Upon analyzing anomalies in your network’s traffic, you discover traces of an insidious malware strain named “ShadowFlee”. This malware operates without writing files to disk, harnessing system utilities and scripts like PowerShell to stealthily execute tasks, effectively evading traditional detection mechanisms. Further, it exploits legitimate processes to propagate internally. Given “ShadowFlee’s” elusive attributes, which strategy would offer the most focused countermeasure?
Answer(s): D
Correct choice: D – Restrict and monitor the execution of scripts and system tools, especially those invoked by unsanctioned processes.Why D is the most effective countermeasureLiving-off-the-land execution: ShadowFlee runs entirely from memory, using legitimate binaries (PowerShell, WScript, cmd.exe, etc.) as its attack platform. Blocking or tightly controlling these “LOLBins” prevents the malware from launching its malicious scripts or commands in the first place. Policy-driven enforcement: Technologies such as AppLocker , Windows Defender Application Control (WDAC) , or Constrained Language Mode can enforce whitelisting of approved script interpreters and enforce execution-context restrictions (e.g., signing requirements, elevated privileges, console-only mode). This directly mitigates the file-less technique. Visibility & alerting: Detailed script-execution logging (PowerShell transcription, module logging, Script Block Logging) enables real-time detection of anomalous invocations from unsanctioned processes, providing both prevention and rapid containment. Minimizes collateral impact: Unlike blanket clean-up or reboot schedules, granular script control allows legitimate automation to continue while only restricting suspicious or unauthorized usage, preserving operational continuity.Why the other options are less suitableA – Regularly clean up temporary folders and enforce stricter permissions on system directoriesHelpful for reducing some persistence artefacts, but ShadowFlee never writes files to disk; therefore, cleaning temp folders does not stop its in-memory execution.B – Schedule frequent system reboots to clear memory and apply patches to all networked devicesReboots can interrupt in-memory malicious code, yet they are an inconsistent and inefficient remediation method. Frequent reboots impose unnecessary downtime and can be circumvented if the malware re-establishes persistence after a reboot.C – Isolate affected systems, deploy deep packet inspection on network traffic, and block communications to blacklisted IPsNetwork-level controls are valuable for limiting C2 traffic, but they cannot prevent the initial execution of arbitrary scripts on the host. Moreover, insider lateral movement often uses legitimate ports, making DPI insufficient as a primary defense against file-less malware.
1. Microsoft Docs – Detect PowerShell attacks using PowerShell logging and script block logging https://learn.microsoft.com/en-us/powershell/scripting/security/powershell-logging2. Microsoft Security – AppLocker overview and best practices for restricting script execution https://learn.microsoft.com/en-us/windows/security/threat-protection/applocker/applocker-overview
An ethical hacker is conducting a penetration test on a company’s network with full knowledge and permission from the organization. What is this type of hacking called?
Answer(s): B
Technical JustificationWhite Hat Hacking – This term describes penetration testing performed with explicit, written authorization from the target organization. The ethical hacker operates within a defined scope, adheres to legal frameworks, and reports findings to improve security. It aligns perfectly with the scenario of a “company’s network with full knowledge and permission.”Grey Hat Hacking – Involves activities conducted without prior permission but with the intent of uncovering vulnerabilities and often disclosing them publicly. Since the question specifies “full knowledge and permission,” grey-hat does not apply.Blue Hat Hacking – Refers to internal security professionals (often within a vendor or organization) who conduct red-team exercises or assist in patch validation. The term is not used to categorize external, permission-based penetration testing and thus is irrelevant here.Black Hat Hacking – Denotes unauthorized, malicious exploitation of systems for personal gain, financial profit, or sabotage. This is the opposite of the described activity, which is sanctioned and goal-oriented toward security improvement.Therefore, the scenario fits the definition of White Hat Hacking (Option B) because it meets all criteria: authorized access, defined scope, and a constructive security objective.
EC-Council, Certified Ethical Hacker (CEH) v13 Official Study Guide, Chapter 1 – Types of Hackers. CompTIA, PenTest+ (PT0-001) Exam Objectives – “White Box, Black Box, Grey Box Testing” section.
What is the main difference between ethical hacking and malicious hacking?
Answer(s): C
Correct answer: C – Ethical hacking is performed with permission, while malicious hacking is unauthorizedPermission and scope – Ethical hackers operate under a formal, written agreement (e.g., a penetration-test contract) that defines the systems, boundaries, and objectives of the engagement. This consent makes the activity legal and aligned with organizational policy. Malicious hackers act without any authority, targeting assets outside any agreed-upon scope. Intent and outcome – The purpose of ethical hacking is to identify vulnerabilities so they can be remediated, thereby strengthening security. Malicious hacking seeks personal gain, disruption, or espionage, often resulting in data theft or system compromise. Legal distinction – Because ethical hacking has explicit authorization, it is protected by law (e.g., computer-fraud statutes that exempt authorized testers). Unauthorized access, regardless of technique, remains illegal.Why the other options are incorrectA – Different tools – Both ethical and malicious hackers frequently use the same toolset (e.g., Nmap, Metasploit). Tool selection depends on skill and task, not on the ethical stance of the practitioner. B – Legality reversal – Ethical hacking is expressly legal when performed with permission; malicious hacking is illegal. The statement reverses the factual legal status. D – Solo vs. team work – Ethical hackers often collaborate with security teams, IT staff, or external auditors. Likewise, malicious groups can be organized or lone actors. Team structure is unrelated to the ethical/legal distinction.
CEH v13 Exam Blueprint – https://www.eccouncil.org/ceh-certification/ceh-exam-blueprint/ EC-Council Code of Ethical Ethical Hacking – https://www.eccouncil.org/ethical-hacking/code-of-ethics/
A security analyst is tasked with gathering detailed information about an organization’s network infrastructure without making any direct contact that could be logged or trigger alarms. Which method should the analyst use to obtain this information covertly?
Correct answer is DStealthy reconnaissance – Examining publicly available data such as leaked documents, data dumps, or prior breach releases allows the analyst to gather detailed architectural and configuration details without sending any network traffic that could be detected by IDS/IPS or logging systems. No active interaction – Options A, B, and C all involve active probing (social engineering, brute-forcing DNS, or network scanning). Those activities generate packets, queries, or user interactions that can be logged by firewalls, DNS servers, or SIEMs, potentially alerting defenders and violating the “covert” requirement. Depth of information – Leaked datasets often contain diagrams, configuration files, employee contact lists, internal policies, and other assets that reveal the full scope of the infrastructure, whereas scanning or brute-force methods only expose surface-level details (open ports, hostnames, sub-domains). Ethical and legal considerations – Passive analysis of already-exposed material avoids violating penetration-testing rules of engagement that forbid unsanctioned exploitation; it stays within the bounds of lawful information gathering.
NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment – https://csrc.nist.gov/publications/detail/sp/800-115/final MITRE ATT&CK – Reconnaissance: OSINT – https://attack.mitre.org/techniques/T1596/ (demonstrates OSINT as a low-profile discovery technique)
A penetration tester is assessing a company’s HR department for vulnerability to social engineering attacks using knowledge of recruitment and onboarding processes. What is the most effective technique to obtain network access credentials without raising suspicion?
Technical JustificationOption B – Create a convincing fake onboarding portal that mimics the company’s internal systemsRationale: The HR onboarding workflow inherently involves new-hire account creation, password self-service, and enrollment in security tools. By replicating the exact UI, branding, and workflow of the legitimate portal, the tester can trick HR staff into entering their corporate credentials (e.g., Active Directory or SSO) without alerting security controls. The request appears to be a routine part of the onboarding process, so it evades suspicion and bypasses typical phishing filters that flag external domains. Effectiveness: Once the victim submits credentials, the tester obtains valid network-access tokens that can be used immediately, often persisting beyond a single use because many portals auto-enroll devices into managed endpoints.Why the other options are inferiorOption A – Phone call posing as a new employee – While social engineering is possible over the phone, live calls are monitored for protocol adherence and often trigger escalation (e.g., verification of identity). A password reset request is limited in scope; it may yield a one-time credential but rarely provides full network access, and call logs can expose the activity. Option C – Fake social media profile – Social media outreach is noisy and traceable; HR employees may scrutinize unknown connections, especially if they reference internal processes. Moreover, extracting sensitive information via informal chats is unlikely to yield direct network credentials. Option D – Generic phishing email with a fake HR policy – Mass-mailed phishing is heavily filtered by email security gateways and user-awareness training. A generic document lacks the contextual relevance of an onboarding portal, leading to lower click-through rates and higher reporting likelihood.Conclusion : Option B best leverages the natural trust placed in onboarding workflows, provides a realistic interface that bypasses suspicion, and delivers exploitable credentials without triggering typical detection mechanisms.
1. Offensive Security Certified Professional (OSCP) – Social Engineering Lab Guide.https://www.offensive-security.com/potraining/2. EC-Council | Certified Ethical Hacker (CEH) v13 – Social Engineering Attack Vectors Module.https://www.eccouncil.org/certified-ethical-hacker-ceh/v13/
A penetration tester is mapping a Windows-based internal network. The tester notices that TCP port 139 and UDP port 137 are open on multiple systems. File and printer sharing is enabled. To retrieve hostnames, user details, and domain roles without triggering alerts, which tool and method would be most effective?
JustificationNetBIOS name resolution is exposed – TCP 139 and UDP 137 are the classic ports used by SMB (port 139) and the NetBIOS Name Service (port 137). When these are reachable on multiple Windows hosts, an attacker can query the NetBIOS Name Table directly from any machine, obtaining hostnames, workgroup names, and, in some cases, domain-joined role information without generating the typical “LDAP bind” or “SMB-client-side” alerts. nbtstat -A sends a NetBIOS name lookup request to a specific IP address, forcing the target to reveal itsNetBIOS name and associated information. The command works locally or remotely, requires only ICMP/UDP connectivity, and leaves minimal traces in the system logs, making it ideal for stealthy enumeration in an internal assessment.Option A – LDAP anonymous bind – While LDAP can enumerate users and machine accounts, it requires the LDAP service (port 389/636) to be reachable and often triggers account-lockout or audit logs when many binds are attempted. Anonymous binds are increasingly disabled on hardened Active Directory environments, and the resulting traffic is more likely to be flagged by SIEMs. Option B – pspasswd – This tool modifies a user’s password on a remote system. It is not an enumeration technique; it does not reveal hostnames, user details, or domain roles and would likely be detected because it performs a privileged change operation. Option D – psloggedon – This utility lists currently logged-on sessions on a local or remote computer. It can show usernames and session IDs but does not provide broader domain role information and generally requires credentials or admin rights on the target, increasing the chance of detection.Therefore, Option C – Run nbtstat -A to query the NetBIOS name table is the most effective, low-profile method for retrieving hostnames, user details, and domain roles when SMB-related ports are open.
Microsoft Docs – nbtstat command-line options: https://learn.microsoft.com/windows-server/administration/windows-commands/nbtstat Nmap Service – NetBIOS Name Service (137/udp) description and usage: https://nmap.org/book/man-port-specs.html#service-nbtstat
A penetration tester is attempting to gain access to a wireless network that is secured with WPA2 encryption. The tester successfully captures the WPA2 handshake but now needs to crack the pre-shared key. What is the most effective method to proceed?
Correct Option: C. Use a dictionary attack against the captured WPA2 handshake to crack the keyWhy option C is the best choiceThe WPA2-PSK handshake is a deterministic cryptographic exchange that can be saved and later processed offline. A dictionary attack exploits a pre-computed list of candidate passphrases (common, leaked, or weak passwords) to test whether any match the hash derived from the captured handshake. Modern cracking tools (e.g., hashcat, aircrack-ng) can apply massive parallel GPU acceleration to evaluate millions of guesses per second against the saved handshake, making the process feasible within a reasonable timeframe when a realistic wordlist is supplied.Why the other options are less suitableA: De-authentication attack – This only forces clients to reconnect; it does not provide any material to recover the PSK and therefore does not aid in key cracking.B: SQL injection attack on the router’s login page – WPA2 routers typically lack a web-based SQL backend for authentication; such an attack targets application-layer flaws, not the wireless encryption protocol. D. Brute-force attack using common passwords – While technically possible, a “brute-force” approach that tries every possible combination without a refined wordlist is computationally expensive and far less efficient than a targeted dictionary attack that leverages known weak passwords and common passphrases.Summary The only method that directly converts the captured WPA2 handshake into a recoverable key is a dictionary-based offline cracking technique , which leverages large, curated wordlists and GPU-accelerated cracking engines to efficiently test likely passphrases.
1. Aircrack-ng Handbook – Handshaking and cracking WPA/WPA2: https://aircrack-ng.org/doku.php?id=handshake 2. Hashcat WPA/WPA2 (22000) mode documentation:https://hashcat.net/wiki/development/commands#22000-wpa-psk
During a security evaluation of a smart agriculture setup, an analyst investigates a cloud-managed irrigation controller. The device is found to transmit operational commands and receive firmware updates over unencrypted HTTP. Additionally, it lacks mechanisms to verify the integrity or authenticity of those updates. This vulnerability could allow an adversary to intercept communications or inject malicious firmware, leading to unauthorized control over the device’s behavior or denial of essential functionality. Which IoT threat category does this situation best illustrate?
JustificationThe vulnerability centers on the way the irrigation controller interacts with external cloud services (command delivery and firmware update). These interaction points are part of the device’s ecosystem interfaces ; the lack of TLS, authentication, or integrity checks means the interface can be spoofed or tampered with. This matches the IoT threat category “Insecure ecosystem interfaces,” which covers improper hardening of communication pathways, APIs, and update mechanisms that connect disparate IoT components.Why the other options are less appropriateA: Insecure network services – describes services that run on insecure protocols (e.g., Telnet, FTP) within the network. The issue here is not the service itself but the trust relationship between the device and the cloud service. C. Insecure default settings – would apply if the device shipped with weak passwords or open ports that are easily exploitable. The scenario does not mention default credentials or exposed ports. D. Insufficient privacy protection – pertains to leakage of personal or usage data. The described threat is about command or firmware manipulation, not about privacy of data.Thus, option B – Insecure ecosystem interfaces best captures the core problem of unverified, unauthenticated communication with external cloud components.
EC-Council – IoT Security Framework (Version 1) – Detailed taxonomy of IoT threat categories, including “Insecure ecosystem interfaces.” https://www.eccouncil.org/iot-security-framework/ NIST Special Publication 800-183 – Guide to Securing the Internet of Things – Discusses interface hardening and authentication of firmware updates. https://csrc.nist.gov/publications/detail/sp/800-183/finalThese sources provide further technical context for the classification used in the question.
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.