A red team operator is assessing the resilience of a corporate network’s authentication infrastructure. They input valid usernames with specifically structured guesses based on prior intel about naming conventions, such as birthdates or favorite sports teams. The guesses are tailored and automated with logic-based iterations. Which technique best describes this targeted approach?
Answer(s): A
Technical JustificationThe red-team operator performs targeted credential testing by feeding a custom-generated username list that incorporates known patterns (e.g., birthdates, team names) derived from intelligence. This approach utilizes logic-driven mutations of the base dictionary, reflecting a strategic pattern-based input rather than random or exhaustive enumeration. Therefore, it aligns precisely with option A – “Strategic pattern-based input using known logic.”Why the other options are unsuitableB – Combining fragments from two lists without rules: The operator relies on specific, rule-based mutations driven by intelligence, not an indiscriminate concatenation of fragments. C – Exhaustive character testing without context: The technique is not a brute-force “character-by-character” test; it is focused on intelligently crafted guesses, thus avoiding unnecessary exhaustive iteration. D – Watching users type their keys in public places: This describes a social-engineering observation method, unrelated to automated, logic-driven username generation.
MITRE ATT&CK® – Credential Access: Valid Accounts (T1078.004) – https://attack.mitre.org/techniques/T1078/004/ NIST SP 800-63B Revision 1 – Digital Identity Guidelines – https://pages.nist.gov/800-63-3/sp800-63b.html
An attacker performs DNS cache snooping using the dig command with the +norecurse flag against a known DNS server. The server returns NOERROR but provides no answer to the query. What does this most likely suggest?
Technical justificationWhat the command does – dig +norecurse <domain> forces the resolver to answer using only its local cache; it will never issue recursive queries to upstream servers. Expected response when data is cached – If the queried name is present in the cache, the server returns the cached record (an ANSWER section) with status NOERROR .Observed response – The server replies with NOERROR but supplies no records in the ANSWER section. This is the typical “cache miss” reply: the resolver knows the zone exists and can answer authoritatively, yet it has nothing stored locally. Interpretation – A cache miss implies that no recent client request for that name has been made , because otherwise the answer would already be cached. Hence the most plausible inference is that “no client from the DNS server’s network has recently accessed the domain.”Why the other choices are less suitableB: “The queried domain has expired and no longer exists.” An expired domain would normally cause the server to return NXDOMAIN (or a similar negative response), not NOERROR with an empty answer.C: “The DNS server failed to resolve the request.” A failure would typically produce an error status (e.g., FORMERR , SERVFAIL ) rather than the success status NOERROR .D: “The requested record was found in the cache and returned.” If the record were cached, the response would contain it in the ANSWER section; an empty answer contradicts this scenario.Therefore, option A aligns with the semantics of a NOERROR response lacking cached data.
Internet Systems Consortium (ISC) – BIND 9 Administrator Reference Manual: https://docs.isc.org/projects/bind9/en/v9.18.29ARM/ RFC 1035 (Domain Names – Implementation and Specification) – Section 4.2.2 “Response Codes”: https://tools.ietf.org/html/rfc1035#section-4.2.2
In her role as a cybersecurity analyst for an established technology firm, Maria is assigned a crucial task. She’s instructed to perform a thorough passive reconnaissance of a major competitor’s online environment to understand their digital strategies better. The challenge, however, is to gather as much relevant information as she can without directly interacting with the competitor’s systems or alerting them to her activities, to avoid any potential legal implications. Given these constraints and the sensitive nature of her assignment, which of the following tools or methods would be least appropriate and potentially risky for Maria to employ in her task?
Technical JustificationOption A – Intensive port scan against competitor’s public IP addresses Scanning open ports on a competitor’s live infrastructure is an active reconnaissance technique. It generates network traffic that can be logged by intrusion detection systems, firewalls, or the target’s security operations center. Such activity may trigger alerts, cause service degradation, and expose the scanner to legal liability under statutes such as the Computer Fraud and Abuse Act (CFAA) or the European Cybercrime Directive. Because the task explicitly requires passive, non-intrusive methods, an aggressive scan violates the privacy-preserving constraint and therefore is the least appropriate choice.Option B – Wayback Machine archival browsing The Wayback Machine stores only publicly indexed snapshots of web pages. Accessing these archives does not generate traffic toward the competitor’s servers and leaves no forensic footprint that could be traced back to the analyst. It satisfies the passive requirement and provides historical insight into the competitor’s public content evolution.Option C – Patent and public-record research Patent databases (e.g., USPTO, EPO) and public filings are openly accessible documents. Extracting technical disclosures is a legitimate, fully passive activity. It yields insight into the competitor’s innovation pipeline without interacting with any networked assets, making it both safe and highly relevant for strategic analysis.Option D – Monitoring public forums and social media Discussions on open platforms (e.g., Reddit, Twitter, industry forums) are publicly posted and indexed. Gathering intelligence from these sources requires only HTTP requests to publicly available endpoints and does not involve credential use or brute-force methods. It is a standard, ethical open-source intelligence (OSINT) technique aligned with the study’s passive constraints.Conclusion – Because Option A involves active probing of live network defenses, it is the only choice that introduces legal risk, potential detection, and a breach of the passive-only rule, making it the least appropriate and most risky method for Maria’s assignment.
https://www.worldwidewebsize.com/wayback (Wayback Machine overview) https://www.uspto.gov/patents (U.S. Patent and Trademark Office)
During a red team exercise, a certified ethical hacker (CEH) is working on exploiting a potential vulnerability in the target’s web server. The CEH has completed the information gathering and footprinting stages and mirrored the website for offline analysis. They have also discovered the server is prone to session hijacking. Which next step is most likely to be part of a successful attack methodology, keeping in mind the requirement to minimize the possibility of detection?
Answer(s): B
Why option B is the most appropriate next stepThe CEH has already built an offline mirror of the site, confirming a session-hijacking weakness. Minimizing detection requires actions that do not generate excessive traffic or leave obvious signatures on the live server. Hijacking an existing session allows the attacker to reuse a trusted authentication token and then modify server configuration files in-offline (or via the mirrored copy) before pushing any changes back, keeping the live system unaware of the intrusion. This approach stays within the footprint of a single authenticated request, avoiding the noisy scanning, injection payloads, or brute-force password attempts that generate repetitive logs and alerts.Why the other options are less suitableA – Automated vulnerability scanning – Scanners generate patterned requests, produce numerous log entries, and often trigger IDS/IPS signatures, making the activity highly detectable. C – SQL Injection for data extraction – Payloads are typically verbose; successful injections often require repeated attempts and can be logged as anomalous input, raising alarms. D – Direct brute-force password cracking – Tries many password guesses, resulting in a high volume of failed-login events that are clearly flagged by account-lockout or lockout-monitoring controls.Thus, reusing a captured session to stealthily alter configuration files best aligns with the goal of exploitation while evading detection.
EC-Council – Certified Ethical Hacker (CEH) v13 – Session Hijacking Overview – https://www.eccouncil.org/ceh-certification/session-hijacking/ OWASP – Session Fixation and Hijacking Mitigations – https://owasp.org/www-project-top-ten/2017/A2_2017-Session_Management_Failures/ (see “Session Fixation” and “Session Hijacking” sections)
A globally-operating bank recently encountered a severe security breach within its Android OS-based mobile banking application. Cybercriminals managed to exploit the bank’s Mobile Device Management (MDM) system and successfully carried out a series of remote commands, creating significant havoc. Upon thorough investigation of this incident, it emerged that the attackers might have leveraged the Android Debug Bridge (ADB) as a conduit for unauthorized access. As a Certified Ethical Hacker tasked with developing countermeasures to this issue, which action would you consider the most potent response in this situation?
Answer(s): C
Reasoning (structured)Option C directly mitigates the specific attack vector – the unrestricted use of Android Debug Bridge (ADB). By enforcing a policy that disables ADB by default and only permits it in tightly-controlled, audited environments, the attack surface is drastically reduced. This control is immediate, enforceable through mobile-device-management tools, and aligns with the principle of least privilege, making it the most effective counter-measure against the reported breach.Option A (updating the MDM) is important for general security hygiene but does not specifically prevent abuse of ADB; the MDM could be fully patched and still allow ADB to remain enabled, leaving the same vulnerability open.Option B (stronger authentication) enhances user identity verification, yet the breach originated from a system-level debugging channel, not from weak credentials. Improving authentication does not stop an attacker who already has remote execution capabilities via ADB.Option D (VPN for all transactions) protects data in transit but does not prevent the initial unauthorized execution of ADB commands. A VPN cannot block malicious ADB calls that occur locally on the device or within the trusted network.Therefore, Option C is the most potent response because it eliminates the exploitable service at its source, providing a decisive, targeted remediation that the other choices cannot match.
Android Debug Bridge (ADB) documentation – Android Developers: https://developer.android.com/studio/command-line/adb Android Security Best Practices – Android Developers: https://developer.android.com/guide/topics/security/best-practices (includes guidance on disabling debugging features in production)
As a cybersecurity consultant, you are helping a small startup strengthen its information security awareness. During an internal audit, an employee reports finding a USB drive labeled “Employee Salary Info 2024” in the company parking lot. Curious, they plugged it into their office computer, after which the system began behaving erratically. What kind of social engineering attack does this scenario represent?
Why the correct option is BThe attacker leaves a tempting physical artifact (“Employee Salary Info 2024”) that provokes curiosity. The victim voluntarily interacts with the item (plugs the USB into a workstation), thereby exposing the system to malicious code. This pattern is textbook “baiting” – a form of social engineering where the victim is lured into a security-compromising action by something that appears valuable or intriguing.Why the other choices are less appropriateA: Impersonating a senior staff member – Requires direct interaction (e.g., phone or email) where the attacker pretends to be a high-ranking colleague to harvest credentials. No such impersonation occurs here. C. Using a discarded document to retrieve sensitive corporate information – Refers to “dumpster diving” ; the attacker seeks to collect discarded paper or digital files, not to induce the victim to plug in a device. D. Attempt to bypass physical security by closely following an authorized employee – Describes tailgating or piggybacking , where an intruder gains access by trailing an authorized person. The scenario involves a USB drive left for curiosity, not a covert entry technique.Thus, the attack leverages curiosity to compel the victim to handle a malicious device , matching definition B .
Social Engineering – Baiting : SANS Security Awareness Training – “Baiting” Overview, https://www.sans.org/security-awareness-training/resources/baiting/ Social Engineering Attack Vectors : MITRE ATT&CK – “Social Engineering” techniques, https://attack.mitre.org/techniques/T1566/These sources confirm that the described behavior exemplifies baiting, a curiosity-driven social engineering tactic.
A major financial institution is experiencing persistent Denial-of-Service (DoS) attacks targeting its online banking services, causing significant disruption to customer transactions and eroding trust in the institution. The security team is under immense pressure to identify and mitigate the sophisticated tactics employed by the attackers to ensure uninterrupted access to banking services. Considering the scenario described, which sophisticated Denial-of-Service (DoS) technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially jeopardizing the availability of online banking services?
Answer(s): D
Justification for selecting option DNature of the attack – The scenario describes a sophisticated, scenario-based technique that directly jeopardizes the availability of the online banking portal. A zero-day exploit targeting the web-server software exploits an unpatched buffer-overflow vulnerability, allowing remote code execution and effectively shutting down the service. This aligns precisely with the described impact on transaction availability and trust.Detection difficulty – Zero-day exploits are unknown to vendors and security tools at the time of the attack.Signature-based IDS/IPS, behavioral analytics, and standard network monitoring rarely trigger because the exploit’s payload is novel and the vulnerability has no existing signature. Consequently, the attack can remain undetected for extended periods.Mitigation complexity – Patching a zero-day requires timely acquisition of a vendor fix, thorough testing, and coordinated deployment across the production environment. In a high-availability financial service, any downtime during patch rollout can exacerbate the outage, forcing the security team to balance rapid response against service continuity—an especially acute pressure in a financial institution.Why the other options are less suitableOption A – Layer-3 Smurf attack : While a Smurf attack can saturate bandwidth, it relies on broadcast ICMP echo requests and is largely mitigated by modern network configurations (e.g., disabling IP directed-broadcast). Its detection is relatively straightforward via ICMP traffic spikes, making it less “sophisticated” in the context of a persistent, targeted DoS. Option B – UDP flood on DNS servers : This attacks the DNS infrastructure, but DNS-related flooding can be filtered with rate-limiting, anycast, and scrubbing services. Moreover, DNS outages affect name resolution but generally do not directly cause the web-application layer outage described in the scenario. Option C – Distributed SQL injection : SQL injection primarily threatens data integrity and confidentiality rather than outright service availability. Even when crafted to cause resource exhaustion, its impact is usually limited to the database tier and can be mitigated with input validation, WAF rules, and query throttling, making it less disruptive to the overall online-banking service than a full web-server crash.Conclusion – Option D represents the most challenging DoS technique for detection and mitigation because it leverages a previously unknown vulnerability, enables remote code execution, and directly halts the primary customer-facing web service. Its sophistication, combined with the high stakes of banking availability, makes it the greatest threat to uninterrupted online banking operations.
NIST Computer Security Resource Center – Buffer Overflow : https://csrc.nist.gov/projects/vulnerability-management/guide-to-secure-software-development CVE Details – Remote Code Execution via Buffer Overflow : https://www.cvedetails.com/vulnerability-list/vendor/google/product-10279/buffer-overflow.html (example link for illustrative purposes; replace with a live CVE entry when citing a specific vulnerability).
At DEF Corporation, as you dive deeper into the vulnerability analysis of their multi-tiered web applications, you observe an anomaly. Some encrypted user session tokens appear to be much longer than others, hinting at possible variable encryption strength based on user roles. This inconsistency could expose certain user sessions, especially those with elevated privileges, to cryptographic attacks. Given the intricate nature of the system and the potential implications of a breach, what would be the most appropriate step to mitigate this specific vulnerability?
Technical JustificationRoot-cause analysis – Variable session-token lengths point directly to inconsistent cryptographic processing across user roles. This disparity creates a “weak” token class that can be enumerated, replayed, or downgraded, exposing privileged accounts to credential-theft attacks. The only way to eliminate this class of vulnerability is to enforce identical, strong encryption parameters for every token , regardless of role. Option A directly addresses the inconsistency by mandating a uniform encryption strength (e.g., fixed-length AES-256-GCM tokens). Standardizing the cipher suite, key size, and token length removes the attack surface created by weaker tokens and aligns the implementation with best-practice session-management controls (OWASP ASVS, NIST SP 800-57). Why the other options are less appropriateB (Key rotation) – Frequent key rotation mitigates key-reuse risk but does not resolve the underlying variable-length token issue; attackers can still exploit weaker tokens before rotation takes effect. C (Centralized logging/monitoring) – Useful for detecting anomalous access patterns after a breach, but it is a compensating control. It does not prevent the creation of weak tokens in the first place. D (MFA for privileged users) – Strengthens authentication, yet it does not affect the confidentiality or integrity of session tokens themselves; the cryptographic weakness remains exploitable.Conclusion – The most effective remediation is to standardize encryption across all token generations , ensuring every session token meets the same high-assurance cryptographic profile.
NIST SP 800-57 Part 1 Rev. 5 – “Recommendations for Key Management” https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/finalOWASP Application Security Verification Standard (ASVS) v4.0 – “Authentication and Session Management” https://owasp.org/www-project-application-security-verification-standard/
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.