support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 4 )

Updated On: 31-Jul-2026
Page 4 of 133
PDF with 1065 Questions

Harry, a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers. Using these techniques, he successfully deployed malware on the target system to establish an outbound connection.
What is the APT lifecycle phase that Harry is currently executing?

  1. Initial intrusion
  2. Persistence
  3. Cleanup
  4. Preparation

Answer(s): A

Explanation:

A is correct, as Harry is currently executing the initial intrusion phase of the Advanced Persistent Threat (APT) lifecycle.
During the initial intrusion phase, an attacker breaches the target network, often through techniques such as spear-phishing or exploiting vulnerabilities. Harry’s actions of sending spear-phishing emails and exploiting vulnerabilities on publicly available servers culminate in successfully deploying malware, which is characteristic of this phase. This phase is crucial as it represents the moment when the adversary establishes a foothold within the target environment, allowing for further malicious activity.
Critical Evaluation of Other Options:
B: Persistence : This phase follows initial intrusion and focuses on maintaining access within the compromised network. Harry is not yet engaged in activities aimed at establishing long-term access; instead, he is actively trying to gain entry.
C: Cleanup : This phase involves removing any traces of intrusion after the completion of the attack or when an attacker wants to cover their tracks. Since Harry has not yet completed his attack but is rather in the process of invading the system, this option does not apply.
D: Preparation : This phase precedes initial intrusion, involving reconnaissance and planning. Since Harry is already executing his attack, this is not the applicable phase; he has moved beyond preparation into active exploitation.
In summary, Harry is clearly in the initial intrusion phase, where he exploits vulnerabilities and deploys malware to establish a presence in the target network.
References:
https://www.csoonline.com/article/3533148/anatomy-of-a-cyber-attack.html https://www.cyclonecomputers.com.au/resource/introduction-to-the-advanced-persistent-threat-apt/ https://www.cybintsolutions.com/what-is-the-apt-lifecycle/#:~:text=The%20APT%20Lifecycle%20is%20an,attacker%20to%20achieve%20their%20objectives .


Reference:

References:
https://www.csoonline.com/article/3533148/anatomy-of-a-cyber-attack.html https://www.cyclonecomputers.com.au/resource/introduction-to-the-advanced-persistent-threat-apt/ https://www.cybintsolutions.com/what-is-the-apt-lifecycle/#:~:text=The%20APT%20Lifecycle%20is%20an,attacker%20to%20achieve%20their%20objectives .



Robin, a professional hacker, targeted an organization’s network to sniff all the traffic. During this process, Robin plugged in a rogue switch to an unused port in the LAN with a priority lower than any other switch in the network so that he could make it a root bridge that will later allow him to sniff all the traffic in the network.
What is the attack performed by Robin in the above scenario?

  1. ARP spoofing attack
  2. STP attack
  3. DNS poisoning attack
  4. VLAN hopping attack

Answer(s): B

Explanation:

B is correct because Robin performed a Spanning Tree Protocol (STP) attack by introducing a rogue switch to manipulate the network topology.
STP attacks exploit the inherent vulnerabilities of the Spanning Tree Protocol, which is designed to prevent loops in network topology by designating a single root bridge. By connecting a malicious switch with a lower bridge priority, Robin effectively becomes the root bridge, allowing him to intercept and analyze all network traffic traversing the switches. This manipulation of STP enables elevated monitoring capabilities that are detrimental to network security.
Evaluation of other options:

A: ARP Spoofing Attack : This technique involves sending falsified Address Resolution Protocol (ARP) messages over a local area network, associating the attacker's MAC address with the IP address of a legitimate host. However, it specifically targets IP-to-MAC address resolution rather than manipulating switch topology.
C: DNS Poisoning Attack : This attack alters DNS records to redirect users to fraudulent sites.
While dangerous, it does not pertain to traffic interception at the switch level, as it focuses on domain name resolution rather than network layer infrastructure.
D: VLAN Hopping Attack : This attack allows an attacker to send packets from one virtual LAN (VLAN) to another without a proper configuration. It does not involve the manipulation of the STP process and is limited to scenarios where VLANs are improperly configured, contrary to leveraging switch roles.
In conclusion, Robin's technique specifically leveraged STP vulnerabilities to gain unauthorized access to network traffic, making option B the only accurate choice.
References:
https://www.cisco.com/c/en/us/support/docs/ip/spanning-tree-protocol/13794-4.html https://www.sans.org/white-papers/37157/ https://www.varonis.com/blog/spanning-tree-attacks-explained/


Reference:

References:
https://www.cisco.com/c/en/us/support/docs/ip/spanning-tree-protocol/13794-4.html https://www.sans.org/white-papers/37157/ https://www.varonis.com/blog/spanning-tree-attacks-explained/



An attacker utilizes a Wi-Fi Pineapple to run an access point with a legitimate-looking SSID for a nearby business in order to capture the wireless password.
What kind of attack is this?

  1. MAC spoofing attack
  2. War driving attack
  3. Phishing attack
  4. Evil-twin attack

Answer(s): D

Explanation:

The correct answer is D: Evil-twin attack.
An evil-twin attack occurs when an attacker sets up a rogue access point that mimics a legitimate Wi-Fi network, tricking users into connecting to it. The Wi-Fi Pineapple operates in this capacity, as it enables an attacker to create a counterfeit SSID that closely resembles a trusted business network. Once users connect to this malicious access point, the attacker can intercept sensitive data, such as passwords, through man-in-the-middle techniques. This method exploits user trust, leading to unauthorized access and potential data breaches.
Evaluation of Incorrect Options:

A: MAC Spoofing Attack : This involves changing the source MAC address of a networking device.
While it can be part of the strategy to evade detection, it does not directly relate to capturing a wireless password via a rogue AP.
B: War Driving Attack : This refers to the practice of searching for Wi-Fi networks while in motion, typically focusing on network enumeration and mapping rather than impersonating a specific SSID to capture credentials.
C: Phishing Attack : Phishing usually entails deceitful communications meant to trick users into providing credentials or personal information. Although it shares objectives with evil-twin attacks, it typically involves the use of emails or fake webpages rather than unauthorized access points.
In conclusion, the nature of the evil-twin attack distinctly aligns with the described scenario involving the Wi-Fi Pineapple and its capability to impersonate legitimate networks.
References:
https://www.eccouncil.org https://www.cisecurity.org https://www.sans.org


Reference:

References:
https://www.eccouncil.org https://www.cisecurity.org https://www.sans.org



CyberTech Inc. recently experienced SQL injection attacks on its official website. The company appointed Bob, a security professional, to build and incorporate defensive strategies against such attacks. Bob adopted a practice whereby only a list of entities such as the data type, range, size, and value, which have been approved for secured access, is accepted.
What is the defensive technique employed by Bob in the above scenario?

  1. Whitelist validation
  2. Output encoding
  3. Blacklist validation
  4. Enforce least privileges

Answer(s): A

Explanation:

A: Whitelist validation is the correct choice because it allows only predefined acceptable inputs, effectively mitigating SQL injection threats by constraining user input.
Whitelist validation, in essence, employs a proactive approach to input validation by exclusively permitting data that meets specific criteria—such as data type, range, size, and value. This significantly reduces the attack surface for SQL injection exploits, as only sanitized and expected values are processed by the database, thus eliminating the risk posed by unexpected and potentially malicious inputs. In scenarios where SQL injection is a threat, adopting a whitelist model ensures that only legitimate requests are handled, effectively fortifying the integrity of the application.
Critical Evaluation of Other Options:
B: Output encoding: While output encoding is crucial for preventing reflected XSS attacks, it does not directly mitigate SQL injection vulnerabilities. It focuses on how data is rendered in the output layer rather than controlling what enters the database.
C: Blacklist validation: Blacklist strategies attempt to filter out known malicious patterns, but they are inherently flawed as attackers may evade detection by using novel encoding or payloads not covered by the blacklist. This approach may provide a false sense of security.
D: Enforce least privileges: Although this principle is vital for restricting user permissions, it does not address input validation directly. Least privilege concerns access control rather than the validation of input data that could lead to SQL injection attacks.
References:
1. https://owasp.org/www-community/OWASP_Secure_Coding_Practices 2. https://www.acunetix.com/blog/articles/sql-injection-defense/ 3. https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet


Reference:

References:
1. https://owasp.org/www-community/OWASP_Secure_Coding_Practices 2. https://www.acunetix.com/blog/articles/sql-injection-defense/ 3. https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet



Joe works as an IT administrator in an organization and has recently set up a cloud computing service for the organization. To implement this service, he reached out to a telecom company for providing Internet connectivity and transport services between the organization and the cloud service provider. In the NIST cloud deployment reference architecture, under which category does the telecom company fall in the above scenario?

  1. Cloud consumer
  2. Cloud broker
  3. Cloud auditor
  4. Cloud carrier

Answer(s): D

Explanation:

D is correct because the telecom company is responsible for providing connectivity and transport services between the organization and the cloud service provider, which aligns with the role of a cloud carrier in the NIST cloud deployment architecture.
In the context of NIST's definitions, the cloud carrier is an essential facilitator that provides the necessary telecommunications infrastructure to enable the cloud services to function effectively. The telecom company’s provision of Internet connectivity directly supports the operational delivery of cloud services, making it an indispensable part of the cloud infrastructure.
Evaluation of Other Options:

A: Cloud Consumer : This term describes the end-users or organizations that utilize cloud services. In this context, Joe, as the IT administrator, represents the cloud consumer, not the telecom company. The consumer is the party benefiting from the services rather than delivering connectivity.
B: Cloud Broker : A cloud broker is an entity that acts as an intermediary between cloud service providers and consumers, aggregating and managing multiple cloud services. In this scenario, the telecom company does not perform intermediary functions between the organization and the cloud service but instead provides the necessary connectivity.
C: Cloud Auditor : A cloud auditor assesses and evaluates the cloud service's efficiency, security, and compliance. The telecom company does not engage in auditing activities within the context provided; thus, this classification is inappropriate.
This distinction emphasizes that the telecom company functions primarily as a provider of connectivity, fitting neatly into the role of a cloud carrier.
For further insights into cloud roles and the NIST architecture, consider the following references:
1. https://csrc.nist.gov/publications/detail/sp/500-292/final 2. https://csrc.nist.gov/publications/detail/sp/800-145/final 3. https://www.nist.gov/system/files/documents/itl/cloud-computing/NIST-Cloud-Computing-
Reference-Architecture.pdf



Bobby, an attacker, targeted a user and decided to hijack and intercept all their wireless communications. He installed a fake communication tower between two authentic endpoints to mislead the victim. Bobby used this virtual tower to interrupt the data transmission between the user and real tower, attempting to hijack an active session. Upon receiving the user’s request, Bobby manipulated the traffic with the virtual tower and redirected the victim to a malicious website.
What is the attack performed by Bobby in the above scenario?

  1. aLTEr attack
  2. Jamming signal attack
  3. Wardriving
  4. KRACK attack

Answer(s): A

Explanation:

A: aLTEr attack is correct because it involves intercepting and manipulating wireless communications through a fake communication tower.
The aLTEr attack specifically targets mobile communications, exploiting the LTE protocol by creating a rogue base station that masquerades as a legitimate one. Bobby's setup of a virtual tower allows him to intercept and manipulate data in transit, effectively hijacking user sessions and redirecting them to malicious sources. This direct manipulation of mobile traffic through the deceptive infrastructure and the ability to capture sensitive data are hallmarks of the aLTEr methodology.
In contrast, the following options are incorrect:
B: Jamming signal attack : This method involves disrupting communications by broadcasting noise or interference, thereby denying any legitimate access rather than manipulating or hijacking established sessions, which is not the focus of Bobby's actions.
C: Wardriving : This refers to the act of searching for Wi-Fi networks while in motion, often mapping their locations for future attacks. Although it involves target discovery, it does not pertain to the active session hijacking described in the scenario.
D: KRACK attack : This vulnerability pertains to the infiltration of Wi-Fi Protected Access II (WPA2) networks, specifically targeting the four-way handshake process to decrypt traffic. However, it does not encompass the creation of a rogue communication point, as Bobby does.
For detailed insights, consider the provided references:
https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/ https://www.sciencedirect.com/science/article/pii/S1877050919318836 https://www.certifiedsecuritypros.com/cybersecurity/a-lter-attacks-explained/



John, a professional hacker, targeted an organization that uses LDAP for accessing distributed directory services. He used an automated tool to anonymously query the LDAP service for sensitive information such as usernames, addresses, departmental details, and server names to launch further attacks on the target organization.
What is the tool employed by John to gather information from the LDAP service?

  1. ike-scan
  2. Zabasearch
  3. JXplorer
  4. EarthExplorer

Answer(s): C

Explanation:

C is correct as JXplorer is a specialized tool designed for querying LDAP directories, facilitating the extraction of sensitive information.
JXplorer enables users to navigate and extract significant data from LDAP directories using a graphical interface. This tool is particularly useful for hackers like John, as it allows them to query LDAP services efficiently and identify crucial information such as usernames, addresses, and server details with minimal detection risk. The capabilities provided by JXplorer are well-suited for targeted information retrieval necessary for subsequent attacks.
Evaluation of Alternatives:

A: ike-scan : This is a tool specifically designed for scanning and discovering internet Key Exchange (IKE) services. It is not intended for LDAP queries, making it irrelevant in this context of directory service enumeration.
B: Zabasearch : While this is an online people search tool, it does not interface directly with LDAP services nor is it designed for automated querying of directory information related to network services. Its capabilities are limited to publicly available information, making it inadequate for the task at hand.
D: EarthExplorer : This tool is focused on accessing geospatial data from various sources and is unrelated to LDAP service queries. Its application does not extend to network services, thereby failing to meet the requirements of the scenario.
In conclusion, JXplorer's specific design for LDAP interactions substantiates its selection over the other tools,
which lack the necessary functionality pertinent to directory service exploitation.
References:
https://www.jxplorer.org https://www.hackerf0x.com/ldap-enumeration/ https://www.tenable.com/blog/ldap-enumeration-a-hacker-s-delight


Reference:

References:
https://www.jxplorer.org https://www.hackerf0x.com/ldap-enumeration/ https://www.tenable.com/blog/ldap-enumeration-a-hacker-s-delight



Annie, a cloud security engineer, uses the Docker architecture to employ a client/server model in the application she is working on. She utilizes a component that can process API requests and handle various Docker objects, such as containers, volumes, images, and networks.
What is the component of the Docker architecture used by Annie in the above scenario?

  1. Docker objects
  2. Docker daemon
  3. Docker client
  4. Docker registries

Answer(s): B

Explanation:

B is correct because the Docker daemon is responsible for managing Docker objects, processing API requests, and facilitating communication between the client and server components in a Docker architecture.
The Docker daemon operates in a server role, handling tasks such as building, running, and managing containers, which aligns with Annie’s requirements for processing API requests and managing various Docker elements. It serves as a centralized control unit, receiving commands from the Docker client and interacting with the underlying system components.
Critique of Other Options:

A: Docker Objects : This is an umbrella term for various entities within Docker such as containers, images, and networks, rather than a specific component. Therefore, it does not fulfill the role of processing requests or managing the system as a whole.
C: Docker Client : This acts as the interface through which users interact with Docker by sending commands to the Docker daemon. However, it does not directly manage or process API requests itself; instead, it relies on the daemon to execute these commands.
D: Docker Registries : These store and distribute Docker images.
While important in the Docker ecosystem, they do not play a role in processing API requests or managing Docker objects directly, which is the core function highlighted in Annie's scenario.
References:
https://docs.docker.com/engine/reference/commandline/dockerd/ https://docs.docker.com/engine/reference/commandline/cli/ https://docs.docker.com/engine/reference/architecture/


Reference:

References:
https://docs.docker.com/engine/reference/commandline/dockerd/ https://docs.docker.com/engine/reference/commandline/cli/ https://docs.docker.com/engine/reference/architecture/



  PDF
Viewing page 4 of 133
Viewing questions 25 - 32 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!