support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 6 )

Updated On: 31-Jul-2026
Page 6 of 133
PDF with 1065 Questions

Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs.
What type of malware did the attacker use to bypass the company’s application whitelisting?

  1. File-less malware
  2. Zero-day malware
  3. Phishing malware
  4. Logic bomb malware

Answer(s): A

Explanation:

A: File-less malware is the correct answer as it operates in memory, evading traditional detection methods employed by anti-virus (AV) tools and intrusion detection/prevention systems (IDS/IPS).
File-less malware typically exploits legitimate system tools and processes to execute its payload directly in memory, thereby bypassing application whitelisting mechanisms that monitor for unauthorized executables. This type of malware can utilize vulnerabilities in existing applications or scripts (e.g., PowerShell, Windows Management Instrumentation) to carry out malicious activities without leaving traditional file signatures that security measures would detect.
Evaluation of Incorrect Options:
B: Zero-day malware: While it refers to newly discovered vulnerabilities exploited before a patch is available, it typically generates signatures that could potentially be detected by proactive security measures, such as IDS/IPS, unlike file-less malware which deliberately avoids such detection.
C: Phishing malware: This option involves social engineering to trick users into divulging information or credentials. Although it can facilitate the introduction of malware, it does not fundamentally bypass application whitelisting since the malware still needs to be installed on the system, leaving detectable artifacts.
D: Logic bomb malware: This malware activates under specific conditions but typically requires installation as a file, making it susceptible to whitelisting checks. Logic bombs do not inherently disguise themselves from detection mechanisms like file-less malware does.
References:
https://www.cio.com/article/284754/what-is-fileless-malware.html https://www.dell.com/en-us/blog/understanding-fileless-malware-and-how-to-prevent-it/ https://www.sans.org/white-papers/38596/


Reference:

References:
https://www.cio.com/article/284754/what-is-fileless-malware.html https://www.dell.com/en-us/blog/understanding-fileless-malware-and-how-to-prevent-it/ https://www.sans.org/white-papers/38596/



Dorian is sending a digitally signed email to Poly. With which key is Dorian signing this message and how is Poly validating it?

  1. Dorian is signing the message with his public key, and Poly will verify that the message came from Dorian by using Dorian’s private key.
  2. Dorian is signing the message with Poly’s private key, and Poly will verify that the message came from Dorian by using Dorian’s public key.
  3. Dorian is signing the message with his private key, and Poly will verify that the message came from Dorian by using Dorian’s public key.
  4. Dorian is signing the message with Poly’s public key, and Poly will verify that the message came from Dorian by using Dorian’s public key.

Answer(s): C

Explanation:

C is correct because Dorian signs the message with his private key, allowing Poly to validate it using Dorian's public key.
In Public Key Infrastructure (PKI), digital signatures rely on asymmetric encryption where a sender signs a message using their private key, and a recipient or any third party can verify the signature with the sender's public key. This ensures both authenticity and non-repudiation, confirming that the message originated from the stated sender—Dorian, in this scenario.
Evaluation of Incorrect Options:

A: This option incorrectly states that Dorian signs the message with his public key. Public keys are meant for encryption and verification, not signing. The signing process relies strictly on private keys.
B: Here, Dorian is said to sign with Poly’s private key, which is fundamentally flawed. Dorian has no access to Poly's private key, and signing cannot be done with a recipient's private key; it must be done with the sender’s key.
D: This option proposes Dorian signing with Poly’s public key. Similar to the prior errors, a public key cannot be used for signing because it’s not intended for that purpose. Signing inherently involves the creator's private key.
In summary, option C correctly identifies the process of signing and verification in digital communications, while the other options misunderstand the foundational elements of public-key cryptography.
References:
https://www.rsa.com/en-us/what-is-cryptography/what-is-a-digital-signature https://www.cloudflare.com/learning/how-tls-ssl/what-is-a-digital-certificate/ https://www.digitalguardian.com/blog/what-is-digital-signature


Reference:

References:
https://www.rsa.com/en-us/what-is-cryptography/what-is-a-digital-signature https://www.cloudflare.com/learning/how-tls-ssl/what-is-a-digital-certificate/ https://www.digitalguardian.com/blog/what-is-digital-signature



Scenario: Joe turns on his home computer to access personal online banking.
When he enters the URL www.bank.com, the website is displayed, but it prompts him to re-enter his credentials as if he has never visited the site before.
When he examines the website URL closer, he finds that the site is not secure and the web address appears different.
What type of attack he is experiencing?

  1. DHCP spoofing
  2. DoS attack
  3. ARP cache poisoning
  4. DNS hijacking

Answer(s): D

Explanation:

D: DNS hijacking is correct as it involves redirecting users from a legitimate website to a fraudulent one.
In this scenario, Joe’s alteration in the website's URL and the refusal to recognize previous credentials suggest that his DNS queries might have been compromised. DNS hijacking manipulates the resolution of a domain name to reroute users to an imposter site. The unsecure connection further indicates a potential phishing attempt, wherein user credentials could be harvesting under the guise of a legitimate banking interface.
Critical Evaluation of Other Options:

A: DHCP Spoofing : While DHCP spoofing can assign a wrong IP address to a victim machine, it does not necessarily involve the modification of a URL or prompt for credentials unless combined with other attacks.
B: DoS Attack : A Denial of Service attack aims to overwhelm a service, rendering it unavailable; it does not manipulate the site appearance or URL, nor does it prompt for credentials.
C: ARP Cache Poisoning : This technique involves altering the ARP cache to redirect traffic through a malicious device, but it typically does not affect the URL appearance directly; rather, it can facilitate other types of attacks, including man-in-the-middle scenarios.
Thus, the symptoms observed by Joe point clearly towards DNS hijacking rather than any of the other listed attacks.
References:
https://www.imperva.com/learn/application-security/dns-hijacking/ https://www.digitalattackmap.com/understanding-dos-attacks/ https://www.cloudflare.com/learning/security/glossary/dhcp-spoofing/


Reference:

References:
https://www.imperva.com/learn/application-security/dns-hijacking/ https://www.digitalattackmap.com/understanding-dos-attacks/ https://www.cloudflare.com/learning/security/glossary/dhcp-spoofing/



Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney’s account page without disclosing any information to the victim.
When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney’s account.
What is the attack performed by Boney in the above scenario?

  1. Forbidden attack
  2. CRIME attack
  3. Session donation attack
  4. Session fixation attack

Answer(s): D

Explanation:

D is correct as the described scenario exemplifies a session fixation attack whereby the attacker manipulates the victim's session by using a predefined session ID.
In a session fixation attack, the attacker first acquires a valid session ID, typically by logging into a service themselves. Subsequently, they feed this session ID to the target, leading the victim to unwittingly authenticate to the attacker’s account. This attack is particularly insidious as it does not require any direct interaction with the victim's credentials; rather, it leverages the established session control, allowing the attacker to gain unauthorized access seamlessly.
Evaluation of Other Options:

A: Forbidden attack : This term does not align with classical definitions of web application security threats.
Forbidden attacks are not formally recognized in the domain of web session security and misattribute the context.
B: CRIME attack : The CRIME (Compression Ratio Info-leak Made Easy) attack exploits HTTP compression to reveal secrets in secure sessions but does not pertain to session IDs directly. It primarily targets the confidentiality and integrity of session data rather than session fixation.
C: Session donation attack : This attack occurs when a user unknowingly donates their session to an attacker, but it typically involves the user clicking a link that the attacker controls. In contrast, the scenario describes an attacker explicitly providing a session ID to the target, which fits the session fixation model more accurately.
The underlying mechanics of session fixation pretext that an attacker can hijack a user’s session without exploiting vulnerabilities in the application itself, highlighting the need for robust session management practices.
References:
https://owasp.org/www-community/attacks/Session_Fixation https://www.owasp.org/index.php/CRIME https://www.owasp.org/index.php/Session_Management_Cheat_Sheet


Reference:

References:
https://owasp.org/www-community/attacks/Session_Fixation https://www.owasp.org/index.php/CRIME https://www.owasp.org/index.php/Session_Management_Cheat_Sheet



Kevin, a professional hacker, wants to penetrate CyberTech Inc’s network. He employed a technique, using which he encoded packets with Unicode characters. The company’s IDS cannot recognize the packets, but the target web server can decode them.
What is the technique used by Kevin to evade the IDS system?

  1. Session splicing
  2. Urgency flag
  3. Obfuscating
  4. Desynchronization

Answer(s): C

Explanation:

The correct answer is C: Obfuscating.
Obfuscating is a technique that involves encoding or altering data to make it difficult for intrusion detection systems (IDS) to detect malicious activity while still being interpretable by the target application. In this scenario, Kevin utilizes Unicode encoding to mask the content of the packets, thus evading detection by CyberTech Inc's IDS. This clever manipulation not only facilitates packet transmission without raising alarms but also ensures that the intended target web server can decode and process the packets correctly.
Evaluation of Other Options:

A: Session Splicing : This technique involves breaking up a single session into multiple segments to elude detection.
While it can bypass some security measures, it does not inherently encode the packets and thus lacks the stealth advantage provided by Unicode obfuscation.
B: Urgency Flag : This method pertains to manipulating TCP flags to signify packet urgency, which can create confusion in traffic analysis. However, it does not involve any encoding techniques and does not specifically target the evasion of IDS through packet content manipulation.
D: Desynchronization : This technique disrupts the state of communication between endpoints and attempts to exploit timing or sequence expectation. Like the other options, it does not include content encoding or manipulation aimed at evading IDS detection.
In conclusion, obfuscating via Unicode encoding is particularly effective at circumventing IDS mechanisms focused on signature-based detection since the malicious payload appears benign until it reaches the target application.
References:
1. https://www.sans.org/white-papers/1513/ 2. https://www.cisco.com/c/en/us/products/security/what-is-intrusion-detection-system-ids.html 3. https://www.jstor.org/stable/26273313


Reference:

References:
1. https://www.sans.org/white-papers/1513/ 2. https://www.cisco.com/c/en/us/products/security/what-is-intrusion-detection-system-ids.html 3. https://www.jstor.org/stable/26273313



Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:

Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

  1. select * from Users where UserName = ‘attack’ ’ or 1=1 -- and UserPassword = ‘123456’
  2. select * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’
  3. select * from Users where UserName = ‘attack or 1=1 -- and UserPassword = ‘123456’
  4. select * from Users where UserName = ‘attack’ or 1=1 --’ and UserPassword = ‘123456’

Answer(s): B

Explanation:

select * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’



Which of the following commands checks for valid users on an SMTP server?

  1. RCPT
  2. CHK
  3. VRFY
  4. EXPN

Answer(s): C

Explanation:

C is correct because the VRFY command is specifically designed to verify the existence of a user on an SMTP server.
The VRFY command directly queries the server to validate a specified email address, returning responses that indicate whether the user exists or not. This functionality is integral to the SMTP protocol, as it allows administrators to manage user accounts effectively while providing an essential tool for ethical hacking assessments. The command typically returns a response code of 250 for valid users, making it a reliable method for confirming user validity.
Evaluation of Other Options:

A: RCPT : This command is used during the SMTP mail transaction phase to specify the recipient of the email. It does not verify user existence; rather, it is part of the process for sending mail and requires an established SMTP transaction.
B: CHK : The CHK command was intended to check for valid users but is not standard in modern SMTP implementations. Its sporadic availability does not make it a reliable choice for verifying user existence across different servers.
D: EXPN : The EXPN command is intended to expand mailing lists or aliases into individual email addresses but does not serve the purpose of verifying a single user's validity. This command provides informational responses rather than validation confirmations.
In conclusion, the specificity and function of the VRFY command uniquely qualify it for checking valid users on an SMTP server, while the other commands serve distinct purposes not directly related to user validation.
References:
https://tools.ietf.org/html/rfc5321 https://www.owasp.org/index.php/SMTP_Commands https://www.ietf.org/rfc/rfc2821.txt


Reference:

References:
https://tools.ietf.org/html/rfc5321 https://www.owasp.org/index.php/SMTP_Commands https://www.ietf.org/rfc/rfc2821.txt



Bella, a security professional working at an IT firm, finds that a security breach has occurred while transferring important files. Sensitive data, employee usernames, and passwords are shared in plaintext, paving the way for hackers to perform successful session hijacking. To address this situation, Bella implemented a protocol that sends data using encryption and digital certificates.
Which of the following protocols is used by Bella?

  1. FTPS
  2. FTP
  3. HTTPS
  4. IP

Answer(s): A

Explanation:

A: FTPS is correct because it encrypts data during transfer, ensuring confidentiality and integrity using protocols such as SSL/TLS.
Reasoning: FTPS (File Transfer Protocol Secure) extends the standard FTP by employing secure encryption through SSL/TLS, thereby safeguarding sensitive information like usernames and passwords. This protocol is specifically designed to protect files during transfer, making it appropriate for situations requiring confidentiality and data integrity, as evidenced by Bella's need to secure sensitive data against session hijacking. In using digital certificates, FTPS guarantees the authenticity of the server and the confidentiality of the data transmitted.
Evaluation of Alternatives:
B: FTP: The standard File Transfer Protocol (FTP) transmits data in plaintext, making it vulnerable to interception and session hijacking. It lacks built-in encryption mechanisms, which renders it unsuitable for transferring sensitive information.
C: HTTPS: While HTTPS provides encryption similar to what FTPS offers, it is primarily designed for web traffic rather than dedicated file transfer scenarios. In the context of Bella's focus on file transfer, FTPS would be more relevant when explicit file transmission is required.
D: IP: This option refers to the Internet Protocol, which is foundational for network communications but does not inherently provide any security measures. It does not offer encryption or authentication capabilities critical to secure file transfers.
FTPS emerges as the superior choice due to its specific encryption features tailored for file transfers and protection against data breaches.
References:
1. https://www.owasp.org/index.php/FTPS 2. https://www.jamf.com/blog/introduction-to-ftps-and-how-to-use-ftps-in-jamf-pro/ 3. https://www.cloudflare.com/learning/how-tls-works/what-is-ftps/


Reference:

References:
1. https://www.owasp.org/index.php/FTPS 2. https://www.jamf.com/blog/introduction-to-ftps-and-how-to-use-ftps-in-jamf-pro/ 3. https://www.cloudflare.com/learning/how-tls-works/what-is-ftps/



  PDF
Viewing page 6 of 133
Viewing questions 41 - 48 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!