EC-COUNCIL 312-50V13 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V13 Online Questions & Answers

• Question 701:

  Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?

  A. Macro virus
  B. Stealth/Tunneling virus
  C. Cavity virus
  D. Polymorphic virus
  B. Stealth/Tunneling virus

  ---

  Explanation

  A Stealth or Tunneling Virus is designed specifically to evade detection by antivirus software and system monitoring tools. These viruses work by intercepting and modifying the operating system's service call interrupts (such as INT 13h and INT 21h in DOS systems), which are used to access files or system services.

  By hooking into these interrupts, the virus can return clean or forged data to antivirus scanners, thus hiding its malicious presence from detection tools.

  Tunneling viruses may also operate at a lower level to evade even more advanced antivirus detection methods, making them particularly dangerous and hard to detect.

  CEH v13 Official Study Guide:

  Module 6: Malware Threats

  Section: Types of Viruses

  Quote:

  "Tunneling viruses attempt to avoid detection by antivirus programs by installing themselves in the interrupt handler chain. These viruses intercept operating system calls to conceal their activities."

  Incorrect Options Explained:

  A. Macro viruses target applications like Microsoft Word/Excel and use embedded macros, but do not alter service call interrupts.

  C. Cavity viruses insert code into empty spaces in files without changing the file size but do not modify interrupts.

  D. Polymorphic viruses mutate their code to avoid signature-based detection but do not typically interfere with system interrupts directly.

• Question 702:

  Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to feed data and specifies the incorrect field in case of invalid credentials. Later, Calvin uses this information to perform social engineering.

  Which of the following design flaws in the authentication mechanism is exploited by Calvin?

  A. Insecure transmission of credentials
  B. Verbose failure messages
  C. User impersonation
  D. Password reset mechanism
  B. Verbose failure messages

  ---

  Explanation

  Verbose failure messages are detailed error messages that reveal too much information about authentication failures. In the described scenario, the web application specifies whether the username or password is incorrect. This behavior enables attackers to:

  Enumerate valid usernames by submitting random inputs and observing which error message is returned.

  Use the valid usernames to conduct targeted attacks such as brute-force attempts or social engineering.

  According to CEH v13:

  Authentication mechanisms should provide generic error messages such as "Invalid username or password" to avoid exposing system behavior.

  Verbose error messages violate the principle of "fail securely."

  Incorrect Options:

  A. Insecure transmission relates to credentials being sent over unencrypted channels (e.g., HTTP instead of HTTPS).

  C. User impersonation involves taking on the identity of another user, not enumeration.

  D. Password reset mechanisms are a different component of authentication, not mentioned in this context.

  CEH v13 Official Courseware:

  Module 14: Hacking Web Applications

  Section: "Authentication Bypass Techniques"

  Subsection: "Enumeration via Verbose Error Messages"

• Question 703:

  You are logged in as a local admin on a Windows 7 system and you need to launch the Computer Management Console from command line.

  Which command would you use?

  A. c:\compmgmt.msc
  B. c:\services.msc
  C. c:\ncpa.cp
  D. c:\gpedit
  A. c:\compmgmt.msc

  ---

  Explanation

  To start the Computer Management Console from command line just type compmgmt.msc /computer:

  computername in your run box or at the command line and it should automatically open the Computer Management console.

  References:

  http://www.waynezim.com/tag/compmgmtmsc/

• Question 704:

  Roma is a member of a security team. She was tasked with protecting the internal network of an organization from imminent threats. To accomplish this task, Roma fed threat intelligence into the security devices in a digital format to block and identify inbound and outbound malicious traffic entering the organization's network.

  Which type of threat intelligence is used by Roma to secure the internal network?

  A. Technical threat intelligence
  B. Operational threat intelligence
  C. Tactical threat intelligence
  D. Strategic threat intelligence
  C. Tactical threat intelligence

  ---

  Explanation

  In CEH v13 Module 01: Information Security Fundamentals, the types of threat intelligence are categorized as Strategic, Tactical, Operational, and Technical, each serving different security roles.

  Tactical Threat Intelligence - Correct Answer

  Definition: Provides information in a machine-readable format such as indicators of compromise (IOCs) -- including IP addresses, file hashes, URLs, domains, and signatures.

  Purpose: Used to update security appliances like firewalls, IDS/IPS, endpoint protection to automatically detect and block threats in real-time.

  Roma used threat intelligence in this exact way -- automating detection and blocking via security tools.

  Why Other Options Are Incorrect:

  A. Technical Threat Intelligence: Often overlaps with tactical but usually refers to low-level indicators used for internal analysis, not device-ready feeds.

  B. Operational Threat Intelligence: Focuses on specific campaigns, attacker TTPs, and is generally not automated or directly used in security appliances.

  D. Strategic Threat Intelligence: High-level, non-technical insights for executives and decision-makers -- used for long-term planning, not immediate threat blocking.

  Module 01 - Threat Intelligence Types and Usage Scenarios

  CEH iLabs: Ingesting IOCs into a Firewall for Tactical Threat Defense

  CEH v13 eBook: Threat Intelligence Integration into Defensive Systems

• Question 705:

  Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned.

  Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?

  A. "GET /restricted/goldtransfer?to=Robandfrom=1 or 1=1' HTTP/1.1Host: westbank.com"
  B. "GET /restricted/\r\n\%00account%00Ned%00access HTTP/1.1 Host: westbank.com"
  C. "GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com"
  D. "GET /restricted/ HTTP/1.1 Host: westbank.com
  C. "GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com"

  ---

  Explanation

  This question shows a classic example of an IDOR vulnerability. Rob substitutes Ned's name in the "name" parameter and if the developer has not fixed this vulnerability, then Rob will gain access to Ned's account. Below you will find more detailed information about IDOR vulnerability.

  Insecure direct object references (IDOR) are a cybersecurity issue that occurs when a web application developer uses an identifier for direct access to an internal implementation object but provides no additional access control and/or authorization checks. For example, an IDOR vulnerability would happen if the URL of a transaction could be changed through client-side user input to show unauthorized data of another transaction.

  Most web applications use simple IDs to reference objects. For example, a user in a database will usually be referred to via the user ID. The same user ID is the primary key to the database column containing user information and is generated automatically. The database key generation algorithm is very simple: it usually uses the next available integer. The same database ID generation mechanisms are used for all other types of database records.

  The approach described above is legitimate but not recommended because it could enable the attacker to enumerate all users. If it's necessary to maintain this approach, the developer must at least make absolutely sure that more than just a reference is needed to access resources. For example, let's say that the web application displays transaction details using the following URL:

  https://www.example.com/transaction.php?id=74656

  A malicious hacker could try to substitute the id parameter value 74656 with other similar values, for example:

  https://www.example.com/transaction.php?id=74657

  The 74657 transaction could be a valid transaction belonging to another user. The malicious hacker should not be authorized to see it. However, if the developer made an error, the attacker would see this transaction and hence we would have an insecure direct object reference vulnerability.

• Question 706:

  Steve, an attacker, created a fake profile on a social media website and sent a request to Stella. Stella was enthralled by Steve's profile picture and the description given for his profile, and she initiated a conversation with him soon after accepting the request. After a few days. Sieve started asking about her company details and eventually gathered all the essential information regarding her company. What is the social engineering technique Steve employed in the above scenario?

  A. Diversion theft
  B. Baiting
  C. Honey trap
  D. Piggybacking
  C. Honey trap

  ---

  Explanation

  The honey trap is a technique where an attacker targets a person online by pretending to be an attractive person and then begins a fake online relationship to obtain confidential information about the target company. In this technique, the victim is an insider who possesses critical information about the target organization.

  Baiting is a technique in which attackers offer end users something alluring in exchange for important information such as login details and other sensitive data. This technique relies on the curiosity and greed of the end-users. Attackers perform this technique by leaving a physical device such as a USB flash drive containing malicious files in locations where people can easily find them, such as parking lots, elevators, and bathrooms. This physical device is labeled with a legitimate company's logo, thereby tricking end-users into trusting it and opening it on their systems. Once the victim connects and opens the device, a malicious file downloads. It infects the system and allows the attacker to take control.

  For example, an attacker leaves some bait in the form of a USB drive in the elevator with the label "Employee Salary Information 2019" and a legitimate company's logo. Out of curiosity and greed, the victim picks up the device and opens it up on their system, which downloads the bait. Once the bait is downloaded, a piece of malicious software installs on the victim's system, giving the attacker access.

• Question 707:

  OpenSSL on Linux servers includes a command line tool for testing TLS. What is the name of the tool and the correct syntax to connect to a web server?

  A. openssl s_client -site www.website.com:443
  B. openssl_client -site www.website.com:443
  C. openssl s_client -connect www.website.com:443
  D. openssl_client -connect www.website.com:443
  C. openssl s_client -connect www.website.com:443

  ---

  Explanation

  Comprehensive and Detailed Explanation:

  The OpenSSL command-line utility s_client is used to test SSL/TLS connections.

  Correct syntax:

  openssl s_client -connect www.website.com:443

  This command will initiate a TLS connection to port 443 on the given domain and allow you to inspect certificates, cipher suites, and server responses.

  From CEH v13 Courseware:

  Module 12: Cryptography # SSL/TLS Testing Tools

  OpenSSL Project Documentation - s_client Usage

• Question 708:

  Emily, an extrovert obsessed with social media, posts a large amount of private information, photographs, and location tags of recently visited places. Realizing this. James, a professional hacker, targets Emily and her acquaintances, conducts a location search to detect their geolocation by using an automated tool, and gathers information to perform other sophisticated attacks. What is the tool employed by James in the above scenario?

  A. ophcrack
  B. Hootsuite
  C. VisualRoute
  D. HULK
  B. Hootsuite

  ---

  Explanation

  Hootsuite may be a social media management platform that covers virtually each side of a social media manager's role.

  With only one platform users area unit ready to do the easy stuff like reverend cool content and schedule posts on social media in all the high to managing team members and measure ROI.

  There area unit many totally different plans to decide on from, from one user set up up to a bespoken enterprise account that's appropriate for much larger organizations.

  Conducting location search on social media sites such as Twitter, Instagram, and Facebook helps attackers to detect the geolocation of the target. This information further helps attackers to perform various social engineering and non-technical attacks. Many online tools such as Followerwonk, Hootsuite, and Sysomos are available to search for both geotagged and non-geotagged information on social media sites. Attackers search social media sites using these online tools using keywords, usernames, date, time, and so on...

• Question 709:

  Which tier in the N-tier application architecture is responsible for moving and processing data between the tiers?

  A. Presentation tier
  B. Application Layer
  C. Logic tier
  D. Data tier
  C. Logic tier

  ---

  Explanation

  In CEH v13 Module 12: Hacking Web Applications, the N-tier architecture is explained as a model used in web applications, typically with:

  Presentation tier - User interface (UI) that interacts with the user.

  Logic tier (also known as application or business logic layer) - Processes commands, makes logical decisions, and handles data movement and processing between the UI and the database.

  Data tier - Manages database access and data storage.

  So, the Logic tier is responsible for:

  Handling the business rules.

  Processing user inputs.

  Accessing and manipulating data from the database.

  CEH v13 Module 12 - Web Architecture Concepts

  CEH iLabs: Application Logic Testing Exercises

• Question 710:

  Becky has been hired by a client from Dubai to perform a penetration test against one of their remote offices. Working from her location in Columbus, Ohio, Becky runs her usual reconnaissance scans to obtain basic information about their network. When analyzing the results of her Whois search, Becky notices that the IP was allocated to a location in Le Havre, France. Which regional Internet registry should Becky go to for detailed information?

  A. ARIN
  B. APNIC
  C. RIPE
  D. LACNIC
  C. RIPE

  ---

  Explanation

  Regional Internet Registries (RIRs):

  ARIN (American Registry for Internet Numbers)

  AFRINIC (African Network Information Center)

  APNIC (Asia Pacific Network Information Center)

  LACNIC (Latin American and Caribbean Network Information Center)