EC-COUNCIL 312-50V13 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V13 Online Questions & Answers

• Question 291:

  A computer science student needs to fill some information into a secured Adobe PDF job application that was received from a prospective employer. Instead of requesting a new document that allowed the forms to be completed, the student decides to write a script that pulls passwords from a list of commonly used passwords to try against the secured PDF until the correct password is found or the list is exhausted.

  Which cryptography attack is the student attempting?

  A. Man-in-the-middle attack
  B. Brute-force attack
  C. Dictionary attack
  D. Session hijacking
  C. Dictionary attack

  ---

  Explanation

  The scenario describes a cryptographic attack where the attacker (in this case, the student) uses a predefined list of commonly used passwords to try and unlock a secured PDF document. This technique is known as a Dictionary Attack.

  According to the CEH v13 Official Courseware:

  A Dictionary Attack is defined as "a method of breaking passwords by trying out a predefined list of words (dictionary) commonly used as passwords."

  Unlike a brute-force attack, which tries every possible character combination, a dictionary attack relies on known or likely password choices, which makes it faster but less exhaustive. Dictionary attacks are commonly used against encrypted or password-protected files, login forms, and even hashes.

  Relevant distinctions from other options:

  A. Man-in-the-middle attack involves intercepting communication between two parties and is unrelated to offline password cracking.

  B. Brute-force attack tries all possible character combinations, not just a list of known or common passwords.

  D. Session hijacking involves taking over a user session and is unrelated to document password cracking.

  Reference CEH v13 Official Study Materials:

  Module 20: Cryptography

  Section: "Cryptanalysis Techniques"

  Subsection: "Dictionary Attack vs. Brute-force Attack"

  CEH v13 eBook or Study Guide - look for Table: "Types of Password Attacks" under "Cryptography Attack Vectors"

  This exact technique is illustrated in CEH v13 labs involving John the Ripper, Hydra, and password recovery tools.

• Question 292:

  Which of the following algorithms can be used to guarantee the integrity of messages being sent, in transit, or stored?

  A. Symmetric algorithms
  B. Asymmetric algorithms
  C. Hashing algorithms
  D. Integrity algorithms
  C. Hashing algorithms

  ---

  Explanation

  Hashing algorithms are specifically designed to ensure data integrity. A hash function takes an input and returns a fixed-length string, called a hash or message digest. Even a small change in the input results in a completely different hash, making it useful for detecting tampering.

  Common hashing algorithms include:

  MD5 (now obsolete for secure uses)

  SHA-1, SHA-2, SHA-3

  HMAC (Hashed Message Authentication Code) From CEH v13 Courseware:

  Module 20: Cryptography

  Topic: Hash Functions and Data Integrity

  CEH v13 Study Guide states:

  "Hashing algorithms provide integrity by generating a unique digital fingerprint of data. Any alteration in the message content will result in a different hash value, indicating that the integrity has been compromised."

  Incorrect Options:

  A: Symmetric algorithms provide confidentiality.

  B: Asymmetric algorithms provide confidentiality and authentication.

  D: "Integrity algorithms" is not a formal cryptographic term.

  CEH v13 Study Guide - Module 20: Cryptographic Hash FunctionsNIST FIPS 180-4 - Secure Hash Standard (SHS)

• Question 293:

  While conducting a covert penetration test on a UNIX-based infrastructure, the tester decides to bypass intrusion detection systems by sending specially crafted TCP packets with an unusual set of flags enabled. These packets do not initiate or complete any TCP handshake. During the scan, the tester notices that when certain ports are probed, there is no response from the target, but for others, a TCP RST (reset) packet is received. The tester notes that this behavior consistently aligns with open and closed ports. Based on these observations, which scanning technique is most likely being used?

  A. ACK flag scan to evaluate firewall behavior
  B. TCP Connect scan to complete the three-way handshake
  C. Xmas scan leveraging RFC 793 quirks
  D. FIN scan using stealthy flag combinations
  D. FIN scan using stealthy flag combinations

  ---

  Explanation

  CEH describes FIN scans as stealthy scans that send packets with the FIN flag without initiating a TCP handshake. According to TCP RFC behavior, closed ports respond with RST packets while open ports ignore the probe, producing no response. This allows enumeration of port states while evading IDS systems that typically monitor SYN-based scans.

• Question 294:

  Based on the following extract from the log of a compromised machine, what is the hacker really trying to steal?

  [Note: Since the log extract is not shown in your message, we must rely on common indicators in similar scenarios.]

  If the log shows paths such as:

  Then the correct answer is:

  A. C:\WINNT\system32\config\SAM
  B. or access to Repair\SAM or Repair\system
  C. or related command lines accessing registry hives
  B. or access to Repair\SAM or Repair\system

  ---

  Explanation

  The Security Account Manager (SAM) file on Windows contains user account information, including password hashes. Hackers target this file to extract credentials for offline cracking using tools like L0phtCrack or Cain and Abel.

  From CEH v13 Official Courseware:

  Module 6: Malware Threats

  Module 4: Enumeration

  CEH v13 Study Guide states: "The SAM file stores hashed user credentials. If attackers gain access to it, they can extract password hashes and perform brute-force or dictionary attacks offline."

  Common locations:

  C:\Windows\System32\config\SAM

  C:\Windows\Repair\SAM

  CEH v13 Study Guide - Module 4: Enumeration # SAM and Registry Hive Attacks

• Question 295:

  env x'(){ :;};echo exploit' bash -c 'cat /etc/passwd'

  What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?

  A. Removes the passwd file
  B. Changes all passwords in passwd
  C. Add new user to the passwd file
  D. Display passwd content to prompt
  D. Display passwd content to prompt

  ---

  Explanation

  The Shellshock vulnerability (CVE-2014-6271) allows attackers to execute arbitrary commands via crafted environment variables in Bash. In this example, the malicious command cat /etc/passwd is executed, displaying the contents of the file (which contains system user account info).

  CEH v13 Official Study Guide:

  Module 6: Malware Threats

  Quote:

  "Shellshock allows remote code execution through environment variables processed by Bash. Exploits can be used to run commands like cat /etc/passwd on a vulnerable system."

  Incorrect Options:

  A. No file deletion occurs.

  B. It doesn't change passwords.

  C. No user addition occurs.

• Question 296:

  An ethical hacker is scanning a target network. They initiate a TCP connection by sending an SYN packet to a target machine and receiving a SYN/ACK packet in response. But instead of completing the three-way handshake with an ACK packet, they send an RST packet. What kind of scan is the ethical hacker likely performing and what is their goal?

  A. They are performing an SYN scan to stealthily identify open ports without fully establishing a connection
  B. They are performing a TCP connect scan to identify open ports on the target machine
  C. They are performing a vulnerability scan to identify any weaknesses in the target system
  D. They are performing a network scan to identify live hosts and their IP addresses
  A. They are performing an SYN scan to stealthily identify open ports without fully establishing a connection

  ---

  Explanation

  The ethical hacker is likely performing an SYN scan to stealthily identify open ports without fully establishing a connection. An SYN scan, also known as a half-open scan or a stealth scan, is a type of port scanning technique that exploits the TCP three-way handshake process. The hacker sends an SYN packet to a target port and waits for a response. If the target responds with an SYN/ACK packet, it means the port is open and listening for connections. If the target responds with an RST packet, it means the port is closed and not accepting connections. However, instead of completing the handshake with an ACK packet, the hacker sends an RST packet to abort the connection. This way, the hacker avoids creating a full connection and logging an entry in the target's system, making the scan less detectable and intrusive. The hacker can repeat this process for different ports and identify which ones are open and potentially vulnerable to exploitation12.

  The other options are not correct for the following reasons:

  B. They are performing a TCP connect scan to identify open ports on the target machine: This option is incorrect because a TCP connect scan involves establishing a full connection with the target port by completing the TCP three-way handshake. The hacker sends an SYN packet, receives an SYN/ACK packet, and then sends an ACK packet to finalize the connection. Then, the hacker terminates the connection with an RST or FIN packet. A TCP connect scan is more reliable and compatible than an SYN

  scan, but also more noisy and slow, as it creates more traffic and logs on the target system12.

  C. They are performing a vulnerability scan to identify any weaknesses in the target system: This option is incorrect because a vulnerability scan is a broader and deeper process than a port scan. A vulnerability scan involves identifying and assessing the security flaws and risks in a system or network, such as missing patches, misconfigurations, outdated software, or weak passwords. A vulnerability scan may use port scanning as one of its techniques, but it also uses other methods, such as banner

  grabbing, service enumeration, or exploit testing. A vulnerability scan usually requires more time, resources, and permissions than a port scan34.

  D. They are performing a network scan to identify live hosts and their IP addresses: This option is incorrect because a network scan is a different process than a port scan. A network scan involves discovering and mapping the devices and hosts connected to a network, such as routers, switches, servers, or workstations. A network scan may use ping, traceroute, or ARP requests to identify the IP addresses, MAC addresses, and hostnames of the live hosts. A network scan usually precedes a port scan, as it

  provides the target range and scope for the port scan56.

  References:

  1: Port Scanning Techniques - an overview | ScienceDirect Topics 2: nmap Host Discovery Techniques 3: Vulnerability Scanning Tools | OWASP Foundation 4: What Is Vulnerability Scanning? Types, Tools and Best Practices | Splunk 5: Network Scanning - an overview | ScienceDirect Topics

  6: Network Scanning - Nmap

• Question 297:

  When a security analyst prepares for the formal security assessment, what of the following should be done in order to determine inconsistencies in the secure assets database and verify that system is compliant to the minimum security baseline?

  A. Data items and vulnerability scanning
  B. Interviewing employees and network engineers
  C. Reviewing the firewalls configuration
  D. Source code review
  A. Data items and vulnerability scanning

  ---

  Explanation

  Comprehensive and Detailed Explanation:

  To identify inconsistencies in secure asset records and confirm that systems meet baseline security standards, vulnerability scanning and checking data items (e.g., configuration settings, software versions) is essential. This helps the analyst discover gaps between expected and actual system states.

  From CEH v13 Official Curriculum:

  Module 5: Vulnerability Assessment # Security Assessment Techniques

  "Automated vulnerability scanners and asset inventories help validate that systems are compliant with security baselines."

  CEH v13 Study Guide, Section on Security Assessment Planning.

• Question 298:

  A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing the Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this service to conceal malicious activities?

  A. Because BITS packets appear identical to normal Windows Update traffic.
  B. Because BITS operates exclusively through HTTP tunneling.
  C. Because BITS utilizes IP fragmentation to evade intrusion detection systems.
  D. Because BITS traffic uses encrypted DNS packets.
  A. Because BITS packets appear identical to normal Windows Update traffic.

  ---

  Explanation

  The Certified Ethical Hacker (CEH) Malware Threats module explains that attackers often abuse legitimate system services to blend malicious traffic with normal system behavior. Background Intelligent Transfer Service (BITS) is a Windows service designed to transfer files in the background using idle network bandwidth.

  Attackers leverage BITS because its traffic closely resembles legitimate Windows Update traffic , which is commonly allowed through firewalls and proxy servers. CEH documentation states that BITS-based malware can download payloads, upload stolen data, and maintain persistence without triggering security alerts.

  Option A is correct because BITS traffic appears legitimate and trusted, making it difficult for security devices to distinguish malicious usage.

  Option B is incorrect because BITS does not operate exclusively through HTTP tunneling; it primarily uses HTTP/HTTPS in a legitimate manner.

  Option C is incorrect because IP fragmentation is not a core feature of BITS.

  Option D is incorrect because BITS does not rely on encrypted DNS traffic. CEH emphasizes that living-off-the-land (LotL) techniques-using native tools like BITS-are increasingly favored by attackers due to their stealth and reliability.

• Question 299:

  The network team has well-established procedures to follow for creating new rules on the firewall. This includes having approval from a manager prior to implementing any new rules. While reviewing the firewall configuration, you notice a recently implemented rule but cannot locate manager approval for it.

  What would be a good step to have in the procedures for a situation like this?

  A. Have the network team document the reason why the rule was implemented without prior manager approval.
  B. Monitor all traffic using the firewall rule until a manager can approve it.
  C. Do not roll back the firewall rule as the business may be relying upon it, but try to get manager approval as soon as possible.
  D. Immediately roll back the firewall rule until a manager can approve it
  A. Have the network team document the reason why the rule was implemented without prior manager approval.
  B. Monitor all traffic using the firewall rule until a manager can approve it.
  C. Do not roll back the firewall rule as the business may be relying upon it, but try to get manager approval as soon as possible.
  D. Immediately roll back the firewall rule until a manager can approve it

  ---

  Explanation

  Without documented approval, the firewall rule could represent an unauthorized change or security risk. Rolling it back until proper change control processes are followed is consistent with best practices in security governance.

  CEH v13 Reference:

  Module 1: Introduction to Ethical Hacking

  "Unauthorized changes to security devices should be immediately reviewed and reverted until formal approval is obtained."

• Question 300:

  In the context of password security, a simple dictionary attack involves loading a dictionary file (a text file full of dictionary words) into a cracking application such as L0phtCrack or John the Ripper, and running it against user accounts located by the application. The larger the word and word fragment selection, the more effective the dictionary attack is. The brute force method is the most inclusive, although slow. It usually tries every possible letter and number combination in its automated exploration. If you would use both brute force and dictionary methods combined together to have variation of words, what would you call such an attack?

  A. Full Blown
  B. Thorough
  C. Hybrid
  D. BruteDics
  C. Hybrid

  ---

  Explanation