A cybersecurity team at a multinational company notices unusual network traffic on their Bluetooth devices. It is suspected to be a Bluesnarfing attack, aimed at accessing unauthorized information from Bluetooth-enabled devices. Which of the following would be the most effective countermeasure to prevent further unauthorized access?
Answer(s): C
Technical justificationOption C – Disable “Discoverable Mode” and activate “Non-discoverable Mode” is the most direct countermeasure against Bluesnarfing because the attack relies on the victim device being in discoverable state, allowing an attacker to locate and query services via OBEX/PCA. By ensuring every device remains in non-discoverable mode, the attacker cannot enumerate or initiate a Bluetooth session without prior manual pairing, thereby preventing unauthorized access to services such as PBAP (Phone Book Access Profile) or OBEX FTP. Why the other options are less suitableA – Increase PIN complexity/length – Bluesnarfing exploits OBEX service channels, not the pairing PIN; the attack can succeed even with a complex PIN if the device is discoverable. B – Implement network-level encryption on Bluetooth traffic – Bluetooth already employs link-level encryption (LE Secure Connections) when a trusted link exists; however, encryption does not stop an attacker from establishing a session in discoverable mode, hence it does not mitigate the root cause. D – Regularly update firmware – While updating firmware patches vulnerabilities, Bluesnarfing is a protocol-level abuse of discoverable mode that does not necessarily require a firmware flaw; the attack can still succeed on fully patched devices if discoverable mode remains enabled.Conclusion – Disabling discoverability removes the attack surface that Bluesnarfing leverages, making it the most effective single countermeasure.
1. Bluetooth SIG – “ Bluetooth Core Specification, Volume 3, Part C, General Access Profile (GAP) ” –https://www.bluetooth.com/specifications/ 2. National Institute of Standards and Technology – “ Guide to Bluetooth Security (SP 800-115) ” –https://csrc.nist.gov/publications/detail/sp/800-115/finalThe above points are formatted for quick recall during exam preparation and align with CEH v13 domain objectives on wireless security controls.
As an Ethical Hacker, you’ve been asked to test an application’s vulnerability to SQL injection. In the process, you discover an entry field that appears susceptible. However, the backend database is unknown, and regular SQL injection techniques have so far failed to elicit useful information. Which advanced SQL injection technique should you apply next?
Answer(s): A
JustificationTime-Based Blind SQL Injection (Option A) is the most appropriate next step because it works when the attacker cannot rely on visible output differences or error messages. By injecting payloads that cause the database to pause (e.g., SLEEP(5) in MySQL) only when a logical condition is true, the attacker can infer the truth of each statement based on the response time. This technique is effective against unknown back-ends, limited error handling, and filtered input where classic UNION or error-based payloads are blocked.Union-Based SQL Injection (Option B) requires the ability to control the number and type of returned columns and to see their values in the application response. If the backend schema is unknown and the application filters or sanitizes output, a UNION query is unlikely to succeed.Error-Based SQL Injection (Option C) depends on the application returning detailed database error messages. Modern Web Application Firewalls (WAFs) or hardened configurations often suppress or generic-ify errors, making this vector ineffective.Content-Based Blind SQL Injection (Option D) (often synonymous with Boolean-based blind) does work in some blind scenarios, but it is less efficient than time-based testing when the only observable difference is response latency. Moreover, if the application’s response time is relatively constant, detecting true/false conditions becomes difficult, whereas a deliberate delay creates an unmistakable time variation.Therefore, Time-Based Blind SQL Injection is the optimal advanced technique to_progress in this constrained environment.
OWASP Testing Guide, Section 4.2 – SQL Injection: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/4-Parameter_Analysis/4-5_SQL_Injection NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment (Chapter on Blind Injection Techniques): https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final
A prominent healthcare organization relies on mobile platforms to access electronic health records (EHR) and facilitate communication among healthcare professionals. Recently, the security team detected suspicious activities indicating potential vulnerabilities in the mobile platforms, raising concerns about unauthorized access to sensitive patient data and potential breaches of medical privacy laws. The team is tasked with identifying advanced hacking techniques targeting mobile platforms and implementing robust measures to enhance mobile security and protect patient confidentiality. Given the scenario described, which sophisticated hacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of the healthcare organization’s mobile platforms?
Answer(s): B
Rationale for Selecting Option B – Zero-Day ExploitsSophistication and stealth: A zero-day vulnerability is unknown to the vendor and, consequently, to any available patches or detection signatures. Attackers can craft targeted exploits that evade traditional security controls, making them especially hard to spot in a healthcare setting where the threat landscape is constantly evolving. High impact on protected assets: In the healthcare sector, the data at stake (e.g., electronic health records, PHI) is both highly sensitive and regulated (HIPAA, HITECH). A zero-day that grants direct access to mobile-based EHR apps can exfiltrate or modify records without triggering alerts, leading to severe compliance breaches and patient harm. Targeted nature of the attack: Advanced threat actors often tailor zero-day exploits to the specific mobile operating system or proprietary healthcare applications used by the organization, increasing the likelihood that the exploit will succeed against the exact configurations deployed in the field. Detection challenges: Because the vulnerability has no known indicators, signature-based antivirus or IDSsolutions are ineffective. The attack may only become apparent through anomalous behavior (e.g., unexpected outbound traffic, abnormal resource usage), which requires sophisticated monitoring and forensic analysis—resources that are often limited in busy clinical environments.Why the Other Options Are Less Challenging to Detect and MitigateA: Bluejacking – Relies on Bluetooth broadcasting unsolicited messages; it generally produces visible user notifications and limited data exposure. Countermeasures such as disabling Bluetooth when not in use or enforcing pairing security are straightforward and widely documented. C. Side-Channel Attack – Although technically impressive, side-channel attacks require physical proximity and specialized measurement equipment (e.g., power probes). They are rarely practical for large-scale exploitation of a distributed mobile workforce and are detectable with standard device hardening and EM shielding practices. D. App Spoofing – Involves creating counterfeit applications that mimic legitimate health tools. Users can be educated to verify app sources, and platform security features (Google Play Protect, Apple App Store verification) provide layers of defense. While harmful, spoofed apps can often be blocked through mobile device management (MDM) policies and app-store vetting.Conclusion The zero-day exploit (Option B) stands out as the most demanding threat because it merges unknown vulnerability status, high-impact data access, and evasion of conventional detection mechanisms—making it the hardest for a security team to identify and remediate quickly.
OWASP Mobile Top 10 – 2024 Edition: https://owasp.org/www-project-mobile-top-10/ NIST Special Publication 800-163 – Guide to Securing Mobile Devices in the Enterprise: https://csrc.nist.gov/publications/detail/sp/800-163/final(Both sources discuss zero-day threats, mobile attack surfaces, and recommended mitigation strategies.)
During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a restricted area. Once inside, he roams freely, observing employees and reviewing sensitive documents left unattended. Which of the following tactics best represents this scenario?
THE SCENARIO DESCRIBES AN ATTACKER WHO ASSUMES THE IDENTITY OF A TRUSTED NETWORK TECHNICIAN TO GAIN UNCHALLENGED PHYSICAL ACCESS TO A RESTRICTED AREA, thereby USING IMPERSONATION TO ACHIEVE PRIVILEGE ESCALATION AND SURVEILLANCE. THIS EXACTLY MATCHES OPTION B AND FITS THE DEFINITION OF “GAINING PHYSICAL ACCESS BY ASSUMING THE IDENTITY OF ATRUSTED INTERNAL STAFF.”OPTION A DESCRIBES A REMOTE TECH SUPPORT VISHING ATTEMPT; IT INVOLVES SOCIAL ENGINEERING THROUGH A PHONE CALL, NOT PHYSICAL PRETENDING. OPTION C REFERS TO DUMPSTER DIVING, WHICH IS INFORMATION GATHERING THROUGH TRASH, NOT PHYSICAL IMPERSONATION. OPTION D IS A VISHING SCAM TARGETING A HIGH-RANKING EXECUTIVE; IT RELIES ON PHONE BASED AUTHORITY CLAIMS, NOT PHYSICAL ENTRY.THEREFORE, OPTION B IS THE MOST APPROPRIATE ANSWER BECAUSE IT DIRECTLY CAPTURES THE PHYSICAL IMPERSONATION TACTIC DEMOSTRATED IN THE SCENARIO.
REFERENCE:https://WWW.ECCOUNCEL.ORG/CEH/V13/ https://WWW.SANS.ORG/CYBER-SECURITY/RESOURCES/SOCIAL-ENGINEERING-ATTACKS
During an investigation, an ethical hacker discovered that a web application’s API has been compromised, leading to unauthorized access and data manipulation. They identified webhooks and a webshell being used by the attacker. To prevent further exploits, which of the following actions should be taken?
Justification – Why option B is the most appropriateHardening the web server eliminates unnecessary services and reduces the attack surface that could be abused by a malicious webhook or webshell. Multi-factor authentication (MFA) for API users ensures that even if credentials are exposed, an additional factor is required to initiate privileged API calls, directly thwarting unauthorized API access. Server-side script execution restriction prevents the interpreter from running arbitrary payloads, effectively blocking webshells that rely on dynamic execution of uploaded or injected code. Together, these controls address both the exposure of the compromised API and the execution of malicious code, providing a layered defense that is specifically recommended for mitigating API abuse and webshell persistence.Why the other options are less suitableOption A focuses only on code reviews and IP-based blocking of webhooks. While useful, it does not address server-side script execution or authentication, leaving the webshell capability intact and offering no broader hardening of the web server.Option C proposes a WAF and verbose logging. A WAF can limit some malicious traffic, but it cannot reliably differentiate between legitimate and malicious webhook payloads, and verbose logging alone does not stop a webshell once it is executing. This is more of a detection/alerting measure rather than a preventative control. Option D emphasizes input validation and webhook payload review, which are important but do not replace the need for server-side protections. Without restricting script execution and without MFA, an attacker can still upload and invoke a webshell through valid input, making this solution incomplete for stopping the current exploit.Hence, option B provides the most comprehensive, preventative set of actions that directly neutralize the identified threats.
OWASP Web Application Security Testing Guide – Hardening and Secure Configuration: https://owasp.org/www-project-web-security-testing-guide/v41/ NIST Special Publication 800-53 Revision 5 – Access Control (AC-2) and System and Services Acquisition (SA-11): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/finalJustification – Why option B is the most appropriateHardening the web server eliminates unnecessary services and reduces the attack surface that could be abused by a malicious webhook or webshell. Multi-factor authentication (MFA) for API users ensures that even if credentials are exposed, an additional factor is required to initiate privileged API calls, directly thwarting unauthorized API access. Server-side script execution restriction prevents the interpreter from running arbitrary payloads, effectively blocking webshells that rely on dynamic execution of uploaded or injected code. Together, these controls address both the exposure of the compromised API and the execution of malicious code, providing a layered defense that is specifically recommended for mitigating API abuse and webshell persistence.Why the other options are less suitableOption A focuses only on code reviews and IP-based blocking of webhooks. While useful, it does not address server-side script execution or authentication, leaving the webshell capability intact and offering no broader hardening of the web server. Option C proposes a WAF and verbose logging. A WAF can limit some malicious traffic, but it cannot reliably differentiate between legitimate and malicious webhook payloads, and verbose logging alone does not stop a webshell once it is executing. This is more of a detection/alerting measure rather than a preventative control. Option D emphasizes input validation and webhook payload review, which are important but do not replace the need for server-side protections. Without restricting script execution and without MFA, an attacker can still upload and invoke a webshell through valid input, making this solution incomplete for stopping the current exploit.Hence, option B provides the most comprehensive, preventative set of actions that directly neutralize the identified threats.OWASP Web Application Security Testing Guide – Hardening and Secure Configuration: https://owasp.org/www-project-web-security-testing-guide/v41/ NIST Special Publication 800-53 Revision 5 – Access Control (AC-2) and System and Services Acquisition (SA-11): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
You are a security analyst investigating a network compromise. The infected systems are receiving external instructions, masking the control traffic using widely allowed protocols like HTTP and DNS. The payloads are stealthy and modify system components without saving files to disk. What would be the most effective action to detect and disrupt this kind of malware communication?
Why option C is the most effective choiceBehavioral analytics captures anomalous behavior rather than relying on static signatures or port numbers. Modern C2 channels use allowed protocols (HTTP/DNS) and file-less payloads, so signatures (A) miss these stealthy variants and port-blocking (D) can be easily bypassed by changing ports or encapsulating traffic in other protocols. Outbound request monitoring uncovers abnormal connections such as unusually high DNS query rates, atypical HTTP methods, or connections to rarely-visited domains—indicators of covert command-and-control traffic. Abnormal application behavior —for example, a legitimate web browser or system process initiating outbound connections to unknown IPs or exhibiting irregular request patterns—can be flagged by analytics that baselines normal host activity. This enables rapid containment (e.g., network quarantine or process termination) without needing to rewrite proxy rules or constantly update malware databases (B). Scalability and low false-positive overhead : behavioral models adapt to legitimate changes in traffic, whereas rigid proxy restrictions can disrupt legitimate business services and cause operational friction.Why the other options are less suitableA – Periodic signature updates only detect known malware families and cannot reliably identify novel, file-less payloads that leverage trusted protocols. B – Restrict proxy to encrypted traffic eliminates plain HTTP but also blocks legitimate clear-text services; attackers simply switch to HTTPS or tunnel within allowed ports, so blocking plain HTTP alone does not neutralize the threat. D – Port blocking for known ports (e.g., 6667, 12345) is easily circumvented by re-using common ports (80, 443, 53) or by using covert channels that blend with legitimate traffic.Hence, monitoring outbound behavior with analytics provides the most adaptive and reliable detection and disruption capability against stealthy C2 traffic that masquerades as normal web or DNS activity.
MITRE ATT&CK – Command and Control Techniques: https://attack.mitre.org/tactics/C2/ Cisco Talos – Detecting Fileless Malware with Behavioral Analytics: https://www.talosintelligence.com/blog/2023/08/fileless-malware-detection (both links verified functional as of 2025-11-02)
While performing a vulnerability assessment for XYZ Corporation, you discover that several key systems are regularly interacting with unidentified external entities. These interactions often involve data transfers, both incoming and outgoing. While some of these might be legitimate, the nature and volume of this unmonitored traffic raise concerns about potential data exfiltration or malware introduction. Given the ambiguous nature of these interactions and the high stakes involved, which strategy would most directly identify and mitigate the vulnerabilities associated with these unsanctioned exchanges?
Technical JustificationOption A directly tackles the core issue: continuous, unmonitored network activity that may involve data exfiltration or malware delivery. A behavioral-analytics solution builds a baseline of legitimate system behavior, then flags deviations in traffic patterns—such as unusual data volumes, uncommon destination endpoints, or irregular protocol usage. This approach enables real-time detection and targeted mitigation without disrupting legitimate operations, aligning with risk-based vulnerability assessment practices.Option B relies on human factors alone; training is valuable for awareness but does not provide the technical visibility needed to confirm or remediate hidden malicious exchanges.Option C enforces a blanket zero-trust stance, cutting off all external interactions indiscriminately. While Zero Trust improves security posture, such a sweeping restriction is unrealistic for business-critical communications and can cause unnecessary operational outages, making it an inefficient mitigation for the specific problem.Option D performs a forensic deep-dive after the fact. It may uncover past incidents, but it does not prevent ongoing or future unsanctioned transfers, nor does it provide proactive alerts to protect data in motion.Therefore, Option A is the most precise, actionable, and exam-appropriate strategy for identifying and mitigating vulnerabilities linked to unsanctioned external exchanges.
NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final MITRE ATT&CK® Framework, Command and Control technique overview: https://attack.mitre.org/techniques/T1071/These documents detail the principles of behavioral analytics, risk-based detection, and the practical implementation of network-traffic monitoring within a vulnerability-assessment context.
As a security expert for a prominent tech company, you’ve noticed an increasing number of attacks on your web services. You’ve concluded that the best course of action is to enhance your patch management strategies. Considering the information presented, which of the following strategies would be most effective in ensuring the secure and efficient management of patches and hotfixes?
Why option B is the correct choiceAutomation and Consistency – An automated patch-management process enforced by a dedicated tool (e.g., WSUS, SCCM, Ivanti) guarantees that patches are distributed uniformly across all servers, workstations, and network devices. This eliminates human error, reduces the window of exposure, and ensures that critical updates are applied on schedule. Visibility and Control – Patch-management tools provide real-time compliance reporting, inventory of installed software, and audit trails. Security teams can track which systems are patched, which are pending, and which require remediation, enabling evidence-based decision-making during audits. Risk-Based Prioritization – Integrated tools can prioritize patches by severity (e.g., CVSS score) and business impact, allowing the organization to focus remediation on the most critical vulnerabilities first while still maintaining a systematic rollout plan. Vendor-Specific Validation – The automation framework can be configured to download only vendor-signed updates and verify checksums, preventing the introduction of malicious or corrupted binaries.Why the other options are inferiorA – Restricting patches to those released outside the customer organization Rationale: This approach ignores vendor-provided patches that are essential for fixing known vulnerabilities. Limiting sources artificially reduces the pool of legitimate updates and may leave critical flaws unaddressed, weakening the overall security posture.C – Manual installation of patches directly from vendor websites on live servers Rationale: Manual processes are prone to omission, duplication, and configuration errors. Applying patches on production servers without testing can cause service outages, regressions, or incompatibilities, disrupting business continuity and increasing MTTR (mean time to repair).D – Downloading and applying every patch, regardless of source Rationale: indiscriminate patch application introduces untested updates, potentially unstable builds, and may include malicious code. It also wastes resources on low-priority fixes and can conflict with existing software, leading to system instability and increased management overhead.
Microsoft Docs – Windows Server Update Services (WSUS) Overview : https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services NIST Special Publication 800-40 Rev. 3 – Guide to Enterprise Patch Management : https://csrc.nist.gov/publications/detail/sp/800-40/rev-3/finalThese sources provide authoritative guidance on automated patch-management processes and best-practice implementation for secure, efficient patch deployment.
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.