A financial services firm is experiencing a sophisticated DoS attack on their DNS servers with DNS amplification and their web servers with HTTP floods. Traditional firewall rules and IDS are failing to mitigate the attack effectively. To protect their infrastructure without impacting legitimate users, which advanced mitigation strategy should the firm implement?
Answer(s): B
Correct Option: B – Utilize a cloud-based DDoS protection service with traffic scrubbing capabilitiesTechnical justificationA cloud-based scrubbing service (e.g., Cloudflare, Akamai, Amazon Shield) can absorb massive upstream traffic volumes and apply deep-packet inspection, anomaly detection, and automated rate limiting at the network edge. It can differentiate legitimate DNS queries or HTTP requests from amplified or malformed traffic by examining protocol headers, payload signatures, and behavioral patterns, then discard the malicious flow before it reaches the corporate infrastructure. This approach preserves legitimate user sessions and application availability because only traffic identified as malicious is filtered, while clean traffic is passed through unhindered. It also provides geographic load-balancing and anycast routing, spreading attack traffic across multiple scrubbing centers. In contrast:A: Increase server capacity and implement simple rate limiting – Adding capacity addresses only the symptom, not the attack vector, and simple rate limits are insufficient against amplification attacks that can exceed any fixed limit. C. Deploy a Web Application Firewall (WAF) to filter HTTP traffic – A WAF protects application-layer HTTP requests but cannot mitigate DNS amplification attacks and is ineffective against high-volume volumetric floods that saturate upstream links. D. Block all incoming traffic from suspicious IP ranges using ACLs – Maintaining dynamic IP-based blocks is operationally cumbersome and can inadvertently block legitimate users or fail to mitigate spoofed sources employed in amplification attacks.
Cloudflare DDoS Protection Overview: https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/ “DDoS Mitigation Techniques” – Radware Whitepaper: https://www.radware.com/ddos-protection/ddos-mitigation-techniques/
A penetration tester is assessing an organization’s cloud infrastructure and discovers that the cloud storage buckets are not publicly accessible but have misconfigured Identity and Access Management (IAM) policies. The IAM policies unintentionally grant read and write permissions to any authenticated user. What is the most effective way to exploit this misconfiguration?
Answer(s): C
Technical JustificationThe misconfiguration makes the S3 buckets readable and writable by any principal that can successfully authenticate to the AWS account . To exploit this, an attacker must first obtain valid authentication credentials that the IAM policy will accept. Creating a personal cloud account (or any other legitimate user account) provides the attacker with a credential set that the IAM policy recognises as “authenticated”, allowing direct read/write access to the buckets without needing to abuse application-level bugs or client-side vulnerabilities. This approach leverages the misconfiguration directly: once the attacker logs in with their own set of credentials, they can enumerate, download, or modify objects just as a legitimate employee would. Why the other options are unsuitableA: SQL injection – Targets a web application’s database; it does not interact with cloud storage buckets or IAM permissions. B. Cross-Site Scripting (XSS) – Exploits a vulnerable web front-end; it does not bypass IAM restrictions or grant direct storage-bucket access. D. Leaked API keys – While technically possible, it relies on the prior acquisition of secret keys that are not guaranteed to exist. The question asks for the most effective exploitation method given only the misconfigured IAM policy; creating a legitimate authenticated session (Option C) is the most straightforward and reliable technique.Conclusion – The most effective exploitation of a misconfigured IAM policy that grants permissions to any authenticated user is to create or use a personal cloud account to authenticate and access the storage buckets (Option C). This turns the policy’s broad allowance into a direct, attacker-controlled entry point.
AWS Identity and Access Management (IAM) – Policy evaluation logic: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices_iam-policies.html Amazon S3 bucket access control – Managing permissions: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html
A penetration tester is running a vulnerability scan on a company’s network. The scan identifies an open port with a high-severity vulnerability linked to outdated software. What is the most appropriate next step for the tester?
Why B is the appropriate next step – The tester must first verify the existence and details of the reported vulnerability. Researching the CVE, checking vendor advisories, and identifying any publicly disclosed exploit code determines whether the finding can be safely validated and exploited during the assessment. This step aligns with the CEH methodology of “Scanning → Enumeration → Vulnerability Verification” and ensures that any subsequent exploitation is justified and authorized.Why the other options are unsuitableA: Brute-force attack – Brute-forcing a service before confirming the vulnerability wastes time and may violate ethical hacking principles by targeting an unvalidated issue. C. Ignoring the finding – Disregarding a high-severity finding undermines the purpose of the engagement and may leave a critical risk unaddressed. D. Launching a DoS attack – Conducting a denial-of-service attack is illegal, can cause collateral damage, and is outside the scope of a responsible penetration test without explicit permission for disruptive actions.
https://nvd.nist.gov/vuln/detail/CVE-2023-34362 https://httpd.apache.org/security/vulnerabilities_24.html
A penetration tester is tasked with assessing the security of a smart home IoT device that communicates with a mobile app over an unencrypted connection. The tester wants to intercept the communication and extract sensitive information. What is the most effective approach to exploit this vulnerability?
JustificationThe IoT device transmits data in cleartext to the mobile app, making the communication channel observable on the network. A man-in-the-middle (MitM) technique enables the tester to position themselves between the device and the app, capture every packet, and decode the unencrypted payload to retrieve credentials, configuration data, or other sensitive information. This approach directly exploits the lack of encryption and provides full visibility into the data flow, which is the most efficient way to extract information in this scenario.Why other options are less suitableA – Brute-force Wi-Fi credentials : This targets network access rather than the application-level traffic; even if successful, it does not guarantee read access to the app’s unencrypted data stream. B – Dictionary attack on admin login : While possibly useful for authentication bypass, it does not leverage the inherent unencrypted transmission and may be impractical if the credential policy prevents weak passwords. D – SQL injection on the cloud portal : The vulnerability described concerns the device-app link, not a database-backed web service; a SQLi attack is unrelated to intercepting the device’s outbound traffic.
https://www.eccouncil.org/ https://owasp.org/www-project-internet-of-things/
An ethical hacker needs to enumerate user accounts and shared resources within a company’s internal network without raising any security alerts. The network consists of Windows servers running default configurations. Which method should the hacker use to gather this information covertly?
Answer(s): D
Technical justificationOption D – Exploit null sessions to connect anonymously to the IPC$ shareOn Windows systems with default settings, the IPC$ share is accessible via RPC without authentication, allowing an attacker to enumerate local user accounts, shares, and other resources simply by establishing a null session. Because it uses legitimate RPC calls, the traffic blends with normal administrative traffic and typically does not generate alerts in Intrusion Detection Systems (IDS) that focus on scan-type activity. This method directly satisfies the requirement of covert enumeration of users and shared resources on Windows servers.Why the other options are less suitableA: SNMP queries – SNMP is often disabled on default Windows servers, and even when enabled, it primarily reveals device-level information (e.g., interface statistics) rather than detailed user-account data. Moreover, SNMP traffic is usually logged and can be flagged by monitoring solutions. B. Packet sniffer – Capturing traffic requires the attacker to be positioned on the same subnet and to collect a large volume of packets, which increases the likelihood of detection by network-behavior analytics. Additionally, modern Windows environments often encrypt SMB and other protocols, limiting the usefulness of plain-text sniffing. C. DNS zone transfer – Zone transfers expose DNS records for the domain (e.g., hostnames, sub-domains) but do not provide direct enumeration of local user accounts or shares. They also may be blocked by DNS server configurations and can trigger alerts if abnormal transfer sizes are observed.Conclusion: Using a null session to access the IPC$ share is the most discreet and effective technique for enumerating user accounts and shared resources on default-configured Windows servers without raising security alerts.
Microsoft Docs – Create a null session connection to the IPC$ share Microsoft Security Guidance – Null Session (IPC$) Access
A penetration tester is tasked with identifying vulnerabilities on a web server running outdated software. The server hosts several web applications and is protected by a basic firewall.Which technique should the tester use to exploit potential server vulnerabilities?
Correct technique – D. Execute a buffer overflow attack targeting the web server softwareThe server is running outdated software behind a basic firewall, which typically means the underlying HTTP/A web server (e.g., Apache, Nginx, IIS) may have unpatched buffer-related bugs. Exploiting such a vulnerability directly compromises the server process, potentially giving remote code execution without needing credentials or application-level input. A buffer overflow targets the memory handling of the server binary itself, bypassing application-level defenses and firewall rules that merely filter network traffic.Why the other options are less suitableA: Perform a brute-force login attack on the admin panel – Requires a login interface and weak credentials; if the admin panel is locked down or uses strong authentication, this method will fail. It also relies on user-specific weaknesses rather than the server’s inherent software flaws. B. Use directory traversal to access sensitive configuration files – Only works if the web application improperly handles file paths. Many modern apps mitigate this, and the technique does not exploit the outdated server software itself. C. Conduct a SQL injection attack on the web application’s login form – Effective only when the application concatenates user input directly into SQL queries. It exploits a flaw in the application logic, not the outdated server platform, and may be blocked by input sanitisation or WAFs.ConclusionOption D directly attacks the vulnerable server software, offering the most reliable path to compromise the system given the described environment.
https://owasp.org/www-community/attacks/Buffer_Overflow https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26150 (example of a recent HTTP server buffer overflow)
A penetration tester needs to identify open ports and services on a target network without triggering the organization’s intrusion detection systems, which are configured to detect high-volume traffic and common scanning techniques. To achieve stealth, the tester decides to use a method that spreads out the scan over an extended period. Which scanning technique should the tester employ to minimize the risk of detection?
Correct Technique – Slow, Random Stealth Scan Using Nmap’s timing options (e.g., -T1 or -T2 ) together with decoy packets and randomized delays spreads probe packets over a longer interval, reducing burst traffic. This approach evades IDS/IPS signatures that look for high-rate scans such as SYN or Xmas sweeps, while still allowing mastery of TCP/IP flags and stealth options (FIN, NULL, Xmas) in a low-profile manner.Why Option A (TCP Xmas) is less suitable A FIN/Xmas scan hides scanning intent, but the pattern of all-flags-set packets is still recognizable by IDS that monitor unusual flag combinations. Additionally, many modern systems drop FIN packets silently, limiting visibility.Why Option C (Fast SYN Scan) is less suitable Fast SYN scans send a burst of SYN packets to many ports, creating a clear signature that defeats stealth goals. They are easily flagged by IDS/IPS and may cause immediate alerts on heavily monitored networks.Why Option D (UDP Scan of All Ports) is less suitable UDP scanning must send packets to every port and wait for ICMP or lack-of-response, generating substantial traffic volume. Uniform UDP probes are readily detected by intrusion detection rules that watch for abnormal UDP flood-like behavior.
Nmap Book – Stealth Scanning Techniques: https://nmap.org/book/stealth.html Nmap Timing and Performance Options: https://nmap.org/book/timing.html
A penetration tester identifies malware on a system that hides its presence and gives an attacker access to administrative functions without being detected. What type of malware is this?
Answer(s): A
The described behavior matches a rootkit because it:stealthily conceals its existence from the operating system and security tools, maintains persistence on the system, and provides the attacker with elevated administrative privileges to execute commands undetected.Other options do not fit all these criteria simultaneously:Ransomware encrypts files for extortion and typically shows clear signs of infection; it does not primarily hide administrative access. Keylogger records keystrokes for credential theft but lacks the deep system-level concealment and administrative control characteristic of rootkits. Virus is a broad category of malicious code that can replicate but does not inherently guarantee stealth or administrative access without additional components.Thus, the malware described is best classified as a rootkit .
https://www.cisa.gov/sites/default/files/publications/Rootkit%20Detection%20and%20Mitigation.pdf https://www.microsoft.com/en-us/security/blog/2020/08/12/malware-rootkits/
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.