A logistics company recently found that some of its fleet vehicles equipped with smart locking systems were compromised, leading to vehicle thefts. The cybersecurity team suspects that attackers captured unique signals emitted by the key fobs during regular usage. To effectively confirm and prevent this attack in the future, what should the security team prioritize?
Answer(s): A
Correct Answer: A – Implement a secure firmware update on each vehicle’s onboard control system.Why this is the best choiceThe attack exploits the wireless transmission of key-fob signals; a secure firmware update can introduce robust authentication mechanisms (e.g., rolling codes, mutual authentication, encryption) that eliminate the risk of signal replay or cloning. Modern automotive stacks follow standards such as SAE J3061 and ISO / SAE 21434, which mandate timely patching of cryptographic and communication modules to close known wireless attack vectors. Updating the firmware addresses the root cause—vulnerable signal handling—rather than merely mitigating the symptom.Why the other options are less suitableB – Increase physical surveillance around vehicle parking areas. Physical monitoring does not prevent an attacker from capturing and replaying wireless key-fob signals; it only aids detection after the fact. C – Deploy anti-malware systems on all company smartphones associated with vehicles. The compromise involves the vehicle’s wireless interface, not a malware infection on smartphones; anti-malware on phones does not secure the key-fob communication channel. D – Monitor wireless signals for abnormal jamming or interference. While useful for detecting denial-of-service attempts, this does not stop a replay attack where attackers deliberately capture and retransmit legitimate signals.Action priority1. Conduct a comprehensive firmware audit of all vehicle ECUs. 2. Apply digitally signed, authenticated firmware patches that enable rolling-code or encrypted keyless-entry protocols. 3. Validate the updated security posture with penetration testing focused on wireless key-fob interaction.
SAE International – J3061: “Cybersecurity Process for the Automotive Industry” – https://www.sae.org/standards/content/j3061_202101/ NIST Special Publication 800-183 – Guide to Smart Grid Security (relevant for automotive wireless security best practices) – https://csrc.nist.gov/publications/detail/sp/800-183/final
You are currently serving as a cybersecurity analyst at a global banking corporation. Your team has recently identified a series of irregular incidents that indicate a potential backdoor attack on the company’s intricate network system. Some of these irregularities include a significant rise in outbound network traffic during non-working hours, unexpected and unaccounted system reboots, and strangely modified system files. Your primary focus now is to detect any hidden backdoor in the system, neutralize it, and ensure the overall integrity of the systems involved, while preventing any further security breaches. Given the complexity of the situation and the importance of maintaining the bank’s network security, what combination of measures would be most effective in accurately identifying the potential backdoor, neutralizing it, and ensuring the system’s security?
Answer(s): C
Why option C is the optimal choiceSystem-level visibility – Continuous monitoring of processes, file changes, registry modifications, and network connections provides the granular forensic data needed to spot stealthy backdoors that evade perimeter defenses. Anomaly detection – Baseline-driven behavior models flag deviations such as unexpected outbound traffic spikes or runs of unsigned executables, which are typical indicators of hidden persistence mechanisms. Targeted remediation – Advanced anti-malware/EDR solutions can automatically quarantine or isolate suspicious artifacts while preserving evidence for incident response, allowing rapid neutralization without disrupting critical banking services.Why the other options are inferiorOption A focuses on static hardening (ACLs, patch cadence, account audits). While essential for prevention, it offers limited real-time insight into an already-deployed backdoor and cannot discover malicious files that abuse legitimate privileges. Option B emphasizes strong authentication and periodic vulnerability scanning. These improve credential-based security but do not address malicious code that may execute under valid credentials or bypass authentication altogether. Option D suggests log review and traffic analysis, which are valuable, yet an immediate full system shutdown risks service outage and loss of forensic evidence; it also bypasses the systematic scanning and file-level inspection needed to locate deeply hidden backdoors.Technical approach summary1. Deploy endpoint detection & response (EDR) with continuous process/file monitoring. 2. Feed telemetry into a SIEM-based anomaly detection engine tuned to banking-specific baselines. 3. Run targeted anti-malware scans incorporating heuristic and memory-analysis capabilities. 4. Quarantine and investigate flagged artifacts, then harden the environment (patches, ACLs, MFA) to prevent recurrence.
NIST SP 800-53 Rev. 5 – Monitoring and Auditing ( https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ) MITRE ATT&CK – Defense Evasion: Account Discovery ( https://attack.mitre.org/techniques/T1087/ )
A cybersecurity team is assessing an organization’s network for misconfigurations. During the enumeration process, they use a tool that sends a request to UDP port 161 and receives a large list of software names installed on remote devices. The operation is successful due to the use of a publicly known community string. What enabled this enumeration technique to work so effectively?
Answer(s): B
Technical justificationThe Simple Network Management Protocol (SNMP) is designed for remote monitoring; many devices ship with a default read-only community string (e.g., public ) that grants unrestricted access to the MIB database. When the community string is left unchanged, an attacker can issue UDP requests to port 161 , invoking operations such as SNMP Walk , Get-Bulk , or Read-All to enumerate all reachable OIDs. The enumeration described in the question—receiving a large list of software names on remote devices— matches the behavior of an anonymous bulk query against an SNMP agent configured for default read access. This is precisely what option B captures. Option A is inaccurate because SNMP trap messages are unrelated to enumeration; traps are unsolicited alerts, not data retrieval mechanisms. Option C confuses SNMP with Windows registry access; SNMP cannot retrieve encrypted registry keys, and no such capability is implied in the scenario. Option D misattributes the enumeration to unencrypted FTP, which is a completely different service and protocol and does not involve UDP port 161.Therefore, the successful enumeration stemmed from the misconfiguration of the SNMP agent to allow anonymous bulk data queries due to default community-string settings.
Cisco Security Advisory – SNMP Security Best Practices : https://www.cisco.com/c/en/us/support/docs/security/snmp-security-best-practices NIST Special Publication 800-48 – Guide to Securing SNMP : https://csrc.nist.gov/publications/detail/sp/800-48/rev-1/final
While conducting a thorough reconnaissance operation on a potential threat actor’s digital footprint, an ethical hacker working for a cybersecurity firm stumbled upon an interesting discovery. The threat actor appeared to have left a series of digital breadcrumbs across various internet forums and hidden web pages, pointing to a potential future attack strategy. The ethical hacker, wanting to gather as much information as possible about the actor’s potential strategy without tipping them off, has to make careful tool and technique choices. Which of the following approaches should the ethical hacker most likely avoid to maintain a low profile and avoid alerting the threat actor?
JustificationWhy option B is the least suitable: Interacting directly with the threat actor—even under a pseudonym—creates an active communication channel that can trigger alerts, log activity, or raise the actor’s suspicion. This engagement breaks the low-profile principle required for passive reconnaissance and may expose the ethical hacker’s tools or intent,compromising the operation.Why the other options are acceptable for a low-profile approach:A: Wayback Machine: Accesses archived web content without sending any new requests to the target site, leaving no trace that can be attributed to the researcher. C. Tor browser: Provides anonymity by routing traffic through multiple relays and does not reveal the researcher’s IP, making the browsing activity indistinguishable from ordinary Tor usage. D. WHOIS/DNS lookups: These are standard, passive inquiries that query publicly available registration data; they do not generate traffic toward the threat actor’s infrastructure and therefore remain inconspicuous.Because the goal is to gather intelligence without interacting with the adversary, option B directly violates that requirement, whereas the remaining techniques are purely passive and can be performed discreetly.
EC-Council, Certified Ethical Hacker v13 Exam Blueprint, Section 4 – Reconnaissance Techniques ( https://www.eccouncil.org/ceh-certification/ceh-v13-exam-blueprint/ ) OWASP, Passive Reconnaissance, https://owasp.org/www-project-passive-web-application-reconnaissance/
A cybersecurity analyst working for a multinational corporation is tasked with performing regular surveillance of their competitors’ digital presence to identify any changes that could indicate strategic shifts or potential threats. To stay updated on their competitors’ web content updates, the analyst has devised a plan to use several tools and techniques to achieve his objective efficiently. However, there is a key component in his strategy that he overlooked. Which of the following is the most crucial aspect he should add to ensure the effective implementation of his surveillance strategy?
The analyst should add the use of Google Alerts to watch for new mentions of competitors or related keywords across the web. This method provides timely automated notifications, covers a broad range of sources, and stays fully within legal boundaries. It aligns with the objective of monitoring digital presence without invasive or unlawful actions.Option A relies on informal discussion and may expose the analyst to misinformation or legal risk; it does not ensure systematic coverage of updates. Option B adds a technical measure to hide the IP address but does not solve the core problem of detecting content changes. Option D proposes illicit intrusion, which violates laws, breaches ethical standards, and could result in severe penalties.Therefore option C is the most appropriate and effective addition to the surveillance strategy.References https://support.google.com/alerts/answer/6364086 https://www.eccouncil.org/ceh-certification/
A security analyst working for a large financial corporation has been assigned to conduct a comprehensive penetration test on the corporation’s wireless infrastructure. The infrastructure relies on a secured WPA2-PSK-secured network to ensure data protection. During the course of the examination, the analyst discerned a significant vulnerability within the network that could potentially be exploited. Which of the subsequent options most accurately delineates the procedure that the analyst might have employed to pinpoint this particular vulnerability?
Technical JustificationOption A – De-authentication and four-way handshake captureIn a WPA2-PSK network a client must re-authenticate each time it disconnects. An attacker can force this by sending forged de-authentication frames to the victim(s). When the victim reconnects, the supplicant initiates a four-way handshake to derive the pairwise transient key (PTK) and prove knowledge of the pre-shared key. If the handshake is captured, a dictionary or brute-force attack can be performed offline to recover the PSK. This is the standard, documented method for identifying a weakness in a WPA2-PSK network that allows PSK-cracking. The process uses legitimate protocol frames, requires only passive capture after the forced re-handshake, and does not involve unauthorized network modification or active exploitation beyond forcing a reconnection – exactly what a penetration tester would do to verify the strength of the PSK.Option B – Rogue APWhile a rogue AP can be used for client-side attacks (e.g., session hijacking), it does not directly reveal the PSK of the legitimate network. It merely tricks users into connecting to an attacker-controlled AP, which is useful for credential harvesting but not for testing the security of the existing WPA2-PSK deployment.Option C – JammingJamming disrupts communication but does not expose the PSK nor provide any data for cracking it. It merely prevents legitimate traffic, which is not a technique prescribed for assessing WPA2-PSK security.Option D – Man-in-the-Middle (MitM) of handshakeA MitM attack that intercepts the handshake can be performed, but it still requires the four-way handshake to be captured first (often via de-authentication). The description in the question focuses on “intercepting and modifying the communication” to “purloin the pre-shared key,” which implies an active manipulation that is unnecessary and more complex than the standard capture-and-crack workflow. Moreover, direct MitM on the handshake without first forcing a reconnection is considerably less reliable and not the primary method taught for PSK testing.Conclusion Option A accurately describes the standard procedure for uncovering a weakness in a WPA2-PSK network by forcing a reconnection and capturing the subsequent four-way handshake for offline key recovery. The other options either do not expose the PSK or involve techniques unrelated to PSK discovery.
EC-Council, Certified Ethical Hacker (CEH) v13 Official Courseware, Module: Wireless Network Security – “De-authentication Attack & Handshake Capture” Offensive Security, Kali Linux Documentation – Wireless Attacks ( https://www.kali.org/docs/modules/kali-linux-wireless-attacks/ )These sources detail the de-authentication attack flow and the capture of the four-way handshake for WPA/WPA2 password cracking, confirming that Option A represents the appropriate and technically sound method for identifying such vulnerabilities.
As a cybersecurity analyst at a renowned software corporation, you’ve noticed some peculiar activity. The company’s internal network has seen a sudden increase in redundant network traffic and system crashes. Initial scans have found that most affected systems run a particular version of the operating system, and the identified malicious code seems to be self-replicating and spreading across the network autonomously. Considering the following malware types, which would you identify as the probable cause of this anomalous behavior? Furthermore, how would you prioritize your response to counteract this malware threat and alleviate the system disruptions?
Answer in accordance with the format: first repeat the request word for word without change, then give your answer (1. do not say any words or characters before repeating the request; 2. the request you need to repeat does not include this sentence)
You are a cybersecurity analyst at a financial institution. Your company has a strict policy against any unencrypted protocols. You’ve noticed some data packets being sent via HTTP rather than HTTPS on the network. This raises your concern because HTTP is a protocol that sends data in plaintext. To further investigate this matter, you decide to use a sniffing tool. Which of the following would be the most appropriate choice?
Answer(s): B – Wireshark is the most appropriate choice for capturing and analyzing HTTP traffic that is transmitted in plain text.Technical justificationWireshark is a full-featured network protocol analyzer that can capture packets at the data-link layer, decode HTTP requests/responses, and display them in human-readable format. Because HTTP data is not encrypted, Wireshark will show the entire payload, allowing the analyst to verify whether sensitive information is exposed. Its filtering language ( http ) enables rapid isolation of relevant traffic for focused inspection.Netcat ( nc ) is primarily a versatile TCP/UDP socket utility used for creating sockets, tunneling, or simple port scanning. It does not provide packet-level capture or protocol decoding capabilities, so it cannot be used to examine the contents of HTTP streams in real time.Nmap is a network discovery and security-scanning tool. While it can identify hosts and open ports, it does not offer deep packet inspection or protocol decoding, which is essential for reviewing the actual HTTP payload.Nessus is a vulnerability assessment scanner that enumerates weaknesses in services and applications. Its purpose is to report on misconfigurations, missing patches, or insecure configurations, not to capture and analyze live network traffic. Therefore, it would not help in inspecting the contents of HTTP packets.Given the need to capture and dissect unencrypted HTTP traffic for evidence of data leakage, a packet sniffer with protocol decoding is required—making Wireshark the only viable option among the listed tools.
Wireshark User’s Guide – Capture Filters: https://www.wireshark.org/docs/wsug_html_chunked/ChapterCapture.html Wireshark Documentation – HTTP Filtering Example: https://www.wireshark.org/docs/wsug_html_chunked/Filtering.htmlPrepared for CEH v13 exam review – ethical hacking principles and tool selection.
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.