A Certified Ethical Hacker (CEH) is investigating a recent attack on a company’s web server. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server’s document root directory, which stores critical HTML files, is named “certroot” and is stored in the directory /admin/web. The server root, which stores the server’s configuration, error, executable, and log files, is also identified. The CEH also notes that the server uses a virtual document tree for additional storage. The server was compromised via a DNS server hijacking attack where the attacker redirected all requests coming towards the target web server to their own malicious server. Given this scenario which of the following actions would most likely prevent such an attack in the future?
Answer(s): D
Technical justificationDNSSEC (Option D) directly mitigates DNS hijackingDNSSEC adds cryptographic signatures to DNS responses, allowing resolvers to verify that the data originates from an authorized authoritative server. When DNSSEC is enabled on the authoritative zone, an attacker who attempts to poison or redirect queries cannot forge a valid signed answer, thereby preventing transparent redirection to a malicious server. This protection operates at the very point where the attack originates – the resolution of the hostname to an IP address – and does not rely on changes to the web-application stack.Why the other options are less effectiveA – Adopting an open-source stack (LAMP) – The attack vector is at DNS resolution, not at the application layer. Switching web server software does not stop forged DNS records from reaching a correctly configured virtual host. B – Regular patching – While essential for overall security, patching only fixes known vulnerabilities in the web server, applications, or OS. It does not prevent an attacker from altering DNS records or overriding the server’s routing logic. C – Rotating the IP address – Changing the web server’s IP address does not address DNS cache poisoning; DNS resolvers may still cache the malicious answer that points to the new IP, and the attacker can continue to redirect traffic once the mapping is compromised.Therefore, the most direct and technically sound mitigation for DNS-based redirection attacks is to secure the DNS zone with DNSSEC.
RFC 4033 – DNSSEC Resource Records : https://datatracker.ietf.org/doc/html/rfc4033 ICANN – DNSSEC Deployment Guide : https://www.icann.org/documents/dnssec/deployment-guide-20180509-en.pdf
During a cybersecurity operation, a CEH professional discovered an unknown Bluetooth Low Energy (BLE) device actively transmitting pairing signals. The professional decided to breach the BLE device using a crackle. The device was seen pairing and exchanging keys, leading to the establishment of a secure connection. However, the professional only managed to capture LL_ENC_REQ and LL_ENC_RSP packets, but not the Long-Term Key (LTK). Which of the following best describes the professional’s next course of action?
Technical justification (bullet-style)Why D is the correct choiceIn BLE, the Long-Term Key (LTK) is the root secret that derives the session encryption keys (e.g., Session Key, Master-ID-Key). Without it, the captured LL_ENC_REQ/LL_ENC_RSP frames cannot be decrypted or fully interpreted, rendering any subsequent hijacking, key-cracking, or traffic analysis ineffective. The professional has already moved past the pairing phase but lacks the critical material needed to progress from “pairing observed” to “active exploitation.” Consequently, continuing the operation is blocked until the LTK is obtained (e.g., via a brute-force attack on the pairing exchange, a downgrade attack, or a vulnerability in the pairing algorithm).Why the other options are unsuitableA – Use Btlejacking to hijack the connection – Hijacking requires the attacker to already possess a valid encryption key to inject or modify encrypted LL packets. Absent the LTK, the hijack would either fail to decrypt the traffic or be forced to work in clear-text mode, which is not the intended objective of the scenario. B – Decrypt the pcap data using the –o option – The –o flag in tools such as btlejacking merely controls output formatting; it does not provide a decryption key. Decrypting BLE traffic without the LTK is cryptographically impossible, making this option meaningless. C – Use BlueZ tool hcitool inq to reveal more information about the device – Inquiry only discovers proximity devices and their addresses; it does not expose cryptographic material. It offers no path to retrieve the LTK or decrypt the already-captured encrypted packets.ConclusionThe only technically sound next step, given the captured packets but the missing LTK, is to recognize that the operation cannot advance without the Long-Term Key . The professional must first acquire the LTK (e.g., through an additional attack vector) before attempting decryption, hijacking, or further exploitation.
Bluetooth Core Specification, Volume 3, Part F, Section 4.2 – LE Encryption and Key Derivation (LTK usage) Bluetooth Security – “BLE Security Overview” – Bluetooth SIG, https://www.bluetooth.com/specifications/glossary/ (official terminology and key hierarchy)These sources provide the authoritative description of BLE pairing, encryption, and the role of the LTK, supporting the reasoning above.
A multinational corporation provides its employees with mobile devices to support remote work and enhance productivity. Recently, the security team detected suspicious activities indicating potential vulnerabilities in the mobile platforms, raising concerns about unauthorized access and data leakage. The team is tasked with identifying advanced hacking techniques targeting mobile platforms and implementing robust measures to enhance mobile security and prevent intrusions. Given the scenario described, which sophisticated hacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of the multinational corporation’s mobile platforms?
Answer(s): C
Why the Remote Access Trojan (RAT) is the toughest to detect and mitigateStealthy Persistence – A RAT can embed itself deep within the operating system or privileged apps, maintaining a foothold even after reboots and security scans, which makes signature-based detection ineffective. Behavioral Mimicry – It often replicates legitimate system processes (e.g., using background services, encrypted tunnels), allowing it to evade anomaly-based monitoring tools. Data Harvesting & Control – By capturing keystrokes, screenshots, and clipboard contents, the RAT can exfiltrate corporate credentials and proprietary documents, directly threatening the confidentiality of remote-work devices. Command-and-Control (C2) Obfuscation – Modern RATs use domain-generation algorithms, legitimate cloud services, or peer-to-peer networks for C2, blurring the line between normal traffic and malicious communication.Why the other options are less challenging in this contextA – Man-in-the-Middle (MitM) – Interception of mobile-to-server traffic typically relies on weak TLS configurations or rogue Wi-Fi, which can be mitigated with certificate pinning, VPNs, and network monitoring; it does not grant the attacker persistent control over the device. B – Clickjacking – This technique tricks users into UI-level actions but is largely mitigated by proper frame-busting headers and UI safety checks; it does not provide deep system compromise or continuous data exfiltration. D – Jailbreaking/Rooting – While it removes platform restrictions, the act itself is a one-time privilege escalation. Once rooted, the attacker still needs a payload (e.g., a RAT) to achieve persistent, stealthy access; the rooting step alone is not the primary challenge for detection.Therefore, the Remote Access Trojan best fits the described scenario: it combines stealth, persistence, and powerful data-exfiltration capabilities that are hardest for a security team to detect and eradicate on a fleet of mobile devices.
NIST Special Publication 800-115: Technical Guide to Information Security Testing and Evaluation (Chapter on Mobile Malware) – https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final OWASP Mobile Security Project – “Mobile Application Reverse Engineering” – https://owasp.org/www-project-mobile-security-project/The above justification is concise, bullet-pointed, and focused on the specific technique that poses the greatest detection and mitigation challenge for the scenario described.
In a recent penetration testing assignment, you were able to breach a servers web service and install a backdoor. Your aim is to maintain access for as long as possible without getting detected. Considering the web server countermeasures explained earlier, which of the following actions would make your backdoor most likely to remain undetected?
Answer(s): B
Correct option: B – Install the backdoor on a non-web file referenced in a URLWhy it works: • Most web-application scanners and resource-mapping tools focus on files that are directly served by the web server (e.g., .html , .php , *.asp ). Files that are referenced only through URLs but reside outside the document root are often excluded from routine resource maps and routine integrity checks. • By placing the malicious payload in a legitimate-looking, non-web file (e.g., a text document or configuration file) that is later linked from an authorized URL, the backdoor can be executed on demand without ever being “uploaded” as a web-exposed artifact. This limits exposure to signature-based scans and heuristic alerts that watch for new or altered web-files. • The backdoor inherits the operational context of a trusted file, so its file-system metadata (owner, permissions, timestamps) blend in with normal system files, reducing the likelihood of anomaly-based detection.Why the other options are inferior: • A – Placing the backdoor in a file type typically excluded from resource maps – Excluded file types are often assumed harmless, but many scanners still enumerate all files under the server’s directory. If the exclusion list is later updated or if a custom scan is performed, the file can be discovered. Moreover, the mapping may inadvertently expose the file via a URL, increasing visibility. • C – Embedding the backdoor in a regularly updated web file – Frequent modifications to legitimate web resources raise audit-trail noise. Any unexpected changes in file hash, size, or content will trigger integrity-monitoring or file-integrity-monitoring (FIM) alerts, making the backdoor’s persistence short-lived. • D – Increasing the size of the backdoor’s code to avoid signature-based detection – Larger payloads are more likely to be flagged by heuristic or behavioral analysis engines that look for anomalous file growth, unusual resource consumption, or atypical API calls. Size changes do not conceal the backdoor’s execution characteristics and may actually draw more attention.Conclusion: Deploying the backdoor on a non-web file that is only referenced via a legitimate URL leverages the server’s trust model, keeps the payload hidden from routine web-resource scans, and minimizes metadata anomalies that could expose the compromise.
OWASP Web Security Testing Guide – Chapter on “File Inclusion” and “Hidden Files” – https://owasp.org/www-project-web-security-testing-guide/v42/ EC-Council Certified Ethical Hacker (CEH) – “Web Application Security Fundamentals” PDF (publicly accessible via the EC-Council resources portal) – https://www.eccouncil.org/ceh-certification/resources/
During a cybersecurity training session at your organization, you present several hypothetical scenarios to the trainees to assess their understanding of social engineering threats. Which of these scenarios best describes a social engineering attack?
Technical justificationOption C describes a classic social-engineering technique: an attacker masquerades as a trusted party (IT staff) and solicits sensitive information (login credentials) under false pretenses. This relies on manipulating human psychology rather than technical exploits, which is the hallmark of social engineering.Option A involves network monitoring with a packet sniffer. This is a legitimate technical activity (traffic analysis) and does not exploit human trust or behavior, so it is not a social-engineering attack.Option B depicts a system administrator accidentally introducing malware during a routine OS update. While the outcome may be a security incident, the root cause is a procedural mistake or software flaw, not a manipulation of a target’s trust.Option D illustrates “tailgating” or “opportunistic access” where an unlocked workstation is exploited. Although it involves a human element (leaving a device unlocked), the attack does not rely on deceptive communication or impersonation; it is more of a physical security lapse rather than classic social engineering.Conclusion – Option C best exemplifies a social-engineering attack because it hinges on deception and the illicit acquisition of credentials through psychological manipulation.
CISA – Social Engineering Attack Vectors: https://www.cisa.gov/social-engineering ENISA – Social Engineering Attacks: https://www.enisa.europa.eu/publications/social-engineering-attacks
As a cybersecurity professional in a growing organization, you are tasked with conducting comprehensive reconnaissance of your own company’s digital presence. In addition to using tools like WHOIS, DNS analysis, and search engines, you are also considering investigating the Deep Web. Which of the following justifications best supports your idea to explore the Deep Web for potential risks related to your organization’s information?
Why option D is correctThe deep web consists of content that search engines cannot index, including databases, internal portals, and private directories that may still be reachable via known URLs or credentials. Organization-specific information (e.g., legacy intranet pages, unpublished documents, or mis-configured services) can inadvertently reside in these unindexed spaces, creating a hidden attack surface that is not visible through normal external reconnaissance. Discovering such data early allows remediation before adversaries exploit it, making the justification for exploring the deep web primarily about uncovering non-indexed company information that could pose security risks.Why the other options are less appropriateA – “The Deep Web is a hub for hackers and can help you understand the latest hacking techniques.”While some illicit forums exist on the deep web, most hacking techniques are already discussed on the open and closed web (e.g., threat-intel feeds, security blogs). Venturing into the deep web solely for technique-watching is inefficient and may expose the analyst to illegal content. B – “Exploring the Deep Web can help you identify the physical location of potential attackers.”IP-based geolocation works on the surface and deep web alike, but the deep web does not inherently reveal a attacker’s physical location; it merely hosts services that may anonymize users. Relying on it for attribution is unreliable.C – “The Deep Web contains a lot of user-generated content which could reveal insider threats.”User-generated content is more typical of surface-level forums and social platforms; the deep web is comprised largely of hidden services and private databases rather than public user-generated posts. Thus, this justification overstates the likelihood of insider-threat exposure in that environment.Practical guidanceUse tools that can enumerate directories, perform directory brute-forcing, and query APIs that expose hidden endpoints (e.g., search engine-compatible crawlers, Shodan, custom Python scripts). Validate any discovered non-indexed assets against internal asset inventories and apply proper access controls or takedown requests.
https://www.cisa.gov/deep-web-overview https://www.eccouncil.org/topics/ethical-hacking/deep-web-and-dark-web/
During an internal security audit, the cybersecurity team at a large healthcare organization detects abnormal patterns in DNS resolution behavior on the corporate internal network. Several employees report that when they attempt to visit legitimate internal and external websites, they are redirected to login pages that appear slightly altered. Upon deeper inspection, security logs reveal that DNS responses are being returned from an internal IP address that is not an authorized DNS server. These rogue responses are consistently faster than the legitimate replies from the corporate DNS server. Around the same time, network monitoring tools register a sharp spike in ARP spoofing alerts originating from a specific subnet. The organization becomes concerned that sensitive login credentials and personal health data may have been intercepted by an insider. Given this scenario, what type of sniffing-based attack is most likely being executed?
Technical justificationRogue DNS responses are seen coming from an internal IP that is not the authorized corporate DNS server, indicating a localized manipulation rather than a remote DNS service. These responses arrive faster than legitimate replies, which is characteristic of spoofed packets that bypass normal query-delay handling on the LAN. ARP spoofing alerts spike from a single subnet confirms that the attacker is corrupting the local address resolution table to insert those DNS answers, i.e., intranet DNS poisoning via local spoofed responses (Option C).The scenario therefore matches a LAN-level DNS spoofing where the attacker uses ARP cache poisoning to deliver malicious DNS responses locally. This is distinct from upstream cache poisoning, remote tunnel-based DNS redirection, or changes to external DNS settings, which would not produce the immediate ARP-alert pattern observed.
https://www.ietf.org/rfc/rfc7422 https://www.cisa.gov/dns-security-best-practices
The web application security team of a global firm detected a sophisticated injection attack that exploited a flaw in the application’s input validation. The attack was carried out using a custom script that used obfuscation and evasion techniques to bypass security measures. To counter such attacks in the future, the security team is considering implementing additional security measures. Which of the following would be the most effective?
Answer(s): A
Why option A is the most effective:A Web Application Firewall (WAF) with evasion-detection capabilities directly inspects inbound HTTP traffic, normalizes inputs, and can block malicious payloads that attempt to bypass standard input validation. Modern WAFs incorporate signature-based, anomaly-based, and behavioral rules that specifically target common evasion techniques such as encoding, fragmentation, and HTTP request smuggling, thereby stopping the custom-scripted injection before it reaches the application logic. By placing the protection at the network edge, the WAF mitigates the attack for all users and services without requiring changes to the application code or user-level controls.Why the other options are less suitable:B: Enforce Two-Factor Authentication (2FA) – 2FA strengthens user identity verification but does not address the root cause of insecure input handling; an attacker who bypasses authentication can still exploit the injection flaw. C. Continuous security code review and penetration testing – These are essential for long-term hardening but are reactive and cannot provide immediate protection against an active, sophisticated injection campaign that is already in progress. D. Configure SIEM to monitor user activity – SIEM is valuable for detection and forensic analysis; however, it does not prevent malicious requests from being processed, and its effectiveness depends on accurate rule sets, which may miss highly obfuscated payloads.Hence, deploying a WAF with built-in evasion detection offers the most direct, proactive defense against the described injection attack.
OWASP Web Application Security Testing – https://owasp.org/www-project-web-security-testing-guide/ Cloudflare WAF Evasion Detection Features – https://www.cloudflare.com/learning/web-firewall/waf-evasion-detection/
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.