer(s): C

Explanation:

C is correct because implementing WPA3 encryption significantly enhances security against "Evil Twin" attacks without disrupting user experience or requiring additional software installations.
WPA3 not only improves encryption through the Simultaneous Authentication of Equals (SAE) method, which offers more robust protection against offline dictionary attacks, but it also enhances security for open networks by supporting Opportunistic Wireless Encryption (OWE). This means that even if users connect to a rogue access point, data remains encrypted, mitigating potential exposure to eavesdropping.
Evaluation of Other Options:

A: Regularly changing the SSID: While changing the SSID might decrease predictability, it does not mitigate the fundamental risks tied to the actual connectivity of users to rogue networks. Users might still unknowingly connect to an "Evil Twin" if it possesses a similar SSID.
B: MAC address filtering: This approach is cumbersome and ineffective in large, dynamic environments like airports. Furthermore, MAC addresses can be spoofed easily, rendering this security measure unreliable against sophisticated attackers.
D: Displaying a captive portal: Although raising user awareness is valuable, it does not provide any technical safeguards. Users often bypass warnings, and the effectiveness of such a portal is subjective, failing to address the actual security vulnerabilities present.
In sum, WPA3 offers proven cryptographic improvements essential for secure wireless communication, making it the most effective countermeasure in this scenario.
https://www.wi-fi.org/discover-wi-fi/security https://www.cisco.com/c/en/us/products/collateral/security/wpa3-security/white-paper-c11-740652.html https://www.nist.gov/publications/wpa3-security-improvements-wireless-local-area-networks



  PDF
Viewing page 19 of 133
Viewing questions 145 - 152 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!