During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this issue?
Answer(s): B
Correct answer – B. Enforcing timely user de-provisioningDe-provisioning ensures that access rights are revoked immediately when employment status changes, eliminating lingering credentials that can be abused. By integrating automated workflows (e.g., HR-IT handshake) and enforcing strong authentication (MFA, certificate revocation), organizations close the window of opportunity for former employees to reach critical resources.Why the other options are less effectiveA: Multi-cloud deployment models – Distributes workloads across providers but does not address credential lifecycle; a former employee’s existing cloud-specific tokens remain valid regardless of deployment pattern. C. Regular penetration testing – Discovers vulnerabilities and misconfigurations, yet it occurs periodically and cannot guarantee that revoked accounts are removed between tests. D. Real-time traffic analysis – Detects anomalous activity in progress, but it is reactive; it cannot prevent access before it occurs if the attacker still possesses valid credentials.
NIST SP 800-53 Rev. 5, Access Control – https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ISO/IEC 27001:2022, Information security – User access management – https://www.iso.org/standard/75670.html
Working as an Information Security Analyst at a technology firm, you’ve been asked to design training material for employees about the potential dangers of session hijacking. As part of the training, you want to explain how attackers could use side jacking to compromise their accounts. Which of the following scenarios would most accurately describe a side jacking attack?
Answer(s): C
Technical JustificationOption C – Correct ChoiceSide jacking (also called session hijacking via cookie capture) requires the attacker to intercept unencrypted HTTP traffic, extract session cookies, and subsequently replay those cookies to the server as if they were the legitimate user. This scenario directly matches the definition of side jacking: exploiting weak session-management (e.g., lack of encryption over TLS) to steal and reuse authentication tokens, leading to unauthorized account access without needing credentials or additional exploits.Why the Other Options Are Less SuitableA: Malicious script injection – This describes a classic Cross-Site Scripting (XSS) or drive-by download scenario; it does not involve capturing or reusing session tokens, nor does it specifically target side jacking techniques. B. Network firewall vulnerability exploitation – Gaining unauthorized access by attacking a firewall pertains to network-level intrusion, not the theft and reuse of session cookies that characterizes side jacking. D. Social engineering for password disclosure – This involves credential theft through manipulation, which is unrelated to the technical exploitation of unprotected session identifiers over the network.Key DistinctionSide jacking is fundamentally about intercepting and reusing session cookies due to lack of encryption, not about deceiving users to disclose credentials or compromising infrastructure components.References Links:1. Session Management Cheat Sheet – OWASPhttps://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html 2. TLS/SSL Best Practices for Secure Session Handling – NIST SP 800-52 Rev. 2https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/finalAdhering to this explanation aligns with the precise, technical description expected in certification exam responses.
As a senior cybersecurity professional at a multinational bank, you are investigating an incident where multiple systems have been infected with malware. On the affected systems, the malware remains dormant until a specific action triggers its malicious activity. The malware has also shown signs of being able to avoid detection by changing its code or encryption each time it infects a new. Based on these characteristics, which type of malware is likely causing this problem, and what is the best method to mitigate its impact?
Correct answer: B – Polymorphic MalwareCharacteristics match polymorphic malware – it mutates its code or encryption each generation, making signature-based detection ineffective, and it lies dormant until a trigger activates its malicious payload. Best mitigation – Deploy behavior-based (heuristic) detection engines that monitor system activity rather than static signatures, and enforce timely patch management to close the vulnerabilities that the malware exploits for execution and propagation.Why the other options are less suitableA – Adware – Primarily delivers unwanted advertisements; it does not self-modify or remain dormant awaiting a trigger, and its impact is nuisance rather than system compromise. C – Rootkit – Grants persistent administrative access and manipulates low-level system functions; it does not typically rewrite its own code per infection and is usually detected by specialized rootkit scanners, not solely by patching. D – Worm – Self-replicates and propagates over networks without user interaction, but its defining feature is rapid spreading, not code mutation or trigger-based activation.
MITRE ATT&CK – Polymorphic Malware Techniques: https://attack.mitre.org/techniques/T1027/ CISA – Recommendations for Detecting and Responding to Malware: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-206aThese sources detail polymorphic behavior, detection strategies, and the importance of patching in mitigating such threats.
An attacker examines differences in ciphertext outputs resulting from small changes in the input to deduce key patterns in a symmetric algorithm. What method is being employed?
Why option C is the only correct choiceDifferential cryptanalysis specifically focuses on how differences (or perturbations) in plaintext inputs produce corresponding differences in ciphertext outputs. By observing many such input-output pairs, an attacker can infer statistical relationships that leak information about the secret key, allowing partial or full key recovery. This technique is a classic, well-established method for breaking symmetric ciphers such as block ciphers (e.g., DES, AES) when the attacker can collect enough chosen-plaintext or known-plaintext samples.Option A – Timing attack relies on variations in the execution time of cryptographic operations to infer secret key bits. While timing variations can be exploited, they do not involve analyzing differences in ciphertext outputs caused by small changes in plaintext, which is the core idea of differential analysis.Option B – Chosen-ciphertext attack involves an attacker obtaining decryptions of ciphertexts of their choosing, typically to manipulate the decryption process and extract plaintext information. It targets the decryption oracle rather than investigating how input differences affect ciphertext differences in a systematic way.Option D – Brute-force attack requires trying every possible key until the correct one is found. This method does not depend on observing any statistical relationship between plaintext differences and ciphertext differences; it is purely exhaustive and unrelated to differential patterns.Conclusion: The described technique—examining how tiny changes in plaintext produce predictable changes in ciphertext to reveal key patterns—is the textbook definition of differential cryptanalysis . Hence, option C is the best answer.
Differential Cryptanalysis – Wikipedia (current page): https://en.wikipedia.org/wiki/Differential_cryptanalysis NIST SP 800-38A: Modes of Operation for Block Ciphers (contains discussion of differential properties of block ciphers): https://csrc.nist.gov/publications/detail/sp/800-38a/finalThese sources provide both a conceptual overview and formal technical background for differential cryptanalysis.
You’re a security analyst conducting a foot printing exercise for a new client to uncover as much information as possible without direct interaction. Your preliminary investigation using search engines and public databases has provided a significant amount of data about the organization's online presence. You are now considering using Google Hacking techniques to find further vulnerabilities. Which of the following could best justify this decision?
Technical JustificationWhy option B is correctGoogle Hacking (or “Google dorking”) uses specially crafted search queries to locate sensitive or vulnerable information that is inadvertently exposed on publicly accessible web pages. Such queries can uncover exposed source code, configuration files, error messages, login portals, or insecure directories that reveal weaknesses in the client’s website code (e.g., revealing hard-coded credentials, insecure API endpoints, or outdated libraries). Identifying these code-level exposures is a core goal of a footprinting phase when the analyst seeks actionable technical findings before any direct interaction with the target.Why the other options are less suitableA: Mapping internal network structure – Google indexed content is limited to the surface web; it cannot reveal internal IP ranges, routing tables, or LAN topology. Network mapping requires active scanning or insider information, not search-engine queries. C. Locating phishing sites that mimic the client’s brand – While Google can surface look-alike sites, its primary utility is not focused on detecting phishing replicas. Dedicated brand-monitoring tools and dark-web monitoring are better suited for that purpose. D. Discovering hidden data from the Deep Web – The Deep Web (e.g., databases behind authentication) is not indexed by Google. Search-engine techniques only surface publicly reachable pages; they cannot retrieve data that requires credentials or is blocked by robots.txt.Conclusion The most appropriate justification is that Google Hacking helps identify weaknesses in the client’s website code, directly supporting the analyst’s objective of uncovering exploitable technical details during the reconnaissance phase.
Official EC-Council CEH v13 material on Google Hacking: https://nuclearpentest.com/google-hacking OWASP “Google Dorking” cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Google_Dorks_Cheat_Sheet.html
A senior executive receives a personalized email with a subject line that reads “Annual Performance Review 2024”. The email contains a downloadable PDF that installs a backdoor when opened. The email appears to come from the CEO and includes company branding. Which phishing method does this best illustrate?
Answer(s): D
Correct Answer: D – Whaling attack aimed at high-ranking personnelThe scenario describes a highly targeted email that mimics the CEO’s style, uses company branding, and references an “Annual Performance Review” – a topic of interest only to senior leaders. Such campaigns are purpose-built to harvest information or gain privileged access from executives, often resulting in larger payoff than generic phishing. The use of a personalized subject line and executive-level content confirms the attacker’s intent to target a specific high-value individual , which is the hallmark of whaling.Why the other options are less appropriateA: Pharming using DNS poisoning – Requires manipulation of DNS resolvers or hosts to redirect traffic; the email contains no indication of network-level hijacking or DNS compromise. B. Email clone attack with altered attachments – While the email may look like a clone, the key distinguishing factor is the targeted nature and the executive-oriented content , which points to whaling rather than a generic clone attack. C. Broad phishing sent to all employees – This attack is indiscriminate; there is no evidence that the email was distributed broadly or that the attacker is seeking mass credential harvest.Key technical distinction Whaling attacks leverage social engineering tailored to high-ranking individuals , often using forged authority cues (e.g., CEO name, branding) to increase credibility and request actions that can expose sensitive data or install persistent backdoors. The combination of personalization , executive relevance , and malicious payload makes option D the most accurate classification.
FBI – “Business Email Compromise (BEC) Impersonation” – https://www.fbi.gov/investigate/crime/email-compromise Encyclopaedia Britannica – “Whaling” (phishing) – https://www.britannica.com/topic/whaling-phishing
You’re an IT security analyst at a fast-growing fintech startup. Recently, you’ve noticed an uptick in network traffic anomalies. You decide to perform a more thorough network scan using the ICMP Echo Request method. During the scan, you notice that a certain set of IPs in your network are not returning any Echo Reply, but other network functionalities seem to be operating normally. How would you interpret this situation?
Why option B is the best answerICMP Echo Request/Reply is the classic “ping” mechanism; many security devices (e.g., firewalls, IDS/IPS) can be configured to drop or block Echo Requests while still allowing other traffic to flow. The observed lack of Echo Replies, together with normal operation of other services, points to a filtering rule rather than a congestion problem or a breach. If the non-responsive hosts were simply unused, they would still respond to ping unless explicitly filtered; the pattern described (a specific set of IPs silently dropping Echo Requests) is characteristic of security controls that suppress ICMP for reconnaissance mitigation. Congestion (A) would typically cause intermittent or delayed replies across many paths, not a deterministic non-reply for a distinct IP group. A breach (C) would likely manifest with other anomalies such as unauthorized connections, privilege escalation, or suspicious outbound traffic—not just silent ping failures. Unused addresses (D) could be silent, but the question states “other network functionalities seem to be operating normally,” implying the hosts are reachable for other protocols, which argues against them being simply dormant assets.Other options – why they are less suitableA: Network congestion – congestion generally degrades performance for many traffic types, not just the lack of ICMP replies for a selective set of addresses. C. Major breach in progress – a breach would generate more detectable signs (e.g., anomalous connections, data exfiltration), not merely silent Echo Replies. D. Unused IPs for future expansion – unused addresses would not be blocked; they would either respond to ping or be unreachable due to routing, not because of an intentional security filter.Conclusion The most plausible interpretation is that a firewall or security control is intentionally blocking ICMP Echo Requests, making option B the correct choice.
1. Internet Control Message Protocol (ICMP) – RFC 792 – https://tools.ietf.org/html/rfc792 2. ICMP (Internet Control Message Protocol) – Microsoft Learn – https://learn.microsoft.com/windows-server/networking/icmp
In a highly secure online banking environment, customers have reported unauthorized access to their accounts despite robust authentication measures in place. Upon investigation, it is discovered that attackers are employing sophisticated session hijacking techniques to compromise user sessions and conduct fraudulent transactions. The security team is tasked with implementing effective countermeasures to prevent further unauthorized access and protect customer accounts. Considering the scenario described, which advanced session-hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of online banking transactions?
Best choice: C – Man-in-the-Browser (MitB) Attack Installing Malicious Browser Extensions to Intercept User SessionsTechnical depth and stealth: MitB operates inside the victim’s browser process, allowing the attacker to read, modify, and replay encrypted session cookies or tokens without ever touching the network layer. Because the malicious code runs with the same origin and privileges as the legitimate banking application, it can bypass TLS, anti-tampering checks, and many server-side session-validation mechanisms. This makes the hijacked session appear legitimate to both the user and the back-end services. Scenario-based realism: The attack can be tailored to mimic normal user actions—e.g., altering transaction amounts or beneficiary details on the fly—so that fraudulent transfers are indistinguishable from genuine activity. The attacker can also inject code that disables security warnings, captures multi-factor authentication codes, or rewrites HTML/JavaScript to hide malicious behavior, giving the attack a high degree of realism. Resistance to conventional defenses: Traditional session-hijacking defenses (e.g., network sniffing detection, cookie flagging, IP reputation) are ineffective because the attacker never needs to capture tokens in transit. Secure cookies, SameSite attributes, and TLS alone cannot stop a compromised browser from legitimately presenting those cookies. Defenses must therefore focus on browser integrity verification, extension whitelisting, runtime application self-protection (RASP), or client-side code signing—areas that are complex to deploy at scale in a banking environment. Operational impact: MitB can affect all users who load the compromised banking page, leading to a broad breach that is difficult to isolate. Remediation requires widespread distribution of clean browser binaries, revocation of compromised client certificates, and continuous monitoring for anomalous JavaScript execution —far more demanding than mitigating simpler session hijacking vectors.Why the other options are less challenging for detection/mitigationA – Passive Sniffing on Unsecured Wi-Fi: The vectors are limited to insecure networks; banks typically enforce TLS and network segmentation. Sniffed tokens are encrypted (TLS), making them useless without private keys. Detection is relatively straightforward (e.g., enforce HTTPS, disable public Wi-Fi access). B – Session Fixation: This attack relies on an attacker-controlled session ID being accepted by the server. Modern web frameworks reject stale or unrecognized session identifiers, and session-management best practices (regeneration after login, strict cookie policies) mitigate it easily. D – Covert XSS in Online Banking Pages: While XSS can be dangerous, it is often caught by modern input-validation, Content-Security-Policy, and output-encoding controls. Moreover, XSS typically results in script execution rather than direct session hijacking, and its impact is generally more visible and easier to quarantine.Conclusion: The Man-in-the-Browser approach blends stealth, operational realism, and resilience against standard defenses, making it the most demanding session-hijacking technique for a high-security banking environment to detect and remediate.
OWASP Top Ten 2021 – A01: Broken Access Control & A04: Insecure Design – discusses MitB as a threat model for client-side attacks. https://owasp.org/www-project-top-ten/ NIST Special Publication 800-53 Rev. 5 – SI-7 (Malicious Code) & SI-10 (Code Integrity) – outlines controls for detecting and preventing malicious browser extensions. https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.