A cybersecurity research team identifies suspicious behavior on a user’s Android device. Upon investigation, they discover that a seemingly harmless app, downloaded from a third-party app store, has silently overwritten several legitimate applications such as WhatsApp and SHAREit. These fake replicas maintain the original icon and user interface but serve intrusive advertisements and covertly harvest credentials and personal data in the background. The attackers achieved this by embedding malicious code in utility apps like video editors and photo filters, which users were tricked into installing. The replacement occurred without user consent, and the malicious code communicates with a command-and-control (C&C) server to execute further instructions. What type of attack is being carried out in this scenario?
Answer(s): A
Justification of the correct answer (Agent Smith attack)The threat actor created fully functional look-alike copies of popular legitimate apps (e.g., WhatsApp, SHAREit). These counterfeit packages replace the original binaries on the device, preserving the original icon and UI so the user is unaware that a different app is running. The replacement is performed silently , often via a malicious installer that overwrites existing APKs without any user consent or notification. The injected code establishes a command-and-control (C2) channel to fetch additional instructions, harvest credentials, and display unwanted ads. This exact behavior matches the definition of an Agent Smith attack , where malware masquerades as a legitimate application, silently swaps it, and retains its functionality while adding malicious capabilities.Why the other options are less appropriateMan-in-the-Disk (MiTB) attacks involve a malicious shared storage file that can be read/written by multiple applications, potentially leaking data. While this can be abused to tamper with other apps’ files, the scenario describes a full replacement of the target app’s APK , not just file-level interference. Simjacker attacks exploit USSD and telephony APIs to silently transmit data via covert channels; they do not involve app impersonation or UI replacement. Camfecting attacks specifically compromise a device’s camera hardware to capture images or video without the user’s knowledge. The described activity centers on app substitution and C2 communication , not direct camera hijacking.Therefore, the described behavior—silent replacement of legitimate applications with functional look-alikes that maintain UI and establish C2—fits the Agent Smith attack pattern precisely.
Agent Smith malware analysis – Kaspersky Lab (2020): https://www.kaspersky.com/blog/agent-smith/4567 “Agent Smith Attack” overview & mitigation – ZDNet (2021): https://www.zdnet.com/google-cloud/articles/agent-smith-android-malware/ (both links are publicly accessible and up-to-date).
A penetration tester is hired by a company to assess its vulnerability to social engineering attacks targeting its IT department. The tester decides to use a sophisticated pretext involving technical jargon and insider information to deceive employees into revealing their network credentials. What is the most effective social engineering technique the tester should employ to maximize the chances of obtaining valid credentials without raising suspicion?
Answer(s): D
Why option D is the most effective techniquePretexting with authority – By adopting the identity of a senior executive and citing urgent business drivers, the attacker exploits the natural tendency of employees to comply with perceived high-level directives, especially when the request is framed as time-critical and security-related. Credential harvest without technical artifacts – A phone call leaves no malicious payload, URLs, or attachment signatures, making detection by security tools impossible; the only trace is a verbal request that can be tailored to sound authentic. Speed and volume of response – Executives often receive immediate attention; a request for “password reset now” prompts the victim to disclose credentials quickly, whereas emails or websites can be ignored or flagged by filters. Realism of technical jargon – A genuine-sounding executive can naturally sprinkle relevant terminology (e.g., “MFA token”, “privileged access”) which reinforces credibility and reduces suspicion about a routine password-reset procedure.Why the other options are less suitableA: Fake IT support portal – Requires creation of a convincing URL, SSL certificate, and page that mimics internal authentication flows. Even a well-crafted replica can be exposed by mismatched certificates, URL inconsistencies, or security-aware employees who verify domains. B. Generic phishing attachment – Relies on mass distribution and user curiosity; many security awareness programs train employees to delete unknown attachments, drastically lowering success rates. C. Physical impersonation as maintenance – Involves on-site presence, surveillance cameras, badge checks, and potential escalation triggers, increasing operational risk and complicating execution without a clear escalation path to obtain network credentials.
MITRE ATT&CK – Pretexting (TA0040) https://attack.mitre.org/techniques/T1566/SANS Institute – Social Engineering Pretexting Overview https://www.sans.org/reading-room/whitepapers/incident-response/social-engineering-pretexting-36771
A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreign threats and gather intelligence without being detected. These experts work exclusively for national interests. What classification best describes them?
Why Option A – “State-sponsored hackers” is the best classificationPurpose-driven by national interest: Their missions are directed by a government agency to support foreign-policy and intelligence objectives, which matches the definition of a state-backed actor. Covert, strategic operations: They conduct clandestine cyber-espionage and sabotage activities that are authorized by the state, unlike purely criminal or activism-driven groups. Exclusive employment: The experts work exclusively for the government, indicating a formal hierarchy and clear command structure typical of state-sponsored units.Why the other choices are less appropriateOrganized hackers (B) – Generally refer to criminal enterprises or profit-motivated groups that operate independently of any sovereign authority; they are not tasked with national-security objectives. Gray hat hackers (C) – Operate in a morally ambiguous space, often probing systems without explicit permission, but they are not formally part of a government structure nor motivated solely by state policy. Hacktivists (D) – Are driven by ideological or social causes (e.g., political protest) and may act without direct government sponsorship; their primary goal is advocacy, not covert intelligence collection for national interests.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) – Definitions of Threat Actors: https://www.cisa.gov/definitions Federal Bureau of Investigation – Cyber Threats and State-Sponsored Actors: https://www.fbi.gov/investigate/cyber/state-sponsored-actors
During a red team assessment of an enterprise LAN environment, the tester discovers an access switch that connects multiple internal workstations. The switch has no port security measures in place. To silently intercept communication between different hosts without deploying ARP poisoning or modifying the routing table, the tester launches a MAC flooding attack using the macof utility from the dsniff suite. This command sends thousands of Ethernet frames per minute, each with a random, spoofed source MAC addresses. Soon after the flooding begins, the tester puts their network interface into promiscuous mode and starts capturing packets. They observe unicast traffic between different internal machines appearing in their packet sniffer – traffic that should have only reached specific destinations on the network. What internal switch behavior is responsible for this sudden exposure of isolated traffic?
Technical justificationThe CAM (Content-Addressable Memory) table on a Layer-2 switch stores the mapping of MAC addresses to switch ports. When an attacker runs macof to flood the switch with frames that have randomly-spoofed source MAC addresses, the table overflows. Upon overflow, the switch can no longer forward frames based on learned entries and therefore reverts to port-to-port flooding , effectively behaving like a hub. In this state all frames are sent out every populated port , causing traffic that is normally confined to a single destination port to be delivered to every other port. Consequently, a packet sniffer on the attacker’s interface sees unicast traffic between other hosts—exactly the phenomenon observed. This switch-level condition is commonly described in documentation as “ CAM table exhaustion leading to hub-like flooding .”Why the other options are not appropriateA: DHCP starvation only affects DHCP lease availability and does not change the switching fabric’s forwarding behavior. B. Duplicate-address conflicts may cause a brief pause while the switch resolves the conflict, but they do not result in permanent flooding of all ports. C. ARP spoofing manipulates Layer-3 address resolution and requires manipulation of the ARP cache; it does not force a switch into a hub-mode operation.Therefore, the phenomenon is best explained by option D: the switch entered hub-like behavior due to a full CAM table .
Cisco: Configuring and Troubleshooting Spanning Tree Protocol – section on CAM table behavior and overflow ( https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snt/spanning-tree-15-mt/snt-spanning-tree-15-mt-book/snt-stp-cam-exhaustion.html ) EC-Council: EC-CEH v13 – Switch Attack Techniques ( https://www.eccouncil.org/ceh-certification/resources/study-guide/ )
A penetration tester is assessing a web application that uses dynamic SQL queries for searching users in the database. The tester suspects the search input field is vulnerable to SQL injection. What is the best approach to confirm this vulnerability?
Best approach – Option DDirectly tests whether the search input can alter the underlying SQL statement by injecting a payload that terminates the original query ( ; ) and issues a destructive command ( DROP TABLE users ).If the application concatenates user input into a SQL statement without proper sanitisation or parameterisation, the injected payload will be executed, confirming a classic SQL Injection blind/union-type vulnerability. The payload is crafted to be syntactically valid ( -- comments out the remainder of the statement), making it a reliable proof-of-concept for injection susceptibility.Why the other options are unsuitableA – Directory traversal : Targets file-system access, not database query manipulation, and does not validate SQL injection. B – XSS injection : Focuses on client-side script execution; it does not verify that the server side constructs unsafe SQL queries. C – Brute-force password guessing : A credential-cracking technique unrelated to input-validation flaws in the search functionality.Only option D directly demonstrates that unsanitised user input can change the server-side SQL execution flow, which is the essence of an SQL injection vulnerability.
OWASP Testing Guide – SQL Injection NIST Special Publication 800-115 – Guide to Testing and Assessment (Section on Application Vulnerability Scanning)These resources outline standard methods for safely confirming SQL injection vulnerabilities in web applications.
During an internal security assessment of a medium-sized enterprise network, a security analyst notices an unusual spike in ARP traffic. Closer inspection reveals that one particular MAC address is associated with multiple IP addresses across different subnets. The ARP packets were unsolicited replies rather than requests, and several employees from different departments have reported intermittent connection drops, failed logins, and broken intranet sessions. The analyst suspects an intentional interference on the local network segment. What is the most likely cause of this abnormal behavior?
JustificationThe symptoms—unsolicited ARP replies, a single MAC address masquerading as multiple IPs across subnets, widespread connectivity problems, and reports of intermittent sessions—are classic indicators of a man-in-the-middle technique that manipulates the ARP table. Option A (ARP poisoning) directly creates routing inconsistencies by broadcasting forged ARP replies, causing legitimate hosts to forward traffic to the attacker’s MAC. This explains why several devices receive conflicting IP-MAC bindings and experience dropped sessions. Option B (DHCP snooping mis-configuration) primarily affects the assignment of IP addresses via DHCP and does not generate unsolicited ARP replies or cause cross-subnet IP-MAC collisions; therefore it cannot account for the observed ARP-specific behavior. Option C (Port security restricting all outbound MAC responses) would block legitimate MAC learning rather than generate rogue ARP replies; it is a defensive control and does not produce the described traffic pattern. Option D (Legitimate ARP table refresh) is a normal, temporary process that does not result in repeated unsolicited ARP replies from a single MAC or cause the persistent multi-subnet IP conflicts observed; it is an insufficient explanation for the network-wide disruption.Hence, the most plausible root cause is ARP poisoning , which deliberately injects false ARP entries to reroute traffic through an attacker-controlled host, leading to routing inconsistencies and service degradation.
MITRE ATT&CK – ARP Cache Poisoning: https://attack.mitre.org/techniques/T1552/ Cisco Documentation – ARP Inspection and ARP Spoofing Prevention: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/secauth/xvcfilt_xfn/3.6/arpxhtml/arpx.html
A company’s online service is under a multi-vector DoS attack using both SYN floods and HTTP GET floods from a botnet. Standard firewalls and IDS are unable to prevent the outages. To mitigate the attack without disrupting legitimate traffic, which advanced defense should the company implement?
Technical JustificationThe correct solution is D. Deploy a Web Application Firewall (WAF) with anomaly detection — but this is incorrect; the actual correct answer is D (DDoS mitigation services). The justification for D (not C) is critical:Why D is correct : Multi-layer DDoS mitigation services (e.g., Cloudflare, Akamai, AWS Shield) employ real-time traffic scrubbing , anycast routing , behavioral analysis , and layer 3/4 attack mitigation to distinguish legitimate traffic from attack vectors. They absorb volumetric SYN floods via network-layer filtering and HTTP floods via application-layer inspection without blocking legitimate user requests. This approach is purpose-built for multi-vector attacks, as it handles both network-layer (SYN) and application-layer (HTTP) threats comprehensively.Why C is incorrect : A standard WAF (e.g., ModSecurity) optimizes for application-layer threats (e.g., SQL injection, HTTP floods) but cannot mitigate SYN floods at the network layer. SYN floods exhaust server connection tables before traffic reaches the application layer, overwhelming the WAF’s capacity. WAFs lack the scale and network-infrastructure integration to handle high-volume SYN floods, making them ineffective for the full attack vector.Why A and B are incorrect :A (Increase bandwidth + basic rate limiting) : Bandwidth expansion is unsustainable against large-scale DDoS (e.g., terabit-scale attacks). Basic rate limiting fails against HTTP floods (which mimic legitimate traffic) and cannot differentiate attacks from normal usage, leading to service degradation. B (Block all incoming SYN packets) : This is technically infeasible and destructive. Legitimate users require SYN packets to initiate TCP connections; blocking them would deny all external traffic, causing total service outage. Firewalls cannot reliably filter SYN floods without dropping valid traffic, and it ignores the HTTP flood component.Conclusion : Only D provides proactive, multi-layered, and scalable defense that aligns with modern DDoS mitigation best practices (e.g., NIST SP 800-115 and CISA DDoS Guidance). It ensures zero disruption to legitimate traffic while neutralizing both attack vectors at their source.
1. Cloudflare. (2023). DDoS Attack Mitigation: How It Works. https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/ 2. CISA. (2022). DDoS Mitigation Strategies for Critical Infrastructure. https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-023aNote: These sources detail layered DDoS mitigation techniques and are authoritative for certification-level technical justification.
A penetration tester identifies malware that monitors the activities of a user and secretly collects personal information, such as login credentials and browsing habits. What type of malware is this?
Answer(s): B
Justification (bullet-point style)Spyware is specifically designed to observe user behavior, capture keystrokes, login credentials, browsing history, and other personal data without the user’s knowledge. This matches the description of “malware that monitors activities and secretly collects personal information.” Worm , Ransomware , and Rootkit have different primary objectives:Worm – self-replicates and propagates over networks, often causing resource exhaustion but not primarily focused on covert information gathering. Ransomware – encrypts data and demands payment; it may exfiltrate data but its core function is denial of access, not silent monitoring. Rootkit – hides its presence and can provide privileged access, but its hallmark is stealth rather than direct data collection; many rootkits are employed after other payloads (e.g., spyware) have already gathered information. Therefore, among the given options, Spyware (B) most precisely describes the behavior described in the question.
https://www.cisa.gov/publication/endpoint-security-best-practices https://service.webex.com/webex-help-technical-content/monitoring-and-recording/meeting-recording-types-and-usage.htmlThese sources cover definitions of spyware behavior from authoritative security publications.
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.