Start your 312-50v13 Exam Questions Preparation with Updated 569 Questions
A Fully Updated 2025 312-50v13 Exam Dumps - PDF Questions and Testing Engine
NEW QUESTION # 68
The Heartbleed bug was discovered in 2014 and is widely referred to under MITRE's Common Vulnerabilities and Exposures (CVE) as CVE-2014-0160. This bug affects the OpenSSL implementation of the Transport Layer Security (TLS) protocols defined in RFC6520.
What type of key does this bug leave exposed to the Internet making exploitation of any compromised system very easy?
- A. Shared
- B. Private
- C. Public
- D. Root
Answer: B
NEW QUESTION # 69
Clark is gathering sensitive information about a competitor and uses a tool to input the target's server IP address to identify network range, OS, and topology. What tool is he using?
- A. Baidu
- B. DuckDuckGo
- C. ARIN
- D. AOL
Answer: C
Explanation:
ARIN (American Registry for Internet Numbers) is a Regional Internet Registry (RIR) that provides information about IP address allocations and autonomous systems in North America. It's used for WHOIS lookups and footprinting in reconnaissance.
NEW QUESTION # 70
A well-resourced attacker intends to launch a highly disruptive DDoS attack against a major online retailer.
The attacker aims to exhaust all the network resources while keeping their identity concealed. Their method should be resistant to simple defensive measures such as IP-based blocking. Based on these objectives, which of the following attack strategies would be most effective?
- A. The attacker should initiate a volumetric flood attack using a single compromised machine to overwhelm the retailer's network bandwidth
- B. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals
- C. The attacker should execute a simple ICMP flood attack from a single IP, exploiting the retailer's ICMP processing
- D. The attacker should instigate a protocol-based SYN flood attack, consuming connection state tables on the retailer's servers
Answer: D
Explanation:
A Pulse Wave attack is a type of DDoS attack that uses a botnet to send high-volume traffic pulses at regular intervals, typically lasting for a few minutes each. The attacker can adjust the frequency and duration of the pulses to maximize the impact and evade detection. A Pulse Wave attack can exhaust the network resources of the target, as well as the resources of any DDoS mitigation service that the target may use. A Pulse Wave attack can also conceal the attacker's identity, as the traffic originates from multiple sources that are part of the botnet. A Pulse Wave attack can bypass simple defensive measures, such as IP-based blocking, as the traffic can appear legitimate and vary in source IP addresses.
The other options are less effective or feasible for the attacker's objectives. A protocol-based SYN flood attack is a type of DDoS attack that exploits the TCP handshake process by sending a large number of SYN requests to the target server, without completing the connection. This consumes the connection state tables on the server, preventing it from accepting new connections. However, a SYN flood attack can be easily detected and mitigated by using SYN cookies or firewalls. A SYN flood attack can also expose the attacker's identity, as the source IP addresses of the SYN requests can be traced back to the attacker. An ICMP flood attack is a type of DDoS attack that sends a large number of ICMP packets, such as ping requests, to the target server, overwhelming its ICMP processing capacity. However, an ICMP flood attack from a single IP can be easily blocked by using IP-based filtering or disabling ICMP responses. An ICMP flood attack can also reveal the attacker's identity, as the source IP address of the ICMP packets can be identified. A volumetric flood attack is a type of DDoS attack that sends a large amount of traffic to the target server, saturating its network bandwidth and preventing legitimate users from accessing it. However, a volumetric flood attack using a single compromised machine may not be sufficient to overwhelm the network bandwidth of a major online retailer, as the attacker's machine may have limited bandwidth itself. A volumetric flood attack can also be detected and mitigated by using traffic shaping or rate limiting techniques. References:
* Pulse Wave DDoS Attacks: What You Need to Know
* DDoS Attack Prevention: 7 Effective Mitigation Strategies
* DDoS Attack Types: Glossary of Terms
* DDoS Attacks: What They Are and How to Protect Yourself
* DDoS Attack Prevention: How to Protect Your Website
NEW QUESTION # 71
Which type of sniffing technique is generally referred as MiTM attack?
- A. Password Sniffing
- B. ARP Poisoning
- C. Mac Flooding
- D. DHCP Sniffing
Answer: B
NEW QUESTION # 72
This TCP flag instructs the sending system to transmit all buffered data immediately.
- A. PSH
- B. FIN
- C. URG
- D. SYN
- E. RST
Answer: A
Explanation:
The PSH (Push) flag in TCP instructs the sending system to:
* Immediately deliver data to the application.
* Avoid waiting for additional buffered data to form a full segment.
This is important in interactive communications like Telnet or SSH, where the delay in transmission would degrade the user experience.
From CEH v13 Courseware:
* Module 3: Scanning Networks # TCP Flags and Packet Structure
Reference:CEH v13 Study Guide - Module 3: TCP Header Fields and FlagsRFC 793 - Transmission Control Protocol (TCP)
NEW QUESTION # 73
Attacker Steve targeted an organization's network with the aim of redirecting the company's web traffic to another malicious website. To achieve this goal, Steve performed DNS cache poisoning by exploiting the vulnerabilities In the DNS server software and modified the original IP address of the target website to that of a fake website. What is the technique employed by Steve to gather information for identity theft?
- A. Pretexting
- B. Wardriving
- C. Skimming
- D. Pharming
Answer: D
Explanation:
A pharming attacker tries to send a web site's traffic to a faux website controlled by the offender, typically for the aim of collection sensitive data from victims or putting in malware on their machines. Attacker tend to specialize in making look-alike ecommerce and digital banking websites to reap credentials and payment card data.
Though they share similar goals, pharming uses a special technique from phishing. "Pharming attacker are targeted on manipulating a system, instead of tricking people into reaching to a dangerous web site," explains David Emm, principal security man of science at Kaspersky. "When either a phishing or pharming attacker is completed by a criminal, they need a similar driving issue to induce victims onto a corrupt location, however the mechanisms during which this is often undertaken are completely different."
NEW QUESTION # 74
"........is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hot- spot by posing as a legitimate provider. This type of attack may be used to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up a fraudulent web site and luring people there." Fill in the blank with appropriate choice.
- A. Evil Twin Attack
- B. Sinkhole Attack
- C. Collision Attack
- D. Signal Jamming Attack
Answer: A
Explanation:
https://en.wikipedia.org/wiki/Evil_twin_(wireless_networks)
An evil twin attack is a hack attack in which a hacker sets up a fake Wi-Fi network that looks like a legitimate access point to steal victims' sensitive details. Most often, the victims of such attacks are ordinary people like you and me.
The attack can be performed as a man-in-the-middle (MITM) attack. The fake Wi-Fi access point is used to eavesdrop on users and steal their login credentials or other sensitive information. Because the hacker owns the equipment being used, the victim will have no idea that the hacker might be intercepting things like bank transactions.
An evil twin access point can also be used in a phishing scam. In this type of attack, victims will connect to the evil twin and will be lured to a phishing site. It will prompt them to enter their sensitive data, such as their login details. These, of course, will be sent straight to the hacker. Once the hacker gets them, they might simply disconnect the victim and show that the server is temporarily unavailable.
ADDITION: It may not seem obvious what happened. The problem is in the question statement. The attackers were not Alice and John, who were able to connect to the network without a password, but on the contrary, they were attacked and forced to connect to a fake network, and not to the real network belonging to Jane.
NEW QUESTION # 75
Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mall servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API.
Which of the following tools is used by Wilson in the above scenario?
- A. Zoominfo
- B. Netcraft
- C. infoga
- D. Factiva
Answer: C
Explanation:
Infoga may be a tool gathering email accounts informations (ip,hostname,country,...) from completely different public supply (search engines, pgp key servers and shodan) and check if email was leaked using haveibeenpwned.com API. is a really simple tool, however very effective for the first stages of a penetration test or just to know the visibility of your company within the net.
NEW QUESTION # 76
Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions.
Which of the following master components is explained in the above scenario?
- A. Kube-apiserver
- B. Kube-controller-manager
- C. Kube-scheduler
- D. Etcd cluster
Answer: C
NEW QUESTION # 77
Let's imagine three companies (A, B, and C), all competing in a challenging global environment.
Company A and B are working together in developing a product that will generate a major competitive advantage for them.
Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing.
With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B.
How do you prevent DNS spoofing?
- A. Install DNS Anti-spoofing
- B. Disable DNS timeouts
- C. Disable DNS Zone Transfer
- D. Install DNS logger and track vulnerable packets
Answer: A
Explanation:
DNS spoofing (also known as DNS cache poisoning) occurs when an attacker intercepts or falsifies DNS responses to redirect traffic or exfiltrate data. The appropriate way to prevent such attacks includes:
* Implementing DNS anti-spoofing techniques
* Using DNSSEC (DNS Security Extensions)
* Ensuring proper DNS configurations and validation of responses
From CEH v13:
* Module 3: Scanning Networks
* Topic: DNS Poisoning and Spoofing Attacks
* Defensive Measures: DNS Hardening
CEH v13 Study Guide states:
"To prevent DNS spoofing and cache poisoning, organizations should use DNSSEC, configure anti-spoofing protections, and restrict zone transfers. DNS Anti-spoofing solutions validate responses and ensure data integrity." Incorrect Options:
* A: Logging may detect but not prevent.
* B: Disabling DNS timeouts is unrelated and harmful.
* D: Prevents zone transfers, not spoofing specifically.
Reference:CEH v13 Study Guide - Module 3: DNS Spoofing PreventionNIST SP 800-81r2 - Secure Domain Name System (DNS) Deployment Guide
NEW QUESTION # 78
Jude, a pen tester working in Keiltech Ltd., performs sophisticated security testing on his company's network infrastructure to identify security loopholes. In this process, he started to circumvent the network protection tools and firewalls used in the company. He employed a technique that can create forged TCP sessions by carrying out multiple SYN, ACK, and RST or FIN packets. Further, this process allowed Jude to execute DDoS attacks that can exhaust the network resources. What is the attack technique used by Jude for finding loopholes in the above scenario?
- A. Spoofed session flood attack
- B. UDP flood attack
- C. Peer-to-peer attack
- D. Ping-of-death attack
Answer: A
Explanation:
In order to circumvent network protection tools, cybercriminals may forge a TCP session more efficiently by submitting a bogus SYN packet, a series of ACK packets, and at least one RST (reset) or FIN (connection termination) packet. This tactic allows crooks to get around defenses that only keep tabs on incoming traffic rather than analyzing return traffic.
NEW QUESTION # 79
Steve, a scientist who works in a governmental security agency, developed a technological solution to identify people based on walking patterns and implemented this approach to a physical control access.
A camera captures people walking and identifies the individuals using Steve's approach.
After that, people must approximate their RFID badges. Both the identifications are required to open the door.
In this case, we can say:
- A. The solution implements the two authentication factors: physical object and physical characteristic
- B. The solution will have a high level of false positives
- C. Biological motion cannot be used to identify people
- D. Although the approach has two phases, it actually implements just one authentication factor
Answer: A
NEW QUESTION # 80
Sam is working as a system administrator In an organization. He captured the principal characteristics of a vulnerability and produced a numerical score to reflect Its severity using CVSS v3.0 to property assess and prioritize the organization's vulnerability management processes. The base score that Sam obtained after performing cvss rating was 4.0. What is the CVSS severity level of the vulnerability discovered by Sam in the above scenario?
- A. High
- B. Medium
- C. Critical
- D. Low
Answer: B
Explanation:
Rating CVSS Score
None 0.0
Low 0.1 - 3.9
Medium 4.0 - 6.9
High 7.0 - 8.9
Critical 9.0 - 10.0
https://www.first.org/cvss/v3.0/specification-document
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of three metric groups: Base, Temporal, and Environmental. The Base metrics produce a score ranging from 0 to 10, which can then be modified by scoring the Temporal and Environmental metrics. A CVSS score is also represented as a vector string, a compressed textual representation of the values used to derive the score. Thus, CVSS is well suited as a standard measurement system for industries, organizations, and governments that need accurate and consistent vulnerability severity scores. Two common uses of CVSS are calculating the severity of vulnerabilities discovered on one's systems and as a factor in prioritization of vulnerability remediation activities. The National Vulnerability Database (NVD) provides CVSS scores for almost all known vulnerabilities.
Qualitative Severity Rating Scale
For some purposes, it is useful to have a textual representation of the numeric Base, Temporal and Environmental scores.
NEW QUESTION # 81
You want to analyze packets on your wireless network. Which program would you use?
- A. Ethereal with Winpcap
- B. Wireshark with Winpcap
- C. Wireshark with Airpcap
- D. Airsnort with Airpcap
Answer: C
Explanation:
https://support.riverbed.com/content/support/software/steelcentral-npm/airpcap.html Since this question refers specifically to analyzing a wireless network, it is obvious that we need an option with AirPcap (Riverbed AirPcap USB-based adapters capture 802.11 wireless traffic for analysis). Since it works with two traffic analyzers SteelCentral Packet Analyzer (Cascade Pilot) or Wireshark, the correct option would be "Wireshark with Airpcap." NOTE: AirPcap adapters no longer available for sale effective January 1, 2018, but a question on this topic may occur on your exam.
NEW QUESTION # 82
is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.
- A. Resource records
- B. Zone transfer
- C. Resource transfer
- D. DNSSEC
Answer: D
Explanation:
The Domain Name System Security Extensions (DNSSEC) is a suite of Internet Engineering Task Force (IETF) specifications for securing certain kinds of information provided by DNS for use on IP networks.
DNSSEC is a set of extensions to DNS provide to DNS clients (resolvers) origin authentication of DNS data, authenticated denial of existence, and data integrity, but not availability or confidentiality. DNSSEC is necessary because the original DNS design did not include security but was designed to be a scalable distributed system. DNSSEC adds security while maintaining backward compatibility.
NEW QUESTION # 83
An ethical hacker is hired to evaluate the defenses of an organization's database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system's signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?
- A. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing
- B. Implementing sophisticated matches such as "OR 'john' = john" in place of classical matches like "OR
1-1" - C. Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form
- D. Manipulating white spaces in SQL queries to bypass signature detection
Answer: D
Explanation:
The hacker could have used the technique of manipulating white spaces in SQL queries to bypass signature detection. This technique involves inserting, removing, or replacing white spaces in SQL queries with other characters or symbols that are either ignored or interpreted as white spaces by the SQL engine, but not by the signature-based IDS. This way, the hacker can alter the appearance of the query and evade the pattern matching of the IDS, while preserving the functionality and logic of the query. For example, the hacker could replace the space character with a tab character, a newline character, a comment symbol, or a URL-encoded value, such as %2012.
The other options are not correct for the following reasons:
* A. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing: This option is not feasible because the char encoding function is not supported by all SQL engines, and it may not be able to convert all hexadecimal and decimal values into valid characters. Moreover, the char encoding function may not be able to bypass the signature detection of the IDS, as it may still match the keywords or syntax of the SQL query3.
* B. Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form:
This option is not effective because the URL encoding method is not applicable to SQL queries, as it is designed for encoding special characters in URLs. The URL encoding method may not be able to replace all characters with their ASCII codes, and it may not be able to preserve the functionality and logic of the SQL query. Furthermore, the URL encoding method may not be able to evade the signature detection of the IDS, as it may still match the keywords or syntax of the SQL query4.
* C. Implementing sophisticated matches such as "OR 'john' = john" in place of classical matches like
"OR 1-1": This option is not advanced because it is a common and basic SQL injection technique that does not involve any evasion or obfuscation. This technique involves injecting a logical expression that is always true, such as "OR 'john' = john" or "OR 1-1", to bypass the authentication or authorization checks of the SQL query. However, this technique may not be able to bypass the signature detection of the IDS, as it may easily match the keywords or syntax of the SQL query.
References:
1: SQL Injection Evasion Detection - F5
2: Mastering SQL Injection with SQLmap: A Comprehensive Evasion Techniques Cheatsheet
3: SQL Injection Prevention - OWASP Cheat Sheet Series
4: URL Encoding - W3Schools
5: SQL Injection - OWASP Foundation
NEW QUESTION # 84
During the process of encryption and decryption, what keys are shared?
- A. Public keys
- B. Private keys
- C. User passwords
- D. Public and private keys
Answer: A
Explanation:
Public-key cryptography, or asymmetric cryptography, is a cryptographic system that uses pairs of keys:
public keys (which may be known to others), and private keys (which may never be known by any except the owner). The generation of such key pairs depends on cryptographic algorithms which are based on mathematical problems termed one-way functions. Effective security requires keeping the private key private; the public key can be openly distributed without compromising security.
In such a system, any person can encrypt a message using the intended receiver's public key, but that encrypted message can only be decrypted with the receiver's private key. This allows, for instance, a server program to generate a cryptographic key intended for a suitable symmetric-key cryptography, then to use a client's openly-shared public key to encrypt that newly generated symmetric key. The server can then send this encrypted symmetric key over an insecure channel to the client; only the client can decrypt it using the client's private key (which pairs with the public key used by the server to encrypt the message). With the client and server both having the same symmetric key, they can safely use symmetric key encryption (likely much faster) to communicate over otherwise-insecure channels. This scheme has the advantage of not having to manually pre-share symmetric keys (a fundamentally difficult problem) while gaining the higher data throughput advantage of symmetric-key cryptography.
With public-key cryptography, robust authentication is also possible. A sender can combine a message with a private key to create a short digital signature on the message. Anyone with the sender's corresponding public key can combine that message with a claimed digital signature; if the signature matches the message, the origin of the message is verified (i.e., it must have been made by the owner of the corresponding private key).
Public key algorithms are fundamental security primitives in modern cryptosystems, including applications and protocols which offer assurance of the confidentiality, authenticity and non-repudiability of electronic communications and data storage. They underpin numerous Internet standards, such as Transport Layer Security (TLS), S/MIME, PGP, and GPG. Some public key algorithms provide key distribution and secrecy (e.
g., Diffie-Hellman key exchange), some provide digital signatures (e.g., Digital Signature Algorithm), and some provide both (e.g., RSA). Compared to symmetric encryption, asymmetric encryption is rather slower than good symmetric encryption, too slow for many purposes. Today's cryptosystems (such as TLS, Secure Shell) use both symmetric encryption and asymmetric encryption.
NEW QUESTION # 85
Your company was hired by a small healthcare provider to perform a technical assessment on the network.
What is the best approach for discovering vulnerabilities on a Windows-based computer?
- A. Create a disk image of a clean Windows installation
- B. Check MITRE.org for the latest list of CVE findings
- C. Use a scan tool like Nessus
- D. Use the built-in Windows Update tool
Answer: C
NEW QUESTION # 86
Which of the following Google advanced search operators helps an attacker in gathering information about websites that are similar to a specified target URL?
- A. site:
- B. info:
- C. inurl:
- D. related:
Answer: D
Explanation:
In CEH v13 Module 02: Footprinting and Reconnaissance, Google advanced operators are tools for passive information gathering.
related: operator is used to find websites similar to a given domain or webpage.
This helps attackers discover alternate domains, competitors, or similar content that may be vulnerable or poorly secured.
Example:
related:example.com
Will return a list of sites Google deems related to example.com.
Option Clarification:
A: inurl: - Searches for a keyword in the URL.
B: related: - Correct - Finds similar or related websites.
C: info: - Provides Google's cached and indexed data about a URL.
D: site: - Restricts search to a specific domain or site.
Reference:
Module 02 - Google Hacking Techniques
CEH iLabs: Google Dorking with Advanced Operators
NEW QUESTION # 87
Which of the following types of SQL injection attacks extends the results returned by the original query, enabling attackers to run two or more statements if they have the same structure as the original one?
- A. Union SQL injection
- B. Blind SQL injection
- C. Error-based injection
- D. Boolean-based blind SQL injection
Answer: A
Explanation:
Union-based SQL injection is a technique that uses the UNION SQL operator to combine the results of the original query with the results of one or more additional queries. This allows attackers to:
Retrieve data from different database tables
Extend the result set returned to the web application
Exploit the application if both queries return the same number and type of columns According to CEH v13:
UNION SELECT can be used to enumerate tables, extract user credentials, or display sensitive data.
It requires knowledge of the structure of the original query.
Incorrect Options:
A: Error-based injection extracts data from database error messages.
B: Boolean-based blind SQLi returns true/false results to infer data.
C: Blind SQLi (generic) relies on no visible output and uses inference techniques.
Reference - CEH v13 Official Courseware:
Module 14: Hacking Web Applications
Section: "Types of SQL Injection Attacks"
Subsection: "Union-Based SQL Injection"
NEW QUESTION # 88
......
Easy Success ECCouncil 312-50v13 Exam in First Try: https://passleader.examtorrent.com/312-50v13-prep4sure-dumps.html
