A multinational corporation relies heavily on remote access for its employees to connect to internal systems and resources. Recently, there have been reports of unauthorized access to sensitive company data, leading to concerns about potential session hijacking attacks. The security team is tasked with identifying the specific techniques used by attackers and implementing measures to enhance session security. Considering the scenario described, which advanced session hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the confidentiality of corporate data?
Answer(s): B
JustificationOption B – ARP Spoofing Attack Redirecting Traffic to Capture Session Data on Local Networks is the most challenging for the security team because it exploits the trust relationship of the local LAN, allowing an attacker to silently insert themselves into the communication path and capture or manipulate active session traffic without requiring any visible authentication steps. This technique works even when the victim is using encrypted protocols (TLS) as long as the attacker can intercept the session tokens on the wire, making detection difficult without network-level monitoring or layered defenses (e.g., DAI, port security).Option A – Brute-Force Session Guessing Exploiting Weak Session ID Generation relies on predictable session identifiers; while it can be mitigated by enforcing strong, random session IDs and proper entropy, many modern web frameworks already implement secure token generation, so the attack surface is relatively limited and more easily mitigated through code review and configuration hardening.Option C – Cookie Poisoning Attack Manipulating Session Cookies typically requires the attacker to already possess a valid session cookie and modify it client-side. This attack is generally detectable by integrity checks (e.g., HMAC, signed cookies) and does not bypass network-level controls, making it less stealthy than an ARP-based session capture.Option D – Session Sidejacking Intercepting Unencrypted Session Tokens over Public Wi-Fi is also effective but is mitigated by enforcing TLS/HTTPS everywhere; if all web applications enforce encryption, the attacker gains little beyond passive eavesdropping, which can be prevented with proper PKI and HSTS policies.Conclusion – Among the listed techniques, ARP spoofing offers the greatest stealth and difficulty of detection within a corporate LAN, posing the highest risk to confidential data and requiring sophisticated network-level mitigations.
OWASP Session Hijacking Cheat Sheet: https://owasp.org/www-community/attacks/Session_Hijacking CISA Guidance on Securing Remote Access: https://www.cisa.gov/secure-remote-accessNote: This response is condensed for exam review purposes and adheres to the requested format.
After a recent breach, your team discovers that attackers used modified versions of legitimate system utilities and a Windows service to persist undetected for weeks, accessing internal credentials. What key step can be taken to better protect against similar future threats?
Answer(s): C
Why option C is the best mitigationFocus on the attack pattern – The adversary altered legitimate system binaries and a Windows service to maintain stealthy persistence and harvest credentials. Detecting unauthorized changes to these critical files directly counters the technique being used. File-hash monitoring provides real-time integrity verification of known “sensitive executables.” When a hash differs from the trusted baseline, it signals tampering before the malicious version can be leveraged, enabling rapid containment. Detection-first approach – Unlike preventive controls such as patching or firewall hardening (options A and D), hash monitoring identifies modifications that have already occurred, which is essential when attackers already have foothold and are using trusted tools to evade detection. Relevance to credential access – By catching altered binaries, analysts can stop credential-dumping services from retrieving secrets, addressing the core impact of the breach.Why the other options are less suitableA – Latest antivirus/firewall – Signature-based AV may miss custom-built variants of legitimate utilities; updated signatures alone cannot guarantee detection of file-level modifications.B – Weekly off-site backups – Backups are vital for recovery, but they do not prevent or detect malicious modifications in real time; they address data loss rather than the stealthy persistence technique. D – Disabling unused ports and limiting outbound traffic – Network segmentation reduces attack surface but does not alert on compromised host files; it cannot detect the altered binaries being used locally.Key takeaway – Implementing integrity-checking (e.g., monitoring file hashes) directly mitigates the identified abuse of modified system utilities and services.
NIST Special Publication 800-53 Rev. 5 – SI-7 (File and Directory Integrity Monitoring): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final CISA “Detecting Malicious Activity” guide – https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-216a (see “File Integrity Monitoring” section)
A tester evaluates a login form that constructs SQL queries using unsanitized user input. By submitting ‘ OR ‘1’=’1’;--, the tester gains unauthorized access to the application. What type of SQL injection has occurred?
Answer(s): A
ExplanationThe payload ' OR '1'='1' ;--uses a logical tautology ( '1'='1' ) to make the entire SQL condition always true,thereby bypassing authentication. This technique manipulates the syntax of the query so that the injected condition is always evaluated as true, which is the defining characteristic of tautology-based (or logical) SQL injection . Why the other options are not appropriateUnion-based : Requires a UNION SELECT clause to combine result sets; the payload does not contain a UNIONoperator. Error-based : Relies on forcing the database to generate an error that reveals data; the payload does not trigger an error message. Time-based blind : Uses a conditional delay (e.g., SLEEP ) to infer data; the payload lacks any time-delay function.Thus, the correct classification is A. Tautology-based SQL injection .
OWASP SQL Injection Prevention Cheat Sheet – discusses logical tautologies in SQLi: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment, Section on injection attacks: https://csrc.nist.gov/publications/detail/sp/800-115/final
A system analyst wants to implement an encryption solution that allows safe key distribution. Which encryption method should the analyst consider?
Technical JustificationAsymmetric encryption uses a key pair: a public key that can be freely distributed and a private key that remains secret. Because the public key does not need to be transmitted securely, it enables safe distribution of encryption material across untrusted networks. This property directly addresses the analyst’s requirement for a solution that allows safe key distribution. Hash functions merely produce a fixed-size digest of input data; they do not provide confidentiality or key exchange capabilities, so they cannot be used to distribute encryption keys securely. Disk encryption secures data at rest on a storage medium but relies on already-established keys for access control; it does not solve the problem of securely exchanging keys between parties. Symmetric encryption requires that both parties share the same secret key. Safely delivering that key to all parties is itself a distribution problem, which symmetric schemes alone do not solve without an additional key-exchange mechanism (e.g., asymmetric key exchange).Therefore, the method that best satisfies the need for safe key distribution is asymmetric encryption .
NIST SP 800-57 Part 1 Rev. 5 – Recommendation for Key Management: https://csrc.nist.gov/publications/detail/sp/800-57/part/1/rev/5/final RFC 5280 – Internet X.509 Public Key Infrastructure Certificate and Certification Path Validation: https://tools.ietf.org/html/rfc5280
In your role as a cybersecurity analyst at a large e-commerce company, you have been tasked with reinforcing the firm’s defenses against potential Denial-of-Service (DoS) attacks. During a recent review, you noticed several IP addresses generating excessive traffic, causing an unnaturally high load on the server. An inspection of these packets revealed that the TCP three-way handshake was never completed, leaving multiple connections in a SYN_RECEIVED state. The intent appears to be the saturation of server resources without any genuine intent to establish a full connection. Given these details, what type of DoS attack is most likely being executed against the company’s servers?
JustificationThe observed behavior—numerous connections stuck in SYN_RECEIVED with no subsequent ACK—is characteristic of a half-open TCP connection attack . In a SYN flood , an attacker sends a large number of SYN packets to exhaust the server’s connection table, leaving the socket queue full and preventing legitimate connections. This directly matches the description of “excessive traffic … leaving multiple connections in a SYN_RECEIVED state” and “the intent appears to be the saturation of server resources without any genuine intent to establish a full connection.” Why the other options are less suitableA: Smurf Attack – Relies on amplified ICMP echo-requests broadcast to many hosts; it does not involve incomplete TCP handshakes. C. UDP Flood – Targets random UDP ports with large volumes of UDP packets; the presence of SYN_RECEIVED packets indicates a TCP-based flood, not UDP. D. Ping of Death – Sends oversized or malformed ICMP packets that exceed IP fragment limits; it does not create SYN-related half-open states.Therefore, the attack most consistent with the observed half-open TCP connections is a SYN Flood (option B ).
RFC 5921 – TCP Authentication Options – provides detailed explanation of TCP three-way handshake states. https://www.rfc-editor.org/rfc/rfc5921 MITRE ATT&CK – SYN Flood (Technique T1498) – describes half-open connection floods and their impact on availability. https://attack.mitre.org/techniques/T1498/
A city’s power management utilizes SCADA systems to oversee operations. Recently, the infrastructure has shown unexplained anomalies such as inconsistent sensor values and intermittent outages. Security experts suspect a side-channel attack aiming to discreetly extract sensitive information from SCADA devices. Which investigative technique would best confirm if attackers employed this specific side-channel method?
JustificationSide-channel attacks on SCADA devices exploit physical properties (e.g., power consumption, electromagnetic emissions, timing) that vary with the device’s internal operations. To verify such an attack, investigators must observe these physical side-effects while the device is actively controlling the process. Option A directly addresses this by measuring unusual fluctuations at the hardware level during normal device operation, which can reveal abnormal power or timing signatures indicative of a side-channel extraction. Option B (reviewing user interfaces) would expose unauthorized logins but does not uncover covert physical data leakage. Option C (checking cryptography) pertains to data confidentiality, not the physical channel used for exfiltration. Option D (network latency) may indicate congestion but does not specifically reveal a side-channel attack targeting hardware-level side effects.\boxed A
1. NIST Special Publication 800-53 Rev. 4 – Security and Privacy Controls for Federal InformationSystems and Organizations (covers monitoring of physical and environmental indicators). https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final 2. ENISA “Guide to Industrial Control System Security” (2021) – Discussion of side-channel and physical-layer attack detection techniques. https://www.enisa.europa.eu/publications/guide-to-industrial-control-system-security
You are a Certified Ethical Hacker contracted by a technology company to perform a security assessment on Bluetooth-enabled devices. These devices have Secure Simple Pairing (SSP) enabled, which generally offers strong security. During your assessment, you identify an attacker trying to exploit a vulnerability in the SSP implementation by employing sophisticated brute-force techniques. The attacker has partial access to the Diffie-Hellman key exchange. Your mission is to identify the most effective method to counteract this attack. Which of the following countermeasures is most likely to be effective?
JustificationOption B – Impose rate-limiting is the most effective mitigation because it directly throttles the number of pairing attempts an attacker can make. By limiting successive authentication requests to a small interval (e.g., ≤ 5 attempts per minute per device), the attacker’s offline brute-force cracking of the Diffie-Hellman parameters is dramatically slowed, increasing the computational cost and likelihood of detection. This technique is widely recommended in Bluetooth security hardening guides and aligns with best-practice controls for mitigating online credential-guessing attacks.Option A – Device whitelisting appears strong but can be circumvented through credential reuse, spoofedMAC addresses, or compromised authorized devices; it does not address the underlying cryptographic weakness of the SSP exchange.Option C – Strengthen SSP by increasing key length is not practical; the DH parameters used in SSP are mandated by the Bluetooth specification, and modifying them would break interoperability. Moreover, the vulnerability stems from insufficient entropy in the random number generator used during pairing, not from an insufficient key size.Option D – Use BLE for all connections does not resolve the core issue; BLE employs a different pairing model (Just Works, Passkey Entry) that also suffers from brute-force risks when low-entropy passkeys are used, and it introduces compatibility problems with legacy devices that rely on classic Bluetooth SSP.Conclusion: Rate-limiting directly reduces the feasibility of the brute-force attack vector and is therefore the recommended countermeasure.
Bluetooth Core Specification, Vol 3, Part G: 5.2.2.2 Pairing and Bonding – security considerations and recommended mitigations. https://www.bluetooth.com/specifications/ NIST Special Publication 800-115, “Guidelines for Managing the Security of Bluetooth Devices” – discusses rate-limiting as a control for mitigating pairing brute-force attacks. https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final
During a black-box assessment, an attacker executes the Nmap command nmap -p25 --script smtp-enum-users --script-args smtp-enum-users.methods= VRFY, EXPN, RCPT) . The script successfully returns multiple valid usernames. What server misconfiguration is being exploited?
Why option B is correctThe Nmap script smtp‑enum‑users uses the SMTP VRFY, EXPN, and RCPT commands to enumerate valid mailbox names. These commands are intended for mail routing and user validation. When a server accepts them and returns positive responses, it discloses user accounts to any remote host that can reach the SMTP service. In a black-box scenario the attacker has no prior knowledge of valid accounts; the script’s success demonstrates that the server is unrestrictively exposing user-verification functionality . This misconfiguration allows enumeration and can be leveraged for further social-engineering or targeted attacks.Why the other options are less appropriateA – STARTTLS disabled : The script does not require TLS; it works over plain TCP on port 25. Disabling STARTTLS does not enable user enumeration, only weakens encryption. C – DNS MX misconfiguration : Mis-routing MX records affects mail delivery, not the ability of an external probe to query VRFY/EXPN/RCPT on the SMTP service itself. D – Authentication without credentials : The script does not attempt to authenticate; it only sends unauthenticated VRFY/EXPN/RCPT commands, which are not equivalent to authentication mechanisms.Conclusion The core issue is that the SMTP server leaves its user-enumeration commands open to unauthenticated queries, allowing an external attacker to discover valid usernames—a clear misconfiguration captured by option B.
Nmap Documentation – smtp-enum-users script: https://nmap.org/doc/nmap-help/script-categories.html#smb RFC 3464 – “Simple Mail Transfer Protocol (SMTP) Extensions for Internationalization”: https://datatracker.ietf.org/doc/html/rfc3464#section-3.1 (shows VRFY/EXPN usage for user verification)
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.