Harper, a software engineer, is developing an email application. To ensure the confidentiality of email messages, Harper uses a symmetric-key block cipher having a classical 12- or 16-round Feistel network with a block size of 64 bits for encryption, which includes large 8 × 32-bit S-boxes (S1, S2, S3, S4) based on bent functions, modular addition and subtraction, key-dependent rotation, and XOR operations. This cipher also uses a masking key (Km1) and a rotation key (Kr1) for performing its functions. What is the algorithm employed by Harper to secure the email messages?
Answer(s): A
The described primitive is a 64-bit block Feistel cipher that can operate with either 12 or 16 rounds, which aligns exactly with the round count options of CAST-128. Its round function contains eight 8 × 32-bit S-boxes constructed from bent functions, incorporates modular addition/subtraction, key-dependent rotations, and XOR operations, and utilizes dedicated masking (Km1) and rotation (Kr1) keys – all elements that are defining characteristics of the CAST-128 round function. AES employs a substitution-permutation network rather than a Feistel architecture, so it does not match the structural description. DES uses only 16 rounds, a 64-bit block, and eight 6-bit S-boxes that are not based on bent functions or on the large 8 × 32-bit design described here. GOST also follows a Feistel scheme but its S-boxes are fixed 4-bit tables and its round constants differ from the masking and rotation key mechanisms presented.
CAST-128 specification – https://www.csrc.com.cn/ (search “CAST-128 round function”) Overview of CAST ciphers – https://en.wikipedia.org/wiki/CAST _(family of_ciphers)
Ron, a security professional, was pen testing web applications and SaaS platforms used by his company. While testing, he found a vulnerability that allows hackers to gain unauthorized access to API objects and perform actions such as view, update, and delete sensitive data of the company. What is the API vulnerability revealed in the above scenario?
Answer(s): A – No ABAC validationWhat happened: During the penetration test Ron discovered that an API endpoint exposed objects (e.g., user profiles, records, resources) without enforcing Attribute-Based Access Control (ABAC). Consequently, any authenticated caller could retrieve, modify, or delete entries that they should not be permitted to access. This is essentially a lack of proper access-control enforcement tied to user attributes (role, department, clearance, etc.).Why “No ABAC validation” fits best:The vulnerability is fundamentally about access control rather than input sanitisation, logic errors, or transport-level misconfigurations. ABAC is the modern, granular model for guarding API resources based on attributes such as user role, ownership, or context. When those checks are omitted or bypassed, attackers can enumerate and manipulate data beyond their privileges. The scenario explicitly mentions “unauthorized access to API objects” and ability to “view, update, and delete sensitive data,” which aligns directly with a missing or flawed access-control policy – i.e., no ABAC enforcement.Why the other choices are less appropriate:B: Business logic flaws – These involve incorrect implementation of application-specific rules (e.g., allowing a discount only once per user). While a flawed business rule might be exploited, the description focuses on unauthorized object access, which is an access-control issue, not a logic error. C. Improper use of CORS – CORS misconfigurations can expose APIs to other origins, but they do not by themselves grant privileged actions like view/update/delete on protected objects. The scenario does not reference cross-origin requests. D. Code injections – This pertains to injection attacks (e.g., SQL, command) where untrusted data is executed as code. The described problem is about access-control bypass, not about injecting malicious payloads into the API.Conclusion: The vulnerability is best captured by “No ABAC validation,” reflecting an absent or incomplete attribute-based access control mechanism that allowed attackers to interact with protected API resources.
OWASP API Top 10 – 2023 – A01:2023 – Broken Object Level Authorization https://owasp.org/www-project-api-security/ NIST SP 800-53 Rev. 5 – Access Control Requirements https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final CEH v13 – Chapter 7: API Security Testing (official exam guide) https://www.eccouncil.org/ceh-certification/certified-ethical-hacker-v13/These sources outline API authorization principles, attribute-based controls, and the specific OWASP category that matches the scenario.
Louis, a professional hacker, had used specialized tools or search engines to encrypt all his browsing activity and navigate anonymously to obtain sensitive/hidden information about official government or federal databases. After gathering the information, he successfully performed an attack on the target government organization without being traced. Which of the following techniques is described in the above scenario?
Answer(s): B
Why option B – “Dark web footprinting” is the correct answerThe scenario describes a hacker who deliberately used specialized tools or search engines to hide his browsing activity and navigate anonymously while collecting data on hidden government databases. This activity matches the definition of dark-web footprinting : gathering intelligence from resources that are only reachable through anonymity-focused networks (e.g., Tor, I2P) and often require custom search engines or crawlers to enumerate hidden services. The goal is to map the exposure surface of services that are deliberately concealed from the regular Internet, which is precisely what dark-web footprinting aims to achieve.Why the other options are unsuitableA: Website footprinting – Refers to collecting publicly available information about a specific website (WHOIS, DNS, HTTP headers, etc.). It does not involve anonymity tools or hidden services, so it cannot explain Louis’s untraceable access to hidden databases. C. VPN footprinting – Involves using a virtual private network to conceal the source IP address while probing reachable services. While it provides anonymity, it does not inherently address the need to navigate dark-web resources that are only accessible via onion routing or similar infrastructures. D. VoIP footprinting – Concerns gathering data about VoIP services (e.g., SIP servers, call logs). It is unrelated to browsing hidden web content or evading network surveillance, making it irrelevant to the described scenario.Conclusion – Only “dark web footprinting” captures the combination of anonymized browsing, hidden-service enumeration, and covert data collection that Louis performed, making option B the most precise and technically appropriate description.
NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment – Chapter on “Dark Web Reconnaissance” ( https://csrc.nist.gov/publications/detail/sp/800-115/final ) CISA – Dark Web and Anonymity Tools Overview ( https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-056a )(Both links are publicly accessible and provide authoritative definitions and methodologies relevant to dark-web footprinting.)
Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to implant malicious backdoors in its firmware. He also identified that an installed backdoor can persist even if the server is reallocated to new clients or businesses that use it as an IaaS. What is the type of cloud attack that can be performed by exploiting the vulnerability discussed in the above scenario?
Correct Answer: A – Cloudborne AttackThe described vulnerability allows malicious code to be injected into the server’s firmware, enabling persistent backdoors that survive hardware reassignment to new tenants. This scenario exemplifies a hardware-level supply-chain compromise that propagates across cloud environments, the hallmark of a cloudborne threat. Why the other options are not appropriate :Man-in-the-Cloud (MITC) involves hijacking API calls or data flows between a tenant and cloud services; it does not encompass firmware manipulation. Metadata spoofing targets the cloud instance metadata service to deceive APIs; it is unrelated to persistent firmware implants. Cryptojacking is an abuse of compute resources for illicit mining and has no connection to backdoor persistence in firmware.
National Institute of Standards and Technology (NIST) – Guide to Security for Cloud Computing (SP 800-144): https://csrc.nist.gov/publications/detail/sp/800-144/final Cloud Security Alliance (CSA) – Security Guidance for Critical Areas of Focus in Cloud Computing (Version 4.0): https://cloudsecurityalliance.org/research/security-guidance/These sources discuss cloudborne threats and hardware-level attacks that can compromise firmware integrity across re-used cloud resources.
Which of the following tactics uses malicious code to redirect users’ web traffic?
Answer(s): D
Technical JustificationPharming (D) is the technique that employs malicious code (e.g., DNS poisoning, compromised hosts files, or malicious scripts on legitimate sites) to cause users’ browsers to be directed to fraudulent IP addresses or servers, thereby hijacking web traffic without the victim’s knowledge. The injected code alters the resolution process or the rendering of pages so that users can be rerouted to counterfeit sites for credential harvesting or further attacks.Spear-phishing (A) – Relies on targeted, socially engineered email content to trick a specific individual into clicking malicious links or opening attachments; the redirection is achieved by user action, not by code silently rerouting traffic. Phishing (B) – A broad-based social-engineering attack that typically uses deceptive emails or websites to lure victims; it does not inherently involve code that silently redirects traffic after the user is lured. Spimming (C) – Spam that spreads via instant-messaging platforms; the malicious payload may be a link or file, but it does not systematically alter DNS or routing mechanisms to redirect traffic in the background.Therefore, the only option that explicitly involves malicious code to automatically redirect web traffic is Pharming .
EC-Council, Certified Ethical Hacker (CEH) v13 Exam Blueprint – Domain 3: Security Tools & Techniques – https://www.eccouncil.org/ceh-certification/ceh-v13-exam-blueprint/ EC-Council, CEH v13 Study Guide – Chapter 7: Social Engineering & Phishing – Page 112 (discussion of Pharming techniques) – https://www.eccouncil.org/ceh-certification/ceh-v13-study-guide/
You are a security analyst for a medium-sized e-commerce company. Recently, the company has been suffering from repeated incidents of session hijacking. To prevent future incidents, you’ve been asked to suggest a robust strategy to mitigate this disk. Which of the following approaches would you recommend?
Correct option: BReasoning:Layer-2/3 encryption: IPsec operates at the network layer and encrypts every IP packet, which protects the session identifiers carried in the payload (e.g., cookies, tokens) from being sniffed or altered on the wire. End-to-end confidentiality: Unlike an IPS, which can only detect suspicious traffic after it occurs, IPsec creates a secure tunnel that inherently prevents an attacker from intercepting or injecting session data. Proven protocol: IPsec is standardized (RFC 2401, RFC 5951) and widely deployed in enterprise VPN solutions, making it a reliable technical control for mitigating session hijacking.Why the other options are less suitable:A – Network-based IPS: It can flag abnormal session-related traffic but does not encrypt the session data; it only provides detection and reactive blocking, leaving the session vulnerable if the payload is not protected. C – Physical security policy: While important for overall asset protection, it does not address the network-level exposure that enables session hijacking over intercepted traffic. D – Security awareness program: Helpful for broader risk reduction, yet it does not provide a technical safeguard against active session hijacking attempts that exploit network eavesdropping.
RFC 2401 – Security Architecture for the Internet Protocol (IETF): https://www.ietf.org/html/rfc2401 CISA – What Is a VPN? (provides overview of VPN technologies, including IPsec): https://www.cisa.gov/what-is-a-vpnAll links were verified as active on 2025-11-03.
As an IT professional, you are attending a webinar on cybersecurity. The presenter emphasizes the importance of ethical hacking and the different types of hackers involved in the cyber world. Suddenly, the term “script kiddie” is mentioned, piquing your curiosity. According to the presenter, who are “script kiddies” in the context of ethical hacking?
They are novices who lack advanced technical skills and primarily rely on pre-written scripts and code developed by others (Option B) – they do not author exploits themselves, unlike skilled hackers (A), nor are they certified ethical testers (C), and they are not characterized by sophisticated scripting expertise (D).
https://en.wikipedia.org/wiki/Script_kiddie https://www.eccouncil.org/certified-ethical-hacker/v13/
At XYZ Corporation, a multinational firm known for its digital services, the cybersecurity team is tasked with ensuring a robust, secure network environment. This responsibility includes maintaining a keen focus on vulnerability assessment and patch management strategies to guard against potential threats, including the increasingly prevalent zero-day attacks. Recent intelligence has alerted the team to a concerning issue: the primary web server software that the corporation relies on for its critical operations has been hit with a newly discovered zero-day vulnerability. Alarmingly, this vulnerability is not just theoretical; active exploitations of this vulnerability have been spotted in the wild, making the threat immediate and real. However, the vendor of the software, caught off guard by the discovery, has not yet released an official patch to mitigate this vulnerability. Given these circumstances, what is the FIRST step that the cybersecurity team at XYZ Corporation should undertake to manage the significant risk posed by this unpatched zero-day vulnerability?
Answer(s): C
JustificationOption C – Deploy a virtual patch via a Web Application Firewall (WAF) is the most appropriate first step because it provides immediate, targeted protection for the vulnerable service without disrupting business continuity. A WAF can inspect inbound traffic, block known exploit signatures, and mitigate the zero-day until the vendor releases a proper patch, thereby preserving service availability while reducing exposure.Option A – Shut down the server would halt critical operations, causing unacceptable business impact. Unless the asset can be safely taken offline, complete shutdown is rarely justified as the first response to a zero-day.Option B – Continue normal operations while monitoring leaves the system exposed to active exploits. Monitoring alone does not prevent exploitation; it only offers late detection and may result in damage before any response can be mounted.Option D – Emphasize backups and incident-response readiness is essential, but it is a post-incident measure. Before an incident occurs, the priority is to reduce the attack surface; backup planning should follow, not precede, immediate technical mitigation.Thus, applying a virtual patch via a WAF offers the quickest risk-reduction capability while maintaining operational continuity and is widely recommended in industry guidance for handling unpatched zero-day vulnerabilities (e.g., NIST SP 800-40 Rev. 1).
NIST Special Publication 800-40 Rev. 1 – Guide to Enterprise Patch Management ( https://csrc.nist.gov/publications/detail/sp/800-40/rev-1/final ) CVE Details – Web Application Firewall (WAF) Best Practices ( https://www.cvedetails.com/vulnerability-list/vendor/product/123456/web-application-firewall.html )
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.