Free 312-50v13 Exam Braindumps
Certified Ethical Hacker v13 Questions 409–416 (page: 53)

Explanation:

Why option C is the best choice
A side-channel attack on the hypervisor can extract cryptographic keys, memory contents, or other tenants’ data without needing valid credentials or exploiting a network-level flaw. Such attacks (e.g., Timing, Cache-Based, Power-Analysis) are known to work across VM boundaries in shared-resource cloud platforms, making them a realistic cause of “unknown vulnerability” data exposure. They do not require external network access or mis-configurations; they exploit subtle implementation details of the virtualization layer itself.
Why the other options are less suitable

A: Brute-force attack on user passwords – This would only recover authentication credentials; it does not directly reveal the underlying stored records in the cloud database. B. Denial of Service (DoS) attack on cloud servers – A DoS disrupts service availability but does not provide a means to read or exfiltrate data. D. Exploitation of misconfigured security groups – While a misconfiguration can expose data, it is primarily a configuration error rather than an “unknown vulnerability” leveraged through a technical exploit of the underlying virtualization stack.
Conclusion The description “unknown vulnerability” together with exposure of customer data in a cloud environment most aligns with a side-channel attack on the hypervisor , as it can silently siphon sensitive information without obvious network indicators.

Reference:

NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment – Chapter on side-channel and virtualization attacks: https://csrc.nist.gov/publications/detail/sp/800-115/final EC-Council Certified Ethical Hacker v13 Exam Blueprint – Domain 3: Cloud Security – Discussion of hypervisor side-channel threats: https://www.eccouncil.org/ceh-certification/ceh-v13-exam-blueprint/

Explanation:

Explanation:

Justification
Option C – “The IDS is configured with very high sensitivity settings, leading to many false positives.” This is the most likely cause because high-sensitivity rules generate alerts for low-severity or benign events such as routine user logons, password changes, or standard client-server traffic. In a medium-sized environment, administrators often over-tune rule sets to avoid missing threats, inadvertently inflating the alert volume to the point where regular user activity appears as security events.
Why the other options are less appropriate

A: Firewall filtering failure – While a mis-configured firewall can allow malicious traffic, it typically produces missed detections rather than an excess of alerts for normal user behavior. B. Out-of-date IDS patches – An outdated IDS may lack detection capabilities, but this generally results in fewer or missed alerts, not an over-abundance of false positives. D. Users unintentionally triggering security protocols – Users do not “trigger security protocols” in a way that would cause a systematic increase in IDS alerts; their actions would be sporadic and not uniformly generate the pattern described.
Therefore, the high sensitivity configuration directly explains the observed surge of alerts stemming from ordinary user activities.

Reference:

Snort Documentation – Rule Tuning and Sensitivity: https://www.snort.org/documents/1709/snort-rules Suricata IDS Tuning Guide (False Positive Management): https://suricata.io/docs/suricata-user-guide/rules/rules-tuning.html

Explanation:

Technical justification
The attack was described as targeting the application layer of the web server. Application-layer DDoS attacks operate at Layer 7 of the OSI model and consume resources of the service itself (e.g., HTTP request handling). Among the options, an HTTP flood attack (Option A) floods the server with a high volume of legitimate-looking HTTP GET/POST requests, exhausting web-server threads and application resources. SYN flood (Option B) operates at the transport layer (TCP three-way handshake) , affecting connection state but not the application logic.
ICMP flood (Option C) and UDP flood (Option D) are network- and transport-layer attacks that send malformed packets at scale; they do not specifically target the web server’s application services.
Therefore, the DDoS attack most likely used against the web server was an HTTP flood attack .

Reference:

EC-Council, Certified Ethical Hacker (CEH) v13 – DDoS Attack Types – https://www.eccouncil.org/ceh-certification/ceh-course-outline/ (see “Application-Layer DDoS – HTTP Flood” section) Cisco, Understanding DDoS Attacks and Mitigation – https://www.cisco.com/c/en/us/support/docs/security/do-s-attack-prevention.html (section on “HTTP Flood” attacks)

Explanation:

Why option D is correct: The analyst submits two payloads that differ only in the relational operator ( 1=1 versus 1=2 ). The application’s response changes accordingly, indicating that the server evaluates the condition and renders different output based on its truth value. This technique—using conditional logic to draw inferences from the application’s behavior—is the hallmark of an in-band boolean-based blind SQL injection . The attacker does not rely on error messages or timing; instead, they observe the visible page differences to reconstruct data.
Why the other options are less appropriate:
Option A describes blind injection that relies on measuring response time differences. In the scenario, the analyst does not mention any latency testing; they rely on visible changes in the page content, not on timing. Option B refers to UNION-based injection, where additional tables are concatenated into the original query to extract data. The payload described ( AND 1=1 / AND 1=2 ) contains no UNION clause or data-extraction syntax. Option C suggests triggering explicit database error messages. The generic error messages remain unchanged; the only observable difference is the logical response to the condition, not an error traceback.
Conclusion: The technique aligns precisely with option D—using conditional payloads to infer database behavior from page output—making it the best answer for identifying in-band blind SQL injection.

Reference:

OWASP SQL Injection Prevention Cheat Sheet –
https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html NIST Special Publication 800-115 – Guide to Understanding and Combating Web Application Security Risks (Section on SQL Injection) – https://csrc.nist.gov/publications/detail/sp/800-115/final

Explanation:

Why the correct option is D – Load Balancing
Definition – Load balancing distributes incoming client requests across multiple servers or links, spreading the traffic load and preventing any single point from being overwhelmed. Fit with the scenario – The organization deliberately uses both hardware appliances and cloud-based services to distribute incoming traffic so that legitimate requests continue to be served even under massive DDoS floods. This is precisely the purpose of a load-balancing DDoS mitigation architecture. Technical effect – By spreading the attack traffic across several resources, the load balancer absorbs the volumetric surge, reduces per-resource bandwidth saturation, and preserves service availability for benign traffic.
Why the other answers are incorrect

A: Sinkholing – Reroutes traffic to a controlled “sinkhole” for analysis. It does not distribute traffic across multiple resources; instead it concentrates it for monitoring, which would not mitigate a flood by spreading load. B. Black Hole Routing – Directs packets to a null interface, effectively discarding them. This approach does not balance load; it simply drops traffic and would cause legitimate users to lose connectivity as well. C. Rate Limiting – Caps the request rate per source or per interface.
While it can throttle excessive traffic, it does not distribute incoming requests across multiple capacity points; it merely throttles, which can still leave a single bottleneck vulnerable to saturation.
Conclusion – The described deployment of hardware and cloud-based mechanisms that distribute incoming traffic to maintain service continuity aligns with the Load Balancing mitigation strategy.

Reference:

EC-Council – Certified Ethical Hacker (CEH) v13 Exam Objectives – https://www.eccouncil.org/ceh-certification/certified-ethical-hacker-v13/ NIST Special Publication 800-41 Rev. 1 – Guide to Administering and Scoring the Security Log Management (SLM) Process – https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final

Explanation:

Why option A is the most appropriate control
Scope of impact – The incident stemmed from the actions of a single customer whose malicious behavior degraded the provider’s reputation and service quality for all customers. This type of cross-tenant contamination can only be mitigated by controls that segregate workloads and resources at the architectural level. Multi-tenant isolation – Enforcing strict isolation (using hypervisor-level security, dedicated networking, storage quotas, and sandboxed execution environments) guarantees that one tenant’s activities cannot affect another’s resources, thereby preserving service continuity and brand integrity. Proactive prevention – Isolation is a preventive measure; it stops the malicious behavior before it can propagate, unlike reactive controls such as logging or authentication, which address symptoms after the fact.
Why the other options are less suitable
B: Assessing multi-tenant isolation techniques – This describes a evaluation activity rather than an implementation of a control. The exam asks which security control would have prevented the issue, not how to evaluate one. C. Using strong encryption algorithms – Encryption protects data confidentiality and integrity, but it does not stop a tenant from abusing shared resources or launching attacks that affect other tenants. D. Enforcing robust authentication methods – Strong authentication secures entry points, yet the malicious activity originated from a legitimate authenticated session. It cannot prevent a legitimate user from performing harmful actions within the environment.
Therefore, A. Assessing multi-tenant isolation techniques is the control that directly addresses the root cause: the lack of effective separation between customers.

Reference:

Cloud Security Alliance – Shared Responsibility Model ( https://cloudsecurityalliance.org/research/shared-responsibility-model/ ) NIST Special Publication 800-144 – Guidelines on Security and Privacy in Public Cloud Computing
( https://csrc.nist.gov/publications/detail/sp/800-144/final )

Explanation:

Technical Justification
The payload 1 AND 1 < (SELECT COUNT(*) FROM all_users A, all_users B, all_users C) is crafted to force the database to evaluate a large, resource-intensive sub-query before the application can continue processing the request. Because the sub-query involves a Cartesian product of three dictionary tables ( ALL_USERS
repeated three times), the resulting row count can be astronomically high, causing the Oracle engine to spend considerable time executing the statement. The observed significant delay —while no error or data is returned to the attacker—is the classic symptom of a heavy-weight query that consumes CPU and/or I/O resources on the database server. This matches the definition of heavy query-based SQL injection , where the attacker does not rely on conditional errors or UNION clauses that generate visible output; instead, the injection simply makes the backend query slow down , which can be used for timing attacks or to trigger denial-of-service effects.
Correct option – D. Heavy query-based SQL injection
The injected fragment manipulates the logical evaluation of the query to increase its computational complexity . The delay occurs without any explicit time-based sleep command ( WAITFOR , pg_sleep , etc.) because the database itself must compute a massive result set. No data is extracted or displayed, ruling out UNION-based or error-based techniques. The behavior is specific to Oracle syntax ( ALL_USERS , Cartesian joins) and does not involve out-of-band channels.
Why the other options are unsuitable

A: Time-based SQL injection using WAITFOR DELAY – This technique relies on an explicit delay function supplied by the DBMS (e.g., WAITFOR DELAY '0:0:5' in SQL Server). Oracle does not support WAITFOR ;
instead, delays arise indirectly from heavy queries. B. Union-based SQL injection – A UNION payload would typically return additional rows or columns to the application (e.g., SELECT … UNION SELECT … ). In this scenario, no output is observed, indicating that the injected fragment does not concatenate result sets.
C: Out-of-band SQL injection – This method triggers a separate network request (e.g., DNS or HTTP) based on the injection condition. The described behavior is purely request-latency related, with no evidence of external callbacks.
Hence, the most accurate classification is Heavy query-based SQL injection .

Reference:

OWASP Testing Guide – Injection – Detailed description of heavy-weight query attacks and timing-based exploitation. https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Client_Side_Testing/01-Introduction Oracle® Database Security Guide – SQL Injection – Discusses how complex queries and Cartesian joins can be leveraged in injection attacks. https://docs.oracle.com/en/database/oracle/oracle-database/19/tdbks/oracle-database-security-guide.pdf