Free 312-50v13 Exam Braindumps
Certified Ethical Hacker v13 Questions 553–560 (page: 71)

Explanation:

Technical justification
Correct option – C. NAC bypass using a pre-authenticated device for network bridging The attacker introduces a Raspberry Pi that inherits the MAC address and authenticated credentials of a legitimate workstation. Because the device is already “trusted” by the Network Access Control (NAC) system, its traffic bypasses authentication checks and goes undetected, allowing east-west traffic to masquerade as normal workstation traffic. This technique directly matches the definition of a pre-authenticated device used to bridge or forward traffic and is a classic example of evading NACs.
Why the other options are unsuitable

A: Exploiting a wireless rogue access point to tunnel through the firewall – The scenario is entirely wired; no wireless AP or tunneling mechanism is involved. B. VLAN double tagging to shift between network segments – Double-tagging manipulates VLAN IDs to bypass ACLs or segmentation, but it does not involve hijacking an authenticated workstation’s identity. D. Spoofing ARP responses from a dynamic IP allocation pool – ARP spoofing alters MAC-to-IP mappings, yet the described attack relies on preserving an existing legitimate MAC and gaining network access through an authenticated session, not on IP spoofing or dynamic pools.
Conclusion Option C precisely captures the method used: a pre-authenticated device placed inline to forward traffic while evading NAC controls, making it the best and most specific answer.

Reference:

EC-Council – Certified Ethical Hacker (CEH) v13 Exam Objectives: https://www.eccouncil.org/certified-ethical-hacker-ceh/v13/ Cisco – Network Access Control Configuration Guide (NAC bypass techniques): https://www.cisco.com/c/en/us/td/docs/security/access/active_directory/1-xx/1-xx-1/white_paper_c11-739092.html

Explanation:

Explanation:

Justification
Option A – Access the local storage to retrieve sensitive data directly from the device Correct choice.
When the app fails to encrypt data at rest, the information (e.g., SharedPreferences, SQLite DB, files in internal storage) resides in clear text on the device’s filesystem. An attacker with physical or logical access can mount the device’s storage (or pull the data via ADB) and read the raw files without any additional exploit chain. This directly leverages the identified weakness.
Option B – Use SQL injection to retrieve sensitive data from the backend server Irrelevant to the vulnerability described. The flaw is local storage encryption, not improper input handling in the server-side database. SQL injection would only be applicable if the application construct SQL queries unsafely, which is not mentioned.
Option C – Perform a brute-force attack on the application’s login credentials Incorrect focus. The issue is not weak authentication or password protection; it is the lack of encryption for stored data. Brute-forcing credentials does not expose the unencrypted data stored on the device.
Option D – Execute a Cross-Site Scripting (XSS) attack to steal session cookies Misdirected. XSS targets client-side script injection to hijack sessions, but the vulnerability at hand pertains to data persistence, not to insecure scripting or output encoding. No session cookie theft is implied.
Conclusion Because the application stores data in an unencrypted manner on the device, the most straightforward and effective exploitation method is to read that data directly from local storage. The other options target unrelated attack surfaces.

Reference:

Android Developers – Encrypting Files: https://developer.android.com/guide/topics/data/data-storage#saving-files OWASP Mobile Security Project – Data Storage: https://owasp.org/www-project-mobile-security-resource-guide/v2/0xa5-architecture/v2-3-data-storage/https://developer.android.com/training/data-storage
These links provide authoritative guidance on proper encryption practices for Android local storage and the associated security considerations.

Explanation:

Justification
Option A – Regularly updating and patching the server software Why it is correct: Keeping the web server, operating system, and any installed modules up-to-date eliminates known vulnerabilities (e.g., CVEs in Apache, Nginx, or the underlying HTTP stack) that attackers could exploit to gain control of the virtual hosts, bypass authentication, or retrieve files from /admin/web/certroot . Patching also ensures that security-related configuration defaults (e.g., directory listing, hidden files exposure) are corrected. This is the most direct and reliable method to harden the server.
Option B – Implementing an open-source stack such as LAMP Why it is less suitable: “Open-source” does not inherently improve security; a LAMP deployment introduces additional components (Linux, Apache, MySQL, PHP) that each bring their own configuration pitfalls and potential vulnerabilities. The security gain depends on how those components are hardened, not on the technology choice itself.
Option C – Changing the server’s IP address regularly Why it is insufficient: IP rotation only obscures the server’s network location; it does not address software flaws, misconfigurations, or exposure of sensitive files. Attackers can still reach the server through DNS, host headers, or other services, and the technique may cause service disruption without real security benefit.
Option D – Moving the document root directory to a different disk Why it is ineffective: Relocating /admin/web/certroot does not change the underlying permissions, ownership,
or exposure of that content. Unless the new location enforces stricter access controls, the same sensitive files remain reachable via the web server, offering no real security improvement.
Conclusion: Of the presented choices, only regularly updating and patching the server software directly mitigates the attack surface and protects the critical document root from exploitation, making it the most appropriate security measure.

Reference:

NIST Cybersecurity Framework – Patch Management – https://www.nist.gov/cyberframework/patch-
management CVE Details – Apache HTTP Server Security Advisories – https://www.cvedetails.com/vulnerability-list/vendor_id-126/product_id-10239/Apache-Apache-http-Server.html

Explanation:

Full Message As a certified Ethical Hacker, I note that Option D – “Changing the source IP address of packets to appear as if the traffic is coming from a trusted source” is the classic method used to evade firewall detection.
Why D is correct – This technique, often called source-IP spoofing , allows malicious traffic to be crafted so that it appears to originate from a legitimate network segment or trusted host. Many perimeter devices (firewalls, IDS/IPS) filter based on source IP; attackers therefore modify the IP header (or use proxy-relay mechanisms) to bypass those controls.
Why other choices are less suitable
A – Encrypted communication channels – Encryption hides the payload from inspection, but firewalls can still block or allow traffic based on port, protocol, or source/destination IP. The technique does not evade firewall detection per se; it merely obscures content. B – Open-source OS – Using a different OS does not inherently alter network traffic characteristics that firewalls examine; it may avoid certain software vulnerabilities but does not directly bypass firewall rules. C – Social engineering – This targets human behavior rather than network-layer mechanisms.
While it can lead to credential theft, it does not involve altering packet headers or bypassing firewall inspection.
Thus, Option D directly describes a technical method for circumventing firewall enforcement, making it the best answer.

Reference:

NIST SP 800-41 Rev. 1 – Guide to Deploying IPv4 Firewalls – Details IP-based filtering and the impact of source-IP spoofing. https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final Cisco Security Guide – “IP Spoofing and Man-in-the-Middle Attacks” – Explains how attackers manipulate source addresses to bypass perimeter security. https://www.cisco.com/c/en/us/support/docs/security/ip-security/111170-ip-spoofing-man-in-the-middle-attacks.html
These resources confirm that IP address manipulation is a recognized bypass technique in standard security literature.

Explanation:

Why option B is the optimal technique
Targeted context: The spear-phishing email leverages recent merger details that only insiders would know, giving the message immediate credibility and relevance to the legal department’s current workload. Low-profile request: By asking for “document access” in a single, context-specific email, the attacker avoids overtly suspicious behavior (e.g., requesting a full file dump or demanding urgent action). High conversion rate: Focused social-engineering campaigns that reference a concrete, timely event achieve higher response rates than generic or untargeted approaches. Stealth: The email can be crafted to mimic internal communication styles (subject lines, signatures, formatting), bypassing typical email-filter heuristics and reducing the likelihood of user-initiated alerts.
Why the other options are less suitable
A – In-person impersonation: Physical presence introduces verification steps (ID badges, reception protocols) that increase the chance of detection; a “new intern” role typically requires follow-up actions (HR onboarding, badge issuance) that cannot be instantly fulfilled. C – Fake LinkedIn profile: Building a believable LinkedIn persona and gaining trust takes weeks to months; the attacker must maintain a realistic activity history, which is impractical for a short-term penetration test. D – Mass phishing with generic templates: Generic legal templates lack the personalized context that makes the request credible; such campaigns are more likely to be flagged by spam filters and by users who recognize the lack of specificity.
Conclusion – A highly contextual spear-phishing email (Option B) delivers the necessary blend of relevance, credibility, and subtlety to obtain confidential documents without raising alarms, making it the most effective technique in this scenario.

Reference:

EC-Council, Certified Ethical Hacker (CEH) v13 – Social Engineering module, Section 3.2: Targeted Phishing Attacks – https://www.eccouncil.org/ceh-certification/training/ National Institute of Standards and Technology (NIST), Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment (Chapter 4: Social Engineering Techniques) – https://csrc.nist.gov/publications/detail/sp/800-115/final

Explanation:

Justification for selecting Option C
Relevance to the finding – The scanner identified an outdated version of a web application. The appropriate response is to verify whether a fix exists (patches, security updates) or if there are known exploit details that affect the specific version. Risk-based methodology – In ethical hacking, after discovery you research the vulnerability to determine impact, available mitigations, and exploitable conditions. This step informs whether the issue truly warrants remediation or further testing. Compliance with ethical standards – Performing a DoS (A) or brute-force login (B) without explicit authorization and scope breaches professional conduct and could cause service disruption or legal exposure. Ignoring the finding (D) defeats the purpose of the assessment.
Why the other options are unsuitable

A: DoS attack – Intentional denial of service is outside the scope of a vulnerability assessment, may violate service-level agreements, and provides no insight into remediation. B. Brute-force admin login – Attempting unauthorized credential guessing can be considered an aggressive intrusion, potentially illegal, and does not address the root cause of the outdated software. D. Ignore the vulnerability – Dismissing a finding simply because it is labeled “medium” disregards risk-based prioritization; medium severity can still lead to critical exposure if exploitable.
Conclusion The most professional and effective next step is to research the vulnerability to locate patches, mitigations, or documented exploits (Option C), ensuring that any subsequent testing is purpose-driven and compliant with ethical hacking principles.

Reference:

NIST Vulnerability Management Guide: https://csrc.nist.gov/publications/detail/sp/800-40/rev-1/final OWASP Testing Guide – Vulnerability Scanning: https://owasp.org/www-project-web-security-testing-guide/v42/
These links provide authoritative guidance on vulnerability research and responsible testing practices.

Explanation:

Justification
The scenario describes an attacker who crafts malicious URL requests to make the web server serve files outside of its intended document root, thereby gaining access to restricted system configuration files. This behavior matches the classic Directory Traversal (Path Traversal) Attack , where insufficient input validation on file-system paths allows an attacker to navigate upward ( ../ ) or use absolute paths to reach arbitrary files. The flaw is explicitly tied to “failure to validate input paths,” which is the hallmark of directory-traversal vulnerabilities; it is independent of caching, response splitting, or credential compromise.
Why the other options are less suitable
B: Web Cache Poisoning Attack – Requires manipulation of proxy or shared cache entries and typically involves tampering with request parameters that affect cached responses, not direct file-system exposure via URL paths. C. FTTP Response Splitting Attack – Involves injecting additional HTTP responses into a streaming protocol; it affects how responses are delimited, not the ability to read arbitrary files through malformed URLs. D. Password Cracking Attack – Refers to offline or online attempts to guess passwords, which does not involve sending malicious URLs that expose server files.
Hence, the correct classification is Directory Traversal Attack .

Reference:

OWASP Testing Guide – Path Traversal: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Tests/07-Input_Validation/01-Path_Traversal NIST Special Publication 800-115 (Rev. 1) – Guide to Testing and Assessment: https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final