Jun-2026 Get Totally Free Updates on 312-50v13 Dumps PDF Questions
Prepare With Top Rated High-quality 312-50v13 Dumps For Success in 312-50v13 Exam
NEW QUESTION # 109
You work for Acme Corporation as Sales Manager. The company has tight network security restrictions. You are trying to steal data from the company's Sales database (Sales.xls) and transfer them to your home computer. Your company filters and monitors traffic that leaves from the internal network to the Internet.
How will you achieve this without raising suspicion?
- A. Change the extension of Sales.xls to sales.txt and upload them as attachment to your Hotmail account
- B. Encrypt the Sales.xls using PGP and e-mail it to your personal gmail account
- C. You can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent-looking email or file transfer using Steganography techniques
- D. Package the Sales.xls using Trojan wrappers and telnet them back to your home computer
Answer: C
Explanation:
Comprehensive and Detailed Explanation:
Steganography allows someone to hide data (like a spreadsheet or document) within another innocuous- looking file (like an image, video, or audio). This disguises the presence of the data entirely, allowing it to bypass standard data loss prevention (DLP) systems and firewalls, which look for file types and suspicious patterns.
From CEH v13 Courseware:
* Module 6: Malware Threats # Steganography and Covert Channels
Reference:CEH v13 Study Guide - Module 6: Data Hiding Techniques Using SteganographyNIST SP 800-83
- Guide to Malware Handling and Prevention
NEW QUESTION # 110
An Internet Service Provider (ISP) has a need to authenticate users connecting via analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Frame Relay network.
Which AAA protocol is the most likely able to handle this requirement?
- A. DIAMETER
- B. TACACS+
- C. Kerberos
- D. RADIUS
Answer: D
Explanation:
https://en.wikipedia.org/wiki/RADIUS
Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service.
RADIUS is a client/server protocol that runs in the application layer, and can use either TCP or UDP.
Network access servers, which control access to a network, usually contain a RADIUS client component that communicates with the RADIUS server. RADIUS is often the back-end of choice for 802.1X authentication.
A RADIUS server is usually a background process running on UNIX or Microsoft Windows.
Authentication and authorization
The user or machine sends a request to a Network Access Server (NAS) to gain access to a particular network resource using access credentials. The credentials are passed to the NAS device via the link-layer protocol- for example, Point-to-Point Protocol (PPP) in the case of many dialup or DSL providers or posted in an HTTPS secure web form.
In turn, the NAS sends a RADIUS Access Request message to the RADIUS server, requesting authorization to grant access via the RADIUS protocol.
This request includes access credentials, typically in the form of username and password or security certificate provided by the user. Additionally, the request may contain other information which the NAS knows about the user, such as its network address or phone number, and information regarding the user's physical point of attachment to the NAS.
The RADIUS server checks that the information is correct using authentication schemes such as PAP, CHAP or EAP. The user's proof of identification is verified, along with, optionally, other information related to the request, such as the user's network address or phone number, account status, and specific network service access privileges. Historically, RADIUS servers checked the user's information against a locally stored flat- file database. Modern RADIUS servers can do this or can refer to external sources-commonly SQL, Kerberos, LDAP, or Active Directory servers-to verify the user's credentials.
The RADIUS server then returns one of three responses to the NAS:
1) Access-Reject,
2) Access-Challenge,
3) Access-Accept.
Access-Reject
The user is unconditionally denied access to all requested network resources. Reasons may include failure to provide proof of identification or an unknown or inactive user account.
Access-Challenge
Requests additional information from the user such as a secondary password, PIN, token, or card. Access- Challenge is also used in more complex authentication dialogs where a secure tunnel is established between the user machine and the Radius Server in a way that the access credentials are hidden from the NAS.
Access-Accept
The user is granted access. Once the user is authenticated, the RADIUS server will often check that the user is authorized to use the network service requested. A given user may be allowed to use a company's wireless network, but not its VPN service, for example. Again, this information may be stored locally on the RADIUS server or may be looked up in an external source such as LDAP or Active Directory.
NEW QUESTION # 111
A CEH has mirrored a website, identified session hijacking risk, and wants to minimize detection. What is the most appropriate next step?
- A. Hijack a session and modify server configuration
- B. Launch brute-force attacks
- C. Attempt SQL Injection
- D. Perform automated vulnerability scanning
Answer: A
Explanation:
According to CEH v13 System Hacking and Web Application Hacking, once reconnaissance and footprinting are complete, attackers typically move into controlled exploitation while maintaining stealth.
Since the CEH has already identified a session hijacking vulnerability, leveraging that weakness is the most logical and stealthy progression.
Session hijacking allows attackers to impersonate legitimate users without triggering authentication alerts, making it significantly less detectable than brute-force or scanning activities. Option B aligns with CEH methodology: hijacking a valid session provides authorized-level access, which can then be abused to make configuration changes discreetly.
SQL injection (Option A) may trigger database errors and IDS alerts. Brute-force attacks (Option C) are noisy and easily logged. Automated vulnerability scanning (Option D) generates excessive traffic and is typically avoided once exploitation begins.
CEH v13 emphasizes using already-identified weaknesses and minimizing footprint during exploitation.
Therefore, Option B is correct.
NEW QUESTION # 112
You are analyzing traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs - 192.168.8.0/24. What command would you use?
- A. sudo tshark -f "net 192.168.8.0/24"
- B. wireshark --fetch '192.168.8*'
- C. tshark -net 192.255.255.255 mask 192.168.8.0
- D. wireshark --capture --local masked 192.168.8.0 ---range 24
Answer: A
Explanation:
Comprehensive and Detailed Explanation:
Tshark is the command-line version of Wireshark. The correct syntax for filtering packets from a subnet:
sudo tshark -f "net 192.168.8.0/24"
This captures only the traffic from that IP range. It's ideal for cron jobs and automated monitoring.
From CEH v13 Courseware:
* Module 8: Sniffing # Tshark and Wireshark Usage
Reference:Wireshark Docs - Tshark Capture Filters
NEW QUESTION # 113
You are instructed to perform a TCP NULL scan. In the context of TCP NULL scanning, which response indicates that a port on the target system is closed?
- A. ICMP error message
- B. TCP RST packet
- C. No response
- D. TCP SYN/ACK packet
Answer: B
Explanation:
TCP NULL scanning is a stealth scanning technique covered in CEH v13 Reconnaissance and Network Scanning. In a NULL scan, all TCP flags are set to zero. According to RFC 793 and CEH documentation, closed ports must respond with a TCP RST (Reset) packet.
If the port is open, the target typically does not respond, making this technique useful for firewall evasion.
Therefore:
* RST response = Closed port
* No response = Open or filtered port
Other options do not apply to NULL scans:
* SYN/ACK is associated with SYN scans.
* ICMP errors may indicate filtering, not port state.
NEW QUESTION # 114
Shellshock allowed an unauthorized user to gain access to a server. It affected many Internet-facing services, which OS did it not directly affect?
- A. OS X
- B. Linux
- C. Unix
- D. Windows
Answer: D
Explanation:
Shellshock (CVE-2014-6271) is a vulnerability in the GNU Bash (Bourne Again Shell) that allows remote code execution via crafted environment variables. It was disclosed in 2014 and had a wide impact on systems that relied on Bash as a command-line shell interpreter.
Affected systems include:
Linux distributions (Red Hat, Debian, CentOS, Ubuntu, etc.)
Unix variants (e.g., FreeBSD, OpenBSD, etc.)
Apple macOS (formerly OS X), since it uses Bash as the default shell
Windows systems were not directly affected because they do not use Bash by default. Bash is not a native component of Windows operating systems, and Shellshock exploits Bash-specific behavior. Only Windows systems where Bash was manually installed through a third-party method or environment (e.g., Cygwin) might be susceptible - but by default, Windows systems are immune.
Incorrect options:
A). Linux - Affected
B). Unix - Affected
C). OS X - Affected
D). Windows - Not directly affected (Correct answer)
Reference:
CEH v13 eCourseware - Module 06: System Hacking # "Common Vulnerabilities: Shellshock" CEH v13 Study Guide - Chapter: "Understanding Common Exploits and Vulnerabilities" # Section:
"Shellshock Bash Vulnerability"
Additional Reference (Public Disclosure):
NVD - CVE-2014-6271 (Shellshock) https://nvd.nist.gov/vuln/detail/CVE-2014-6271
NEW QUESTION # 115
Which of the following is a low-tech way of gaining unauthorized access to systems?
- A. Scanning
- B. Social Engineering
- C. Sniffing
- D. Eavesdropping
Answer: B
Explanation:
Social engineering is a non-technical attack that manipulates human behavior to gain access to systems or data. It often involves deception (e.g., phishing, pretexting, baiting) and requires no technical expertise or tools, making it a low-tech yet highly effective method.
Reference - CEH v13 Official Study Guide:
Module 9: Social Engineering
Quote:
"Social engineering exploits human psychology and trust to gain unauthorized access. It is considered a low- tech method because it does not require technical means." Incorrect Options Explained:
B: Eavesdropping may require technical tools to intercept data.
C: Scanning involves active use of tools to find vulnerabilities.
D: Sniffing is technical and requires tools to capture network traffic.
NEW QUESTION # 116
Attacker Rony Installed a rogue access point within an organization's perimeter and attempted to Intrude into its internal network. Johnson, a security auditor, identified some unusual traffic in the internal network that is aimed at cracking the authentication mechanism. He immediately turned off the targeted network and tested for any weak and outdated security mechanisms that are open to attack. What is the type of vulnerability assessment performed by Johnson in the above scenario?
- A. Host-based assessment
- B. Application assessment
- C. Wireless network assessment
- D. Distributed assessment
Answer: C
Explanation:
Wireless network assessment determines the vulnerabilities in an organization's wireless networks. In the past, wireless networks used weak and defective data encryption mechanisms. Now, wireless network standards have evolved, but many networks still use weak and outdated security mechanisms and are open to attack. Wireless network assessments try to attack wireless authentication mechanisms and gain unauthorized access. This type of assessment tests wireless networks and identifies rogue networks that may exist within an organization's perimeter. These assessments audit client-specified sites with a wireless network. They sniff wireless network traffic and try to crack encryption keys. Auditors test other network access if they gain access to the wireless network.
Expanding your network capabilities are often done well using wireless networks, but it also can be a source of harm to your data system . Deficiencies in its implementations or configurations can allow tip to be accessed in an unauthorized manner.This makes it imperative to closely monitor your wireless network while also conducting periodic Wireless Network assessment.It identifies flaws and provides an unadulterated view of exactly how vulnerable your systems are to malicious and unauthorized accesses.Identifying misconfigurations and inconsistencies in wireless implementations and rogue access points can improve your security posture and achieve compliance with regulatory frameworks.
NEW QUESTION # 117
A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer's software and hardware without the owner's permission. Their intention can either be to simply gain knowledge or to illegally make changes.
Which of the following class of hacker refers to an individual who works both offensively and defensively at various times?
- A. Gray Hat
- B. White Hat
- C. Black Hat
- D. Suicide Hacker
Answer: A
NEW QUESTION # 118
in an attempt to increase the security of your network, you Implement a solution that will help keep your wireless network undiscoverable and accessible only to those that know It. How do you accomplish this?
- A. Disable SSID broadcasting
- B. Lock all users
- C. Delete the wireless network
- D. Remove all passwords
Answer: A
Explanation:
The SSID (service set identifier) is the name of your wireless network. SSID broadcast is how your router transmits this name to surrounding devices. Its primary function is to make your network visible and easily accessible. Most routers broadcast their SSIDs automatically. To disable or enable SSID broadcast, you need to change your router's settings.
Disabling SSID broadcast will make your Wi-FI network name invisible to other users. However, this only hides the name, not the network itself. You cannot disguise the router's activity, so hackers can still attack it.
With your network invisible to wireless devices, connecting becomes a bit more complicated. Just giving a Wi-FI password to your guests is no longer enough. They have to configure their settings manually by including the network name, security mode, and other relevant info.
Disabling SSID might be a small step towards online security, but by no means should it be your final one.
Before considering it as a security measure, consider the following aspects:
- Disabling SSID broadcast will not hide your network completely
Disabling SSID broadcast only hides the network name, not the fact that it exists. Your router constantly transmits so-called beacon frames to announce the presence of a wireless network. They contain essential information about the network and help the device connect.
- Third-party software can easily trace a hidden network
Programs such as NetStumbler or Kismet can easily locate hidden networks. You can try using them yourself to see how easy it is to find available networks - hidden or not.
- You might attract unwanted attention.
Disabling your SSID broadcast could also raise suspicion. Most of us assume that when somebody hides something, they have a reason to do so. Thus, some hackers might be attracted to your network.
NEW QUESTION # 119
What two conditions must a digital signature meet?
- A. Has to be legible and neat.
- B. Must be unique and have special characters.
- C. Has to be the same number of characters as a physical signature and must be unique.
- D. Has to be unforgeable, and has to be authentic.
Answer: D
NEW QUESTION # 120
An attacker identified that a user and an access point are both compatible with WPA2 and WPA3 encryption.
The attacker installed a rogue access point with only WPA2 compatibility in the vicinity and forced the victim to go through the WPA2 four-way handshake to get connected. After the connection was established, the attacker used automated tools to crack WPA2-encrypted messages. What is the attack performed in the above scenario?
- A. Side-channel attack
- B. Downgrade security attack
- C. Timing-based attack
- D. Cache-based attack
Answer: B
NEW QUESTION # 121
Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?
- A. Produces less false positives
- B. Cannot deal with encrypted network traffic
- C. Can identify unknown attacks
- D. Requires vendor updates for a new threat
Answer: C
Explanation:
An anomaly-based intrusion detection system is an intrusion detection system for detecting both network and computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on heuristics or rules, rather than patterns or signatures, and attempts to detect any type of misuse that falls out of normal system operation. This is as opposed to signature-based systems, which can only detect attacks for which a signature has previously been created.
In order to positively identify attack traffic, the system must be taught to recognize normal system activity.
The two phases of a majority of anomaly detection systems consist of the training phase (where a profile of normal behaviors is built) and the testing phase (where current traffic is compared with the profile created in the training phase). Anomalies are detected in several ways, most often with artificial intelligence type techniques. Systems using artificial neural networks have been used to great effect. Another method is to define what normal usage of the system comprises using a strict mathematical model, and flag any deviation from this as an attack. This is known as strict anomaly detection.[3] Other techniques used to detect anomalies include data mining methods, grammar-based methods, and the Artificial Immune System.
Network-based anomalous intrusion detection systems often provide a second line of defense to detect anomalous traffic at the physical and network layers after it has passed through a firewall or other security appliance on the border of a network. Host-based anomalous intrusion detection systems are one of the last layers of defense and reside on computer endpoints. They allow for fine-tuned, granular protection of endpoints at the application level.
Anomaly-based Intrusion Detection at both the network and host levels have a few shortcomings; namely a high false-positive rate and the ability to be fooled by a correctly delivered attack. Attempts have been made to address these issues through techniques used by PAYL and MCPAD.
NEW QUESTION # 122
Which of the following steps for risk assessment methodology refers to vulnerability identification?
- A. Assigns values to risk probabilities; Impact values.
- B. Determines risk probability that vulnerability will be exploited (High. Medium, Low)
- C. Determines if any flaws exist in systems, policies, or procedures
- D. Identifies sources of harm to an IT system. (Natural, Human. Environmental)
Answer: B
NEW QUESTION # 123
A security analyst is tasked with gathering detailed information about an organization's network infrastructure without making any direct contact that could be logged or trigger alarms. Which method should the analyst use to obtain this information covertly?
- A. Use network mapping tools to scan the organization's IP range
- B. Perform a DNS brute-force attack to discover subdomains
- C. Examine leaked documents or data dumps related to the organization
- D. Initiate social engineering attacks to elicit information from employees
Answer: C
Explanation:
Passive reconnaissance focuses on collecting intelligence without interacting with the target's systems. CEH materials emphasize reviewing publicly available information, including leaked documents, breach data, reports, or exposed metadata, as this yields internal network structure details while generating no detectable traffic. This method avoids triggering monitoring systems and aligns with stealth requirements for covert intelligence gathering.
NEW QUESTION # 124
During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.
What is this type of DNS configuration commonly called?
- A. DNS Scheme
- B. DNSSEC
- C. Split DNS
- D. DynDNS
Answer: C
NEW QUESTION # 125
......
Get 100% Success with Latest CEH v13 312-50v13 Exam Dumps: https://www.vcetorrent.com/312-50v13-valid-vce-torrent.html
312-50v13 Free Certification Exam Easy to Download PDF Format 2026: https://drive.google.com/open?id=1NUZ2K11JwUy3bs35DSA-t3vAp4AdxSPg