A penetration tester finds malware that spreads across a network without user interaction, replicating itself from one machine to another. What type of malware is this?
Answer(s): D
Answer(s): D – WormCharacteristic behavior – A worm is self-replicates and propagates across a network (or the Internet) without requiring user interaction, exactly matching the observed “spreads across a network without user interaction” pattern. Virus (A) also self-replicates but typically needs a host file/program to attach to and often requires user action (e.g., opening an infected file) to spread. Ransomware (B) is defined by its payload (encrypting data for extortion), not by the method of propagation; it can spread via phishing or exploits but the defining trait is encryption, not autonomous network spreading. Keylogger (C) is a surveillance tool that records keystrokes; it does not inherently self-replicate or propagate across machines.
1. MITRE ATT&CK – Worm (Technique T1025) : https://attack.mitre.org/techniques/T1025/ 2. CISA – Understanding Malware Types : https://www.cisa.gov/understanding-malwareThese sources confirm that a worm is defined by its ability to self-replicate and spread across networks autonomously.
A penetration tester is assessing a web application that employs secure, HTTP-only cookies, regenerates session IDs upon login and uses strict session timeout policies. To hijack a user’s session without triggering the application's security defenses, which advanced technique should the tester utilize?
Answer(s): C
Correct option: C – Conduct a network-level man-in-the-middle attack to intercept and reuse session tokensSecure, HTTP-Only cookies and regeneration of session identifiers protect the server-side state, but they do not prevent an attacker who can observe the traffic between the client and the web server from capturing a freshly issued session token. By positioning the tester (or attacker) on the same network segment as the victim – for example, through ARP spoofing, rogue Wi-Fi, or compromised switches – the tester can sniff unencrypted or weakly-encrypted HTTP requests/responses, extract the session identifier that is still sent in the clear, and replay it in subsequent requests. This approach bypasses server-side defenses (e.g., token regeneration, timeout policies) because the attacker uses a perfectly valid token that has not been altered by the application; the reuse appears legitimate from the server’s perspective and triggers no anomaly detection. Options A, B, and D do not fit the scenario:A (CSRF) manipulates actions after a valid session is established; it does not provide a way to obtain or reuse the session identifier itself. B (Session fixation) is mitigated by the application’s forced regeneration of session IDs at login, eliminating any pre-authenticated identifier that could be reused. D (Token prediction) requires predictable session ID generation; modern applications typically use high-entropy, random IDs, making systematic prediction infeasible.Therefore, a network-level MITM attack is the most appropriate technique for hijacking a session without tripping the application’s built-in safeguards.
OWASP – Session Management Cheat Sheet : https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html RFC 7231 – Hypertext Transfer Protocol (HTTP/1.1) Message Semantics and Payload Syntax (section on Session Cookies): https://httpwg.org/http.html#header.field.session.cookie (documentation of cookie handling and transmission)
A university’s online registration system is experiencing disruptions due to a DDoS attack that combines DNS reflection and HTTP slowloris techniques. Standard firewalls and load balancers are unable to mitigate the attack without impacting legitimate users.To ensure uninterrupted registration services, which advanced mitigation strategy should the university implement?
Answer(s): A
JustificationOption A – A hybrid DDoS mitigation solution that combines on-premises scrubbing appliances with cloud-based “traffic-cleaning” (e.g., Cloudflare, Akamai, or Amazon Shield) can absorb DNS-reflection amplification and HTTP slow-loris floods while preserving legitimate user sessions. The service can off-load massive reflection traffic to the cloud edge and apply application-aware throttling without degrading performance for authorized registrants. Option B – An IPS with deep-packet inspection adds latency and is not sized for the volume of DNS reflection or the connection-keeping semantics of slow-loris. It can introduce false positives and cannot scale to the bandwidth required for large-scale attacks. Option C – Blocking all inbound DNS and HTTP traffic would also deny legitimate registration requests, effectively taking the service offline. This is an over-reaching, denial-of-service approach rather than a mitigation strategy. Option D – Simply raising bandwidth and applying generic rate limits does not distinguish attack vectors; DNS amplification can still consume resources, and HTTP slow-loris exploits connection state rather than raw volume. Basic limits cannot differentiate legitimate spike traffic from malicious patterns.Therefore, the only choice that provides targeted, scalable protection while preserving service availability is Option A .
Cloudflare – DDoS Protection Overview: https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/ AWS Shield – DDoS Protection Services: https://aws.amazon.com/shield/ddos-protection/
In a vertical privilege escalation scenario, the attacker attempts to gain access to a user account with higher privileges than their current level. Which of the following examples describes vertical privilege escalation?
JustificationOption A correctly describes vertical privilege escalation: the attacker starts with ordinary user privileges and exploits a vulnerability that grants administrative (higher-level) permissions , thereby moving “up” the permission hierarchy. This is the textbook definition of vertical escalation.Option B describes an attack that results in equivalent privileges (e.g., exploiting an unquoted service path to access another user’s data). The attacker does not gain higher privileges, only the same level of access as the targeted user—hence it is a horizontal or same-level access scenario.Option C involves accessing data with alike privileges, which again reflects a horizontal movement (stealing data from a peer account) rather than acquiring elevated rights.Option D focuses on session-management weaknesses that allow account switching without elevation; the attacker ends up with privileges identical to the other user, not higher.Therefore, only Option A embodies a genuine vertical privilege escalation, where the privilege level strictly increases.
MITRE ATT&CK – Privilege Escalation NIST Special Publication 800-53 Rev. 5 – IA-5: Privilege Management
While evaluating a smart card implementation, a security analyst observes that an attacker is measuring fluctuations in power consumption and timing variations during encryption operations on the chip. The attacker uses this information to infer secret keys used within the device. What type of exploitation is being carried out?
Correct Answer: CThe analyst is observing variations in power usage and timing emitted by the smart-card during cryptographic operations. Such side-channel data can be statistically analyzed to recover secret keys—a classic power-/timing-based side-channel attack . Option C directly describes “Observe hardware signals to deduce secrets,” which matches the described technique of extracting key material from physical emissions.Why the other options are unsuitableA – Disrupt control flow to modify instructions – This refers to control-flow hijacking or code-injection attacks, not to measuring physical side-effects. B – Force session resets through input flooding – This describes a denial-of-service or input-flooding attack, unrelated to observing hardware emissions. D – Crack hashes using statistical collisions – This pertains to cryptanalytic collisions on hash outputs, not to exploiting power or timing side-channels on a device.Therefore, option C is the only choice that accurately captures the nature of the attack being performed.
Side-Channel Analysis : https://www.cs.rice.edu/~kocher/papers/SCN02.pdf Power Analysis Attacks on Smart Cards : https://www.iacr.org/archive/crypt2000/pdfs/179.pdf
A penetration tester finds that a web application does not properly validate user input and is vulnerable to reflected Cross-Site Scripting (XSS). What is the most appropriate approach to exploit this vulnerability?
JustificationCorrect option – A: Reflected XSS occurs when user-supplied data is returned to the browser without proper sanitization or encoding. By crafting a malicious URL that contains a script payload (e.g., <script>alert(1)</script> ) and convincing a victim to click that link, the attacker causes the script to execute in the victim’s browser, achieving code execution in the context of the vulnerable site. This is the textbook exploitation technique for reflected XSS.Why the other choices are unsuitableB) Directory traversal – This technique targets file-system access on the server, not client-side script execution. It does not exploit the reflected XSS flaw. C) Brute-force login – Attacking authentication credentials does not leverage the input-validation issue that enables script injection; it is unrelated to XSS. D) SQL injection – Injecting SQL into a search form would attempt to manipulate the database, which is a different vulnerability class and does not directly execute client-side scripts.Therefore, the only method that directly exploits a reflected XSS vulnerability is to embed a malicious script in a URL and rely on a victim’s action to trigger its execution.
OWASP – Cross-Site Scripting (XSS): https://owasp.org/www-community/attacks/xss/CWE-79: Dangerous Web Content Using Improper Neutralization of Data from the Web: https://cwe.mitre.org/data/definitions/79.html
During a red team assessment, an ethical hacker is assigned the task of mapping a large multinational enterprise’s external attack surfaces. The target organization operates multiple regional websites and cloud-hosted environments under different subdomains. Due to strict rules of engagement, the hacker must avoid any active scans or probes that could alert the organization’s security monitoring systems. The goal is to uncover as many publicly exposed subdomains as possible to identify potential unpatched or misconfigured services that may exist under obscure or forgotten subdomains. Which method should the ethical hacker use to passively enumerate the organization’s subdomains?
Answer(s): B
Why option B is the best choicePassive enumeration (e.g., using Netcraft or DNSdumpster) queries publicly available DNS data sources, requiring no direct interaction with the target’s DNS servers, thus avoiding detection by security monitoring systems. It can discover a large set of subdomains—including obscure or legacy entries—without generating traffic that could trigger IDS/IPS alerts. The method complies with strict rules of engagement by relying solely on open-source intelligence (OSINT) and does not involve active scanning, credential brute-forcing, or unauthorized access.Why the other options are unsuitableA: Conduct a brute-force DNS subdomain enumeration – This generates many DNS queries that appear as active scanning, likely triggering alerts and violating the “no active probes” constraint. C. Request internal DNS records using spoofed credentials – This requires illicit access to internal systems, constitutes credential misuse, and breaches the ethical-hacking scope; it is not a passive technique. D. Guess admin credentials and access the company’s DNS portal – This is an active, credential-guessing attack that would be logged and could be detected; it also exceeds the allowed enumeration scope.
Netcraft Subdomain Search – https://searchdns.netcraft.com/ DNSdumpster Public DNS Enumeration – https://dnsdumpster.com/
During a stealth assessment of a corporate internal network, an attacker gains access to a subnet where host communications are switched and protected against common ARP poisoning techniques. While passively sniffing traffic, the attacker observes that the target system (Host B) intermittently delays its response to ARP requests. Recognizing a potential opportunity, the attacker crafts and injects a fake ARP reply that maps the target’s IP address to their own MAC address and sends it before the legitimate reply arrives. Over time, the attacker notices that packets originally intended for Host B occasionally arrive at their own system, especially during these ARP response delays. The switch’s CAM table seems to temporarily associate the target's IP with the attacker’s MAC and port, before reverting back once the legitimate host reasserts itself. What type of sniffing attack is the attacker performing?
Answer(s): A – Switch port stealing via timing-based ARP spoofingJustificationThe attacker does not maintain a full-blown Man-In-The-Middle session; they merely inject a single forged ARP reply that arrives before the legitimate reply. By arriving first, the forged reply temporarily replaces the switch’s CAM entry for the target’s IP address with the attacker’s MAC / port. This causes the switch to forward frames destined for Host B to the attacker’s port while the legitimate host re-asserts its correct CAM entry after the delay, resulting in intermittent capture of those packets. The technique relies on precise timing to win the race against the legitimate ARP reply, which is precisely what “timing-based ARP spoofing” describes, and it transiently hijacks the switch’s forwarding path – i.e., “port stealing.” Option B (ARP poisoning for MiTM) requires sustained poisoning to maintain a continuous interception; here the attacker only captures packets opportunistically during the brief window when the forged reply is effective. Option C (Passive sniffing) is inaccurate because the attacker is actively transmitting forged ARP replies rather than passively listening. Option D (Duplicate IP conflict resolution) involves address-resolution conflicts that are not observed here; the attacker never creates a conflict but rather hijacks an existing entry temporarily.
RFC 826 – An Ethernet Interface’s ARP – details the ARP request/reply exchange and timing considerations. EC-Council | CEH v13 Official Study Guide, Chapter 6: “ARP Spoofing & Switch Hijacking” – describes timing-based ARP attacks and port-stealing behavior.Both links are publicly accessible and provide deeper technical background on the concepts discussed.
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.