Free ECCouncil 312-50v13 Test Practice Test Questions Exam Dumps [Q327-Q349]

Free ECCouncil 312-50v13 Test Practice Test Questions Exam Dumps

Prepare Top ECCouncil 312-50v13 Exam Audio Study Guide Practice Questions Edition

NEW QUESTION # 327
A zone file consists of which of the following Resource Records (RRs)?

• A. DNS, NS, AXFR, and MX records
• B. SOA, NS, AXFR, and MX records
• C. DNS, NS, PTR, and MX records
• D. SOA, NS, A, and MX records

Answer: D

Explanation:
A DNS zone file contains resource records (RRs) that define mappings and configurations for domains and subdomains. The standard records found in a zone file include:
* SOA (Start of Authority): Indicates the beginning of the zone file.
* NS (Name Server): Specifies the authoritative name servers.
* A (Address): Maps hostnames to IPv4 addresses.
* MX (Mail Exchange): Specifies mail servers.
These records are essential for the DNS resolution process and mail routing.
From CEH v13 Official Courseware:
* Module 3: DNS Enumeration
* Topic: DNS Record Types
CEH v13 Study Guide states:
"A zone file contains all the resource records including SOA, NS, A, and MX. These define name server authority, IP resolution, and mail server routing." Incorrect Options:
* A: DNS is a protocol, not a resource record.
* B: PTR is for reverse DNS, typically in a separate reverse zone file.
* C: AXFR is a DNS transfer mechanism, not an RR in the zone file.
Reference:CEH v13 Study Guide - Module 3: DNS Record TypesRFC 1035 - Domain Names:
Implementation and Specification

NEW QUESTION # 328
Sam, a web developer, was instructed to incorporate a hybrid encryption software program into a web application to secure email messages. Sam used an encryption software, which is a free implementation of the OpenPGP standard that uses both symmetric-key cryptography and asymmetric-key cryptography for improved speed and secure key exchange. What is the encryption software employed by Sam for securing the email messages?

• A. PGP
• B. SMTP
• C. GPG
• D. S/MIME

Answer: C

Explanation:
The scenario describes a hybrid encryption solution based on the OpenPGP standard that uses both symmetric and asymmetric encryption. The key phrase in the question is "a free implementation of the OpenPGP standard," which directly refers to GPG.
GPG (GNU Privacy Guard) is a free, open-source implementation of the OpenPGP standard.
It combines symmetric encryption for data encryption (fast and efficient) and asymmetric encryption for secure key exchange (using public/private key pairs).
GPG is widely used to secure emails, files, and messages, often in conjunction with tools like Thunderbird or command-line utilities.
Incorrect Options:
A). PGP (Pretty Good Privacy) is the original proprietary implementation of OpenPGP, not free/open-source by default.
B). S/MIME (Secure/Multipurpose Internet Mail Extensions) is another email encryption standard but does not implement OpenPGP.
C). SMTP (Simple Mail Transfer Protocol) is a mail transport protocol, not an encryption method.
Reference - CEH v13 Official Courseware:
Module 20: Cryptography
Section: "Hybrid Encryption and Email Encryption Tools"
Subsection: "GPG and OpenPGP-Based Encryption"
=

NEW QUESTION # 329
Malware infecting multiple systems remains dormant until triggered and changes its code or encryption with each infection to evade detection. Which malware type best fits this description, and what is the most effective mitigation?

• A. Rootkit - use anti-rootkit tools and patch systems
• B. Polymorphic malware - use behavior-based detection and ensure systems are patched
• C. Adware - deploy anti-adware tools and train users
• D. Worm - isolate infected systems and scan the network

Answer: B

Explanation:
The CEH Malware Threats module defines polymorphic malware as malicious code that mutates its appearance (code, encryption, packing) each time it propagates, making signature-based detection ineffective. Dormancy and trigger-based activation are also common characteristics.
CEH emphasizes that behavior-based detection, sandboxing, and heuristic analysis are the most effective countermeasures against polymorphic threats.
Option D is correct.
Options A, B, and C do not address polymorphic evasion techniques.

NEW QUESTION # 330
Which of the following tools is used to analyze the files produced by several packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

• A. tcptrace
• B. Nessus
• C. OpenVAS
• D. tcptraceroute

Answer: A

Explanation:
tcptrace is a command-line tool used to analyze the output of packet-capture tools such as tcpdump and Wireshark. It processes the captured data and generates detailed reports on TCP connections including connection durations, round-trip times, throughput, and more.
# Reference - CEH v13 Study Guide, Module 10: Sniffing
"tcptrace reads in packet trace files and outputs information about each TCP connection seen."
# Incorrect options:
B). Nessus is a vulnerability scanner.
C). OpenVAS is also a vulnerability assessment tool.
D). tcptraceroute is used to trace the path of packets at the TCP level, not for analyzing captured data.

NEW QUESTION # 331
Tess King is using the nslookup command to craft queries to list all DNS information (such as Name Servers, host names, MX records, CNAME records, glue records (delegation for child Domains), zone serial number, TimeToLive (TTL) records, etc) for a Domain.
What do you think Tess King is trying to accomplish? Select the best answer.

• A. A zone transfer
• B. A zone harvesting
• C. A zone update
• D. A zone estimate

Answer: A

NEW QUESTION # 332
A large company intends to use BlackBerry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the corporate network. What tool should the analyst use to perform a Blackjacking attack?

• A. BBCrack
• B. Paros Proxy
• C. BBProxy
• D. Blooover

Answer: C

Explanation:
The Blackjacking attack involves leveraging a compromised BlackBerry device and its connection through the BlackBerry Enterprise Server (BES) to tunnel back into the internal corporate network, bypassing perimeter firewalls. The tool used in this method is BBProxy.
BBProxy is installed on the BlackBerry device and establishes a covert tunnel via BES, allowing attackers to pivot into the internal LAN from outside the perimeter.
Reference - CEH v13 Official Study Guide:
Module 17: Hacking Mobile Platforms
Quote:
"Blackjacking is a technique in which attackers use BBProxy to exploit a trusted path from a BlackBerry device to the corporate LAN through BES." Incorrect Options Explained:
A). Paros Proxy is a web proxy used for intercepting HTTP/S traffic.
C). Blooover is used for Bluetooth security auditing.
D). BBCrack is used for password recovery on BlackBerry devices, not for tunneling.
=

NEW QUESTION # 333
You are a cybersecurity consultant for a healthcare organization that utilizes Internet of Medical Things (loMT) devices, such as connected insulin pumps and heart rate monitors, to provide improved patientcare.
Recently, the organization has been targeted by ransomware attacks. While the IT infrastructure was unaffected due to robust security measures, they are worried that the loMT devices could be potential entry points for future attacks. What would be your main recommendation to protect these devices from such threats?

• A. Regularly change the IP addresses of all loMT devices.
• B. Implement multi-factor authentication for all loMT devices.
• C. Use network segmentation to isolate loMT devices from the main network.
• D. Disable all wireless connectivity on loMT devices.

Answer: C

Explanation:
Internet of Medical Things (IoMT) devices are internet-connected medical devices that can collect, transfer, and analyze data over a network. They can provide improved patient care and comfort, but they also pose security challenges and risks, as they can be targeted by cyberattacks, such as ransomware, that can compromise their functionality, integrity, or confidentiality. Ransomware is a type of malware that encrypts the victim's data or system and demands a ransom for its decryption or restoration. Ransomware attacks can cause serious harm to healthcare organizations, as they can disrupt their operations, endanger their patients, and damage their reputation.
To protect IoMT devices from ransomware attacks, the main recommendation is to use network segmentation to isolate IoMT devices from the main network. Network segmentation is a technique that divides a network into smaller subnetworks, each with its own security policies and controls. Network segmentation can prevent or limit the spread of ransomware from one subnetwork to another, as it restricts the communication and access between them. Network segmentation can also improve the performance, visibility, and manageability of the network, as it reduces the network congestion, complexity, and noise.
The other options are not as effective or feasible as network segmentation. Implementing multi-factor authentication for all IoMT devices may not be possible or practical, as some IoMT devices may not support or require user authentication, such as sensors or monitors. Disabling all wireless connectivity on IoMT devices may not be desirable or realistic, as some IoMT devices rely on wireless communication protocols, such as Wi-Fi, Bluetooth, or Zigbee, to function or transmit data. Regularly changing the IP addresses of all IoMT devices may not prevent or deter ransomware attacks, as ransomware can target devices based on other factors, such as their domain names, MAC addresses, or vulnerabilities. References:
* What Is Internet of Medical Things (IoMT) Security?
* 5 Steps to Secure Internet of Medical Things Devices
* Ransomware in Healthcare: How to Protect Your Organization
* [Network Segmentation: Definition, Benefits, and Best Practices]

NEW QUESTION # 334
An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML code to embed a malicious applet in all HTTP connections. When users accessed any page, the applet ran and exploited many machines. Which one of the following tools the hacker probably used to inject HTML code?

• A. Ettercap
• B. Tcpdump
• C. Aircrack-ng
• D. Wireshark

Answer: A

Explanation:
Ettercap is a comprehensive MITM attack tool that supports live traffic interception and content injection. It can modify HTTP streams in real time and inject malicious payloads, such as JavaScript or applets, into web traffic.
Reference - CEH v13 Official Study Guide:
Module 8: Sniffing
Quote:
"Ettercap allows attackers to intercept, analyze, and alter data on the fly, including injecting malicious content like Java applets in HTTP sessions during MITM attacks." Incorrect Options Explained:
A & D. Wireshark and Tcpdump are passive sniffers with no injection capability.
C). Aircrack-ng is for Wi-Fi key cracking, not traffic manipulation.
=

NEW QUESTION # 335
Which encryption method supports secure key distribution?

• A. Hash functions
• B. Disk encryption
• C. Asymmetric encryption
• D. Symmetric encryption

Answer: C

Explanation:
Asymmetric encryption, as defined in CEH v13 Cryptography, uses a public-private key pair, solving the key distribution problem inherent in symmetric encryption.
Public keys can be freely shared, enabling secure communication initiation without prior shared secrets. Disk encryption and hashes do not address key exchange.
Therefore, Option D is correct.

NEW QUESTION # 336
During a penetration test at Lone Star Healthcare in Austin, ethical hacker Liam evaluates the hospital's perimeter defenses by generating controlled traffic flows through the firewall. He uses a tool that can create and replay diverse traffic patterns to test how well the firewall enforces its rules against both legitimate and malicious traffic types. This allows him to demonstrate whether the device properly identifies evasion attempts under simulated attack conditions.
Which tool is Liam most likely using in this test?

• A. Traffic IQ Professional
• B. Nmap
• C. Metasploit
• D. Colasoft Packet Builder

Answer: A

Explanation:
The scenario best matches Traffic IQ Professional because it describes a tool used to generate and replay diverse traffic patterns through a firewall to validate rule enforcement and detection under simulated attack conditions. The key functions here are traffic generation, replay, and the ability to model both legitimate and malicious flows to test whether the firewall correctly handles evasion attempts and policy enforcement.
Traffic generation/replay platforms are used in security validation and firewall testing to emulate real-world network behaviors at scale and to assess how devices respond to crafted or replayed traffic profiles.
Why the other tools are less suitable:
Nmap (A) is primarily a scanner for host discovery, port scanning, and service enumeration, with some scripting capabilities. It is not chiefly a traffic generation/replay system for exercising a firewall with diverse controlled flows.
Colasoft Packet Builder (C) can craft packets and build custom traffic at the packet level, which is useful for creating specific test packets. However, the scenario emphasizes broader "diverse traffic patterns" and replay of flows in a way typically associated with traffic modeling/validation suites rather than single-packet construction.
Metasploit (D) is an exploitation framework used to develop and execute exploits and payloads. While it can generate certain traffic, its primary purpose is not comprehensive traffic generation and replay to validate firewall policies under many traffic types.
Traffic IQ Professional is the best fit because it aligns with a firewall test plan focused on simulating legitimate and malicious traffic profiles, including evasion-style patterns, and demonstrating how the perimeter device behaves under controlled conditions. This approach is often used to evaluate whether a firewall can consistently enforce security policies, detect anomalies, and resist evasion techniques without overblocking legitimate traffic.
Therefore, the most likely tool is B. Traffic IQ Professional.

NEW QUESTION # 337
You are a security analyst conducting a footprinting exercise for a new client to gather information without direct interaction. After using search engines and public databases, you consider using Google Hacking (Google Dorking) techniques to uncover further vulnerabilities. Which option best justifies this decision?

• A. Google Hacking can help discover hidden organizational data from the Deep Web.
• B. Google Hacking can assist in mapping the client's internal network structure.
• C. Google Hacking can help identify weaknesses in the client's website code.
• D. Google Hacking can help locate phishing websites that mimic the client's website.

Answer: C

Explanation:
The Certified Ethical Hacker (CEH) Footprinting and Reconnaissance module defines Google Hacking, also known as Google Dorking, as the use of advanced search operators to uncover sensitive information unintentionally exposed on the public internet. This technique remains passive, making it ideal during early reconnaissance.
Google Hacking can reveal:
* Exposed configuration files
* Backup files (.bak, .old, .zip)
* Error messages and stack traces
* Source code fragments and scripting errors
These findings often indicate coding weaknesses or insecure configurations within a web application. CEH explicitly highlights Google Dorking as an effective way to identify web application weaknesses without scanning or exploiting the target directly.
Option C is correct because Google Hacking is commonly used to identify coding and configuration weaknesses exposed through indexed files.
Option A may be possible indirectly but is not the primary justification.
Option B is incorrect because Google does not index the Deep Web.
Option D involves internal network discovery, which Google Hacking cannot directly achieve.
CEH emphasizes Google Hacking as a powerful passive reconnaissance technique for discovering exposed vulnerabilities.

NEW QUESTION # 338
Email is transmitted across the Internet using the Simple Mail Transport Protocol. SMTP does not encrypt email, leaving the information in the message vulnerable to being read by an unauthorized person. SMTP can upgrade a connection between two mail servers to use TLS. Email transmitted by SMTP over TLS is encrypted. What is the name of the command used by SMTP to transmit email over TLS?

• A. UPGRADETLS
• B. FORCETLS
• C. STARTTLS
• D. OPPORTUNISTICTLS

Answer: C

Explanation:
STARTTLS is an SMTP command that allows the client to upgrade an existing insecure connection to a secure, encrypted TLS connection. It is widely supported by SMTP servers and used to protect email transmissions from interception.
Reference - CEH v13 Official Study Guide:
Module 20: Cryptography
Section: Secure Email Communication
Quote:
"STARTTLS is an SMTP command used to initiate encryption on an existing plaintext connection using TLS." Incorrect Options:
A). Opportunistic TLS is a concept, not a command
B & C. UPGRADETLS and FORCETLS are not valid SMTP commands

NEW QUESTION # 339
During a review for DoS threats, several IP addresses generate excessive traffic. Packet inspection shows the TCP three-way handshake is never completed, leaving many connections in a SYN_RECEIVED state and consuming server resources without completing sessions. What type of DoS attack is most likely occurring?

• A. Ping of Death
• B. SYN Flood
• C. UDP Flood
• D. Smurf Attack

Answer: B

Explanation:
In the CEH Denial-of-Service and Network Attacks coverage, a SYN flood is a classic TCP-based DoS technique that exploits the TCP connection establishment process. In a normal handshake, the client sends SYN, the server replies SYN/ACK, and the client completes with ACK. A SYN flood deliberately sends a high volume of SYN packets (often spoofed) but never completes the final ACK. As CEH describes, this leaves the server holding many half-open connections in SYN_RECEIVED, consuming memory and connection table resources (backlog queue). When the backlog fills, legitimate clients cannot establish connections, degrading availability.
The indicators in your scenario align exactly with CEH's SYN flood fingerprints: incomplete handshakes and accumulation of half-open connections. The goal is resource exhaustion at the connection-management layer rather than bandwidth saturation.
Option B (Ping of Death) involves malformed/oversized ICMP packets and does not match SYN_RECEIVED behavior. Option C (UDP flood) targets UDP services/ports and creates different symptoms (high UDP traffic, ICMP unreachable messages, service degradation) without half-open TCP states. Option D (Smurf) is ICMP- based amplification via broadcast addresses-again unrelated to incomplete TCP handshakes.
CEH also notes mitigations such as SYN cookies, increasing backlog, reducing SYN-RECEIVED timers, rate limiting, and upstream filtering-further reinforcing that the described event is a SYN flood.

NEW QUESTION # 340
The network team has well-established procedures to follow for creating new rules on the firewall. This includes having approval from a manager prior to implementing any new rules. While reviewing the firewall configuration, you notice a recently implemented rule but cannot locate manager approval for it. What would be a good step to have in the procedures for a situation like this?

• A. Have the network team document the reason why the rule was implemented without prior manager approval.
• B. Immediately roll back the firewall rule until a manager can approve it
• C. Monitor all traffic using the firewall rule until a manager can approve it.
• D. Do not roll back the firewall rule as the business may be relying upon it, but try to get manager approval as soon as possible.

Answer: B

NEW QUESTION # 341
Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned.
Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?

• A. "GET /restricted/ HTTP/1.1 Host: westbank.com
• B. "GET /restricted/goldtransfer?to=Rob&from=1 or 1=1' HTTP/1.1Host: westbank.com"
• C. "GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com"
• D. "GET /restricted/\r\n\%00account%00Ned%00access HTTP/1.1 Host: westbank.com"

Answer: C

Explanation:
This question shows a classic example of an IDOR vulnerability. Rob substitutes Ned's name in the "name" parameter and if the developer has not fixed this vulnerability, then Rob will gain access to Ned's account.
Below you will find more detailed information about IDOR vulnerability.
Insecure direct object references (IDOR) are a cybersecurity issue that occurs when a web application developer uses an identifier for direct access to an internal implementation object but provides no additional access control and/or authorization checks. For example, an IDOR vulnerability would happen if the URL of a transaction could be changed through client-side user input to show unauthorized data of another transaction.
Most web applications use simple IDs to reference objects. For example, a user in a database will usually be referred to via the user ID. The same user ID is the primary key to the database column containing user information and is generated automatically. The database key generation algorithm is very simple: it usually uses the next available integer. The same database ID generation mechanisms are used for all other types of database records.
The approach described above is legitimate but not recommended because it could enable the attacker to enumerate all users. If it's necessary to maintain this approach, the developer must at least make absolutely sure that more than just a reference is needed to access resources. For example, let's say that the web application displays transaction details using the following URL:
* https://www.example.com/transaction.php?id=74656
A malicious hacker could try to substitute the id parameter value 74656 with other similar values, for example:
* https://www.example.com/transaction.php?id=74657
The 74657 transaction could be a valid transaction belonging to another user. The malicious hacker should not be authorized to see it. However, if the developer made an error, the attacker would see this transaction and hence we would have an insecure direct object reference vulnerability.

NEW QUESTION # 342
Widespread fraud ac Enron. WorldCom, and Tyco led to the creation of a law that was designed to improve the accuracy and accountability of corporate disclosures. It covers accounting firms and third parties that provide financial services to some organizations and came into effect in 2002. This law is known by what acronym?

• A. HIPAA
• B. PCIDSS
• C. SOX
• D. Fed RAMP

Answer: C

Explanation:
The Sarbanes-Oxley Act of 2002 could be a law the U.S. Congress passed on July thirty of that year to assist defend investors from fallacious money coverage by companies.Also called the SOX Act of 2002 and also the company Responsibility Act of 2002, it mandated strict reforms to existing securities rules and obligatory powerful new penalties on law breakers.
The Sarbanes-Oxley law Act of 2002 came in response to money scandals within the early 2000s involving in public listed corporations like Enron Corporation, Tyco International plc, and WorldCom. The high-profile frauds cask capitalist confidence within the trustiness of company money statements Associate in Nursingd light-emitting diode several to demand an overhaul of decades-old restrictive standards.

NEW QUESTION # 343
Which type of sniffing technique is generally referred as MiTM attack?

• A. Password Sniffing
• B. ARP Poisoning
• C. DHCP Sniffing
• D. MAC Flooding

Answer: B

Explanation:
Comprehensive and Detailed Explanation:
ARP Poisoning (Address Resolution Protocol Poisoning) is a classic Man-in-the-Middle (MiTM) attack in a LAN environment. It works by sending fake ARP replies to devices on a network to associate the attacker's MAC address with the IP address of another host (typically the default gateway). As a result:
Network traffic meant for the gateway is sent to the attacker instead.
The attacker can then intercept, modify, or forward the traffic to the actual destination, performing a full MiTM.
This allows the attacker to:
Sniff sensitive data (e.g., credentials, emails)
Hijack sessions
Inject malicious payloads
From CEH v13 Courseware:
Module 8: Sniffing
Topic: MiTM Attacks # ARP Spoofing Techniques
Incorrect Options:
A). Password Sniffing is a result of MiTM but not a technique itself.
C). MAC Flooding is a switch attack that floods the CAM table to make the switch act like a hub.
D). DHCP Sniffing relates to capturing DHCP messages but is not commonly used for MiTM.
Reference:CEH v13 Study Guide - Module 8: ARP Poisoning and MiTM AttacksOWASP Network Threats - ARP Spoofing ChatGPT said:

NEW QUESTION # 344
You are the chief security officer at AlphaTech, a tech company that specializes in data storage solutions.
Your company is developing a new cloud storage platform where users can store their personal files. To ensure data security, the development team is proposing to use symmetric encryption for data at rest.
However, they are unsure of how to securely manage and distribute the symmetric keys to users. Which of the following strategies would you recommend to them?

• A. Use digital signatures to encrypt the symmetric keys.
• B. implement the Diffie-Hellman protocol for secure key exchange.
• C. Use hash functions to distribute the keys.
• D. Use HTTPS protocol for secure key transfer.

Answer: D

Explanation:
Symmetric encryption is a method of encrypting and decrypting data using the same secret key. Symmetric encryption is fast and efficient, but it requires a secure way of managing and distributing the keys to the users who need them. If the keys are compromised, the data is no longer secure.
One of the strategies to securely manage and distribute symmetric keys is to use HTTPS protocol for secure key transfer. HTTPS is a protocol that uses SSL/TLS to encrypt the communication between a client and a server over the Internet. HTTPS can protect the symmetric keys from being intercepted or modified by an attacker during the key transfer process. HTTPS can also authenticate the server and the client using certificates, ensuring that the keys are sent to and received by the intended parties.
To use HTTPS protocol for secure key transfer, the development team needs to implement the following steps1:
* Generate a symmetric key for each user who wants to store their files on the cloud storage platform.
The symmetric key will be used to encrypt and decrypt the user's files.
* Generate a certificate for the cloud storage server. The certificate will contain the server's public key and other information, such as the server's domain name, the issuer, and the validity period. The certificate will be signed by a trusted certificate authority (CA), which is a third-party entity that verifies the identity and legitimacy of the server.
* Install the certificate on the cloud storage server and configure the server to use HTTPS protocol for communication.
* When a user wants to upload or download their files, the user's client (such as a web browser or an app) will initiate a HTTPS connection with the cloud storage server. The client will verify the server's certificate and establish a secure session with the server using SSL/TLS. The client and the server will negotiate a session key, which is a temporary symmetric key that will be used to encrypt the data exchanged during the session.
* The cloud storage server will send the user's symmetric key to the user's client, encrypted with the session key. The user's client will decrypt the symmetric key with the session key and use it to encrypt or decrypt the user's files.
* The user's client will store the symmetric key securely on the user's device, such as in a password- protected file or a hardware token. The user's client will also delete the session key after the session is over.
Using HTTPS protocol for secure key transfer can ensure that the symmetric keys are protected from eavesdropping, tampering, or spoofing attacks. However, this strategy also has some challenges and limitations, such as:
* The development team needs to obtain and maintain valid certificates for the cloud storage server from a trusted CA, which might incur costs and administrative overhead.
* The users need to trust the CA that issued the certificates for the cloud storage server and verify the certificates before accepting them.
* The users need to protect their symmetric keys from being lost, stolen, or corrupted on their devices.
The development team needs to provide a mechanism for key backup, recovery, or revocation in case of such events.
* The users need to update their symmetric keys periodically to prevent key exhaustion or reuse attacks.
The development team needs to provide a mechanism for key rotation or renewal in a secure and efficient manner.
References:
* Key Management - OWASP Cheat Sheet Series
* Symmetric Cryptography & Key Management: Exhaustion, Rotation, Defence
* What is Key Management? How does Key Management work? | Encryption Consulting

NEW QUESTION # 345
A security analyst uses Zenmap to perform an ICMP timestamp ping scan to acquire information related to the current time from the target host machine.
Which of the following Zenmap options must the analyst use to perform the ICMP timestamp ping scan?

• A. -PP
• B. -PY
• C. -PU
• D. -Pn

Answer: A

Explanation:
In CEH v13 Module 03: Scanning Networks, ICMP scan types are covered under host discovery techniques in Nmap/Zenmap.
The -PP option in Nmap is used to perform an ICMP timestamp request scan.
This method sends an ICMP timestamp request and listens for a timestamp reply from the target.
It helps analysts determine the system uptime and verify whether the host is alive (for stealthy discovery).
Option Clarification:
A: -PY: SCTP INIT Ping (used for SCTP-based hosts).
B: -PU: UDP Ping (sends UDP packets).
C: -PP: ICMP Timestamp Ping - correct answer.
D: -Pn: Skips host discovery (treats all hosts as alive), not a ping type.
Reference:
Module 03 - Host Discovery Techniques
CEH Labs: Zenmap and Nmap Scanning with ICMP Ping Options
Nmap Docs: https://nmap.org/book/man-host-discovery.html

NEW QUESTION # 346
You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist's email, and you send her an email changing the source email to her boss's email (boss@company). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your malicious links (these links contain malware) and send back the modified pdf, saying that the links don't work. She reads your email, opens the links, and her machine gets infected. You now have access to the company network. What testing method did you use?

• A. Social engineering
• B. Piggybacking
• C. Tailgating
• D. Eavesdropping

Answer: A

Explanation:
Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.
Social engineering attacks typically involve some form of psychological manipulation, fooling otherwise unsuspecting users or employees into handing over confidential or sensitive data. Commonly, social engineering involves email or other communication that invokes urgency, fear, or similar emotions in the victim, leading the victim to promptly reveal sensitive information, click a malicious link, or open a malicious file. Because social engineering involves a human element, preventing these attacks can be tricky for enterprises.

NEW QUESTION # 347
Shellshock allowed an unauthorized user to gain access to a server. It affected many Internet-facing services, which OS did it not directly affect?

• A. Linux
• B. Unix
• C. OS X
• D. Windows

Answer: D

Explanation:
Shellshock (CVE-2014-6271) is a vulnerability in the GNU Bash (Bourne Again Shell) that allows remote code execution via crafted environment variables. It was disclosed in 2014 and had a wide impact on systems that relied on Bash as a command-line shell interpreter.
Affected systems include:
Linux distributions (Red Hat, Debian, CentOS, Ubuntu, etc.)
Unix variants (e.g., FreeBSD, OpenBSD, etc.)
Apple macOS (formerly OS X), since it uses Bash as the default shell
Windows systems were not directly affected because they do not use Bash by default. Bash is not a native component of Windows operating systems, and Shellshock exploits Bash-specific behavior. Only Windows systems where Bash was manually installed through a third-party method or environment (e.g., Cygwin) might be susceptible - but by default, Windows systems are immune.
Incorrect options:
A). Linux - Affected
B). Unix - Affected
C). OS X - Affected
D). Windows - Not directly affected (Correct answer)
Reference:
CEH v13 eCourseware - Module 06: System Hacking # "Common Vulnerabilities: Shellshock" CEH v13 Study Guide - Chapter: "Understanding Common Exploits and Vulnerabilities" # Section:
"Shellshock Bash Vulnerability"
Additional Reference (Public Disclosure):
NVD - CVE-2014-6271 (Shellshock) https://nvd.nist.gov/vuln/detail/CVE-2014-6271
===

NEW QUESTION # 348
Noah, a security analyst at a Seattle-based healthcare provider, is responding to a real-time data breach where attackers accessed patient records stored on a compromised server. During incident response, he must quickly secure sensitive files located on the system's primary storage to prevent further exfiltration. The data resides in a mounted partition that needs full-volume encryption, but standard file encryption isn't sufficient. Noah selects a solution that supports encrypted containers, strong key lengths like 256-bit AES, and can conceal secure volumes within standard ones to reduce detection. His goal is to ensure confidentiality while forensic operations continue without disrupting system functionality.
Which disk encryption tool should Noah deploy to meet these objectives?

• A. FileVault
• B. BitLocker Drive Encryption
• C. Rohos Disk Encryption
• D. VeraCrypt

Answer: D

Explanation:
The best match is VeraCrypt because the scenario explicitly requires three capabilities commonly associated with it in CEH cryptography and data protection coverage: encrypted containers, strong modern ciphers such as AES with 256-bit keys, and the ability to hide a protected volume inside another volume to reduce detectability. VeraCrypt is a successor to TrueCrypt and is widely referenced in ethical hacking curricula as a practical disk encryption utility that can create encrypted file containers and encrypt entire partitions or drives.
It supports multiple algorithms and combinations, including AES-256, and can mount encrypted containers as virtual drives so applications can access data normally while it remains encrypted at rest.
The key distinguishing requirement is concealment of secure storage using hidden volumes. VeraCrypt supports plausible deniability by allowing a hidden volume to exist inside an outer encrypted volume. If compelled to reveal a password, a user can disclose the outer volume password while the hidden volume remains undetectable without its separate credentials. The prompt's phrase "conceal secure volumes within standard ones" maps directly to this VeraCrypt feature and is not a standard capability of BitLocker or FileVault.
BitLocker and FileVault provide strong full-disk encryption, but they do not provide hidden volumes for plausible deniability. Rohos can create encrypted containers, but hidden-volume style plausible deniability is most strongly and commonly associated with VeraCrypt in CEH-oriented discussions. Therefore, VeraCrypt is the most appropriate tool for Noah's stated objectives.

NEW QUESTION # 349
......

Go to 312-50v13 Questions - Try 312-50v13 dumps pdf: https://www.dumpstillvalid.com/312-50v13-prep4sure-review.html

Dumps Practice Exam Questions Study Guide for the 312-50v13 Exam: https://drive.google.com/open?id=1CsKSwNQewBeoMrCGjvYm4S8H0tnYXHsD