You’ve been hired as a Certified Ethical Hacker (CEH) by a large multinational corporation to investigate the unauthorized access of sensitive data from their web application. You discover that the web application uses a custom authorization scheme involving token-based authentication. The system issues tokens, which expire after 30 minutes. In the server logs, you notice multiple failed login attempts using expired tokens within a 3-minute window, followed by successful access with a valid token. You suspect that an attacker exploited the authorization scheme. What could be the most likely attack scenario?
Answer(s): C
JustificationCorrect option – C (Token captured before expiry and reused)The logs show a sequence of failed login attempts using expired tokens, followed by a successful access using a valid token within a short timeframe. This pattern is characteristic of an attacker who obtains a legitimate token (e.g., by sniffing a successful authentication request), stores it, and later replays it before the token’s 30-minute lifetime expires. Because the token is still within its validity window, the server accepts it, granting access without needing to crack or forge the token. The presence of multiple failed attempts with expired tokens indicates that the attacker may have attempted replay with older tokens first, which were rejected, before finally presenting a still-valid token.Why the other options are less appropriateA – Race-condition exploiting token expiration : A race condition would require a timing flaw where the server validates a token after it has expired but before the check completes, which is uncommon in well-implemented token schemes and is not directly indicated by the observed pattern of failed expired-token attempts followed by a successful one. B – Brute-forcing the token generation algorithm : Brute-forcing would generate many invalid tokens that are accepted, leading to a high volume of successful (rather than failed) log entries. The logs show only a single successful access after repeated failures, inconsistent with a brute-force effort. D – Token replay attack confusing the server to accept an expired token : A replay attack that deliberately uses an expired token and convinces the server to accept it would still be rejected by the server’s expiration check. The scenario described ends with a successful access on a valid token, not an expired one.Conclusion The most plausible attack scenario is that an attacker captured a legitimate token while it was still active and replayed it to bypass authentication. This aligns with the observed timing of failed expired-token attempts and a subsequent successful access using a valid token.
OWASP Authentication Cheat Sheet – Token Handling: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html RFC 6750 – The OAuth 2.0 Token Dispatcher: https://tools.ietf.org/html/rfc6750
A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this particular service to hide malicious activities?
Answer(s): B
JustificationWhy option B is correctBITS (Background Intelligent Transfer Service) runs over HTTP/HTTPS using the standard Windows Update port (port 80/443). Its traffic patterns—regular request/response cycles, size-based throttling, and use of the same URL-based request format as legitimate updates—make it indistinguishable from normal Microsoft update traffic to typical firewalls and IDS/NGFW signatures. Because it employs the sameTCP streams and TLS handshakes as normal Windows Update, it can bypass content-filtering and deep-packet inspection that focus on unusual ports or protocols.Why the other options are unsuitableA – Encrypted DNS packets – BITS does not use DNS tunneling; it relies on HTTP/HTTPS, not encrypted DNS. C – Operates exclusively through HTTP tunneling – While BITS uses HTTP, it does not encapsulate arbitrary traffic in an HTTP tunnel; it simply leverages HTTP to transfer files, not to hide arbitrary payloads across the network. D – Utilizes IP fragmentation – BITS does not fragment IP packets as a primary evasion mechanism; its stealth comes from protocol mimicry, not from packet size manipulation.Conclusion Attackers choose BITS precisely because its traffic resembles benign Windows Update flows, allowing it to blend in with legitimate system updates and evade detection by firewalls and IDS that lack granular visibility into HTTP-based Windows services.
Microsoft Docs – “Background Intelligent Transfer Service (BITS) Overview”: https://learn.microsoft.com/en-us/windows-server/administration/technologies/background-intelligent-transfer-service/background-intelligent-transfer-service MITRE ATT&CK – “Transfer Over Web Services: BITS”: https://attack.mitre.org/techniques/T1105/Prepared for CEH-v13 style review.
You are a new member of your company’s IT team, and you've been assigned to understand and implement ethical hacking principles to improve the company’s cybersecurity posture. Your supervisor highlights the importance of following the five phases of ethical hacking. What is the correct order of these phases?
Answer(s): A
Technical JustificationThe five-phase ethical-hacking methodology follows a logical, linear flow that mirrors the attacker’s lifecycle while ensuring that findings are systematically documented and remediation is planned:Reconnaissance – Passive/active information gathering (public data, DNS, WHOIS, etc.) defines the target’s footprint before any interaction. Scanning – Active enumeration (port scans, service fingerprinting, vulnerability scanning) validates the data collected and identifies exploitable assets. Gaining Access – Exploitation of identified vulnerabilities enables the tester to obtain a foothold in the environment. Maintaining Access – Post-exploitation activities (persistence mechanisms, credential harvesting) are performed to demonstrate long-term presence without alerting defenders. Covering Tracks – Cleanup (log deletion, artifact removal) ensures the test mimics a realistic adversary who wishes to avoid detection.Why Option A is correct Option A lists the phases in the exact sequence described above, matching the industry-standard model (e.g., the EC-Council’s “Advanced Penetration Testing” and NIST SP 800-115). This ordering reflects the natural progression from information gathering to post-exploitation hygiene, which is essential for credible, repeatable assessments.Why the other options are unsuitableOption B – Starts with “Gaining Access” without first gathering intelligence or scanning, making the approach speculative and unsupported by any legitimate methodology. Option C – Begins with “Maintaining Access,” which presupposes a foothold that could not have been established without prior reconnaissance and exploitation steps. Option D – Places “Scanning” before “Reconnaissance.” In practice, scanning cannot be meaningfully performed until the target’s scope and assets are understood; otherwise, scans generate unnecessary noise and miss contextual relevance.Thus, Option A is the only sequence that aligns with accepted ethical-hacking standards, providing a clear, repeatable workflow for security assessments.
EC-Council, Certified Ethical Hacker (CEH) v13 Exam Blueprint, https://www.eccouncil.org/ceh-certification/ National Institute of Standards and Technology, Special Publication 800-115: Technical Guide to Information Security Testing and Assessment, https://csrc.nist.gov/publications/detail/sp/800-115/final
As a certified ethical hacker, you have been engaged to evaluate the security protocols of a smart city project. This cutting-edge venture incorporates an interconnected system featuring intelligent traffic lights, public Wi-Fi points, and advanced water management facilities. Upon evaluating the IoT network’s logs, you stumble upon anomalous traffic patterns, signifying a high volume of data exchange between a particular traffic light and an external IP address. Your further investigation reveals that this traffic light has an inexplicably open port. Given the gravity of these revelations, what would be your subsequent course of action?
Answer(s): D
Why option D is the most appropriate actionImmediate containment – Isolating the compromised traffic light segments the breach, preventing the external IP from communicating further and limiting any potential impact on other city services (traffic control, water management, public Wi-Fi). Root-cause analysis – Removing the device from the production network allows a forensic examination of its firmware, configuration files, and operational logs without risking data loss or service disruption. Evidence preservation – Isolation protects volatile artifacts (e.g., running processes, memory dumps) that are essential for later legal or incident-response reporting. Safety & compliance – A smart-city environment involves public safety systems; premature exploitation attempts (e.g., reverse-connect testing or full network penetration) could trigger unsafe state changes (e.g., traffic-signal failure) and violate responsible-disclosure principles.Why the other options are less suitableA – Firewall rule amendment – Modifying firewall rules is reactive and may not address a compromised firmware or back-door that already exists within the traffic light. It also leaves the device on the network, allowing continued potential exfiltration. B – Full penetration test – Conducting a broad pen-test before containment could deliberately manipulate critical infrastructure, possibly causing denial-of-service or unsafe operational states, and would expose the environment to unnecessary risk. C – Reverse connection test – Attempting to force a reverse connection can alter the traffic light’s state and may trigger unintended control actions, endangering public safety and violating ethical hacking principles that prioritize “do no harm”.Hence, the safest and most methodical response is to isolate the device, investigate its firmware, and then apply remediation (Option D).
NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment – https://doi.org/10.6028/NIST.SP.800-115 ENISA “Incident Management Handbook” (2023 edition) – https://www.enisa.europa.eu/publications/incident-management-handbook
During a routine security audit, administrators found that cloud storage backups were illegally accessed and modified. What countermeasure would most directly mitigate such incidents in the future?
The 3-2-1 backup model (multiple copies, different media, off-site location) directly prevents lone-point failures and limits the impact of illegal access or modification of cloud storage backups, providing a clear recovery path. Biometric entry systems (B) address physical access control but do not protect data that has already been stored and accessible within the cloud environment. SQL injection testing (C) focuses on application-level query flaws; it does not mitigate tampering of backup data stored outside the application layer. Resource auto-scaling (D) adjusts compute resources for performance or cost, offering no defense against backup security breaches.
NIST SP 800-53 Revision 5 – CP-9 (Backup and Restore): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final# CP9AWS Backup Best Practices – 3-2-1 backup strategy: https://docs.aws.amazon.com/backup/latest/devGuide/best-practices.html
You have recently joined as a cybersecurity analyst at a multinational corporation. Your role includes regular vulnerability assessments of the company’s wide-ranging IT infrastructure. During one of these assessments, you employ the Nessus scanner. The scanner flags a severe vulnerability marked as CVE-2023-12456. This vulnerability specifically targets the SSH (Secure Shell) service running on one of the company’s Linux servers. With a CVSS (Common Vulnerability Scoring System) score of 9.0, the vulnerability poses a substantial risk. Most concerning is its ability to allow potential remote code execution. Given the high-risk nature of the vulnerability, as depicted by the CVSS score, and its potential impact, what course of action should be immediately prioritized from the following choices?
Why Option B is the optimal immediate responseCritical severity and remote code execution – CVE-2023-12456 carries a CVSS 3.1 base score of 9.0 and explicitly enables unauthenticated RCE on the SSH daemon. In such cases, the industry standard is to remediate the vulnerability before any other operational activity. Patching eliminates the attack surface entirely, whereas inspection, isolation, or work-arounds merely mitigate exposure temporarily. Patch-first policy aligns with CVSS-driven prioritisation – Most enterprise vulnerability-management frameworks (e.g., NIST SP 800-40, ISO 27001 Annex A.12.6) require that high-severity findings be addressed by applying the vendor-supplied fix as soon as practicable. The recommended patch closes the vulnerable code path, validates input, and removes the RCE vector. Scheduled reboot is necessary for full take-effect – Many Linux SSH daemons load patches only after a service reload or system reboot. Performing the reboot during the next planned maintenance window ensures minimal disruption while guaranteeing that the patched binary is active. Delaying the reboot would leave the system in a partially-patched state, preserving the risk. Compliance with change-control processes – Applying a vendor patch and scheduling a controlled reboot follows established change-management procedures, providing auditability, rollback capability, and verification that the fix was successful.Why the alternative choices are less suitableOption A – Manual inspection and false-positive handling – For a vulnerability with an active RCE capability, waiting for manual verification wastes critical time. Relying on a “false-positive” determination before patching may expose the system to exploitation while the scanner’s output is still under analysis. Option C – Backup SSH service and traffic rerouting – Creating a secondary SSH endpoint does not address the underlying flaw in the vulnerable daemon. An attacker can still target the original server directly, bypassing any backup service. Moreover, rerouting traffic adds latency and complexity without removing the vulnerability.Option D – Temporary isolation and audit before patching – Isolation reduces immediate attack surface but does not eliminate the exploit path; the vulnerable SSH service remains reachable from within the isolated segment. Postponing patch application until an in-depth audit may delay remediation indefinitely, contrary to best-practice timelines for critical CVEs.Implementation steps derived from Option B1. Download and verify the vendor patch for the affected SSH package. 2. Deploy the patch to the affected Linux server using the organization’s standard package-management tool (e.g., yum update , apt-get install ).3. Conduct a quick functional test to confirm that the SSH service starts without error. 4. Schedule a controlled reboot during the next maintenance window; ensure that all dependent services are gracefully stopped. 5. Post-reboot, validate that the patched version is running ( ssh -V ) and that the CVE scanner no longer reports the vulnerability. 6. Document the change, update the vulnerability-tracking ticket, and close it after verification.
NVD Entry for CVE-2023-12456 – https://nvd.nist.gov/vuln/detail/CVE-2023-12456 OpenSSH Security Advisory (example vendor patch guidance) – https://www.openssh.com/security.html (consult the specific advisory for the version that addresses CVE-2023-12456)These sources provide the technical details needed to justify the patch-first approach and to locate the official remediation instructions.
A large chemical plant uses operational technology (OT) networks to control its industrial processes. Recently, security personnel noticed abnormal behavior from critical Programmable Logic Controllers (PLCs), suspecting a stealthy compromise via malicious firmware. Which action should the team take first to effectively verify and neutralize this issue?
Technical justificationWhy option C is the optimal first stepA stealthy malware that modifies PLC firmware typically resides within the device’s firmware image, making hidden, unauthorized changes difficult to detect with network-level sensors alone. A detailed forensic inspection of the firmware (e.g., hashing, signature verification, static code analysis, and memory dump comparison) directly identifies any malicious modifications or backdoors that could control the process.This approach provides concrete evidence of compromise, enabling targeted remediation such as firmware re-flash, patch deployment, or device replacement, thereby neutralizing the threat before an attacker can exploit the altered control logic.Why the other options are less appropriate as the initial responseOption A – Enhanced IDS/IPS rules : Network-based anomaly detection is valuable for spotting traffic irregularities, but it cannot reliably uncover hidden firmware changes that do not affect network signatures. Deploying additional rules is a useful follow-up step after confirming a firmware issue. Option B – Immediate isolation of suspicious devices : Segmentation limits the lateral spread of malware but does not address the root cause—a compromised firmware image. Moreover, abrupt isolation may disrupt critical production processes without guaranteeing the threat’s removal. Option D – Restricting remote admin access : While tightening access control is a best practice for hardening OT environments, it does not directly verify whether existing PLC firmware has been tampered with. It is a preventative measure rather than a diagnostic action for an ongoing compromise.Conclusion Performing a meticulous firmware inspection (Option C) delivers the necessary forensic evidence to both verify the suspected compromise and neutralize it by confirming or refuting the presence of malicious code, which then informs subsequent containment or remediation actions.
NIST Special Publication 800-82 Rev. 2 – Guide to Industrial Control Systems (ICS) Security https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/finalCISA – Industrial Control Systems Cybersecurity Guide (ICS-CERT) https://www.cisa.gov/ics-security-best-practices
You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side controls. During your testing, you discover that client-side controls enforce password strength and ensure CAPTCHA validation. The application also uses a proprietary encryption algorithm for client-side data. Your goal is to bypass these client-side controls to assess how robust they really are. What method would be the most effective for bypassing these controls without triggering server-side alarms?
Key Insight: Client-side checks are merely a convenience for the user; they are never a reliable security boundary. The most reliable way to test whether the server enforces the actual authentication policy is to remove the client-side constraints altogether and submit malformed inputs directly . This approach proves that the server will accept or reject the credentials based on its own logic, not on the whims of JavaScript.Why Option B Wins:Directly evaluates the server’s validation. By disabling JavaScript you bypass any client-side script that enforces password complexity or CAPTCHA generation, forcing the browser to send whatever string you choose. If the server still accepts weak passwords or invalid CAPTCHAs, the flaw is confirmed. Stealthy and low-profile. No alteration of network traffic or encryption parameters is required, so no new signatures are generated that could trip server-side anomaly detectors. The request appears as a normal form submission from a standard browser. Reproducible and observable. You can capture the exact request/response that the server returns for a weak password or bad CAPTCHA, giving concrete evidence for remediation.Why the Other Options Are Less Suitable:A – Inject malicious JavaScript into the login form: While injection can alter client-side rules, modern browsers enforce Content-Security-Policy (CSP) and other sandboxing mechanisms that block arbitrary script injection on a different origin. Moreover, any injected script will be executed before the request is sent, potentially triggering client-side security extensions (e.g., CSP violations) that raise alerts.C – Use a proxy to modify client-side controls: Intercepting and rewriting outbound traffic is effective for testing vulnerabilities but typically involves altering request headers or payloads in a way that can be detected by Web Application Firewalls (WAFs) or SIEMs. This may generate alerts even if you succeed, and it requires more setup than simply disabling JavaScript.D – Reverse-engineer the proprietary encryption algorithm: Proprietary client-side encryption is often obfuscated or custom-rolled. Fully reverse-engineering it, understanding its key management, and then re-encrypting data accurately is time-intensive and error-prone. Even if successful, the server may still validate the integrity of the encrypted payload using checksums or digital signatures, making it difficult to bypass without triggering alerts.Bottom-line: The cleanest, most reliable, and least conspicuous way to confirm that client-side controls are ineffective is to disable JavaScript and submit the data you wish to test . This directly exposes any gaps in the server-side validation logic while avoiding any modifications that could be flagged by intrusion-detection mechanisms.
OWASP Testing Guide – Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html PortSwigger Web Security Academy – Client-side bypasses: https://portswigger.net/web-security/cheatsheet#client-side-bypasses
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.