A financial institution’s online banking platform is experiencing intermittent downtime caused by a sophisticated DDoS attack that combines SYN floods and HTTP GET floods from a distributed botnet. Standard firewalls and load balancers are unable to mitigate the attack without affecting legitimate users. To protect their infrastructure and maintain service availability, which advanced mitigation strategy should the institution implement?
Answer(s): A
Technical justificationOption A – Cloud-based DDoS protection with multi-layer scrubbing and auto-scaling is the only solution that can distinguish benign traffic from malicious packets at scale, filter SYN-flood and HTTP-GET floods without dropping legitimate requests, and automatically expand capacity to absorb traffic spikes. This matches the requirements of a distributed botnet attack that overwhelms both the network and application layers while preserving service for genuine users. Option B – Block all external SYN and HTTP requests would indiscriminately drop legitimate client traffic from any source outside the internal network, causing a total outage for remote customers—an unacceptable trade-off for a financial institution that must keep its services accessible. Option C – Increase server bandwidth and apply basic rate limiting provides only a superficial increase in capacity and a static limit that cannot adapt to a sophisticated, distributed botnet whose source IPs constantly change; it does not offer traffic scrubbing or protocol-aware inspection. Option D – Deploy an IPS with deep packet inspection can inspect payloads but typically lacks the massive, distributed scrubbing capacity required to handle multi-gigabit flood volumes and cannot scale elastically; it also adds latency that may impact legitimate banking transactions.Thus, the cloud-based DDoS mitigation service (Option A) uniquely satisfies the need for layer-7 awareness , elastic scaling , and transparent traffic cleaning while preserving the user experience.
1. Cloudflare DDoS Protection Overview – https://www.cloudflare.com/learning/ddos/what-is-ddos/ 2. AWS Shield – https://aws.amazon.com/shield/
A penetration tester discovers that a system is infected with malware that encrypts all the files and demands payment to decrypt them. What type of malware is this?
Answer(s): B
Correct option – B. RansomwareRansomware is specifically designed to encrypt victim data, rendering it inaccessible until a payment (often in cryptocurrency) is made for the decryption key. The behavior described – “infects the system, encrypts all files, and demands payment to decrypt” – directly matches the definition of ransomware used by the EC-Council in its malware taxonomy.Technical indicators such as file-extension changes, ransom note creation, and usage of asymmetric encryption (e.g., RSA-2048 + AES) are hallmark characteristics of ransomware payloads.Why the other options are less appropriateSpyware (A) – Primarily focuses on covertly monitoring user activity and stealing information; it does not encrypt files or demand payment. Keylogger (C) – Captures keystrokes to harvest credentials; encryption of data and ransom demands are outside its typical scope. Worm (D) – Propagates over networks by exploiting vulnerabilities; while it can deliver payloads, the defining feature of a worm is self-replication, not file encryption or extortion.Conclusion The scenario presents classic ransomware traits (encryption + extortion), making option B the only accurate classification.
EC-Council | Certified Ethical Hacker v13 – Malware Types Overview: https://www.eccouncil.org/malware-types MITRE ATT&CK – Ransomware (TA0040) Overview: https://attack.mitre.org/techniques/T1486/
A penetration tester discovers malware on a system that disguises itself as legitimate software but performs malicious actions in the background. What type of malware is this?
Answer(s): C
Correct answer: C – TrojanA Trojan horse is a type of malware that disguises its true purpose as legitimate software, allowing it to execute malicious behavior while maintaining an innocuous appearance. The description matches the classic definition of a Trojan, which relies on social engineering or bundling with legitimate installers to gain execution. Why the other options are less appropriate: • Worm (A) – Propagates automatically across networks without user interaction; it does not require masquerading as another program. • Rootkit (B) – Focuses on concealment of its own presence and often modifies system components; it may hide processes but it is not primarily defined by appearing as legitimate software. • Spyware (D) – Collects information about the user and may operate covertly, but its defining characteristic is covert data collection rather than masquerading as benign software. Because the scenario emphasizes “disguises itself as legitimate software” while executing hidden malicious actions, the malware fits the trojan-horse pattern precisely, making Trojan the most accurate classification.
MITRE ATT&CK® – Trojan (Technique T1195.001 – “User Execution”/Masquerading): https://attack.mitre.org/techniques/T1195/ CISA – Malware Glossary: https://www.cisa.gov/news-events/cybersecurity-advisories/feature/malware-glossary
An attacker is analyzing traffic from a mobile app and finds that sensitive data like session tokens are being transmitted over HTTP instead of HTTPS. The attacker plans to intercept and manipulate the data during transmission. Which vulnerability is the attacker exploiting?
Technical JustificationThe scenario describes a mobile app sending session tokens over plain HTTP, allowing an attacker to intercept and modify the traffic.This directly represents Insecure Communication , which occurs when sensitive data is transmitted without adequate protection (e.g., no TLS/SSL, weak encryption, or use of clear-text protocols).Option C – Insecure Communication is therefore the precise vulnerability being exploited.Why the other options are unsuitable:A: Insufficient Input Validation – This flaw pertains to improper handling of user-supplied data that could lead to injection attacks; it does not describe the lack of transport-layer protection. B. Improper SSL Pinning – SSL pinning is a client-side mechanism that validates a server’s certificate; the issue here is the absence of TLS altogether, not a failure to pin a certificate. D. Security Misconfiguration – While a misconfiguration could result in HTTP usage, the root cause is the lack of encryption, which is classically categorized as “Insecure Communication” rather than a generic configuration error.Conclusion: The attacker is exploiting an insecure communication channel, making option C the correct answer.
OWASP Top 10 – A06 2021: Broken Object Level Authorization (related to insecure transport) – https://owasp.org/www-project-top-ten/2021/A06_2021-BrokenObjectLevelAuthorization OWASP Transport Layer Protection Cheat Sheet – https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html
A penetration tester is tasked with enumerating user accounts and network resources in a highly secured Windows environment where standard methods like SMB null sessions are blocked. The network employs strict firewall rules and intrusion detection systems to prevent unauthorized access. Which technique should the tester use to discreetly gather the required information without triggering security alarms?
Technical JustificationOption A – Exploit a mis-configured LDAP service for anonymous searchesLDAP can be queried without explicit credentials when the service permits anonymous bind or has overly permissive access controls. An attacker can issue a simple LDAP search (e.g., (&(objectClass=user)(cn=*)) ) to enumerate user objects directly from the directory, bypassing the need for SMB or NetBIOS traffic that is often filtered by firewalls and IDS. Because the query is performed over standard LDAP/LDAPS ports (389/636), it blends with legitimate directory-service traffic, making it less conspicuous.Why the other choices are inferiorB – DNS zone transfer – Modern environments typically restrict AXFR/IXFR to authorized secondary name servers; many organizations block these requests at the perimeter, and a successful zone transfer would reveal only DNS data, not user accounts or network resources. C – NetBIOS over TCP/IP – NetBIOS relies on ports 137-139 and can be easily detected by IDS/IPS signatures; in tightly firewalled networks these ports are usually blocked, and the technique requires the target to be on the same LAN segment. D – AD Web Services (e.g., PowerView, BloodHound) – Interaction with Active Directory Web Services generally requires authenticated credentials or Kerberos tickets. Without valid authentication, the service will reject the request, making it impractical for covert enumeration.Conclusion Because LDAP can often be queried anonymously when mis-configured, it provides the most discreet way to enumerate users and resources in a hardened Windows environment while evading typical firewall and IDS detection mechanisms.
Microsoft Docs – LDAP Anonymous Bind : https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server_2003/cc781241(v=ws.10) OWASP LDAP Injection Cheat Sheet : https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Cheat_Sheet.html
A penetration tester targets a company’s executive assistants by referencing upcoming board meetings in an email requesting access to confidential agendas. What is the most effective social engineering technique to obtain the necessary credentials without raising suspicion?
Technical justification for the selected techniqueThe most effective social-engineering tactic in this scenario is to craft a personalized email that references specific upcoming board meetings and requests credential validation (Option B).By mentioning concrete details such as the meeting agenda and deadline, the message demonstrates insider knowledge, which lowers the target’s suspicion and increases perceived legitimacy. The request is limited to a simple credential confirmation—often perceived as a low-risk administrative task —making the victim more willing to comply without triggering security alerts. Personalization also aligns with modern spear-phishing best practices, where attackers profile the victim (e.g., role, routines, language) and tailor the payload accordingly.Why the other options are less suitableOption A – A mass phishing email with a generic fake meeting link lacks the contextual relevance required to bypass the victim’s trust filters; it is easily identified as spam and offers no personal connection to the target’s responsibilities. Option C – Creating a fake LinkedIn profile is a longer-term reconnaissance effort and does not directly solicit credentials; it also risks detection if the profile lacks authentic activity or connections. Option D – Posing as IT support over the phone introduces a real-time interaction where voice, accent, or procedural questions can expose inconsistencies, and many organizations enforce multi-factor verification that would thwart credential harvesting without prior knowledge.Why Option B stands outIt exploits the principle of authority (referencing board meetings) combined with specificity , which together create a high-credibility scenario. The technique minimizes the number of steps required from the victim, reducing friction and the likelihood of the request being questioned. It allows the attacker to gather the needed credentials in a single exchange, making it the most efficient and least conspicuous method for obtaining executive-assistant access without raising suspicion.Placeholders: The technique can be adapted for any organization, e.g., [target_company] and [executive_name]to illustrate how the attacker would personalize the message with real-world details.
https://www.nist.gov/cyberframework https://owasp.org/www-project-social-engineering-attacksThese links provide authoritative guidance on social-engineering methodologies and mitigation strategies relevant to the scenario described.
During a covert red team engagement, a penetration tester is tasked with identifying live hosts in a target organization’s internal subnet (10.0.0.0/24) without triggering intrusion detection systems (IDS). To remain undetected, the tester opts to use the command nmap -sn -PE 10.0.0.0/24, which results in several “Host is up” responses, even though the organization’s IDS is tuned to detect high-volume scans. After the engagement, the client reviews the logs and is surprised that the scan was not flagged. What allowed the scan to complete without triggering alerts?
Why option A is the correct answer nmap -sn -PE 10.0.0.0/24 tells Nmap to perform a ping sweep ( -sn ) using ICMP echo requests ( -PE ).The tool never opens TCP or UDP connections to the targets; it only sends a single ICMP echo request to each address and waits for a reply. Because there is no port probing , no SYN/FIN/XMAS scans, and no high-volume traffic patterns, IDS/IPS signatures that flag rapid scanning or multiple probe types are not triggered. The only observable activity is a normal-looking ICMP echo request, which many security devices treat as benign host discovery traffic, allowing the sweep to complete undetected.Why the other options are less suitableB: It used UDP packets that bypassed ICMP inspection – The command does not send UDP packets; -PEspecifically sends ICMP echo requests. C. It scanned only the ports open in the firewall whitelist – No port scanning occurs at all; -sn disables port probing, so there is nothing to “scan.” D. It used TCP ACK packets that were allowed through – TCP ACK probing is not part of the -sn -PEcommand; the scan relies solely on ICMP.Thus, the scan evaded detection because it performed an ICMP Echo ping sweep without port probing , matching option A.
Nmap Manual – Ping Scan ( -sn ): https://nmap.org/book/man.html# sect-service-ping-scanRFC 792 – ICMP Echo Request : https://datatracker.ietf.org/doc/html/rfc792#section-3.2.2
During a security assessment of a cloud-hosted application using SOAP-based web services, a red team operator intercepts a legitimate SOAP request sent by a user. The operator duplicates the body of the message along with its digital signature, inserts the duplicate into the same SOAP envelope, and forwards it to the server. Due to improper validation of the message structure, the server accepts the duplicated body as authentic and processes it, resulting in unauthorized code execution. This behavior reveals a vulnerability in how the server handles signed SOAP messages. What type of attack does this scenario illustrate?
Attack type: The described technique—re-using a signed SOAP envelope, inserting a duplicated body, and bypassing validation—is a classic signature-wrapping (or “wrapping”) attack against web-service trust mechanisms. Why A is correct: The attacker exploits the server’s failure to perform a deep integrity check on the entire SOAP envelope. By duplicating the signed body and nesting it inside another valid envelope, the attacker presents a structurally different message that the server incorrectly accepts as authentic, allowing execution of unauthorized code. This bypass directly matches the definition of a signature-wrapping attack. Why the other options are unsuitable:B: Cryptanalysis attack – Involves mathematical breakdown of cryptographic primitives; the scenario does not target algorithmic weaknesses, only policy enforcement. C. IMDS abuse – Refers to abuse of instance metadata services in cloud environments, unrelated to SOAP envelope manipulation. D. Cloud snooper attack – Typically describes passive data gathering from cloud logs or APIs, not the active injection of duplicated signed payloads.
OWASP XML Security – Signature Wrapping: https://owasp.org/www-community/XML/Signature_Wrapping NIST Special Publication 800-57 Part 1 Rev. 5 – Recommendations on XML Signature Validation: https://csrc.nist.gov/publications/detail/sp/800-57/part-1/rev-5/final
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.