As a security analyst, you are testing your company’s network for potential vulnerabilities. During your investigation, you suspect that an attacker might be using MAC flooding to compromise the switches and sniff network traffic. Which of the following indicators would most likely confirm your suspicions?
Answer(s): D
JustificationCorrect indicator – D. Numerous MAC addresses seen on a single switch port is the hallmark of MAC-flooding: an attacker forces many source MACs into the CAM table, exhausting aging time and causing the switch to forward frames out all ports, effectively turning a switched LAN into a shared environment. Option A. Multiple MACs on one IP address is uncommon and usually caused by DHCP relay or mis-configured devices; it does not directly indicate MAC flooding. Option B. Multiple IPs using the same MAC can happen with MAC-based load balancing or virtual machines, but it is not a symptom specific to flooding attacks. Option C. An increase in ARP requests may be seen in ARP-scan or spoofing scenarios, yet it is not a reliable sign of MAC flooding, which primarily manipulates the switch’s MAC table rather than ARP traffic.Conclusion – The presence of many distinct MAC addresses attached to a single switch port (Option D) directly reflects the effects of MAC flooding and therefore best confirms the analyst’s suspicion.
Cisco – Understanding MAC address table aging and flushing: https://www.cisco.com/c/en/us/support/docs/switches/campus-switches/71699-understanding-mac-address-table-aging.htmlCisco – Securing switches against MAC flooding attacks: https://www.cisco.com/c/en/us/support/docs/switches/campus-switches/71684-security-features-on-cisco-switches.htmlThese documents explain how MAC address table dynamics are altered during flooding and the tell-tale signs to look for during traffic analysis.
You have recently been hired as an entry-level IT technician in a large corporation. In a meeting with the IT team, the terms “ethical hacking” and “penetration testing” are mentioned frequently. Later, a colleague explains to you that the main difference between the two is based on their goals. What is the primary goal of an ethical hacker in comparison to a penetration tester?
Answer(s): B
Why option B is the best choicePrimary objective alignment – An ethical hacker is hired to harden the environment; the end-goal is to find weaknesses in order to strengthen security controls and reduce risk. Focus on discovery for remediation – Penetration testers exploit identified vulnerabilities to demonstrate the impact of an attack, but their purpose is to provide evidence that can be used to fix the problem, not to keep the exploit alive. Professional scope – In the CEH framework, an ethical hacker’s mandate is defined by the principle of “defense-first” : conduct activities that are repeatable, documented, and intended to improve the organization’s security posture.Why the other options are incorrectOption A misstates the roles; ethical hackers do not merely exploit vulnerabilities for its own sake, nor does a penetration tester “secure” the system without a clear remediation plan. Option C describes a destructive mindset that contradicts ethical hacking ethics; bringing a system down is unrelated to either role. Option D reverses the terminology; “bringing the system down” is not a legitimate goal of a penetration tester —they aim to uncover issues without causing unacceptable service disruption.Therefore, option B correctly captures that ethical hackers secure the system while penetration testers are primarily engaged in exploiting vulnerabilities to expose risks.
EC-Council, Certified Ethical Hacker (CEH) v13 Exam Blueprint , Section 1.2 – Ethical Hacking vs. Penetration Testing: https://www.eccouncil.org/certified-ethical-hacker-ceh/v13/ EC-Council, CEH v13 Study Guide – Chapter 3: Penetration Testing Methodology , which defines the goal of ethical hacking as “identifying security gaps and recommending remediation” (p. 45): https://www.eccouncil.org/cehv13-study-guide/These sources confirm the role distinction used in the CEH certification and support the answer’s rationale.
During a penetration test on a legacy Windows network, you use the nbtstat -A command on a target system and retrieve several NetBIOS names, including entries ending with <20> and <03>. However, attempts to list shared folders fail. Which of the following best explains this behavior?
Technical JustificationThe nbtstat -A command reveals NetBIOS names that include the <20> (workstation service) and <03>(messenger service) suffixes, confirming that NetBIOS name service and the NetBIOS-over-TCP/IP (NetBT) stack are operational on the target. However, the inability to enumerate shared folders indicates that the Server (SMB) service , which hosts the share information, is not exposing shares over the network. In legacy Windows environments, this typically occurs when File and Printer Sharing (the Server service) is disabled or the server-side share permissions/registry settings are mis-configured. The other options can be ruled out for the following reasons:A: The default NetBIOS name service operates on port 137 (TCP/UDP) and does not need a non-standard port to enumerate names; the issue is not a port binding problem. C. Whether the host is a domain member affects authentication and trust relationships, not the fundamental ability of NetBIOS to publish share listings. It does not prevent the SMB service from advertising shares locally. D. nbtstat is designed only for NetBIOS name resolution; it does not enumerate shares. The correct tool for enumerating shares via NetBIOS is smbclient or net view , but the question focuses on why the share enumeration fails even though NetBIOS names are visible. This points back to the service being disabled, not a limitation of nbtstat .Therefore, the most precise explanation is that File and printer sharing is disabled on the target system , which prevents the Server (SMB) service from advertising shares despite NetBIOS name service being functional.
Microsoft Docs – File and Printer Sharing (SMB): https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/file-and-printer-sharing-troubleshooting TechNet – NetBIOS over TCP/IP Overview: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/netbios-over-tcpip-overviewThese sources confirm the role of the Server service in share enumeration and the impact of disabling File and Printer Sharing.
You are a cybersecurity consultant at a large healthcare organization. As part of your responsibilities, you are tasked with making sure the company’s systems are secure from various attacks. Recently, you’ve noticed some unusual traffic patterns that suggest someone might be trying to evade the company’s Intrusion Detection System (IDS). Which of the following techniques would most likely be used by an attacker in an attempt to evade detection by the IDS?
Answer(s): A
Technical JustificationOption A (Correct) – Fragmenting malicious packets into smaller pieces (TCP/IP or IPv6 fragmentation) can bypass signature-based IDS engines that examine whole payloads. Many intrusion-detection signatures are applied to the complete reassembled packet; if the IDS does not re-assemble fragments before inspection, the malicious payload remains invisible, making fragment manipulation a classic evasion technique.Option B – Flooding the IDS with ping traffic is a denial-of-service (DoS) tactic. While it can degrade IDS availability, it does not directly hide malicious traffic; instead it draws attention to the IDS and may trigger alerts of its own. Evasion focuses on concealment, not resource exhaustion.Option C – Advanced malware with self-replication (e.g., worms) is a serious threat, yet the question centers on IDS evasion . Self-replication does not inherently alter how traffic appears to the IDS; attackers would still need a separate evasion method to hide that traffic.Option D – Phishing via email targets human credentials, not IDS visibility. Although phishing can lead to network compromise, it is unrelated to the technical evasion of an IDS.Conclusion – The most direct method for evading IDS detection is to manipulate packet structure so the IDS fails to recognize malicious content, which aligns precisely with fragment-splitting (Option A).
Snort Documentation, Fragment Reassembly: https://snort.org/documents/1997/snort_manual.pdf Cisco IDS Evasion Techniques Overview: https://www.cisco.com/c/en/us/td/docs/security/ips/intrusion-prevention-system-ips-4-0/network-security/ips_40_config_guide/fragment.html
During a red team engagement targeting a custom web application, a tester observes that the app takes a numeric id parameter from the URL and dynamically builds SQL queries. Suspecting SQL injection, the tester sends a crafted HTTP GET request like: http://vulnerableapp.local/view.php?id=l; DROP TABLE users; --Shortly after, the application throws database errors, and the team confirms that the users table has been removed from the backend database. Based on this behavior, which SQL injection method was most likely used?
Why option D is the correct choiceThe payload l; DROP TABLE users; -- terminates the original query after the numeric identifier ( l ) and then injects a second, independent query ( DROP TABLE users ) before closing the comment.The web-application processes the whole string as a single statement, so two separate SQL commands are executed sequentially. The first reads the intended data, the second drops the users table. Because the second command causes an error and visibly removes a table, the tester can confirm that a second malicious query was executed alongside the first.Why the other options are less appropriateA – UNION clause would be used to retrieve additional rows from a SELECT statement, not to modify data or schema. Dropping a table does not involve a UNION operation. B – Error-based extraction relies on extracting information from verbose error messages; here the observable effect is table deletion, not the exploitation of an error message for data inference. C – Boolean-based inference depends on probing true/false conditions and interpreting response differences. The test here does not depend on conditional responses; it directly alters the database schema.Thus, the behavior matches a Union-based SQL injection that also executes a secondary query , i.e., option D.
OWASP SQL Injection Prevention Cheat Sheet – details on multiple statements execution: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment, section on injection attacks: https://csrc.nist.gov/publications/detail/sp/800-115/final
As a newly appointed network security analyst at a mid-tier company, you have been tasked with assessing the security of the network. As part of this, you need to ensure that your company’s network can detect and prevent evasion techniques. You know that one popular evasion technique used by attackers is using ‘packet fragmentation’. Which of the following IDS configurations should you implement to counteract this particular technique?
Technical JustificationOption B – Implement an anomaly-based IDS that can recognise irregular traffic patterns caused by packet fragmentationWhy it’s optimal: Fragmentation creates non-standard header lengths, overlapping offsets, and irregular fragment-reassembly behavior. An anomaly-based system learns the baseline of normal packet size and inter-fragment timing, allowing it to flag deviations such as unusually small fragments, fragmented payloads that exceed the reassembly window, or suspicious timing gaps. This approach catches novel or obfuscated fragments that signature engines would miss, making it the most effective defense against evasion via packet fragmentation.Option A – Reject all fragmented packetsWhile blocking fragments altogether removes the specific evasion vector, it also disrupts legitimate traffic that relies on fragmentation for legitimate reasons (e.g., handling large packets on a path with a smaller MTU). Modern networks routinely use IP fragmentation for legitimate purposes; rejecting every fragmented packet would cause unnecessary service outages and is not a sustainable security posture.Option C – Recognise regular intervals of fragmented packetsFragmentation intervals are highly variable and depend on the attacker’s tooling, network conditions, and end-host implementations. Relying on “regular intervals” as a detection cue offers no reliable distinguishing feature; legitimate traffic does not exhibit a predictable interval pattern tied to fragmentation, making this method ineffective for catching covert or opportunistic fragmented attacks.Option D – Use a signature-based IDS that matches a specific fragmented-packet signatureSignature-based detection works only when a known malicious signature exists for the exact fragment pattern. Attackers can easily evade such signatures by altering fragment sizes, using different fragmentation offsets, or combining fragments with other evasion techniques. Consequently, signature matching provides limited coverage and cannot keep pace with evolving evasion tactics.Conclusion Implementing an anomaly-based IDS (Option B) provides a dynamic, behavior-centric detection capability that adapts to the irregularities introduced by fragmentation, offering superior coverage without breaking legitimate traffic. The other options either introduce unacceptable operational side-effects (A), lack a reliable distinguishing signal (C), or are too static to counter evolving fragmentation evasion (D).
Snort Documentation – IP Fragmentation and Reassembly (how to detect anomalies in fragment headers): https://docs.snort.org/snort/ids-uses/rules/ip fragmentation.html Suricata – Fragment Reassembly and Anomaly Detection: https://suricata.io/suricata-update/fragment-reassembly/
A malware analyst is tasked with evaluating a suspicious PDF file suspected of launching attacks through embedded JavaScript. Initial scans using pdfid show the presence of JavaScript and /OpenAction keywords. What should the analyst do next to understand the potential impact?
Technical JustificationEmbedded JavaScript in a PDF is executed by the viewer’s JavaScript engine when the document is opened. To assess the actual malicious behavior, the analyst must view the JavaScript code that will run. PDFStreamDumper extracts the raw stream objects (including embedded scripts) from the PDF structure, enabling direct inspection of the malicious payload and facilitating reverse-engineering of its capabilities. Inspecting the extracted streams allows the analyst to identify dangerous calls (e.g., app.launchURL , exec ),evaluate potential data exfiltration, or trigger secondary payloads, which is essential for impact assessment. Option A (hashing) only yields a fingerprint for later matching; it does not reveal the script’s functionality and cannot predict its impact. Option C (disassembling with PE Explorer) targets Windows executable binaries and is irrelevant to PDF content; PDFs do not contain PE sections. Option D (upload to VirusTotal) may provide a quick reputation score but does not expose the embedded JavaScript code, leaving the analyst without the detailed behavior needed for a thorough impact analysis.Conclusion – Extracting and analyzing the stream objects with a dedicated PDF tool (e.g., PDFStreamDumper) directly addresses the need to understand the malicious JavaScript’s capabilities, making option B the most suitable next step.
PDF JavaScript Specification (ISO 32000-2) – Official documentation on embedded JavaScript support in PDF: https://www.iso.org/standard/70957.html PDFStreamDumper Tool Documentation – Guide on extracting PDF stream objects for analysis: https://github.com/m1k3y/pdfstreamdumper#readme
A cybersecurity company wants to prevent attackers from gaining information about its encrypted traffic patterns. Which of the following encryption algorithms should they utilize?
Answer(s): C
Why AES (Option C) is the best choiceConfidentiality of bulk traffic – AES is a high-performance symmetric cipher that encrypts data in large blocks, making it ideal for protecting the actual payload of network flows. This prevents an observer from learning patterns in ciphertext length or timing that could reveal application-level information. Strong security per bit – AES supports 128-, 192-, and 256-bit key lengths, providing a security margin well beyond what is required for modern traffic analysis attacks. Standardized and widely vetted – AES has been extensively analyzed and is the mandatory encryption algorithm in numerous security standards (e.g., TLS-1.3, IPsec ESP, Wi-Fi WPA3). Its proven resistance to known-plaintext, differential, and linear cryptanalysis makes it the preferred algorithm for protecting secret data streams. Efficiency – Being symmetric, AES can be implemented in hardware or software with low latency, allowing continuous encryption of high-throughput traffic without significant performance penalty.Why the other options are inferiorDES (Option A) – Uses only a 56-bit key, which is vulnerable to exhaustive key-search attacks on modern hardware. Its 64-bit block size also leads to practical collisions and weak diffusion, making it unsuitable for protecting sensitive traffic patterns. RSA (Option B) – Primarily a public-key algorithm used for key exchange or digital signatures, not for bulk data encryption. RSA encryptions are computationally expensive and produce ciphertexts larger than the plaintext, which can expose metadata about traffic patterns; it therefore adds little to hide volume or timing characteristics compared with a symmetric cipher like AES. HMAC (Option D) – Provides message authentication and integrity verification but does not encrypt data. It is used alongside an encryption algorithm to confirm authenticity, but it cannot by itself mask traffic-pattern information; without an underlying encryption primitive, it cannot hide the contents of the traffic.Hence, to obscure the shape and volume of encrypted traffic from potential attackers, a strong symmetric cipher such as AES is the most appropriate solution.
NIST FIPS 197 – Advanced Encryption Standard (AES): https://csrc.nist.gov/publications/detail/fips/197 RFC 5280 – Internet X.509 Public Key Infrastructure Certificate and Certification Path Validation: https://tools.ietf.org/html/rfc5280 (shows AES usage in TLS and IPsec protocols)
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.