As a recent graduate, you’ve landed your first job as a junior cybersecurity analyst for a local company. Your team leader is explaining the different types of hackers and their motivations. He mentions the term “hacktivist”. According to the information you recall from your CEH v12 study material, which of the following best describes a hacktivist?
Answer(s): B
Why option B is correctA hacktivist is defined by the intent to advance a political, social, or ideological agenda rather than personal profit, curiosity, or employment-related duties. They employ their technical abilities to compromise or publicize vulnerable systems, often leaving overt messages that expose the cause they support. This aligns with CEH curriculum, which describes hacktivists as “technically skilled actors who conduct unauthorized attacks to promote a cause” (EC-Council, CEH v12 – Module on Threat Actors).Why the other options are less appropriateOption A – Accurately characterizes penetration testers or ethical security professionals, not hacktivists. Their work is authorized, systematic, and tied to remediation, not to activism. Option C – Describes script kiddies or curiosity-driven lone hackers; hacktivists are purpose-driven and typically organize collective campaigns, not act solely out of idle curiosity. Option D – Matches financially motivated cybercriminals (e.g., ransomware operators), whose primary driver is monetary gain rather than a sociopolitical message.
EC-Council, Certified Ethical Hacker v12 – Threat Actors Overview ( https://www.eccouncil.org/ceh-certification/ceh-v12/ ). CEH Official Study Guide, Chapter 4: “Threat Landscape & Actor Types” ( https://www.pearson.com/us/higher-education/program/EC-Council-CEH-Certified-Ethical-Hacker-v12-Study-Guide-9780134858321.html ).
As a certified ethical hacker, you have been tasked to exploit a security vulnerability on an Android device that uses the latest version of the OS. You found that there’s an unpatched weakness in the handling of user permissions in the device, but the device has a fully updated anti-virus application installed. What would be the most effective approach to exploit this vulnerability without being detected by the anti-virus application?
Answer(s): D
JustificationOption D – Develop a custom exploit code using obfuscationA bespoke payload can be handcrafted to interact only with the specific permission-checking flaw, minimizing the use of generic library calls that signature-based AV engines monitor. Obfuscation techniques (e.g., string encoding, control-flow flattening, runtime packing) change the binary footprint on each build, evading static and dynamic signature detection. Because the exploit can be compiled on-the-fly and executed in memory (e.g., via a malicious app’s loadLibrary or DexFile ), it leaves little forensic artifact for the AV to flag.Why the other options are less suitableA – SMS phishing – Relies on social engineering rather than a technical bypass; the AV can still block malicious payloads delivered via SMS, and the user-granting step is unpredictable. B – Rootkit deployment – Requires elevated privileges that the unpatched permission bug may not provide;rootkit installation typically creates persistent system-wide artifacts that are easily detected by modern AV. C – Metasploit framework – Uses well-known exploit modules and payload signatures that are explicitly part of AV blacklists; generic usage is readily flagged.Therefore, a custom, obfuscated exploit tailored to the specific permission-handling weakness offers the highest chance of successful exploitation while staying under the radar of an up-to-date anti-virus solution.
Android Permissions Documentation – developer.android.com/reference/AndroidManifest.permission Android Security Best Practices & Exploit Mitigations – source.android.com/security
As a Certified Ethical Hacker, you have been approached by a leading international corporation to assess and enhance their cloud-based security framework. The corporation recently transitioned to a serverless computing architecture for its e-commerce application and experienced significant improvements in scalability and cost efficiency. However, they fell victim to an intricate attack where an unauthorized user manipulated their cloud service’s function-as-a-service (FaaS) component to execute malicious commands. Your investigation revealed that the attack originated from an insecure third-party API used within one of the serverless functions. Given the attack’s complexity, what would be your recommended countermeasure for strengthening the security posture?
Justification – Why Option D is the optimal countermeasureTargeted enforcement at the FaaS boundary – The breach originated from a compromised third-party API that was invoked by a serverless function. Restricting the function’s runtime permissions to only the APIs it must call (e.g., allowing calls only to vetted endpoints) eliminates the indirect execution path that the attacker abused. This directly plugs the “function-level” gap exploited by the malicious call. Principle of least privilege (PoLP) compliance – By assigning the minimal set of IAM roles, network policies, and resource-level permissions to each function, any attempt to invoke an unauthorized external API is blocked at the point of execution. PoLP reduces the attack surface dramatically compared to a blanket “allow all” approach. Alignment with serverless security best practices – Modern serverless platforms (AWS Lambda, Azure Functions, GCP Cloud Functions) natively support granular permission scopes (e.g., resource-based policies, VPC-level filters, service-specific scopes). Implementing these scopes is considered the primary defense against supply-chain or API-abuse attacks in FaaS environments. Minimal performance impact – Enforcing function-level limits is an inline check performed by the platform during invocation; it imposes negligible latency compared to external policy enforcement layers that require every request to be inspected by a CASB or IDS.Why the other options are less suitableOption A – CASB : A CASB inspects traffic between a client and cloud services, providing visibility and policy enforcement at the network/transport level. While useful for data leakage prevention, it does not prevent a compromised function from invoking a malicious endpoint if the function already possesses the authority to do so. The root cause—excessive function permissions—remains unaddressed. Option B – Cloud-native security platform (CNSP) : CNSPs consolidate many security controls (CSPM, CIEM, workload protection) but typically operate at the resource or workload level, not granularly at the function-code execution boundary. Deploying a CNSP is valuable for holistic governance yet does not specifically resolve the insecure API call caused by overly permissive function permissions. Option C – Regular patching : Keeping functions up-to-date is essential for mitigating known library vulnerabilities, yet the attack in this scenario bypassed code-level flaws entirely; it leveraged a trusted function to call a rogue third-party API. Patching does not stop a function with legitimate execution rights from making an unauthorized outbound call.Conclusion – The most direct and effective remediation is to implement function-level permission controls and enforce the principle of least privilege , thereby eliminating the unauthorized path opened by the compromised third-party API call.
AWS Well-Architected Framework – Security Pillar (Function-level permissions): https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/privileged-access.html Microsoft Azure Functions – Secure execution with minimal permissions: https://learn.microsoft.com/azure/azure-functions/functions-security-concepts#function-permissions-and-networking
As a cybersecurity analyst, you were assigned the task of analyzing the traffic patterns of your company’s network. You started noticing irregularities that suggested a potential scanning attempt. The attacker appears to be quite sophisticated, operating slowly and meticulously, making it a challenge to detect or trace. Given the stealthiness of this approach, which of the following scenarios best describes the scanning technique the attacker might be using?
JustificationOption A – Sending FIN packets is indeed a stealthy way to probe closed ports, but it assumes the target behaves like a typical TCP/IP stack that replies with RST for closed ports and acknowledges the FIN. Modern intrusion-detection systems can normalise these responses, so while FIN scanning can be evasive, it is not the most effective technique when the attacker wants to remain undetected across all port states.Option B – Directly opening a TCP connection to every port (a full connect scan) is fast to identify open services but produces obvious SYN-ACK responses and generates a high volume of traffic, making it the least stealthy method. This approach would quickly trigger alerts on IDS/IPS and log entries.Option C – Sending packets with all flags (often referred to as “XMAS” or “NULL” scans) can elicit different replies from some legacy systems, but contemporary OSes typically treat these packets uniformly, and many security devices flag them as suspicious scan traffic. The technique offers limited reliability and is rarely used in sophisticated, low-volume scanning campaigns.Option D – Leveraging a compromised “zombie” or proxy host to launch the scan hides the true source IP, allowing the attacker to perform a slow, low-bandwidth scan while evading attribution. By distributing the traffic across multiple compromised assets and throttling the rate, the attacker minimizes detection risk and can maintain persistence, making this the most appropriate description of a stealthy scanning technique.Conclusion – The scenario that best fits a sophisticated, low-profile scanning activity is Option D , because it explicitly mentions using a zombie machine to obscure the scan’s origin, which aligns with the described stealth and difficulty of detection.
EC-Council Certified Ethical Hacker (CEH) v13 – Network Scanning Techniques – https://www.eccouncil.org/certified-ethical-hacker-ceh/v13/ Nmap User Guide – Stealth Scanning Options – https://nmap.org/book/stealth-scanning.html
You work as a network security officer for a large corporation. Recently, you’ve noticed that certain confidential files are being accessed by unauthorized users within the network. You suspect that a Man-in-the- Middle (MitM) attack is being carried out. Which of the following network activities would help you confirm this?
Answer Explanation – Why Option D is CorrectIP → MAC mismatch (Option D) A Man-in-the-Middle (MitM) attack often relies on ARP spoofing/poisoning, causing legitimate workstations to associate the same IP address with an attacker’s MAC address. That results in the same IP being resolved to multiple MAC addresses (or vice-versa), which is a clear indicator of ARP manipulation and a possible MitM intercept of traffic. Detecting such ARP inconsistencies directly confirms that an unauthorized device is positioning itself between communicating hosts and can be used to corroborate the suspected attack.Why the other options are less appropriateA – Sudden increase in network traffic – Traffic spikes can be caused by many legitimate events (e.g.,backups, software updates) and do not uniquely point to a MitM. B – Multiple login attempts from the same IP – This pattern is more indicative of brute-force or credential-stuffing attempts, not specifically MitM activity. C – Abnormal amounts of DNS requests – Excessive DNS queries may stem from mis-configured applications or caching issues, but they are not a distinctive signature of ARP-based MitM attacks.Conclusion: The detection of IP addresses mapped to multiple MAC addresses (Option D) provides the most direct technical evidence supporting the hypothesis of a Man-in-the-Middle attack within the network.
Cisco ARP Inspection – Troubleshooting Guide : https://www.cisco.com/c/en/us/support/security/asa-security-appliance/75559.html MITRE ATT&CK – ARP Spoofing : https://attack.mitre.org/techniques/T1550/ (accessed 2025)
A leading online retailer has been experiencing a series of security incidents involving unauthorized access to customer accounts and fraudulent transactions. Upon investigation, it is suspected that attackers are employing sophisticated session-hijacking techniques to compromise user sessions and carry out illicit activities. The security team is tasked with implementing robust measures to prevent further breaches and protect customer trust. Given the scenario described, which advanced session hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of online transactions on the retailer’s website?
JustificationOption D – Session Reuse Attack – This technique captures a legitimate session token (often encrypted or signed) and replays it against the server, allowing an attacker to bypass authentication and perform transactions as the legitimate user. Because the token is indistinguishable from a genuine request, detection relies on subtle anomalies such as timing, IP diversity, or token entropy, making it the hardest to spot and remediate among the listed methods.Option A – Clickjacking – While it can trick users into unintended actions, it primarily exploits UI overlay rather than directly hijacking an active session. Defense-in-depth mitigations (frame-busting headers, CSP) are straightforward to implement, so it is less challenging to detect.Option B – Credential Stuffing – This attack reuses leaked credentials rather than hijacking an existing authenticated session. It offers no stealth advantage; compromised credentials are quickly flagged by login-anomaly monitoring, making it easier to detect.Option C – CSRF – CSRF forces a browser to issue a state-changing request on behalf of the user, but it does not require session token reuse. Modern anti-CSRF tokens and SameSite cookie policies render it relatively easy to detect and block.Conclusion: The session replay attack (Option D) poses the greatest detection and mitigation challenge because it leverages a perfectly valid, already-authenticated session, evading most conventional security controls.
OWASP Testing Guide – Session Management ( https://owasp.org/www-project-web-security-testing-guide/v41/4-Testing-Guide/Sessions ) NIST Special Publication 800-63B – Digital Identity Guidelines ( https://csrc.nist.gov/publications/detail/sp/800-63b/rev-1/final )
As a cybersecurity analyst for a leading multinational company, you have unearthed evidence suggesting a breach. Analysis indicates that sophisticated steganography techniques are in play, allowing the hacker to exfiltrate data by cleverly embedding it within image files. Confronted with the deceptive nature of steganography and its potential implications, which course of action offers the best chance to detect and counteract this clandestine threat?
Answer(s): C
Answer AnalysisOption C – Engage a specialized steganalysis toolProvides targeted detection of hidden data within image files, employing signature-based and statistical analyses to uncover steganographic payloads. Allows the analyst to decode the embedded information, thereby exposing the exfiltration method, the data type, and possibly the attacker’s identity. Directly addresses the core challenge: identifying covert data that is intentionally concealed, which firewalls, IPS, or generic traffic monitors cannot reliably do.Why the other options are less suitableA: Robust firewall – Blocks traffic but cannot inspect the content of outbound streams for covertly encoded images; it merely impedes the flow, often driving the attacker to more covert channels. B. Intrusion Prevention System – Good at spotting known malicious signatures and anomalous behavior, yet most IPS signatures lack deep payload inspection of image metadata, limiting effectiveness against sophisticated steganography. D. Network traffic analyzer – Can highlight unusual volumes or patterns, but without specialized inspection of image files it cannot reveal hidden data or understand the exfiltration methodology.Conclusion – The only approach that directly solves the problem—detecting, decoding, and understanding steganographically embedded data—is to employ a dedicated steganalysis solution.
EC-Council | Certified Ethical Hacker (CEH) v13 – Steganography Overview: https://www.eccouncil.org/ceh-certification/steganography/ NIST Special Publication 800-53 Rev. 5 – “Communications Security” (Chapter on Data Exfiltration via Steganography): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
As a newly appointed cybersecurity analyst in a financial firm, you are tasked with performing network scanning to maintain the organization’s network security posture. You decide to conduct a SYN scan, sometimes referred to as half-open scanning, using a popular tool like Nmap. If you initiate a SYN scan against a target IP address and receive a SYN/ACK packet in response, how would you interpret this result?
JustificationWhen a SYN scan sends a SYN packet to a target port, the expected response for an open port is a SYN/ACK (synchronize/acknowledge). This indicates that the service on the port is listening and is ready to complete the TCP three-way handshake. Option C correctly interprets a SYN/ACK as “the scanned port on the target IP address is open,” because the receipt of SYN/ACK confirms that the host is accepting connections on that port.Why the other options are incorrectOption A – Incorrect. A SYN/ACK proves that the host replied, meaning the IP address is reachable; it does not indicate a failed attempt. Option B – Incorrect. A filtered port normally yields no response (or an ICMP/ firewalls may produce a RST/FIN/ICMP). Receiving a SYN/ACK shows that a response was generated, not that a filter is blocking it. Option D – Incorrect. If the port were closed, the typical response would be a RST-ACK (or just RST) packet, not a SYN/ACK. A SYN/ACK is the hallmark of an open port awaiting completion of the handshake.Conclusion The correct interpretation of receiving a SYN/ACK during a SYN scan is that the target port is open (Option C).
Nmap Reference Guide – Scan Types: SYN Scan ( https://nmap.org/book/man.html#tech-scan-syn ) TCP/IP Three-Way Handshake – Overview ( https://www.tcpipguide.com/tcptutorial/3_1.html )
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.