You have been hired by a government agency to evaluate Android smartphones’ resistance against covert surveillance. During your assessment, you want to demonstrate whether attackers could eavesdrop on sensitive conversations conducted through the loudspeaker without special permissions by exploiting built-in smartphone sensors. Which specific attack technique should you implement to effectively demonstrate this privacy risk?
Answer(s): C
Answer(s): C – Spearphone attack exploiting accelerometer-based vulnerabilitiesTechnical fit for the scenarioThe attack leverages the phone’s built-in accelerometer (and sometimes other IMU sensors) to reconstruct sound waves emitted from the loudspeaker. By monitoring minute vibrations of the device chassis, an adversary can infer speech content without needing any special Android permissions beyond standard sensor access. This method precisely demonstrates a covert-listening risk where ambient conversations spoken through the speaker can be intercepted by a malicious app that only requires the ordinary android.permission.READ_ACCELEROMETER permission.Why it is the most appropriate choiceIt directly aligns with the objective of “eavesdropping on sensitive conversations via the loudspeaker without special permissions.” The technique is demonstrated in research (e.g., “Spearphone: Acoustic-Free Remote Speaker Identification”) and showcases a privacy breach that can be performed silently in the background. It is a realistic, permission-free vector that can be reproduced in a lab setting for a certification-level proof-of-concept.Why the other options are less suitableA – Tap ‘n Ghost (NFC/touchscreen) – Primarily exploits NFC or touchscreen UI flows; it does not provide a direct channel to capture audio from the speaker and generally requires interaction with system UI or payment-related components, which are not the focus of the scenario. B – Man-in-the-Disk (MITD) with app updates – Involves tampering with package installations or system updates; it requires elevated capabilities or user-initiated installation steps, and the attack vector does not inherently enable passive speaker-based eavesdropping. D – Malicious APK via Metasploit – This requires successful delivery and execution of a malicious payload, which typically needs user interaction or elevated privileges. It is a generic exploitation technique rather than a specific sensor-based covert listening attack, and it does not directly illustrate the speaker-eavesdropping privacy risk.
Spearphone Attack Paper (arXiv) – https://arxiv.org/abs/1809.06736 USENIX Security ’18 Presentation Slides – https://www.usenix.org/conference/usenixsecurity18/presentation/luThese documents provide detailed technical analyses and proof-of-concept implementations of the accelerometer-based speaker-eavesdropping attack.
You are a new IT intern at a local tech company. The company has a strong focus on cybersecurity and regularly hires ethical hackers to maintain its security posture. You come across the term ‘black box testing’ in a company document. Uncertain about its meaning, you decide to ask your supervisor. She explains that it refers to a type of testing in cybersecurity. In the context of ethical hacking, what is ‘black box testing’?
Answer(s): A
Technical justificationCorrect option – A – In ethical-hacking terminology, black-box testing describes an assessment where the tester begins with no prior knowledge of the internal architecture, credentials, source code, or configuration of the target. The tester treats the system as an opaque external adversary, interacting only with the visible interfaces (network endpoints, web pages, APIs, etc.) to discover vulnerabilities. This simulates a realistic threat actor who would not have insider information, making it the most accurate description of a black-box engagement.Why the other choices are less suitableB – Describes white-box (or glass-box) testing, where the tester possesses full internal knowledge (e.g., source code, network diagrams). This is the opposite of a black-box approach. C – While a black-box tester does interact only with inputs and outputs, the phrase “only knows the system’s inputs and outputs” is more typical of functional software testing and does not capture the essential characteristic of lack of any insider knowledge that defines a security-focused black-box penetration test. D – Refers to open-source reconnaissance or OSINT-only testing. Although information gathering is a prerequisite, black-box testing proceeds to active exploitation; limiting the test to publicly available data does not fulfill the definition of a black-box assessment.
EC-Council, Certified Ethical Hacker (CEH) v13 – Exam Blueprint, Section 2.1 “Penetration TestingMethodologies”. https://www.eccouncil.org/ceh-certification/ NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, Chapter 3 “Testing Methodologies”. https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final
An ethical hacker is auditing a hospital’s wireless network, which is currently secured with WPA encryption using TKIP. The hacker successfully demonstrates packet-injection and decryption attacks on the network. Which vulnerability in WPA most likely allowed these attacks to succeed?
Technical justificationCorrect option – C. Dependence on weak Initialization Vectors (IVs). WPA-TKIP was designed to overcome the weaknesses of WEP, but it still relies on the RC4 stream cipher with a relatively small IV space (48 bits). The original IV generation method re-uses values quickly, causing IV collisions and enabling replay attacks such as the Michael integrity attack. These predictable IV patterns make packet-injection and decryption feasible, which is exactly what was demonstrated in the audit.Why the other choices are less appropriate.A: Lack of AES-based encryption – While WPA-TKIP does not use AES, the attack succeeded before any AES consideration; the core flaw lies in the IV handling of RC4, not the cipher choice itself. B. Predictable group temporal key (GTK) – GTK protects multicast traffic, but the demonstrated attacks targeted unicast sessions and the vulnerability was not linked to GTK predictability. D. Dependence on weak passwords – WPA-Enterprise environments use strong authentication mechanisms; the exploit did not rely on password cracking, making this option irrelevant to the technical cause.Conclusion The success of packet-injection and decryption attacks against WPA-TKIP in this scenario is fundamentally tied to the weak IV design, which allowed repeated IVs and facilitated the classic RC4-related attacks.
https://www.cert.org/nic/resource/1269/ https://www.wi-fi.org/discover-wi-fi/security
As a security analyst, you’re investigating an incident where an attacker was able to gain access to your network. Upon initial examination of the log files, you noticed a large number of TCP SYN packets sent to various ports on the network but with no corresponding ACKs. What type of scanning technique do you think the attacker may have used?
Answer(s): D
Technical JustificationThe observed behavior – a flood of TCP SYN packets to many ports with no ACKs in the log – is characteristic of a SYN (half-open) scan . In a SYN scan the attacker sends a SYN, receives either a SYN-ACK (port open) or RST (port closed), and never completes the three-way handshake, thus leaving no ACK in the session log. Option D precisely describes this technique: “SYN scan, also known as half-open scanning, which involves sending SYN packets and waiting for SYN/ACK responses.”Why the other options are less appropriateA – SYN/ACK scan : This technique uses a SYN-ACK packet to probe a target; it is generally employed by privileged scanners to bypass certain firewall rules, but the description mentions tricking the firewall, not the lack of ACKs observed. Moreover, a SYN/ACK scan would elicit ACKs from the target, contrary to the log evidence. B – XMAS scan : An XMAS scan sets FIN, PSH, and URG flags to evade simple packet filters. It relies on receiving no response (or a reset) to infer port state, but the description focuses on determining open/closed ports via flag manipulation, not on the SYN-only pattern seen in the logs. C – TCP Connect scan : This scan completes the full three-way handshake (SYN → SYN-ACK → ACK) using the operating system's connect call. It would generate ACKs and complete connections, which would appear in the logs, unlike the half-open nature of the observed traffic.Therefore, the only option that aligns with a flood of SYN packets lacking ACKs is D – SYN scan .
Nmap Network Scanning – SYN Scan : https://nmap.org/book/man-scan-sy.html TCP/IP Illustrated, Volume I – TCP State Transition Diagram : https://www.tcpipguide.com/tcpip-illustrated.html (see Chapter 3, “TCP Internals”)
An organization uses SHA-256 for data integrity checks but is still experiencing unauthorized data modification. Which cryptographic tool can help resolve this issue?
Correct option: C – Digital signaturesWhy digital signatures solve the problemDigital signatures use asymmetric cryptography to bind a cryptographic hash (e.g., SHA-256) of the data to a signer’s private key, producing a signature that can be verified by anyone with the corresponding public key. The signature guarantees two properties: authenticity (the data originated from the holder of the private key) and integrity (any alteration of the data changes the hash and invalidates the signature). Because the signature is applied after the data is hashed, an unauthorized party cannot modify the data without being detected during verification, directly addressing the integrity-check bypass that SHA-256 alone cannot prevent.Why the other options are inappropriateA: Asymmetric encryption – Provides confidentiality and can also provide authentication, but it does not inherently verify data integrity; it encrypts the plaintext rather than creating a verifiable hash-based proof of unchanged content. B. Symmetric encryption – Secures confidentiality using shared keys, yet it does not supply a mechanism to detect tampering after decryption, nor does it bind a hash of the data to an identity in a way that can be independently verified. D. SSL/TLS certificates – Protect the channel of transmission and authenticate servers/clients, but they are not a tool for signing arbitrary data objects after creation; they secure communications, not post-generation integrity checks.Conclusion – Digital signatures specifically combine hashing (e.g., SHA-256) with asymmetric key technology to provide verifiable integrity and non-repudiation, making them the most suitable cryptographic tool to prevent unauthorized modification when integrity checks alone are insufficient.
National Institute of Standards and Technology (NIST). Digital Signature Standard (FIPS 186-4). https://doi.org/10.6028/NIST.FIPS.186-4 RSA Laboratories. PKCS#1 v2.2: RSA Encryption Standard. https://www.rfc-editor.org/rfc/rfc8017
In a comprehensive penetration testing scenario, you are charged with the task of gaining detailed insights into a target organization’s network configuration, structure, and security posture. To accomplish this task, you plan to employ a multitude of reconnaissance techniques, including an in-depth DNS interrogation. DNS interrogation can reveal various pieces of information that are invaluable to a penetration tester. However, there are certain limitations to the kind of data you can obtain directly through this method. Considering these restrictions, which among the following pieces of information CANNOT be directly obtained from an extensive DNS interrogation?
Answer(s): B
Why option B is the only item that cannot be obtained directly from DNS interrogationDNS queries only expose name-to-address mappings. By probing the organization’s DNS servers you can enumerate:IP addresses of mail servers (Option C). Subdomains under the primary domain (Option D). Reverse-lookup clues that may hint at geographic region (Option A).Credentials are never stored in DNS records.Username and password pairs are typically kept in directory services (e.g., Active Directory), applications, or configuration files, not in DNS. Even if a service accidentally publishes a credential in a TXT record, it would be an oversight, not a guaranteed or reliable source. Hence Option B (specific usernames and passwords) cannot be directly derived from DNS interrogation.Geolocation (Option A) can be inferred indirectly.While DNS itself provides only hostnames and IP addresses, correlating those IPs with public WHOIS or GeoIP databases yields a reasonable estimate of server location. This inference is possible, though less precise than a direct capability.Why the other options are feasible:Option C: Mail-exchange (MX) records are part of DNS and explicitly list the servers handling the organization’s email. Option D: Subdomains are discovered through enumeration of DNS zones (e.g., mail , ftp , dev sub-domains).Option A: IP blocks can be mapped to regions via external IP-to-location services, giving an estimated geographic location.Therefore, Option B is the only piece of information that DNS interrogation cannot directly reveal.
EC-Council Certified Ethical Hacker (CEH) v13 – Domain Enumeration & DNS Recon chapter. NIST Special Publication 800-115 – Technical Guide to Information Security Testing & Assessment (DNS methodology).
A corporation has transitioned to a public cloud service. The security team found a critical flaw in the API of the cloud service provider. What is the potential threat they are most likely to face?
JustificationC – Unauthorized access to cloud resources – An API vulnerability that exposes authentication, authorization, or input-validation logic can be directly exploited to bypass security controls and gain privileged access to cloud services (e.g., compute, storage, or management APIs). This is the most immediate and realistic threat when a cloud provider’s API is flawed, because attackers can enumerate resources, enumerate and manipulate data, or issue commands as legitimate users, leading to data exfiltration, service abuse, or lateral movement within the cloud environment.A – DDoS attack on cloud servers – While a maliciously crafted API request could be used as part of a DDoS amplification vector, the primary impact of an API flaw is not overwhelming network traffic but rather the breach of control mechanisms. DDoS attacks are more attributable to resource-exposure or mis-configured web front-ends rather than a specific API code defect.B – Compromise of encrypted data at rest – If the API flaw enables attackers to read or decrypt data, the underlying encryption may already be strong; the breach results from improper access control rather than a cryptographic break. Thus, the root cause is unauthorized access, and the “compromise of encrypted data at rest” is a downstream effect, not the primary threat inherent to the API defect.D – Vulnerability to physical security breaches – Physical security concerns the hardware and data-center premises, which are outside the scope of an API-level vulnerability. The risk here is unrelated to the software interface exposed over the network.Conclusion – The most likely and direct threat stemming from a critical API flaw in a cloud service is unauthorized access to cloud resources, making option C the best answer.
National Institute of Standards and Technology (NIST) – Special Publication 800-124A Rev. 1 : “Guide to Cloud Computing Security”. https://csrc.nist.gov/publications/detail/sp/800-124a/rev-1/final Cloud Security Alliance (CSA) – Security Guidance for Critical Areas of Focus in Cloud Computing (Version 4.0) : https://cloudsecurityalliance.org/research/csaguide/v4/
As a cybersecurity analyst at XYZ Corp., you’re examining system logs and notice an array of activities that suggest the presence of an elusive rootkit. Given the stealthy nature of rootkits, their detection and eradication are pivotal to maintaining system security and preventing data compromise. Assessing the system, you find the rootkit has been embedded deeply within the operating system kernel. In this critical situation, which strategy should you follow to remediate the rootkit effectively while minimizing potential damage?
Answer ExplanationOption C is the only response that aligns with best-practice incident handling for a kernel-level rootkit.1. Evidence-driven verification – A dedicated rootkit detection utility (e.g., OSSEC, chkrootkit, or vendor-specific forensic tools) confirms the presence, persistence mechanism, and type of the malicious code before any removal is attempted. 2. Tailored remediation – Once the exact rootkit variant is identified, the analyst can apply the appropriate cleanup steps (e.g., driver unload, kernel module removal, or system file restoration) rather than resorting to blunt, disruptive actions that may cause collateral damage. 3. Minimization of impact – By proceeding methodically, the analyst preserves evidence for post-incident forensics, maintains system stability, and avoids unnecessary service outages or data loss.Why the other options are unsuitableA – Full system reformat – While a clean reinstall guarantees removal of hidden components, it is an excessive measure that destroys user data, requires extensive redeployment, and does not address the root cause (e.g., compromised credentials or vulnerable services). It should be a last resort after all forensic options are exhausted. B – Power-down and network isolation – Stopping the host halts the rootkit’s activity but does not remediate the underlying infection. Moreover, shutting down may erase volatile evidence and impede forensic analysis, offering no long-term security benefit. D – Deploying high-interaction honeypots – Honeypots are proactive deception tools, not remediation tactics. In an active rootkit scenario, resource allocation to lure attackers diverts attention from immediate containment and eradication, prolonging exposure.Hence, the systematic, multi-layered approach described in Option C is the most effective, efficient, and professional course of action for rootkit remediation in a production environment.
National Institute of Standards and Technology (NIST) – Computer Security Incident Handling Guide (Special Publication 800-61r2): https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS Institute – Rootkit Detection and Response: https://www.sans.org/reading-room/whitepapers/malware/rootkit-detection-response-36923
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.