You are conducting a vulnerability assessment in a segmented internal network. When scanning a set of IPs using the nbtscan tool, you discover multiple devices responding with NetBIOS names, but only one of them has the entry in its response. What does this indicate about that specific host?
Answer(s): A
Why A is correctNBTSCAN sends NetBIOS name-query requests (type 0x20) and expects the target to return its NetBIOS name in the response.In a properly configured network, only the Domain Master Browser / Primary Domain Controller (PDC) returns a NetBIOS name when it receives a broadcast query and the query is answered by the host that owns the name; all other devices typically return “no name” or do not respond. Therefore, seeing a NetBIOS name in the scan output for a single host indicates that this host is the authority for that name—i.e., it is the domain master browser (or PDC that holds the naming information).Why the other options are less suitableB: Rogue DHCP server – DHCP and NetBIOS name queries are unrelated; a DHCP server does not affect NetBIOS name responses. C. Disabled NetBIOS over TCP/IP – If NetBIOS were disabled, the host would not return any NetBIOS name at all; it would not produce a name response that can be captured. D. Local system of the scanner – The scanner runs on its own workstation, but that machine’s NetBIOS name is not automatically echoed back when probing other hosts; only the queried host’s name should appear.Conclusion The presence of a NetBIOS name in the NBTSCAN output for a single IP is diagnostic of that IP being the domain master browser/PDC , which maintains the NetBIOS name registration authority.
Microsoft Docs – NetBIOS Name Resolution : https://learn.microsoft.com/en-us/windows-server/networking/name-resolution/netbios-name-resolution “NBTSCAN – NetBIOS Name Scanner” – Nmap Scripts : https://nmap.org/nsdb/api.html#nbtscan
A global media streaming platform is experiencing periodic traffic surges every 10 minutes, severely degrading performance and leading to widespread buffering issues. Traffic analysis reveals intermittent spikes exceeding 300 Gbps, followed by quiet intervals. The security team suspects the attacker is using a technique designed to disrupt services without maintaining a continuous flood. What type of DDoS attack best explains this scenario?
Answer(s): B
Technical Justification: The scenario describes periodic traffic surges every 10 minutes with high-volume bursts (300 Gbps) followed by quiet intervals, explicitly avoiding a continuous flood. This matches the Pulse Wave attack (Option B), which uses short, high-intensity bursts timed to exploit network resource scheduling or timeout mechanisms (e.g., overwhelming buffers during peak processing cycles). Such attacks avoid sustained traffic to evade detection while causing transient but severe resource exhaustion.Why other options are incorrect:Option A (Recursive HTTP GET flood) : Requires sustained traffic mimicking user behavior, not periodic bursts; would show consistent high volume, not 10-minute intervals.Option C (Permanent DoS) : Involves physical hardware destruction (e.g., firmware corruption), not traffic pattern-based resource exhaustion. Option D (UDP flood-sustained) : Relies on continuous high-volume UDP packets, contradicting the observed "quiet intervals" and periodic nature.
1. CISA. (2023). DDoS Attack Types and Mitigation Strategies. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-054a 2. Cloudflare. (2023). Pulse Wave Attack: Definition and Mitigation. https://blog.cloudflare.com/pulse-wave-attack/
You are a cybersecurity trainer and are planning a course on ethical hacking for some newcomers in your organization. While creating the content, you recall from the CEH vl2 study material that there are different types of penetration tests. Which of the following best describes a black box penetration test?
JustificationOption B – “The tester has no prior knowledge of the system to be tested.”This definition matches the classic black-box methodology: the assessor operates only with publicly observable information, mirroring the viewpoint of an external adversary who has no internal credentials or design details. It ensures that the test validates the organization’s external-facing security posture without any advantage derived from insider knowledge, making the findings most representative of a real-world attack.Option A – “The tester has some knowledge of the system… such as user IDs and passwords.”Describes a grey-box or partial-knowledge test. While useful for certain assessments, it does not meet the strict “no prior knowledge” requirement of a black-box scenario.Option C – “The tester is given a copy of the system to test so that the actual system remains unaffected.”Refers to sandbox or duplicate-environment testing, which is a safe-testing practice but does not define the knowledge scope. It can be applied to any test type, including black-box, but the description emphasizes environment isolation rather than tester knowledge.Option D – “The tester has complete knowledge of the system to be tested.”Represents a white-box (or full-knowledge) test. Here the assessor has internal documentation, source code, and privileged credentials, the opposite of a black-box approach.Therefore, Option B is the only choice that precisely encapsulates the defining characteristic of a black-box penetration test: the tester begins with zero insider information about the target.
EC-Council Official Courseware – Certified Ethical Hacker (CEH) v13 – Penetration Testing Methodologies: https://academy.ec-council.org/course/certified-ethical-hacker-ceh-v13 EC-Council Exam Blueprint – CEH v13 Domain 1: Ethics, Legals, and Professional Responsibilities (includes test type definitions): https://www.eccouncil.org/ceh-v13/ exam-Blueprint.pdf
You are a Certified Ethical Hacker hired by a financial institution to assess the robustness of its web application security. In your penetration testing, you are particularly focused on exploiting vulnerabilities related to session management mechanisms. The web application uses multi-factor authentication, encrypted cookies, and has well-configured web application firewalls. During your assessment, you identify several possibilities to compromise session management. Which of the following techniques would most effectively exploit a session management vulnerability while bypassing the application’s sophisticated security measures?
Answer(s): D
Why D ( Session Fixation ) is the most effective techniqueThe application already employs strong session-level defenses: multi-factor authentication, encrypted, HttpOnly and Secure cookies, and a Web Application Firewall. Under these conditions, classic attacks such as side-jacking (A) or CSRF (C) are largely mitigated by the encrypted Secure cookies and SameSite/Samesite-Lax settings, making it difficult to capture or reuse a valid session token without direct token leakage. An insecure deserialization exploitation (B) would require the attacker to influence the deserialization path of the server-side session object; while powerful, it typically demands deep knowledge of the server’s serialization format and may be blocked by the WAF or input-validation measures. Session fixation (D) bypasses these protections by forcing a victim’s existing session identifier to be replaced with one the attacker controls. Since the application’s session cookie is not regenerated after authentication, an attacker who previously obtains a valid session ID (e.g., through a predictable session-ID generation algorithm) can later trick the user into re-using that ID, effectively granting the attacker the same authenticated session. The attack works even when the session cookie is encrypted and protected, because the identifier itself is transmitted in the client-side state and can be set server-side prior to login. Consequently, session fixation directly subverts the session-management mechanism that the other techniques rely on, making it the most reliable method to achieve an authenticated session bypass in this scenario.Why the other options are less suitableA – Session Sidejacking : The encrypted Secure and HttpOnly cookies, combined with TLS and possibleSameSite attributes, prevent an attacker from simply capturing a token from the network or client storage. B – Insecure Deserialization : Exploiting deserialization generally yields code execution, but it requires a specific code path influenced by attacker-controlled input. The presence of a WAF and strict input sanitisation reduces the likelihood of such a path being exploitable. C – CSRF : Modern session handling, especially when using SameSite cookies and token-based anti-CSRF mechanisms, neutralises CSRF attempts, making it ineffective against a hardened application.
OWASP Testing Guide – Session Management ( https://owasp.org/www-project-web-security-testing-guide/v41/4-Testing---Client-Side-Session-Management ) NIST SP 800-63B – Digital Identity Guidelines (Session fixation considerations) ( https://pages.nist.gov/800-63-3/sp800-63b.html )
You’ve recently been hired as a cybersecurity intern for a growing tech startup. During your onboarding, the company’s chief information security officer (CISO) explains the various types of hackers you need to be aware of as part of your role. The term “script kiddie” comes up during this discussion. Based on your CEH v12 study material, which of the following descriptions best defines a script kiddie?
Answer(s): B – A hacker who uses pre-existing scripts and tools to carry out attacks without fully understanding how they work.Why B is correctA script kiddie relies on publicly available or shared scripts/tools (e.g., DDoS generators, web-exploit kits) rather than creating their own exploits. The emphasis is on execution rather than comprehension; the attacker generally does not grasp the underlying mechanics or the full impact of the payload. This matches the CEH definition of a “script kiddie” as a low-skill actor who leverages ready-made code for opportunistic attacks.Why the other choices are less suitableA: Describes a *script writer (often called a “developer” or “researcher”), not a script kiddie. C. Refers to a novice learner; while a script kiddie may be young, the defining trait is the use of others’ tools, not the stage of learning ethics. D. Misidentifies the target language (JavaScript) rather than the behavioral characteristic of using off-the-shelf scripts.The correct option captures the emphasis on reuse of existing exploit code with limited technical insight , which distinguishes a script kiddie from more capable threat actors.
1. EC-Council, Certified Ethical Hacker (CEH) v13 Exam Blueprint, Section “Threat Actors” –https://www.eccouncil.org/ceh-certification/ceh-exam-blueprint/ 2. EC-Council, Official CEH v13 Study Guide, Chapter on “Types of Hackers” –https://www.eccouncil.org/-/media/eccouncil/media/ceh-v13-study-guide.pdf (PDF)
A future-focused security audit discusses risks where attackers collect encrypted data now, anticipating that they can decrypt it later with quantum computers. What is this threat known as?
JustificationThe scenario describes “harvest-now, decrypt-later” attacks in which adversaries collect ciphertext today with the expectation that it can be broken when sufficiently powerful quantum computers become available. This exact concept is commonly labeled “saving data today for future quantum decryption.” It reflects the practice of storing intercepted encrypted material for later quantum-enabled cryptanalysis. Option B directly captures this definition, making it the correct choice. Option A (“Breaking RSA using quantum algorithms”) describes a specific computational capability, not the proactive strategy of collecting data now for later decryption. Option C (“Replaying intercepted quantum messages”) implies active manipulation of quantum communications, which is unrelated to the passive storage of classical ciphertext. Option D (“Flipping qubit values to corrupt the output”) refers to quantum error injection, again unrelated to the strategic data-harvesting approach.
NIST Post-Quantum Cryptography Project – Overview and Recommendations: https://csrc.nist.gov/projects/post-quantum-cryptography “Quantum Threat Landscape and Migration Strategies” – ENISA White Paper (2023): https://www.enisa.europa.eu/publications/quantum-threat-landscape-and-migration-strategies
Your role as a cybersecurity analyst at XYZ Corporation requires you to perform a thorough security assessment of the company’s online presence. You initiate the process with a passive reconnaissance phase, trying to gather as much information as possible without interacting directly with the target system. Which of the following techniques or tools is least likely to assist you in this endeavor?
Why option A is the least suitable for passive reconnaissancePassive reconnaissance involves collecting data that is openly available without sending any probes to the target. A. Nmap scanning sends packets to discover open ports, services, and hosts. This requires direct interaction with the network and is classified as an active reconnaissance technique; it violates the passive-only constraint. B. WHOIS lookup , C. Search-engine queries , and D. Social-media monitoring all retrieve information that is already published and do not generate traffic toward the target system, making them quintessential passive methods.Why the other options are more appropriate for passive assessmentB: WHOIS database provides publicly registered domain, registrar, and networking details without contacting the organization. C. Search-engine and linked services surface indexed pages, metadata, archived snapshots, and mapping data that are openly visible. D. Social-media and professional networking sites expose employee profiles, organizational charts, and project details that can be harvested without any technical probing.
NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment – discusses passive reconnaissance techniques and contrasts them with active testing ( https://csrc.nist.gov/publications/detail/sp/800-115/final ) OWASP Passive Reconnaissance Checklist – outlines publicly available sources (WHOIS, search engines, social media) and cautions against active scanning ( https://owasp.org/www-project-passive-recon/ )
You are tasked with assessing wireless network security for a corporation using WPA2 encryption. During the assessment, you identify vulnerabilities that could allow attackers to intercept and replay previously captured packets. Which WPA2 vulnerability is likely being exploited?
Answer(s): C
Technical JustificationCorrect Choice – C. KRACK vulnerabilities through key reinstallationKRACK (Key Reinstallation Attack) exploits the WPA2 4-way handshake by forcing a victim to reinstall an already-used encryption key. This causes the replay of previously captured packets, allowing an attacker to decrypt traffic and recover plaintext. The attack specifically manipulates the MIC and reinstall triggers to induce replay, directly matching the described scenario.Why the other options are less suitableA: Hole196 – shared GTK : This vulnerability involves the group-traffic key being broadcast in plaintext; it enables traffic decryption, but it does not rely on packet replay. B. Insecure WPS PIN recovery : This attack targets the WPS protocol and can retrieve the network password, yet it does not cause replay of captured packets after a handshake compromise. D. Weak RNG affecting GTK : A poor random number generator can weaken key material, but it does not inherently enable replay of captured frames; the primary effect is reduced entropy, not replay exploitation.Conclusion The behavior of allowing intercepted, replayed packets after a handshake compromise aligns precisely with KRACK’s key-reinstallation mechanism, making option C the correct answer.
KRACK Attack Research Paper: https://www.krackattack.com/ IEEE 802.11i-2004 Standard Overview: https://www.iEEE.org/publications/standards/detail/802_11-2003
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.