During an internal assessment, a penetration tester gains access to a hash dump containing NTLM password hashes from a compromised Windows system. To crack the passwords efficiently, the tester uses a high-performance CPU setup with the hashcat tool, configuring it to attempt millions of password combinations per second using a known hash algorithm. This setup drastically reduces the time required for password recovery compared to CPU-based cracking methods. Which technique is being optimized in this scenario?
Answer(s): D
Correct Answer: D – Leverage hardware acceleration for cracking speedThe scenario describes feeding NTLM hash material into hashcat , exploiting a GPU-based, highly parallel architecture to test millions of candidate passwords per second. This is precisely what hardware acceleration means: using dedicated processing units (GPUs, FPGAs, or ASICs) to perform the brute-force or rule-based hash calculations far faster than a single CPU core. By configuring hashcat with optimized kernel workloads and rule files, the tester maximises hash-rate, dramatically shortening the time needed to recover the plaintext passwords.Why the other options do not fitA: Dump SAM contents for offline password retrieval – Dumping the SAM is simply the method of acquiring the NTLM hashes; the question focuses on cracking those hashes, not on how they were collected. B. Spoof NetBIOS to impersonate a file server – NetBIOS spoofing is a lateral-movement or man-in-the-middle technique unrelated to password-hash cracking performance. C. Exploit dictionary rules with appended symbols – While rule files can improve cracking efficiency, the primary optimization highlighted is the millions of attempts per second achieved through compute resources, not the specific rule set.
Hashcat documentation: https://hashcat.net/hashcat/ NTLM hash cracking with GPU acceleration: https://hashcat.net/wiki/doku.php? id=faq#how_fast_can_i_crack_ntlm_hashes
A penetration tester detects malware on a system that secretly records all keystrokes entered by the user. What type of malware is this?
Answer(s): C
JustificationKeylogger (C) – Malware that records every keystroke typed by a user is specifically classified as a keylogger. It captures input data covertly, which matches the description in the question. Rootkit (A) – Rootkits are designed to hide the presence of other processes or files and maintain privileged access; they do not inherently record keystrokes. Ransomware (B) – Ransomware encrypts victim data and demands payment; it does not collect keystroke information. Worm (D) – Worms self-replicate and spread across networks without necessarily capturing user input; they are focused on propagation, not on monitoring keystrokes.Therefore, the malware described is best identified as a Keylogger .
MITRE ATT&CK® – Keylogging OWASP Cheat Sheet – Keylogger Detection
During a network analysis at a mid-sized enterprise, a security engineer detects irregular DHCP behavior. Multiple endpoints are being assigned incorrect gateway and DNS settings, causing loss of connectivity and redirection to unauthorized servers. Packet captures show that clients are receiving IP address offers from more than one DHCP source. Upon further investigation, the logs confirm that the access switch is forwarding DHCP responses from all connected ports without filtering. This indicates that an unauthorized (rogue) DHCP server has been introduced into the network, impersonating the legitimate server and responding to client DHCPDISCOVER messages. To prevent this type of attack from occurring in the future, what security feature should the administrator enable?
Answer(s): A
Correct answer: A – DHCP snooping on trusted interfacesWhy this is the best solutionDHCP snooping builds a binding table that records which switch ports are allowed to send DHCP server responses. By configuring the uplink or server-facing interface as trusted, the switch will accept DHCP replies only from that port and drop them on all other ports, preventing rogue DHCP servers on end-user ports from being heard. This directly stops unauthorized DHCP servers from issuing DHCPOFFER messages that overwrite gateway and DNS settings, eliminating the described redirection attacks.Why the other options are less suitableB: ARP inspection across VLANs – Protects against ARP spoofing, but does not control DHCP traffic; rogue DHCP packets can still reach clients. C. Static DHCP reservations for clients – Guarantees specific IP assignments for known devices, but does not stop a rogue server from answering other clients, leaving the network vulnerable to similar attacks. D. Port security on all trunk ports – Limits MAC addresses per port, but cannot differentiate legitimate DHCP server traffic from rogue responses; it does not provide the DHCP-specific filtering needed to block unauthorized DHCP offers.Implementation guidance1. Enable DHCP snooping globally. 2. Identify the interface that connects to the legitimate DHCP server and mark it as trusted. 3. Enable snooping on all other access ports (untrusted) and configure the expected DHCP relay information if needed. 4. Optionally, set the switch to drop DHCP packets on untrusted ports that contain DHCP OFFER/ACKmessages, enforcing the binding table.By enforcing DHCP snooping, the network ensures that only authorized DHCP servers can respond to client requests, restoring proper IP, gateway, and DNS assignment and preventing future rogue server attacks.
Cisco DHCP Snooping Configuration Guide – Trusted Interfaces: https://www.cisco.com/c/en/us/td/docs/switches/dc/applications/ip dhcp_snooping.html Cisco Best Practices for DHCP Snooping: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/dhcp_snooping.conf/groupings/best_practices.html
A system administrator observes that several machines in the network are repeatedly sending out traffic to unknown IP addresses. Upon inspection, these machines were part of a coordinated spam campaign. What is the most probable cause?
Answer(s): B
Technical JustificationOption B – Devices were enslaved into a botnet networkA botnet is a collection of compromised hosts that can be coordinated remotely to generate large volumes of traffic, including spam. The observed repeated outbound connections to unknown IP addresses and the fact that the activity is part of a coordinated spam campaign point directly to centralized command-and-control (C2) instructions being executed by infected machines. This matches the typical profile of a botnet used for mass-mailing or relaying spam.Option A – Keyloggers were harvesting user credentialsKeyloggers focus on capturing typed credentials; they do not inherently cause outbound network traffic to unknown IPs, nor do they coordinate a large-scale spam delivery system.Option C – Worms exploited zero-day vulnerabilitiesWhile worms can spread rapidly and may generate network traffic, the specific goal described is a “spam campaign.” Exploiting a zero-day is a propagation technique, not the motive behind the observed traffic pattern.Option D – Browsers were redirected to adware-injected sitesBrowser redirection typically serves adware or malicious ads and usually manifests as frequent connections to known ad-servers, not as a coordinated, large-scale outbound traffic pattern targeting unknown IP addresses for spam.Conclusion – The behavior described (regular outbound connections to unknown IPs as part of a coordinated spam operation) is characteristic of machines that have been commandeered into a botnet, making Option B the most probable cause.
Botnet fundamentals – CISA: https://www.cisa.gov/botnet Spam botnet operation analysis – McAfee Labs: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/spam-botnets-evolving-threat
A hacker is analyzing a system that uses two rounds of symmetric encryption with different keys. To speed up key recovery, the attacker encrypts the known plaintext with all possible values of the first key and stores the intermediate ciphertexts. Then, they decrypt the final ciphertext using all possible values of the second key and compare the results to the stored values. Which cryptanalytic method does this approach represent?
The described attack is a meet-in-the-middle (MiTM) technique. The attacker pre-computes all possible encryptions with the first key until the middle point, stores the resulting ciphertexts (usually in a hash table), then encrypts the known plaintext with the second key backwards, comparing intermediate results to the stored values. When a match is found, the corresponding key pair (k ₁ , k ₂ ) is recovered. This method directly exploits the layered nature of double encryption and avoids exhaustive search of both keys simultaneously.Option A (flood memory with brute-forced credentials) describes credential stuffing, unrelated to intermediate ciphertext storage. Option B (reverse permutations) suggests bypassing encryption via permutation inversion, which does not involve the two-stage meet-in-the-middle approach. Option D (scrape electromagnetic leakage) refers to side-channel extraction, not an algorithmic key-recovery method.Therefore, the correct answer is C – Use midpoint collision to identify key pair .
Schneier, Bruce. Applied Cryptography: Protocols, Algorithms, and Source Code in C (Chapter on Meet-in-the-Middle Attacks). National Institute of Standards and Technology. Guide to Elliptic Curve Cryptography (Section on Meet-in-the-Middle key recovery).
A penetration tester is assessing a web application that does not properly sanitize user input in the search field. The tester suspects the application is vulnerable to a SQL injection attack. Which approach should the tester take to confirm the vulnerability?
Why option B is the correct choiceThe goal is to verify whether the search input is vulnerable to SQL injection. By entering a payload such as ' OR 1=1 -- the tester directly leverages the unsanitized query to force a logical condition that always evaluates to true. If the application returns data that should be restricted (e.g., additional rows, error messages, or page changes), this confirms that the input is being concatenated directly into the SQL statement, thus proving the injection point. This technique is the standard, safe, and exam-appropriate method for confirming a SQL-i vulnerability in a web-app context.Why the other options are inappropriateA – Brute-force the login page : This tests password strength, not input sanitization; it does not address the suspected SQL-i flaw. C – Directory traversal : Attempts to read files on the server probe a path-traversal issue, which is unrelated to improper query construction in the search field. D – Inject JavaScript : This targets Cross-Site Scripting (XSS) and would not confirm a SQL-i vulnerability; it merely attempts to execute client-side script.
OWASP Testing Guide – Testing for SQL Injection https://owasp.org/www-project-web-security-testing-guide/v4.0/4-Web_Application_Security_Testing/07-Client_Side_Testing/01-Testing_for_SQL_InjectionNIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment (Section on Web Application Testing) https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final
An ethical hacker needs to gather detailed information about a company’s internal network without initiating any direct interaction that could be logged or raise suspicion. Which approach should be used to obtain this information covertly?
Correct choice – C. Examine email headers from past communications with the companyEmail headers contain metadata such as source IPs, mail transfer relays, timestamps, and hidden routing information that reveal internal network topology or mail server configurations without any active probing. Because the data is already captured in legitimate correspondence, retrieving it leaves no forensic footprint on the target network and does not generate traffic that could be logged or trigger alerts. This method fulfills the requirement for covert, non-intrusive information gathering and aligns with best practices for footprinting in ethical-hacker assessments.Why the other options are less suitableA: Utilize network scanning tools to map the company’s IP range – Scanning actively sends packets that can be detected by intrusion-detection systems or firewalls; it is noisy and raises suspicion. B. Inspect public WHOIS records for hidden network data – WHOIS data is limited to publicly registered domain and IP registration details; it rarely exposes internal addressing schemes or sensitive network specifics. D. Analyze the company’s SSL certificates for internal details – SSL certificates may include subject alternative names but generally do not disclose internal network structure; extracting such information often requires additional probing that can be logged.
Ethical Hacking and Penetration Testing Cheat Sheet – OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Ethical_Hacking_and_Penetration_Testing_Cheat_Sheet.html NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (Section on Passive Information Gathering): https://csrc.nist.gov/publications/detail/sp/800-115/final
A penetration tester is conducting an external assessment of a corporate web server. They start by accessing https://www.targetcorp.com/robots.txt and observe multiple Disallow entries that reference directories such as /admin-panel/, /backup/, and /confidential_docs/. When the tester directly visits these paths via browser, they find that access is not restricted by authentication and gain access to sensitive files, including server configuration and unprotected credentials. Which stage of the web server attack methodology is demonstrated in this scenario?
Why option B is the correct choiceThe tester discovers that the web server unintentionally publishes sensitive directories ( /admin‑panel/ ,/backup/ , /confidential_docs/ ) in its robots.txt file.By following those entries and accessing the listed URLs directly in a browser, the attacker receives unauthenticated access to files that should be protected —exactly the behavior described in OWASP’s “Information Disclosure” category. This step is purely reconnaissance/intelligence-gathering : the server reveals indexed or searchable locations without any required authentication or additional exploit logic. Hence it aligns with option B: Gathering information through exposed indexing instructions.Why the other options are unsuitableA – CSRF attack – Involves tricking an authenticated user’s browser to perform unwanted actions. The scenario contains no interaction with a victim’s session or any forged request, so CSRF is irrelevant. C – SQL injection – Requires the application to execute unsanitized SQL commands against a database. The described activity consists only of navigating to static filesystem paths; no database queries are mentioned. D – Directory traversal – Involves manipulating file-system paths (e.g., ../ ) to ascend outside an allowed directory and read arbitrary files. Here the attacker simply accesses the exact paths disclosed in robots.txt ;they do not inject traversal payloads to bypass path restrictions.Thus, the behavior exemplifies information gathering from exposed resources , making B the only logically consistent answer.
OWASP Top 10 – A01:2021 – Broken Access Control – Example of information disclosure RFC 9756 – Robots.txt Standard: https://www.rfc-editor.org/rfc/rfc9756#section-4
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.