A penetration tester has completed a vulnerability scan on a company’s internal network. The scan reveals multiple low-risk vulnerabilities, but one high-risk vulnerability is associated with outdated server software. What should the tester prioritize as the next step?
Answer(s): C
Why option C is the best choicePrioritization of risk : In professional penetration testing, the tester must focus on the highest-impact findings first. A high-risk vulnerability in outdated server software can potentially allow unauthenticated remote code execution or privilege escalation, making it the most critical issue to address before moving to lower-severity items. Feasibility check : Before attempting exploitation, the tester needs to confirm that the vulnerability is actually exploitable in the target environment (e.g., the specific version is affected, patches are missing, and the exploit is known to work). This step validates effort and avoids wasted time on non-viable targets. Methodical workflow : After discovery, a responsible tester follows the standard PTES/OSSTMM phases: Discovery → Validation → Exploitation → Reporting. Skipping validation (option A) or focusing on low-risk items first (option B) undermines risk-based assessment.Why the other options are unsuitableA – Perform a brute-force attack on the server Brute-forcing unrelated services ignores the identified high-risk vulnerability and wastes resources. It also may violate acceptable use policies and could cause unnecessary denial of service.B – Focus on exploiting the low-risk vulnerabilities first Low-risk findings are typically “nice-to-have” or informational. Exploiting them before confirming and remediating a high-risk issue contradicts the core principle of security testing to address the most dangerous weaknesses first.D – Ignore the high-risk vulnerability and proceed with testing other systems Ignoring any discovered high-risk finding would compromise the integrity of the engagement. High-risk vulnerabilities must be investigated and reported; neglecting them undermines both the tester’s responsibility and the client’s security posture.
EC-Council PTES (Penetration Testing Execution Standard) – “Information Collection” and “Vulnerability Analysis” phases: https://www.ptes.info NIST SP 800-115 – “Technical Guide to Information Security Testing and Assessment” – Section on risk-based vulnerability prioritization: https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/finalThese documents outline the professional methodology that mandates validating and prioritizing high-risk, exploitable vulnerabilities before proceeding to lower-risk findings.
A penetration tester suspects that a web application’s product search feature is vulnerable to SQL injection. The tester needs to confirm this by manipulating the SQL query. What is the best technique to test for SQL injection?
Answer(s): D
Technical JustificationOption D – “Input 1 OR 1=1 in the search field to retrieve all products”This is a classic Boolean-based payload that forces the underlying SQL expression to evaluate to TRUE, causing the query to return every row (e.g., SELECT * FROM products WHERE name LIKE '%1 OR 1=1%' ).Successful retrieval of an unexpectedly large result set confirms that the input is directly incorporated into the query without proper sanitization or parameterization, demonstrating a functional SQL-Injection vulnerability. It provides immediate, observable feedback (extra rows returned) that can be logged and further probed, making it the most reliable method for confirming injection in a black-box test.Why the other options are less suitableOption A – “Inject a malicious script to test for XSS” – XSS testing concerns client-side script execution, not server-side query manipulation. It does not verify whether the input can alter the server’s SQL statement. Option B – “Use directory traversal syntax to access server files” – Directory traversal probes file-system access; while it may reveal path-traversal issues, it does not test the SQL query itself and is unrelated to injection detection. Option C – “Insert admin ‘-- to bypass authentication” – This payload attempts to comment out authentication checks, but it presumes the application uses a conditional authentication clause that can be disabled by a comment. It targets a specific authentication bypass rather than confirming that arbitrary input can be injected into the query; it may fail silently or be ineffective if the query does not use that logic.Conclusion Option D directly demonstrates that unsanitized input can alter the application’s SQL logic and retrieve unintended data, fulfilling the penetration tester’s goal of confirming an SQL-Injection vulnerability.
OWASP Testing Guide, Section 4.2 – Injection – https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/4-Input_Validation_Testing/4-1-Testing_for_Injection NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment – https://csrc.nist.gov/publications/detail/sp/800-115/getting-started/ (see “SQL Injection” subsection)
A penetration tester is hired to legally assess the security of a company’s network by identifying vulnerabilities and attempting to exploit them. What type of hacker is this?
Answer(s): A
JustificationWhite Hat (A) – The description matches the definition of a white-hat hacker: a professional engaged to ethically assess security, identify vulnerabilities, and lawfully exploit them with proper authorization. This activity is precisely what a penetration tester does as part of a formal, contracted engagement . Script Kiddie (B) – Refers to non-technical actors who use pre-written tools without understanding or authorization; they lack the systematic methodology and reporting required of a penetration test. Black Hat (C) – Describes malicious attackers who compromise systems illegally for personal gain; their activities are outside any legal scope. Grey Hat (D) – Implies hackers who may discover vulnerabilities without permission but sometimes disclose them; however, they still operate outside a defined, authorized mandate , unlike a contracted penetration tester.Therefore, the scenario aligns with the White Hat role, as it involves authorized, methodical security testing performed by a qualified professional.
EC-Council, “Certified Ethical Hacker (CEH) v13 Exam Blueprint,” Section 1: Ethical Hacking Overview – https://www.eccouncil.org/ceh/resources/exam-blueprint/ NIST Special Publication 800-115, “Technical Guide to Information Security Testing and Assessment” – https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final
A penetration tester suspects that a web application’s user profile page is vulnerable to SQL injection, as it uses the userID parameter in SQL queries without proper sanitization. Which technique should the tester use to confirm the vulnerability?
Answer(s): B
Answer(s): BTechnique: Modify the userID parameter in the URL to the string ‘ OR ‘1’=‘1 and observe whether the application returns multiple or unexpected profile data, confirming that the input is not properly sanitized and that the underlying query can be subverted.Justification:Option B directly tests the suspected injection point by injecting a logical condition that is always true ( 1’=‘1 ).If the application incorporates this fragment into its SQL statement without validation, the resulting query will return more rows than intended, revealing an injection vulnerability. This is the canonical method for confirming an SQL injection flaw. Option A (directory traversal) targets file-system access and is unrelated to SQL query logic; it does not test the injection hypothesis. Option C (HTML injection) probes for Cross-Site Scripting, which is a separate class of vulnerabilities; success there does not prove SQL injection. Option D (brute-force admin login) attempts authentication bypass and may exploit other flaws, but it does not specifically verify whether the userID field is vulnerable to SQL injection.Thus, only option B provides a focused, injection-specific test that can reliably confirm the presence of an SQL injection vulnerability in the userID parameter.
OWASP Testing Guide – SQL Injection Practical Web Application Security – “Detecting SQL Injection with Boolean-Based Payloads” (practical examples and payloads) – https://www.veracode.com/blog/2019/03/detecting-sql-injection-with-boolean-based-payloads/
A global fintech company that processes millions of online payments daily begins receiving alarming emails from an unknown threat actor claiming to represent a notorious hacktivist group. The email includes a demand for 20 BTC in cryptocurrency, warning that a large-scale DDoS attack will cripple their infrastructure if the ransom is not paid within 72 hours. To prove their seriousness, the attacker initiates a short-lived HTTP flood targeting the company’s checkout service. Within minutes, legitimate users report long delays and service timeouts during payment processing. The incident response team observes a significant spike in POST requests with incomplete payloads, overwhelming the application layer and causing partial service disruptions. The attack ceases after 15minutes, followed by a second email reinforcing the ransom demand and threatening a more severe attack. What type of DDoS attack is being carried out in this scenario?
Why Option C is CorrectThe scenario describes a DDoS attack that is explicitly tied to a ransom-payment ultimatum and a threat of further disruption. This dual element— technical flooding plus extortion messaging —is the hallmark of a threat-and-extortion DDoS campaign, which is what “DDoS attack combining threat and extortion” denotes. The attacker sends a demand for 20 BTC and warns of a larger attack if the demand is not met, demonstrating the ransom-driven motive that differentiates this class of attacks from generic volumetric floods.Why the Other Options Are Less SuitableA: Recursive GET flood disguised as crawling – a GET-based brute-force crawl mimics legitimate web-scraper traffic; there is no evidence here that the attacker is masquerading as a crawler. B. Pulse wave attack with burst patterns – while the flood lasted only 15 minutes, the focus is on the extortion motive, not on a distinctive pulse-wave traffic pattern. D. DRDoS attack using intermediaries – the description does not mention the use of reflection/amplification servers or spoofed source IPs, which are required for a DRDoS classification.Key Technical IndicatorsSpike in incomplete POST payloads → layer-7 (application-level) flood . Sudden, short-duration service degradation (delays, timeouts) consistent with a targeted, brief volumetric penalty . Explicit ransom demand and threat escalation → extortion component .Selection VerdictC best captures both the attack vector (application-layer DDoS) and the tactical purpose (ransom/extortion), making it the most accurate classification for the scenario.
CISA – DDoS Attack Types and Mitigation Strategies : https://www.cisa.gov/us-cert/national-digital-emergency-response-nep/ddos-attack-types NIST Special Publication 800-115 – Computer Security Log Management : https://csrc.nist.gov/publications/detail/sp/800-115/finalThese sources detail DDoS classifications, including extortion-driven attacks, and provide technical context supportive of the analysis above.
During a physical penetration test simulating a social engineering attack, a threat actor walks into the lobby of a target organization dressed as a field technician from a known external vendor. Carrying a fake ID badge and referencing a known company name, the attacker confidently claims they’ve been dispatched to perform a routine server room upgrade. Using internal-sounding terminology and referencing real employee names gathered via OSINT, the individual conveys urgency. The receptionist, recognizing the vendor name and the convincing language, allows access without verifying the credentials.
Why option B is the best answerThe attacker leverages perceived authority by dressing as a field technician from a reputable external vendor; the appearance and professional language trigger the receptionist’s mental shortcut. Third-party familiarity is exploited: the vendor name and reference to known employee names (gathered via OSINT) give the impression that the visitor belongs to a trusted partner. Social-engineering success often hinges on authority bias —people are conditioned to comply with individuals who appear to be in a legitimate, high-status role or represent a recognized organization.Why the other options are less appropriateOption A – Physical security logs were not consulted; the breach relied on verbal interaction, not on the system’s logging mechanisms. Option C – No credentials were leaked or used from public networks; the attacker created new, fabricated credentials. Option D – The attack did not involve any network misconfiguration or segmentation bypass; access was granted at the physical entry point.
https://www.eccouncil.org/certified-ethical-hacker/v13/ https://academy.eccouncil.org/course/social-engineering-essentials/These links provide official EC-Council documentation on social-engineering tactics and the authority principle used in physical penetration testing.
A penetration tester evaluates the security of an iOS mobile application that handles sensitive user information. The tester discovers that the application is vulnerable to insecure data transmission. What is the most effective method to exploit this vulnerability?
Correct Option: A – Perform a man-in-the-middle attack to intercept unencrypted data transmitted over the networkWhy A is correct: The core flaw is insecure data transmission – the app sends sensitive information over an unencrypted or weakly-encrypted channel (e.g., HTTP, outdated TLS). An attacker who can position themselves on the same network (or compromise a Wi-Fi router) can capture, modify, or replay the traffic. This directly exploits the transmission weakness and provides the most straightforward path to obtain credentials, tokens, or personal data.Why the other options are less suitable:B: CSRF attack – Requires the user to be logged in and the app to accept cross-origin requests without proper anti-CSRF tokens. It does not address the underlying problem of unprotected data in transit. C. SQL injection – Targets server-side input validation flaws; it does not leverage the network-level transmission vulnerability. If the app validates inputs properly, an attacker would need a separate server-side injection point, which the scenario does not describe. D. Brute-force authentication – Focuses on weak password or credential mechanisms; the vulnerability under test is about data being exposed on the wire, not about password strength or authentication hardening.
OWASP Mobile Security Project – Insufficient Transport Layer Protection: https://owasp.org/www-project-mobile-security-project/ Apple Platform Security – Network Security and Transport Protection: https://support.apple.com/guide/security/transport-securityworth10ab3b9c9c2-webSAF8E5C6A23Key takeaway: When an iOS app transmits sensitive data without proper encryption, the most effective exploitation technique is a man-in-the-middle interception of that unprotected traffic.
A penetration tester needs to map open ports on a target network without triggering the organization’s intrusion detection systems (IDS), which are configured to detect standard scanning patterns and abnormal traffic volumes. To achieve this, the tester decides to use a method that leverages a third-party host to obscure the origin of the scan. Which scanning technique should be employed to accomplish this stealthily?
Technical justificationIdle (Zombie) scan operates by selecting a “zombie” host that the attacker can control remotely. The scanner sends a single unauthenticated probe (often an IP packet with the IP ID incremented) from the zombie to the target’s ports, observes the response of the target’s IP ID, and deduces which ports are open/closed without sending any packets from the attacker’s IP address. Because all traffic appears to originate from the third-party zombie host, the IDS sees only normal traffic patterns from an innocuous system, drastically reducing the likelihood of triggering signature-based or volume-based alerts. The technique also avoids direct connection attempts, SYN floods, or UDP bursts that are typical of traditional scans, making it the most suitable choice when evading modern IDS/IPS with sophisticated traffic-analysis capabilities.Why the other options are less suitableTCP SYN scan with slow-timing options (A) still generates SYN packets from the attacker’s IP and can be flagged by threshold-based IDS rules, even if the rate is reduced. TCP FIN scan with randomized port sequences (C) may evade some simple signature checks but is still a direct scan from the tester’s host; many IDS signatures specifically flag FIN-flagged probes, and randomization does not hide the source. UDP scan with packet fragmentation (D) produces fragmented UDP packets that can trigger IDS alerts for abnormal fragmentation and often results in higher traffic volume, which defeats the stealth goal.Therefore, the Idle scan using a zombie host (B) best satisfies the requirement for covert enumeration while leveraging a third-party host to hide the attacker’s identity.
Nmap Documentation – Idle Scan: https://nmap.org/book/secscan-idlescan.html HackTricks – Stealth Scanning Techniques: https://book.hacktricks.xyz/networking/nmap/stealth-scanning#idle-scanThese links provide detailed explanations and examples of zombie scanning and other evasion methods relevant to the discussion.
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.