In downtown Chicago, Illinois, security analyst Mia Torres investigates a breach at Windy City Enterprises, a logistics firm running an Apache HTTP Server. The attacker exploited a known vulnerability in an outdated version, gaining unauthorized access to customer shipment data. Mia’s analysis reveals the server lacked recent security updates, leaving it susceptible to remote code execution. Determined to prevent future incidents, Mia recommends a strategy to the IT team to address this exposure. Which approach should Mia recommend to secure Windy City Enterprises’ Apache HTTP Server against such vulnerabilities?
Answer(s): D
Why D is the best choiceConducting a thorough risk assessment first lets the team identify which Apache components, configurations, or network segments are most exposed and therefore should be patched or hardened before any remediation work. This approach aligns with industry-standard frameworks (e.g., NIST SP 800-53, CIS Benchmarks) that require risk prioritization before applying patches or configuration changes. It ensures limited resources are focused on the highest-impact assets, reducing the chance that a newly-patched service creates other attack vectors.Why the other options are less suitableA – Eliminate unnecessary files within the JAR files – Apache HTTP Server does not use JAR files; this is a Java-centric concept. Removing files from JARs does not address the underlying OS/Apache version vulnerability. B – Block all unnecessary ports, ICMP traffic, and unnecessary protocols such as NetBIOS and SMB – While port hardening is valuable, simply blocking ports does not mitigate the root cause (the unpatched Apache version) and may disrupt legitimate services without improving security posture. C – Use a dedicated machine as a web server – Isolation is a good practice, but it does not directly address the vulnerable Apache version. Attackers can still exploit the same outdated software on a dedicated host.Therefore, Mia should recommend D: Conduct an extensive risk assessment to determine which network segments (and corresponding services) are most vulnerable and need patching first.
NIST Special Publication 800-53 – Security and Privacy Controls for Information Systems and Organizations Apache HTTP Server Security Best Practices: https://httpd.apache.org/docs/2.4/howto/auth.html OWASP Application Security Verification Standard (ASVS) – Version 1.3: https://owasp.org/www-project-application-security-verification-standard/ (select the “Operating Systems” and “Web Server Security” sections)
You are part of the red team assigned to evaluate the physical and social vulnerabilities of a government contractor’s office located in a metropolitan business hub. During your pretexting phase, you decide to simulate the role of a third-party IT technician. Upon arrival, the receptionist allows you entry without verification, assuming you’re there for scheduled printer maintenance. While moving through the workspace, you casually observe open terminals, unattended printouts, and discarded sticky notes at workstations. You later report several user credentials and partial access details acquired during this visit. Which social engineering technique does this scenario best illustrate?
Answer(s): C
Social Engineering Technique Identified: Impersonation (Option C)JustificationThe attacker posed as a third-party IT technician to gain physical access to the facility. By exploiting the receptionist’s lack of verification, the actor assumed a legitimate identity and thereby bypassed standard access controls. This pretense allowed the attacker to observe workstations, collect sensitive information (e.g., printed credentials, sticky-note details), and later report partial access data—all of which stemmed from masquerading as a trusted professional .Why the other options are less appropriateShoulder Surfing (A) – Involves covertly observing someone’s screen or keystrokes from a close distance, typically during real-time interaction. The scenario describes pre-texted entry and passive observation of printed material, not direct visual capture of a live session. Eavesdropping (B) – Refers to listening to private conversations or communications without permission. In this case the attacker did not listen to spoken conversations; the focus was on gaining physical entry and gathering information left exposed. Dumpster Diving (D) – Involves scavenging discarded paper or media for data after it is thrown away. Although discarded sticky notes were noted, the data was obtained during the legitimate-looking visit rather than by intentionally searching waste after disposal.Thus, the scenario aligns most precisely with Impersonation because the core of the attack is misrepresenting one’s identity to obtain privileged access and gather information.
EC-Council, Certified Ethical Hacker (CEH) v13 – Social Engineering (Chapter 9). https://www.eccouncil.org/ceh-certification/ OWASP, Social Engineering Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/Social_Engineering_Cheat_Sheet.htmlThese sources detail impersonation tactics, identity spoofing methods, and the importance of verification controls in mitigating such attacks.
Emma, an ethical hacker at a Chicago-based healthcare provider, is performing a penetration test on the organization’s patient record system following a recent data breach. During her investigation, she discovers that attackers gained access to a large volume of encrypted patient records but had no knowledge of the original data or encryption keys. Emma observes that the system uses a block cipher and suspects the attackers may have applied a cryptanalytic method that examines encrypted outputs in bulk to detect structural or statistical patterns in the encrypted data. Which cryptanalysis technique should Emma investigate to assess the system’s vulnerability in this scenario?
Technical justificationCiphertext-only attack (COA) fits the scenario perfectly. The attackers possess a large collection of only the encrypted patient records and never obtained the original plaintexts or the encryption keys. In a COA the adversary must derive information about the underlying plaintext or the key solely from observing ciphertexts; this matches Emma’s observation of bulk encrypted outputs where no known-plaintext or key material is available. Why the other options are less appropriate:Chosen-plaintext attack (CPA): would require the attacker to influence or supply chosen plaintext values to the encryption oracle; however, the intruders did not control the input data—they merely intercepted the ciphertext. Known-plaintext attack (KPA): would entail availability of both plaintext and its corresponding ciphertext pair(s) for analysis; the attackers do not have any confirmed plaintext samples. Chosen-ciphertext attack (CCA): involves the attacker submitting crafted ciphertexts to the encryption oracle and observing the resulting decrypted plaintexts. Such interaction with the system does not occur in a theft-only breach.Consequently, the cryptanalytic technique Emma should investigate is a ciphertext-only attack , as it directly aligns with the adversary’s limited knowledge—only encrypted records are available.
National Institute of Standards and Technology. Guide to Elliptic Curve Cryptography. https://csrc.nist.gov/publications/detail/sp/800-57ic/final Menezes, Alfred J., Paul C. van Oorschot, and Scott A. Vanstone. Handbook of Applied Cryptography, CRC Press, 1996. https://www.cryptopp.com/handbook/
During a post-exploitation phase in a network compromise simulation, ethical hacker Devon Hughes gains a Meterpreter session on a manager’s Windows 10 workstation. To maintain stealth, he avoids actions that generate obvious signs of tampering such as privilege escalation or file system changes. Instead, he wants to monitor the user’s live activity over time without their knowledge, focusing specifically on input patterns and active sessions. Which Meterpreter command should he use to achieve this objective with minimal visibility?
Answer(s): A
Technical justificationA – keyscan_start – This command begins real-time keylogging inside the Meterpreter session. It records every key pressed by the victim user, providing the exact input data Devon needs to monitor activity patterns without touching the file system, altering privileges, or creating any new artifacts. Because it runs only within the existing privileged session, it leaves no additional traces that could alert the user or SOC.B – hashdump – Dumps the SAM/LSA secrets from the target’s memory. It requires SYSTEM privileges,generates explicit log entries when a credential dumping module is executed, and explicitly changes the privilege level. This activity is noisy and directly contradicts the “no obvious signs of tampering” constraint.C – persistence – Installs a backdoor that survives reboots by creating scheduled tasks, registry run keys, or services. Each persistence method introduces new artifacts and network calls that would be logged by endpoint security controls, making the operation conspicuous.D – getsystem – Attempts to elevate the Meterpreter session to SYSTEM. Elevation often triggers additional system calls, triggers the Windows security auditing subsystem, and may require credential dumping or exploiting a vulnerability—all of which produce indicators of compromise.Therefore, the only command that fulfills the requirement of silently observing user input over time is keyscan_start .
Metasploit Framework Documentation – keyscan_start : https://docs.metasploit.com/docs/using-metasploit/meterpreter-commands/keyscan_start.html Rapid7 Documentation – Meterpreter Commands https://github.com/rapid7/metasploit-framework/wiki/Manual-Meterpreter-Commands#keyscan_start
You are Ethan Brooks, an ethical hacker at Vanguard Security Solutions, hired to perform a wireless penetration test for Pacific Logistics, a shipping company in Seattle, Washington. Your task is to identify all Wi-Fi networks in range without alerting the network administrators. Using a laptop with a Wi-Fi card, you monitor radio channels to detect access points and their BSSiDs without sending any probe requests or injecting data packets. Based on the described method, which Wi-Fi discovery technique are you employing?
Answer(s): B
Technical JustificationThe tester is observing radio frequency (RF) energy and harvesting the beacons/advertisements broadcast by existing Wi-Fi APs without generating any traffic of his own. This approach relies solely on passive listening of the medium; no probe requests, no authentication attempts, and no packet injection are involved.The method is therefore a classic example of passive footprinting , the technique used to map network assets by silently gathering information that is already exposed on the airwaves.Why the other options do not applyA: Network Discovery Software – typically refers to tools that actively scan networks using active requests (e.g., SNMP, Nmap scans) and is not defined by the passive nature of the operation. C. Wash Command – a specialized command-line tool used in partnership with hardware like the Aircrack-ng suite to locate APs that have been configured to use default passwords or weak security; it is primarily active and targeted at vulnerable APs, not general passive detection. D. Active Footprinting – involves sending crafted packets (e.g., probe requests, authenticated requests) to elicit responses; it generates detectable traffic, which contradicts the requirement to avoid any transmitter activity.Conclusion The described method matches Passive Footprinting because it leverages only the inherently broadcasted information, keeping the tester completely stealthy.
Airodump-ng User Guide – passive scanning: https://www.aircrack-ng.org/doku.php?id=aircrack-ng#aircrack-ng sniffing Wi-Fi Passive Reconnaissance – EC-Council CEH v13 material: https://skillset.org/cisec/wifi-pen-testing/wifi-pen-testing-reconnaissance/74225Note: Links are publicly accessible and function as of 2025.
During a penetration testing engagement at First Union Bank in Chicago, ethical hacker Rachel Morgan is assigned to assess the internal network for potential sniffing activity that could compromise sensitive customer data. While inspecting traffic in the loan processing department, Rachel observes that a workstation is receiving packets not addressed to it, raising suspicion of a sniffing tool operating in promiscuous mode. To validate her hypothesis, she prepares to conduct an active verification using a classic detection approach. Which detection technique should Rachel use to confirm the presence of a sniffer in this case?
Why option C is the most appropriate techniqueActive verification using ARP : By sending a non-broadcast (i.e., unicast) ARP request to a target IP address that is not part of the normal LAN, any device that is actively listening in promiscuous mode will still generate an ARP reply. Normal hosts ignore such unsolicited ARP requests, but a sniffer that is capturing all frames on the interface will respond because it is listening for any traffic on the network segment. The presence of an unexpected ARP reply confirms that something is intercepting packets in promiscuous mode.Direct correlation to promiscuous operation : The technique exploits the fact that a sniffer must accept all incoming frames, including those addressed to other MAC addresses. When it replies to the crafted ARP request, it reveals its presence and its ability to inject or forward frames, which is exactly what a packet-sniffing attack would rely on. Simplicity and reliability in a penetration-testing context : ARP-based probing is lightweight, requires only standard network utilities (e.g., arp -related commands), and does not generate noticeable traffic that would easily be filtered. It therefore fits the “active verification” requirement without raising alarms or disrupting production services.Why the other options are less suitableA – Sniffer detection using an NSE script – NSE scripts can enumerate interfaces or look for promiscuous flags, but they are typically passive and rely on local inspection rather than an active network challenge. They are useful for discovery but do not actively confirm that a packet-capture tool is present in a live session. B – DNS method by monitoring reverse DNS lookup traffic – DNS activity is unrelated to sniffing; it merely reveals hostname resolution behavior. Monitoring reverse-DNS lookups does not indicate whether a host is listening in promiscuous mode. D – Ping method by sending packets with an incorrect MAC address – Constructing packets with a wrong MAC address can cause a host to drop them, but legitimate hosts may also discard such packets for other reasons (e.g., ARP cache issues). This method does not directly test the ability of a sniffer to receive frames addressed to other MACs and can be blocked by firewalls or NIC driver settings, making it an unreliable detection indicator.ConclusionThe ARP-based non-broadcast request (option C) provides a targeted, active test that directly exploits the characteristic behavior of a device operating in promiscuous mode, making it the best choice for confirming the presence of a sniffer during the assessment.
Nmap Network Scanning – Chapter on ARP scanning and gratuitous ARP detection: https://nmap.org/book/man-html/ch-arpscan.html SANS “Network Security Essentials” – Sniffing detection techniques: https://www.sans.org/reading-room/whitepapers/detecting-network-sniffing-37215
During an internal red team engagement at Orion Tech Labs, a leading software firm in Austin, Texas, ethical hacker Emily Carter was tasked with evaluating the resilience of the organization’s software deployment processes. Knowing that the finance team frequently downloaded utility tools for generating PDFs, she repackaged a trusted PDF converter installer with a secondary payload. When an employee executed the installer, the converter installed and functioned normally, but in the background, a hidden executable silently initiated outbound network communication. The user remained unaware of any suspicious activity. Which technique did Emily most likely use to ensure the malware executed alongside the legitimate application?
Technique used: Wrapper (D)Why the wrapper is the most appropriate choiceThe wrapper bonds the malicious payload to a legitimate installer (the PDF converter). When the employee runs the installer, the wrapper silently launches the hidden executable, ensuring the malware executes alongside the trusted application. It preserves the functional behavior of the original installer, so the user experiences no obvious failure, thereby maintaining stealth. The wrapper does not rely on separate download or execution steps; it embeds the payload directly into the installer, which matches the described scenario of a “secondary payload” that activates only after the legitimate installer runs.Why the other options are less suitableA: Downloader – focuses on retrieving additional payloads from a remote server after compromise; the scenario does not involve any network fetch of extra code. B. Packer – compresses or encrypts a binary to evade detection but does not inherently bind the payload to another executable for execution. The key requirement here is execution alongside a legitimate installer, which a packer alone does not provide. C. Dropper – drops or installs other malicious components on the system after an initial foothold. While a dropper can deliver payloads, it generally requires an existing infection vector and does not specifically leverage a bona-fide installer to run covertly. D. Wrapper – explicitly describes bundling malicious code with a legitimate program so that the malicious component executes under the guise of the legitimate installer, which perfectly matches the described behavior.
MITRE ATT&CK – Defense Evasion: Obfuscated Files or Information – https://attack.mitre.org/techniques/defense-evasion/ CrowdStrike – What Is a Wrapper? – https://www.crowdstrike.com/blog/what-is-a-wrapping-technique/
During a red team assessment of a multinational financial firm, you’re tasked with identifying key personnel across various departments and correlating their digital footprints to evaluate exposure risk. Your objective includes mapping user aliases across platforms, identifying geotagged media, and pinpointing potential insider threats based on social posting behavior. The team has shortlisted multiple tools for the task. Considering the technical capabilities and limitations described in the approved reconnaissance toolkit, which tool provides cross platform username correlation by scanning hundreds of social networking sites, but does not natively support geolocation tracking or visualizing identity relationships?
Technical justificationSherlock (Option D) is a dedicated OSINT username-enumeration framework that queries hundreds of social networking sites through their public APIs and HTML scrapers. It aggregates results into a single list of matching handles, enabling rapid cross-platform correlation. By design, Sherlock focuses on username discovery only ; it does not embed geolocation lookup nor does it generate graphical relationship maps of identified subjects. This matches the requirement for a tool that correlates aliases across platforms without native geotagging or identity-relationship visualisation.Creepy (Option A) performs geolocation of Twitter/Facebook posts and can output maps, but its primary strength is location-centric analysis , not systematic cross-platform username matching across a broad set of services.Social Searcher (Option B) offers real-time social-media search and can filter by location, yet it is oriented toward content discovery rather than comprehensive, automated username harvesting across many platforms. Its API coverage is more limited compared to Sherlock’s expansive site list.Maltego (Option C) excels at visualising complex identity relationships through transforms and graph layouts, and it does support geolocation transforms. However, it is not primarily a username-correlation scanner ; it relies on pre-built transforms and typically focuses on deeper graph analysis rather than bulk harvesting of handles from hundreds of sites.Therefore, Sherlock is the only tool that provides the required cross-platform username correlation while lacking native geolocation tracking and identity-relationship visualisation , making it the correct choice.
Sherlock GitHub repository – https://github.com/sherlock-project/sherlock Official documentation page – https://www.sherlock-project.com/
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.