ECCouncil 312-50v13 - Certified Ethical Hacker Exam (CEH v13 AI)

CEH v13 identifies spear-phishing as one of the most effective and targeted social engineering methods. It involves crafting highly personalized messages that reference real events, internal processes, or upcoming activities to build credibility and reduce suspicion. In this scenario, referencing board meetings—an event executive assistants frequently handle—creates a believable and urgent context for the request. CEH emphasizes that personalization significantly increases success rates because recipients perceive the sender as someone with legitimate access to internal information. A phone call impersonating IT support (Option B) is less convincing for retrieving agenda access-specific credentials. Mass phishing (Option C) lacks personalization and is easily flagged. LinkedIn social engineering (Option D) is long-term and less effective for obtaining immediate credentials. Therefore, a tailored spear-phishing email is the most effective approach.

Mobile Remote Access Trojans (RATs) are highlighted in CEH v13 Mobile Platform Hacking as one of the most dangerous threats. Once installed, a mobile RAT provides attackers persistent, covert access to devices, allowing screen capture, keystroke logging, microphone activation, and data exfiltration.

Unlike MitM or clickjacking, RATs operate post-compromise, often disguised as legitimate apps. Jailbreaking is detectable via integrity checks, but RATs can remain hidden even on non-rooted devices.

CEH v13 emphasizes that RATs bypass traditional defenses, including antivirus and MDM, making them extremely difficult to detect. Hence, Option C is correct.

The correct answer is D. tcptrace. Tcptrace is a specialized network analysis tool designed to examine and analyze packet capture (PCAP) files generated by packet-sniffing and packet-capture applications such as tcpdump, WinDump, Wireshark, and EtherPeek. It provides detailed information about TCP connections, including throughput, round-trip times, retransmissions, packet loss, connection duration, and communication statistics.

In CEH network traffic analysis and packet-sniffing topics, captured network traffic is often stored in PCAP files for later examination. Tools such as tcptrace help security professionals, penetration testers, and incident responders analyze network communications, troubleshoot performance issues, identify anomalies, and investigate security incidents.

Option A (OpenVAS) and Option B (Nessus) are vulnerability scanners used to identify security weaknesses in systems and networks. Option C (tcptraceroute) is a network path discovery tool that traces routes using TCP packets rather than ICMP packets. Neither is intended for analyzing packet-capture files.

CEH Exam Tip:

tcpdump/Wireshark = Capture network traffic.

tcptrace = Analyze captured traffic (PCAP files).

Nessus/OpenVAS = Vulnerability assessment tools.

Therefore, tcptrace is the correct tool for analyzing packet-capture files created by multiple packet-capture applications.

The correct answer is C, Bollards. Bollards are physical security controls designed to prevent vehicles from entering restricted areas or crashing into buildings, entrances, sensitive facilities, or pedestrian zones. They are commonly installed outside government buildings, data centers, banks, airports, and other critical infrastructure locations to mitigate vehicle-borne threats and unauthorized vehicle access. Depending on the security requirement, bollards may be fixed, removable, retractable, or reinforced to withstand high-impact collisions.

In CEH physical security concepts, organizations use preventive physical controls to protect personnel, equipment, and facilities from unauthorized access and physical attacks. Bollards are considered perimeter security controls because they create a physical barrier between vehicles and protected assets. A receptionist provides administrative access control but cannot physically stop a vehicle. A mantrap is an access-control vestibule used to restrict and verify personnel entry. A turnstile controls pedestrian movement and helps prevent tailgating. Since the question specifically asks about stopping vehicles from crashing through building doors, bollards are the most appropriate and effective security feature.

Answer: C

CEH v13 explains that packet fragmentation is a classic and effective IDS evasion technique. By breaking malicious payloads into smaller fragments, attackers attempt to prevent the IDS from reconstructing the full packet stream correctly, thereby avoiding signature detection.

Many IDS systems rely on packet reassembly and pattern matching. Fragmented packets can confuse or overload the reassembly process, especially if the IDS is poorly configured. CEH v13 specifically lists fragmentation, overlapping fragments, and out-of-order packets as evasion techniques used to bypass network defenses.

Option B describes malware propagation, not IDS evasion. Option C is a social engineering attack, unrelated to IDS detection. Option D is a denial-of-service attempt, not a stealth evasion method.

CEH v13 highlights that defending against fragmentation-based evasion requires proper normalization and reassembly configuration in IDS/IPS systems. Therefore, Option A is the correct answer.

CEH incident response material explains that LLMNR and NBT-NS poisoning is a common credential-harvesting technique in internal networks. These legacy name-resolution protocols operate via broadcast queries. Attackers can listen for these broadcasts and respond faster than legitimate DNS/hosts entries, impersonating the requested resource. Once the victim system attempts to authenticate, it sends NTLM hashes to the attacker-controlled machine. Tools like Responder and Inveigh automate this process, enabling attackers to collect challenge-response hashes for offline cracking. CEH highlights that this method is passive from the victim’s viewpoint and difficult to detect unless monitoring tools watch for anomalous LLMNR/NBT-NS responses. Options A, B, and D refer to other components of password cracking, but none describe the mechanism of capturing hashes via poisoned name resolution. The attacker’s technique directly aligns with exploiting the name-resolution protocol to intercept authentication attempts.

According to the CEH Network and Perimeter Security module, one of the most effective and widely used firewall evasion techniques is the use of encrypted communication channels. When traffic is encrypted using protocols such as HTTPS, TLS, or VPN tunnels, traditional firewalls and packet-inspection tools may be unable to inspect payload contents unless SSL/TLS inspection is explicitly enabled.

CEH documentation explains that attackers commonly encrypt command-and-control (C2) traffic to:

Blend in with legitimate encrypted traffic

Bypass content-based inspection

Evade signature-based detection

Option B is therefore correct.

Option A (IP spoofing) is less effective against stateful firewalls.

Option C is a human-focused attack, not firewall evasion.

Option D has no relevance to firewall bypass techniques.

CEH highlights encryption misuse as a major blind spot in perimeter defenses.

The most critical benefit in this scenario is scalability. CEH-aligned guidance on modern ethical hacking emphasizes that large, distributed enterprise environments create a fundamental operational challenge: the number of assets, configurations, cloud services, and remote endpoints is too large for purely manual assessment methods to maintain consistent coverage within acceptable timelines. The question highlights exactly this constraint by stating “highly complex and distributed” infrastructure and the “sheer scale of the environment.” An AI-driven platform that “automatically scans the entire network” and continuously flags anomalies is primarily valuable because it can expand assessment coverage across many systems simultaneously, helping the red team evaluate more of the attack surface efficiently.

While predictive analysis is a real AI capability, the scenario’s success requirement is not forecasting future attacks; it is executing assessment activities at enterprise scale and keeping pace as conditions change. Simulation and testing is what red teams do regardless of AI, but AI’s differentiator here is the ability to perform continuous, large-scale discovery and prioritization across cloud, servers, and endpoints without proportional increases in human effort. Enhanced reporting helps communicate results, but it is not the primary operational limiter described.

Additionally, the prompt mentions adapting detection models as new behaviors appear. That supports continuous operation, but the deciding factor is still the ability to operate across a massive environment and maintain broad visibility. Therefore, scalability is the key benefit most critical to success in this scenario.

The correct answer is A, No flags set. In CEH scanning concepts, a NULL scan is a TCP port-scanning technique in which the scanner sends a TCP segment with none of the TCP flags enabled. This means the packet does not contain SYN, ACK, FIN, RST, PSH, or URG flags. The uploaded CEH material states that when no TCP flag is set, the scan is known as Null Scanning, and further describes a NULL scan as sending a packet “without any flag set.” This differs from a SYN scan, which sends SYN packets to begin a half-open connection, and from an ACK scan, which sends packets with the ACK flag set to help identify filtering behavior. RST is not what a NULL scan sends; rather, a closed port may respond with RST. For exam purposes, remember: NULL scan equals empty TCP flag field, so the best answer is No flags set.

The correct answer is A. Administrative safeguards because risk assessment is a fundamental component of an organization ' s security management process and is closely associated with identifying, evaluating, and managing risks through administrative, technical, and physical controls. Administrative safeguards include security policies, procedures, risk management processes, security awareness training, personnel security, incident response planning, and governance mechanisms. These safeguards help organizations identify threats, assess vulnerabilities, determine risk levels, and implement appropriate controls to reduce risk to an acceptable level.

In CEH information security concepts, risk assessment is used to determine the likelihood and impact of threats against organizational assets. Administrative safeguards are a key part of this process because they define how security is managed and enforced throughout the organization. Physical security is a security control category rather than a risk assessment component itself, while a DMZ is a network architecture element used to isolate public-facing systems. A logical interface refers to a technical system component and is not part of the risk assessment framework. Therefore, Administrative safeguards represent the best answer because they directly support risk identification, evaluation, and management activities within an organization ' s overall security program.

According to the CEH IDS/IPS module, false positives occur when legitimate activity is incorrectly flagged as malicious. The most common cause is overly sensitive IDS rules or thresholds.

Option D correctly identifies this issue.

Option A describes the symptom, not the root cause.

Option B is unrelated to IDS alert behavior.

Option C can cause missed detections, not excessive alerts.

CEH recommends proper tuning and baseline profiling.

The correct answer is Modifying spacing and delimiter placement to disrupt detection patterns. CEH web application hacking material explains that pattern-based inspection controls, including weak input filters and some signature-driven defenses, often rely on recognizable textual structure in malicious payloads. If detection depends on static pattern matching, an attacker may preserve the same logical database operation while changing whitespace, separators, delimiter placement, or token formatting so the payload no longer matches the expected signature. That is exactly what the question describes: blocked requests shared a consistent textual arrangement, and the tester changed the presentation of those components without changing the intended SQL effect. Alternate encoding and dynamic construction are also known evasion ideas, but the scenario specifically emphasizes changed arrangement rather than transformed character sets or runtime string building. Inline comments can fragment keywords, yet the broader and best-fitting CEH answer is modification of spacing and delimiters to break the detection pattern. CEH materials stress that filters focused only on signature appearance are fragile because slight formatting variation can bypass them while leaving the attack semantics intact. Therefore, option C is the most accurate evasion method.

The CEH web server attack methodology describes reconnaissance as a key phase, where testers gather publicly available information before attempting exploitation. Robots.txt is commonly used by administrators to instruct web crawlers about which directories should not be indexed. CEH emphasizes that attackers regularly review robots.txt because it often exposes sensitive directories unintentionally, providing valuable intelligence about internal structure, configuration paths, administrative pages, and potential weak points. In this scenario, the tester observes “Disallow” entries and then discovers the directories are not protected by authentication, allowing direct access to sensitive files. This falls under information gathering through exposed indexing instructions rather than directory traversal, which involves path-manipulation exploits. The tester is not altering file paths or inserting traversal sequences; instead, they are reviewing publicly available indexing instructions and discovering misconfigured access controls. This perfectly aligns with the reconnaissance phase of the CEH methodology, where attackers learn about server architecture using passive or minimally intrusive techniques.

This scenario demonstrates tailgating, which is gaining unauthorized physical access to a secure area by following an authorized person through an access-controlled entry point. Priya does not present credentials, swipe a badge, or otherwise authenticate; instead, she leverages normal human behavior and social assumptions during a busy shift change. Because employees assume she belongs there and do not challenge her, she successfully bypasses the physical access control.

Tailgating is common in workplaces with high traffic, open-plan culture, or weak enforcement of “no badge, no entry” rules. Attackers may exploit politeness, distraction, or the desire to hold doors open. It is especially effective during shift changes, deliveries, or when people are carrying items and appreciate someone holding the door. The security weakness being tested here is not the badge technology itself but the human factor: lack of challenge culture and inconsistent adherence to access policies.

Tailgating versus piggybacking: in many security references, piggybacking implies the authorized person knowingly allows the other to enter (e.g., holds the door intentionally after being asked). Tailgating typically implies the intruder enters without explicit permission, often by slipping in behind a group. In this scenario, no one confronts her and they “assume she belongs there,” indicating she is following them in without asking or being granted explicit permission—tailgating.

The other options are unrelated: shoulder surfing is visual observation of sensitive input; dumpster diving is retrieving information from trash. Therefore, the correct answer is C. Tailgating.