Pass Exam With Full Sureness - 312-50v13 Dumps with 1102 Questions
Verified 312-50v13 dumps Q&As - 100% Pass from VerifiedDumps
NEW QUESTION # 311
Which of the following commands checks for valid users on an SMTP server?
- A. EXPN
- B. RCPT
- C. CHK
- D. VRFY
Answer: D
Explanation:
The VRFY commands enables SMTP clients to send an invitation to an SMTP server to verify that mail for a selected user name resides on the server. The VRFY command is defined in RFC 821.
The server sends a response indicating whether the user is local or not, whether mail are going to be forwarded, and so on. A response of 250 indicates that the user name is local; a response of 251 indicates that the user name isn't local, but the server can forward the message. The server response includes the mailbox name.
NEW QUESTION # 312
During a red team assessment at New England Insurance in Boston, ethical hacker Daniel sends a series of spoofed TCP packets carrying the reset flag to a server hosting client applications. As a result, several active sessions between employees and the server are abruptly terminated, causing temporary disruption of legitimate work. Daniel uses this demonstration to highlight how attackers can forcibly tear down sessions without completing a full hijack. Which type of network- level session hijacking technique is Daniel simulating?
- A. Blind Hijacking
- B. UDP Hijacking
- C. RST Hijacking
- D. TCP/IP Hijacking
Answer: C
Explanation:
Sending spoofed TCP packets with the reset (RST) flag terminates active connections abruptly.
This method of forcibly disrupting sessions without taking over the connection is known as RST hijacking.
NEW QUESTION # 313
A senior executive receives a personalized email with the subject line "Annual Performance Review 2024." The email contains a downloadable PDF that installs a backdoor when opened. The email appears to come from the CEO and includes company branding. Which phishing method does this best illustrate?
- A. Email clone attack with altered attachments
- B. Whaling attack aimed at high-ranking personnel
- C. Broad phishing sent to all employees
- D. Pharming using DNS poisoning
Answer: B
Explanation:
This scenario is a textbook example of a Whaling Attack, a highly targeted phishing technique described in the CEH v13 Social Engineering module. Whaling specifically targets senior executives or high-ranking individuals, exploiting their authority, access privileges, and decision-making roles.
In the given case, the attacker crafts a personalized email, impersonates the CEO, and uses legitimate corporate branding to build trust. The malicious PDF attachment delivers a backdoor, aligning with CEH v13 descriptions of advanced spear-phishing techniques used against executives.
CEH v13 differentiates whaling from other phishing types:
* Broad phishing targets large groups indiscriminately.
* Pharming redirects users via DNS manipulation.
* Email clone attacks copy legitimate emails but typically target peers, not executives.
Whaling attacks are particularly dangerous because executives often bypass security scrutiny and possess elevated system access. CEH v13 emphasizes executive awareness training as a key mitigation strategy.
Therefore, the correct answer is Whaling attack aimed at high-ranking personnel.
NEW QUESTION # 314
A penetration tester suspects that a web application's product search feature is vulnerable to SQL injection. The tester needs to confirm this by manipulating the SQL query. What is the best technique to test for SQL injection?
- A. Use directory traversal syntax in the search field to access server files
- B. Inject a malicious script into the search field to test for Cross-Site Scripting (XSS)
- C. Input 1 OR 1=1 in the search field to retrieve all products from the database
- D. Insert admin '-- in the search field to attempt bypassing authentication
Answer: C
Explanation:
Injecting a tautological condition such as 1 OR 1=1 manipulates the SQL query logic to always evaluate as true. If the application returns all products or behaves abnormally, it confirms the presence of a SQL injection vulnerability.
NEW QUESTION # 315
A penetration tester performs a vulnerability scan on a company's web server and identifies several medium-risk vulnerabilities related to misconfigured settings. What should the tester do to verify the vulnerabilities?
- A. Ignore the vulnerabilities since they are medium-risk
- B. Conduct a denial-of-service (DoS) attack to test the server's resilience
- C. Use publicly available tools to exploit the vulnerabilities and confirm their impact
- D. Perform a brute-force attack on the web server's login page
Answer: C
Explanation:
After identifying vulnerabilities through scanning, the correct approach is to validate them safely.
Using appropriate tools to confirm exploitability and real impact ensures accurate risk assessment without unnecessary disruption.
NEW QUESTION # 316
In a large organization, a network security analyst discovered a series of packet captures that seem unusual.
The network operates on a switched Ethernet environment. The security team suspects that an attacker might be using a sniffer tool. Which technique could the attacker be using to successfully carry out this attack, considering the switched nature of the network?
- A. The attacker might be compromising physical security to plug into the network directly
- B. The attacker might be implementing MAC flooding to overwhelm the switch's memory
- C. The attacker is probably using a Trojan horse with in-built sniffing capability
- D. The attacker might be using passive sniffing, as it provides significant stealth advantages
Answer: B
Explanation:
A sniffer tool is a software or hardware device that can capture and analyze network traffic. In a switched Ethernet environment, where each port on a switch is connected to a single device, a sniffer tool can only see the traffic that is destined for or originated from the device it is attached to. However, an attacker can use various techniques to overcome this limitation and sniff the traffic of other devices on the same network. One of these techniques is MAC flooding, which exploits the finite memory of the switch's MAC address table.
The attacker sends a large number of frames with different source MAC addresses to the switch, which fills up the MAC address table and causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, regardless of the destination MAC address. This way, the attacker can see all the traffic on the network and capture it with a sniffer tool.
The other options are less likely or less effective techniques for sniffing a switched Ethernet network.
Compromising physical security to plug into the network directly may allow the attacker to sniff the traffic of the device they are connected to, but not the traffic of other devices on the network. Using a Trojan horse with in-built sniffing capability may allow the attacker to sniff the traffic of the infected device, but not the traffic of other devices on the network, unless the Trojan horse also performs MAC flooding or other techniques to bypass the switch. Using passive sniffing, which involves listening to the network traffic without sending any packets, may provide significant stealth advantages, but it does not help the attacker to see the traffic of other devices on the network, unless the switch is already in fail-open mode or the attacker uses other techniques to induce it.
References:
Sniffing: A Beginners Guide In 4 Important Points
How can I run a packet sniffer on a Router or Switch
Detection of Sniffers in an Ethernet Network
NEW QUESTION # 317
A system administrator observes that several machines in the network are repeatedly sending out traffic to unknown IP addresses. Upon inspection, these machines were part of a coordinated spam campaign. What is the most probable cause?
- A. Devices were enslaved into a botnet network
- B. Browsers were redirected to adware-injected sites
- C. Worms exploited zero-day vulnerabilities
- D. Keyloggers were harvesting user credentials
Answer: A
Explanation:
Machines participating in coordinated outbound traffic to unknown IP addresses for activities like spam distribution are characteristic of botnet infections, where compromised devices are remotely controlled as part of a larger malicious network.
NEW QUESTION # 318
A financial services provider in Frankfurt, Germany, experienced intermittent service disruption affecting its public-facing transaction portal. Network engineers observed a surge of connection attempts targeting the web servers.
Packet inspection revealed that the majority of incoming traffic consisted of connection initiation requests that were never completed. The servers allocated memory and maintained half-open connection states while waiting for acknowledgments that never arrived. Over time, the connection table reached capacity, preventing legitimate users from establishing new sessions.
No abnormal payloads were detected, and the packets themselves appeared structurally valid.
Which attack technique best explains this behavior?
- A. Spoofed session flood attack
- B. SYN flood attack
- C. Fragmentation attack
- D. ACK flood attack
Answer: B
Explanation:
The behavior described involves a large number of incomplete TCP connection attempts where SYN requests are sent but the final handshake is never completed. This causes the server to maintain half-open connections until resources are exhausted, which is the defining characteristic of a SYN flood attack.
NEW QUESTION # 319
FILL BLANK
Scenario
Instructions
You have been hired as a part of the Red Team at CEHORG, an IT and ITES organization that deals with advanced research and development in the field of information security. It has offices all over the country connected in real-time by its network infrastructure.
Your organization is worried about rising cybersecurity incidents and has entrusted you with a comprehensive security audit of the complete infrastructure.
CEHORG's internal network consists of several subnets housing various organizational units like any large organization. The front office is connected to a separate subnet that connects to the company's public-facing computers. The company has installed multiple kiosks to help customers understand their products and services. The front office also has Wi-Fi connectivity to cater to the users who carry their smartphones and laptops.
The CEHORG's internal network is made up of Militarized and Demilitarized zones. As a security precaution and by design, all the internal resource zones are configured with different subnet IPs.
The militarized zone houses the application servers that provide application frameworks for various departments. The Demilitarized Zone contains public-facing systems of the organization, such as web and mail servers. The headquarters' network topology and protocols are replicated worldwide in all its satellite offices for efficient communication with the headquarters.
Description
CEH Practical exam presents you with 20 challenges built on the ethical hacking domains covered in the C|EH program. The exam hosts multiple hidden machines, each containing a set of vulnerable applications and services. You must apply your knowledge and skills in various ethical hacking domains and solve the challenges. The exam duration is 6 hours. Each challenge in CEH Practical weighs 10 points, and you are required to solve a minimum of 14 challenges out of 20, which would sum up to 140 points, to become a CEH (Practical) Credential Holder.
On the cyber range, you will have access to Ethical Hacker Workstations, EH Workstation - 1 and EH Workstation - 2. EH Workstation - 1 is a Parrot Security machine and EH Workstation
- 2 is a Windows 11 machine. You can switch to these machines from the Resources tab.
Please note that there are a maximum of 3 attempts for each challenge.
Available target networks:
10.10.55.0/24
192.168.44.0/24
192.168.200.0/24
Exclusions:
10.10.55.1, 10.10.55.2
192.168.44.1, 192.168.44.2
192.168.200.1, 192.168.200.2
The credentials to access EH Workstation - 1 (Parrot Security) machine are as below:
Username: attacker Password: toor
The credentials to access EH Workstation - 2 (Windows 11) are as below:
Username: Admin Password: Pa$$w0rd
The credentials to access OpenVAS on EH Workstation - 1 (Parrot Security) machine are as below:
Username: admin Password: password
To open OpenVAS tool, click Applications at the top of the Desktop window and navigate to Pentesting → Vulnerability Analysis → Openvas - Greenbone → Start Greenbone Vulnerability Manager Service to launch OpenVAS tool.
Note: You can use username.txt and password.txt available on the Desktop of the EH Workstation - 1 (Parrot Security) machine for any credentials/password cracking attempt.
Flags
Challenge:
You are assigned to investigate a large-scale DDoS attack targeting the IP address 172.22.10.10.
The objective is to analyze the network traffic to identify the malicious packets involved and determine the IP address of the attacker machine running Windows as its operating system. The network capture file, Mystic-capture.pcapng, is located in the Documents directory of the "EH Workstation - 2" (Windows 11) machine. (Format: NN*NN*NN*NN)
Answer:
Explanation:
10.10.55.11
NEW QUESTION # 320
A payload drops a database table by injecting ; DROP TABLE users; --. What SQL injection method was used?
- A. Error-based SQL injection
- B. Piggybacked queries
- C. Boolean-based SQL injection
- D. UNION-based SQL injection
Answer: B
Explanation:
This attack is a classic example of Piggybacked SQL Injection, covered in CEH v13 Web Application Hacking. Piggybacked queries allow attackers to append additional malicious SQL commands to an existing query using a delimiter such as a semicolon.
The payload executes the original query followed by a destructive command (DROP TABLE). UNION-based injections retrieve data, Boolean-based injections infer logic, and error-based injections rely on error messages-not destructive execution.
CEH v13 explicitly describes piggybacked queries as capable of data destruction and privilege escalation, making Option A correct.
NEW QUESTION # 321
During a red team engagement targeting a custom web application, a tester observes that the app takes a numeric id parameter from the URL and dynamically builds SQL queries. Suspecting SQL injection, the tester sends a crafted HTTP GET request like:
http://vulnerableapp.local/view.php?id=l; DROP TABLE users; --Shortly after, the application throws database errors, and the team confirms that the users table has been removed from the backend database.
Based on this behavior, which SQL injection method was most likely used?
- A. The attacker triggered errors to extract database information.
- B. The attacker executed a second malicious query alongside the first.
- C. The attacker appended a UNION clause to retrieve additional data.
- D. The attacker used Boolean logic to infer true/false responses.
Answer: B
Explanation:
The attacker injected an additional malicious SQL statement that was executed alongside the original query, allowing destructive commands such as dropping a table, which is characteristic of stacked (piggy-backed) SQL queries.
NEW QUESTION # 322
Windows LAN Manager (LM) hashes are known to be weak.
Which of the following are known weaknesses of LM? (Choose three.)
- A. Hashes are sent in clear text over the network.
- B. Effective length is 7 characters.
- C. Makes use of only 32-bit encryption.
- D. Converts passwords to uppercase.
Answer: A,B,D
NEW QUESTION # 323
Eric, a cloud security engineer, implements a technique for securing the cloud resources used by his organization. This technique assumes by default that a user attempting to access the network is not an authentic entity and verifies every incoming connection before allowing access to the network. Using this technique, he also imposed conditions such that employees can access only the resources required for their role.
What is the technique employed by Eric to secure cloud resources?
- A. Container technology
- B. Zero trust network
- C. Demilitarized zone
- D. Serverless computing
Answer: B
Explanation:
Zero Trust Networks The Zero Trust model is a security implementation that by default assumes every user trying to access the network is not a trusted entity and verifies every incoming connection before allowing access to the network.It strictly follows the principle, "Trust no one and validate before providing a cloud service or granting access permission."It also allows companies to impose conditions, such as allowing employees to only access the appropriate resources required for their work role. (P.2997/2981) Zero Trust is a strategic initiative that helps prevent successful data breaches by eliminating the concept of trust from an organization's network architecture. Rooted in the principle of "never trust, always verify," Zero Trust is designed to protect modern digital environments by leveraging network segmentation, preventing lateral movement, providing Layer 7 threat prevention, and simplifying granular user-access control.
NEW QUESTION # 324
Every company needs a formal written document which spells out to employees precisely what they are allowed to use the company's systems for, what is prohibited, and what will happen to them if they break the rules. Two printed copies of the policy should be given to every employee as soon as possible after they join the organization. The employee should be asked to sign one copy, which should be safely filed by the company. No one should be allowed to use the company's computer systems until they have signed the policy in acceptance of its terms.
What is this document called?
- A. Penetration Testing Policy (PTP)
- B. Company Compliance Policy (CCP)
- C. Information Audit Policy (IAP)
- D. Information Security Policy (ISP)
Answer: D
NEW QUESTION # 325
Joel, a professional hacker, targeted a company and identified the types of websites frequently visited by its employees. Using this information, he searched for possible loopholes in these websites and injected a malicious script that can redirect users from the web page and download malware onto a victim's machine.
Joel waits for the victim to access the infected web application so as to compromise the victim's machine.
Which of the following techniques is used by Joel in the above scenario?
- A. Watering hole attack
- B. DNS rebinding attack
- C. Clickjacking attack
- D. MarioNet attack
Answer: A
Explanation:
Web Application Threats - Watering Hole Attack In a watering hole attack, the attacker identifies the kinds of websites a target company/individual frequently surfs and tests those particular websites to identify any possible vulnerabilities. Attacker injects malicious script/code into the web application that can redirect the webpage and download malware onto the victim machine. (P.1797/1781)
NEW QUESTION # 326
You are a penetration tester hired to evaluate the security posture of a regional manufacturing company's network devices. During your assessment, you discover that one of the core routers allows external administrative access without requiring a password. Additionally, the router communicates with other devices using a protocol that does not provide encryption or validation.
Based solely on these observations, which of the following network device vulnerabilities is most clearly present?
- A. Firewall vulnerabilities
- B. Insecure routing protocols
- C. Lack of authentication
- D. Lack of password protection
Answer: D
Explanation:
The router explicitly allows administrative access without requiring a password, which directly indicates missing password protection. This is a clear and specific vulnerability that exposes the device to unauthorized access.
NEW QUESTION # 327
A digital media company in Seattle, Washington deploys an Nginx-based infrastructure to support its internal analytics dashboard and content publishing portal. During an authorized red team engagement, a tester evaluates the web-based administrative interface used to upload configuration bundles and manage application components. While analyzing a file-upload feature, the tester observes that certain user-supplied parameters submitted with uploaded content are incorporated into backend processing routines with limited validation. By adjusting specific values in the request, he alters how the server-side component interprets those inputs. Subsequent log analysis shows that the modified input affected system-level operations executed under the web service context, despite no direct shell access being obtained. Which Nginx-related vulnerability best describes the weakness identified in this scenario?
- A. NULL pointer dereference in HTTP/3
- B. Server-side request forgery (SSRF) vulnerability
- C. OS command injection in nginxWebUI
- D. Improper certificate validation
Answer: C
Explanation:
User-supplied parameters from the file-upload feature are incorporated into backend processing with insufficient validation, allowing manipulation of system-level operations under the web service context. This behavior is characteristic of OS command injection in nginxWebUI, where crafted input alters command execution without requiring direct shell access.
NEW QUESTION # 328
Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?
- A. To test for virus protection
- B. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail
- C. To perform a DoS
- D. To create needless SPAM
- E. To determine who is the holder of the root account
Answer: B
Explanation:
Sending email to a non-existent address can generate bounce messages or server responses that reveal useful information about the organization's email infrastructure, mail servers, and handling mechanisms.
NEW QUESTION # 329
Todd has been asked by the security officer to purchase a counter-based authentication system. Which of the following best describes this type of system?
- A. An authentication system that creates one-time passwords that are encrypted with secret keys.
- B. An authentication system that uses passphrases that are converted into virtual passwords.
- C. A biometric system that bases authentication decisions on behavioral attributes.
- D. A biometric system that bases authentication decisions on physical attributes.
Answer: A
NEW QUESTION # 330
You are a cybersecurlty consultant for a smart city project. The project involves deploying a vast network of loT devices for public utilities like traffic control, water supply, and power grid management The city administration is concerned about the possibility of a Distributed Denial of Service (DDoS) attack crippling these critical services. They have asked you for advice on how to prevent such an attack. What would be your primary recommendation?
- A. A Deploy network intrusion detection systems (IDS) across the loT network.
- B. Implement IP address whitelisting for all loT devices.
- C. Establish strong, unique passwords for each loT device.
- D. Implement regular firmware updates for all loT devices.
Answer: D
Explanation:
Implementing regular firmware updates for all IoT devices is the primary recommendation to prevent DDoS attacks on the smart city project. Firmware updates can fix security vulnerabilities, patch bugs, and improve performance of the IoT devices, making them less susceptible to malware infections and botnet recruitment12. Firmware updates can also enable new security features, such as encryption, authentication, and firewall, that can protect the IoT devices from unauthorized access and data theft3. Firmware updates should be done automatically or remotely, without requiring user intervention, to ensure timely and consistent security across the IoT network4.
The other options are not as effective or feasible as firmware updates for the following reasons:
B). Deploying network intrusion detection systems (IDS) across the IoT network can help detect and alert DDoS attacks, but not prevent them. IDS can monitor network traffic and identify malicious patterns, such as high volume, spoofed IP addresses, or unusual protocols, that indicate a DDoS attack5. However, IDS cannot block or mitigate the attack, and may even be overwhelmed by the flood of traffic, resulting in false positives or missed alerts. Moreover, deploying IDS across a vast network of IoT devices can be costly, complex, and resource-intensive, as it requires dedicated hardware, software, and personnel.
C). Establishing strong, unique passwords for each IoT device can prevent unauthorized access and brute-force attacks, but not DDoS attacks. Passwords can protect the IoT devices from being compromised by hackers who try to guess or crack the default or weak credentials. However, passwords cannot prevent DDoS attacks that exploit known or unknown vulnerabilities in the IoT devices, such as buffer overflows, command injections, or protocol flaws. Moreover, establishing and managing strong, unique passwords for each IoT device can be challenging and impractical, as it requires user awareness, memory, and effort.
D). Implementing IP address whitelisting for all IoT devices can restrict network access and communication to trusted sources, but not DDoS attacks. IP address whitelisting can filter out unwanted or malicious traffic by allowing only the predefined IP addresses to connect to the IoT devices. However, IP address whitelisting cannot prevent DDoS attacks that use spoofed or legitimate IP addresses, such as reflection or amplification attacks, that bypass the whitelisting rules. Moreover, implementing IP address whitelisting for all IoT devices can be difficult and risky, as it requires constant updating, testing, and monitoring of the whitelist, and may block legitimate or emergency traffic by mistake.
References:
1: How to proactively protect IoT devices from DDoS attacks - Synopsys
2: IoT and DDoS: Cyberattacks on the Rise | A10 Networks
3: Detection and Prevention of DDoS Attacks on the IoT - MDPI
4: How to Secure IoT Devices: 5 Best Practices | IoT For All
5: Intrusion Detection Systems (IDS) Part 1 - Network Security | Coursera
6: DDoS Attacks: Detection and Mitigation - Cisco
7: The Challenges of IoT Security - Infosec Resources
8: IoT Security: How to Protect Connected Devices and the IoT Ecosystem | Kaspersky
9: IoT Security: Common Vulnerabilities and Attacks | IoT For All
10: The Password Problem: How to Use Passwords Effectively in 2021 | Dashlane Blog
11: What is IP Whitelisting? | Cloudflare
12: DDoS Attacks: Types, Techniques, and Protection | Cloudflare
13: IP Whitelisting: Pros and Cons | Imperva
NEW QUESTION # 331
How is the public key distributed in an orderly, controlled fashion so that the users can be sure of the sender's identity?
- A. Hash value
- B. Digital signature
- C. Private key
- D. Digital certificate
Answer: D
Explanation:
A digital certificate, issued by a trusted Certificate Authority (CA), binds a public key to the identity of an entity (e.g., user, organization). This provides a means to validate ownership of the public key.
CEH v13 Reference:
Module 17: Cryptography
"A digital certificate ensures the authenticity of the public key through a trusted third party known as a Certificate Authority."
######################
NEW QUESTION # 332
......
312-50v13 Dumps Full Questions - Exam Study Guide: https://www.verifieddumps.com/312-50v13-valid-exam-braindumps.html
Pass 312-50v13 Exam in First Attempt Guaranteed 2026 Dumps: https://drive.google.com/open?id=1Ufcq3yuc_8x84pcjaPVGljp17G8rfU0P
