A large media-streaming company begins receiving complaints from users that their web application is timing out or failing to load. The security team observes that the web server is overwhelmed with a high number of open HTTP connections, most of which appear to be legitimate but are transmitting data at an abnormally slow rate. These connections are never fully completed, causing the server’s resources to remain occupied and unable to process new incoming client requests. The incident response team rules out bandwidth exhaustion and malformed packet-based attacks and suspects an application-layer DoS technique is responsible. Given the scenario, which specific type of attack is most likely being executed on the company’s web application?
Answer(s): C
Technical justificationThe described behavior – a large number of long-lived HTTP connections that stay open but send data extremely slowly, eventually exhausting the server’s concurrent-connection limit – is characteristic of a Slowloris attack. This technique does not consume bandwidth or require malformed packets; instead it exploits the target web server’s connection-handling logic by holding sockets open while sending partial headers at intervals just long enough to keep the connection alive but short enough to prevent the server from timing out. As a result, the server can accept only a handful of additional connections and cannot serve legitimate clients, leading to the reported time-outs.Why option C is correctSlowloris intentionally creates many open sockets and throttles request transmission, precisely matching the observed symptom of “legitimate-looking, abnormally slow HTTP traffic” that occupies resources without appearing as a traditional flood. The attack deliberately targets the application layer (HTTP) to saturate the server’s connection pool, which aligns with the incident response’s exclusion of bandwidth-based or network-layer attacks.Why the other options are unsuitableOption A describes a classic UDP flood that overwhelms bandwidth; the scenario explicitly rules out bandwidth exhaustion and involves TCP/HTTP, not random UDP traffic. Option B refers to fragmented packets with overlapping offsets, a technique used to confuse IP stack processing, but the observed traffic consists of completed HTTP requests, not malformed IP fragments. Option D mentions continuous ICMP Echo Requests, a network-layer ICMP flood that would generate obvious ping traffic; the complaint focuses on HTTP connections, not ICMP, and the attack is clearly application-layer.Thus, the only answer that accurately reflects the application-layer, connection-persistence exploitation described is C – a Slowloris attack .
EC-Council – Slowloris description in the CEH v13 exam objectives: https://www.eccouncil.org/ethical-hacking-certification/ceh-v13/ CVE-2009-2812 – Original Slowloris vulnerability report: https://cve.mitre.org/cgi-bin/cvename.cgi? name=2009-2812
During an ethical hacking exercise, a security analyst is testing a web application that manages confidential information. The analyst suspects the application may be susceptible to SQL injection attacks. Which of the following payloads will most likely reveal if the application is vulnerable to time-based blind SQL injection attacks?
Answer(s): A
Technical justificationOption A – ‘ AND BENCHMARK(5000000,ENCODE(‘test’,‘test’)); -- forces the DBMS to execute a heavy function( ENCODE ) for 5 million iterations. In a time-based blind injection, the application measures response time; a noticeable delay confirms that the injected predicate is being evaluated, revealing vulnerability. This payload directly triggers a time delay based on a condition, making it the most reliable indicator of a blind-time injection point.Option B – ‘ UNION SELECT NULL, NULL, NULL; -- is an error-based or union-based vector; it attempts to pull data back rather than cause a timing effect. If the query returns no data or throws an error, you may learn something, but it does not test for time-based behavior, so it is unsuitable for proving a blind-time condition.Option C – ‘ AND 1=0 UNION ALL SELECT ‘admin’,‘admin’; -- combines a logical false test with a UNION that injects rows. It can enumerate data but again relies on result-set errors or visible output, not on response-time variation, making it less appropriate for a pure blind time test.Option D – ‘ OR ‘1’=‘1’; -- is a classic tautology that would always be true; it merely confirms that the injection point is present but does not produce a measurable timing difference, so it cannot be used to verify a time-based blind injection.Conclusion – Only option A deliberately imposes a controlled delay whose existence can be observed by the tester, making it the correct payload for confirming a time-based blind SQL injection vulnerability.
OWASP Testing Guide – Blind SQL Injection NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment (Chapter on Time-Based Blind SQL Injection) – https://csrc.nist.gov/publications/detail/sp/800-115/final
You are a security consultant who has been hired to conduct security awareness training at a mid-sized organization. During the session on social engineering, you emphasize the importance of being vigilant against different types of social engineering attacks. Which of the following scenarios best describes a tailgating social engineering attack?
Answer(s): D
Why option D is the correct answerTailgating is defined as an attacker physically following an authorized person through a controlled access point to gain unauthorised entry without presenting credentials. In the scenario, the intruder follows an employee through a secure door before it closes, which matches the classic definition of tailgating. Option A describes a classic phishing email that solicits credentials—social engineering, but it is digital credential harvesting , not physical proximity or unauthorized entry. Option B represents vishing (voice phishing), where an attacker manipulates a service representative over the phone. This is a remote deception technique, not a physical access breach. Option C illustrates baiting with a malicious USB device left in a public area, aiming to trick a user into executing malware. It exploits curiosity but does not involve gaining entry to a secured facility.Therefore, only option D accurately depicts a tailgating attack, which relies on exploiting physical security gaps rather than digital communication channels.
NIST Special Publication 800-50 Rev. 1 – “Guide to Testing and Assessment of Security Controls.” ( https://csrc.nist.gov/publications/detail/sp/800-50/rev-1/final ) OWASP “Social Engineering” Cheat Sheet ( https://cheatsheetseries.owasp.org/cheatsheets/Social_Engineering_Cheat_Sheet.html )
As a cybersecurity professional in XYZ Corporation, you’ve been assigned to investigate an anomaly in the system logs that suggest possible unauthorized activities. The system administrators detected repeated failed login attempts on a critical server, followed by a sudden surge in outbound data traffic. These events, while discrete, are raising concerns that the system may have been compromised. Given the high stakes and sophisticated nature of this potential security breach, what should be your initial course of action to manage this situation effectively?
JustificationOption C – Real-time monitoring and log analysis is the most appropriate first step because it allows the investigator to:1. Confirm the nature of the activity without disrupting ongoing operations, preserving volatile evidence such as active connections and process states. 2. Identify attack vectors, compromised accounts, or mis-configurations by correlating failed login attempts with the subsequent outbound traffic spike. 3. Enable rapid, targeted containment (e.g., firewall rules or host-based IDS alerts) once the malicious behavior is characterized, minimizing impact on legitimate services. 4. Support forensic documentation for later escalation or incident-response reporting, ensuring a clear chain of evidence.Option A – Immediately change credentials may lock out legitimate users and, without prior analysis, could mask the attacker’s foothold or destroy volatile logs needed for investigation.Option B – Disconnect the server outright terminates legitimate business functions, creates a denial-of-service impact, and does not address the root cause; it also prevents further data collection that could clarify the incident.Option D – Audit all outbound traffic and scrutinize destination IPs is valuable, but performing it prior to real-time monitoring risks missing critical contextual data (e.g., the timing of the failed attempts) and may be computationally expensive on a busy critical server.Conclusion: Initiating live monitoring and detailed log scrutiny (Option C) provides the optimal balance of evidence preservation, contextual understanding, and the ability to apply a precise countermeasure without unnecessary service interruption.
NIST Special Publication 800-61 Rev. 2 – Computer Security Incident Handling Guide: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA – Incident Response Lifecycle: https://www.cisa.gov/incident-response-lifecycle
A critical infrastructure facility has an extensive network of IoT devices integrated with its OT systems. Following a recent surge in cyberattacks on similar facilities globally, the security team received an anonymous email detailing a possible attack on their systems. The attacker allegedly plans to compromise the IoT devices and use them as a gateway to the OT systems. What should be the immediate action of the security team to mitigate this threat?
Justification for Selecting Option CCorrect Mitigation – The email warns of IoT devices being leveraged as a foothold into OT environments. The most direct way to stop an attacker from using those devices as “gateways” is to ensure that communications between IoT and OT subsystems are cryptographically protected and authenticated . Implementing a secure communication protocol (e.g., TLS/DTLS, mutual authentication) isolates device traffic from the broader IT network, prevents man-in-the-middle hijacking, and stops lateral movement into OT. Least Exposure to Immediate Threat – Deploying such a protocol can be done rapidly through policy changes on existing devices (if supported) or by inserting security gateways that enforce encrypted tunnels. It does not require lengthy assessments, external testing, or buying new AI-driven platforms, which would leave a window of exposure. Alignment with Standards – Frameworks such as IEC 62443 and NIST 800-82 prescribe secure, authenticated communication channels as a baseline control for any integration of IoT and OT. Meeting these standards is required for critical-infrastructure compliance.Why the Other Options Are Less AppropriateOption A – Full-scale pen test on IoTPenetration testing validates vulnerabilities after the interface is already exposed. Conducting a comprehensive test now would consume time and resources while the attack may already be underway. It does not stop ongoing malicious traffic. Option B – Deploy ML-based security solutionMachine-learning models are useful for anomaly detection in mature environments, but they require extensive training data and historical baselines. In an urgent incident, such a solution cannot guarantee immediate protection and may generate false positives that mask the real attack. Option D – Employ IDS/IPS on the networkAn IPS can flag malicious traffic, yet many IoT protocols operate over non-standard ports and use obscure encodings, making reliable detection difficult. Moreover, signature-based IPS cannot block a novel tunnelling technique that blends with legitimate OT traffic without prior knowledge.Hence, establishing a secure, encrypted, authenticated communication channel directly addresses the attack vector (IoT-to-OT tunnelling) and is the fastest, most deterministic control for the given threat.
IEC 62443-3-3 – Security for Industrial Automation and Control Systems (IACS) – Section 4.2 “Secure Communication Between Levels”. https://webstore.iec.ch/publication/60261 NIST Special Publication 800-82 Rev. 2 – Guide to Industrial Control Systems (ICS) Security . https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final(These links provide the authoritative guidance that underpins the recommended action.)
In an enterprise environment, the network security team is alerted to unusual network behavior suggestive of advanced sniffing techniques being employed by a potential attacker. Upon closer examination, it is discovered that the adversary is exploiting vulnerabilities in legacy protocols to intercept sensitive communications. The security team must identify the specific sniffing technique being utilized and deploy effective countermeasures to protect critical assets. Amidst the advanced sniffing activities observed in the enterprise network, which intricate technique poses the most formidable challenge for the security team to detect and neutralize effectively, potentially compromising the confidentiality of proprietary information?
Technical JustificationThe most formidable sniffing technique in this scenario is Covert Channel Establishment through Modbus Protocol Manipulation (Option A) .Modbus is a widely deployed, legacy industrial-control protocol that operates at the data-link layer of many critical infrastructure systems (SCADA, PLCs, etc.). Because it is often excluded from traditional network-IDS/IPS signatures and rarely inspected by standard security appliances, adversaries can embed malicious control commands within legitimate Modbus function codes (e.g., 0x04 – Read Input Registers) to create a covert signalling channel. Such manipulation allows the attacker to exfiltrate sensor data or inject malicious commands without triggering protocol-level anomalies that would be flagged by deep-packet inspection tools trained on modern protocols. The covert channel can be resilient to traffic-volume-based detection because it piggybacks on legitimate read/write cycles, making it extremely difficult to distinguish from normal operational traffic.Why the other options are less challengingCovert Data Interception via X.25 Packet Fragmentation (B) relies on an obsolete packet-switched protocol that has been largely superseded by IP; modern network monitoring tools routinely reassemble and inspect X.25 fragments, making concealment more straightforward. Encrypted Data Extraction via HTTP Header Field Overflows (C) occurs within the familiar HTTP request/response flow; security solutions such as Web Application Firewalls and HTTP-aware IDS can readily inspect header fields for anomalies, limiting the stealth of this technique. Steganographic Payload Embedding within SMTP Email Headers (D) also exploits a standard application-layer protocol; many email security gateways perform content scanning and header validation, reducing the likelihood of prolonged undetected exploitation.Therefore, the Modbus-based covert channel presents the highest detection difficulty because it exploits a protocol that is often unmonitored, operates at a low OSI layer, and allows persistence within critical operational traffic.
NIST Special Publication 800-82 Rev. 2 – Guide to Industrial Control Systems (ICS) Security ( https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final ) SANS Institute – Industrial Control System (ICS) Security – Modbus Protocol Overview ( https://www.sans.org/cyber-security-awareness-training/resources/modbus-protocol-security/ )
In your role as a cybersecurity specialist for a growing tech company, you are tasked with performing a regular network scan to check for any potential vulnerabilities. Your manager has specifically asked you to use a NULL scan for this round. In the context of TCP NULL scanning, what response (or lack thereof) would indicate that a particular port on a target machine is closed?
Answer(s): B
ReasoningA TCP NULL scan sends packets with no flag bits (NULL, FIN, or Xmas). The target’s TCP/IP stack follows RFC 793: a closed port must reply with a RST (reset) packet to any unexpected TCP segment, including a NULL scan. Therefore, receiving a RST indicates that the port is closed . If the port were open , the stack would typically ignore the packet (no response) or reply with an ACK; a SYN/ACK is characteristic of a SYN scan and does not apply to NULL scanning. An ICMP error message is not a standard TCP response to a TCP NULL packet; it would only appear if the host is configured to generate ICMP “port unreachable” for IP-level filtering, which is unrelated to the TCP state. A lack of response usually means the packet is being filtered (e.g., stateful firewall) or the host is silently dropping the packet, not that the port is closed.Hence, the correct answer is B – the target machine responds with a TCP RST packet , which definitively signals a closed port in a TCP NULL scan.Why the other options are unsuitableA – No response – indicates filtering or an open/filtered port, not a closed one. C – ICMP error message – pertains to IP-level unreachability and does not represent the TCP state of a specific port. D – SYN/ACK packet – is the hallmark of an open port in a SYN scan, not a closed-port indication in a NULL scan.
Nmap Network Scanning – TCP NULL Scan Description https://nmap.org/book/man-html/evasion.html#def-tcp-null-scanTCP/IP RFC 793 – Transmission Control Protocol (Section on RST handling) https://datatracker.ietf.org/doc/html/rfc793#section-3.1These sources detail how NULL scans interpret a returned RST packet as evidence of a closed port.
A penetration tester is evaluating a web application that uses HTTPS, secure cookies, and implements multi factor authentication to prevent session hijacking. To hijack a legitimate user’s session without triggering security alerts, which advanced technique should the tester employ?
Why option B is the best choiceDirect client-side compromise – A zero-day in the target browser allows the tester to execute arbitrary code in the context of the legitimate user’s session. By injecting malicious scripts (e.g., via XSS or a remote code-execution exploit), the attacker can read the victim’s encrypted session cookie/token, reuse it, and manipulate the session without the server detecting any abnormal activity. Bypasses server-side protections – Because the attack originates from the compromised browser, standard server controls such as secure cookies, HTTPS encryption, and multi-factor authentication remain intact; the hijack occurs entirely on the client side, evading detection by typical IDS/IPS or server logs. Stealth factor – The malicious code runs only in the victim’s browser, leaving little forensic evidence on the server. The hijacked session can be leveraged to perform actions indistinguishable from a legitimate user, avoiding alerts that would be raised by token replay or abnormal network traffic.Why the other options are less suitableA: CSRF manipulation – CSRF relies on a victim’s authenticated browser to submit a forged request, but it does not provide direct session-token access. The attacker can only trigger actions the server permits; it does not grant the ability to steal or reuse the encrypted session token without being logged as a new authenticated session. C. Session token replay – Modern applications bind session tokens to cryptographic parameters (e.g., HMAC, short expiration) that make replay of captured tokens ineffective unless the token can be decrypted or the replay window is open. Capturing an encrypted token does not guarantee successful reuse, and automated replay often triggers security controls (e.g., replay-attack detection). D. MITM on a trusted network device – To pull off a MITM attack on a trusted network, the tester must have compromised a core router, switch, or similar infrastructure. Such compromises are high-risk, likely to be logged, and usually generate suspicious traffic patterns that trigger alerts; they also expose the attacker to detection unrelated to the web application itself.
OWASP Cheat Sheet Series – Cross-Site Scripting (XSS): https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Cheat_Sheet.html OWASP CSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Request_Forgery_Prevention_Cheat_Sheet.html
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.