ECCouncil 312-50v13 - Certified Ethical Hacker Exam (CEHv13)

The correct answer is D. WSDL Probing Attacks.

The scenario describes retrieving and analyzing service description files to identify web service operations, methods, parameters, and response schemas. That directly matches WSDL probing. WSDL, or Web Services Description Language, describes the functions exposed by a web service, including supported operations and message structures.

CEH-aligned cloud and web service material identifies WSDL, SOAP, and UDDI as web service-related information that attackers may capture or analyze during service hijacking and reconnaissance activities . CEH-aligned web application material also explains that SOAP is used to exchange structured information in web services, and that malicious interaction with SOAP/web service structures can expose backend functionality .

Option A. SOAP Injection is incorrect because the tester is not injecting malicious SOAP payloads.

Option B. Application Logic Attacks is too broad and would involve abusing business logic, not specifically reviewing service descriptions.

Option C. XML Injection is incorrect because the scenario does not involve injecting malicious XML content.

Option D. WSDL Probing Attacks is correct because the tester is probing service description files to understand exposed web service capabilities.

Therefore, the best answer is D. WSDL Probing Attacks.

The correct answer is B. hashdump because the output described—“a long list of alphanumeric strings representing LM and NTLM values”—matches the Windows password hash formats typically extracted from the local Security Account Manager (SAM) database (with supporting data from the SYSTEM hive). In CEH-aligned post-exploitation and credential access concepts, attackers frequently target LM/NTLM hashes rather than plaintext passwords. Hashes can be taken offline for password recovery attempts (e.g., dictionary/brute-force and rule-based cracking), which aligns with the scenario where the values are transferred to a cracking rig.

Within a Meterpreter context, hashdump is the command commonly associated with dumping local account password hashes from a compromised Windows host. The hashes are useful for simulating credential compromise across an environment because recovered passwords may be reused on other systems, and even without recovery, hashes can sometimes be leveraged in authentication abuse scenarios depending on controls in place.

Why the other options are incorrect:

keyscan_start initiates keystroke logging in Meterpreter; it would not output LM/NTLM hash strings.

getsystem attempts privilege escalation to SYSTEM-level (or equivalent). While higher privileges may be required before successfully dumping hashes, getsystem itself does not produce a list of hashes; it changes/attempts to change the privilege context.

screenshot captures the user’s screen and has no relationship to credential hash extraction.

The “post-exploitation phase” detail is important: credential dumping is a classic activity after gaining a foothold, used to expand access (pivoting/lateral movement) and assess the impact of poor password hygiene. From a defensive perspective, this highlights the need for least privilege, credential protection controls, restricted local admin, strong password policies, and monitoring for suspicious credential-access behaviors.

This scenario is a textbook example of a Whaling Attack, a highly targeted phishing technique described in the CEH v13 Social Engineering module. Whaling specifically targets senior executives or high-ranking individuals, exploiting their authority, access privileges, and decision-making roles.

In the given case, the attacker crafts a personalized email, impersonates the CEO, and uses legitimate corporate branding to build trust. The malicious PDF attachment delivers a backdoor, aligning with CEH v13 descriptions of advanced spear-phishing techniques used against executives.

CEH v13 differentiates whaling from other phishing types:

Broad phishing targets large groups indiscriminately.

Pharming redirects users via DNS manipulation.

Email clone attacks copy legitimate emails but typically target peers, not executives.

Whaling attacks are particularly dangerous because executives often bypass security scrutiny and possess elevated system access. CEH v13 emphasizes executive awareness training as a key mitigation strategy.

Therefore, the correct answer is Whaling attack aimed at high-ranking personnel.

The Certified Ethical Hacker (CEH) Cloud Computing and Data Protection module emphasizes the importance of resilient backup strategies to protect against data tampering, ransomware, and unauthorized modification.

The 3-2-1 backup model is a widely recommended best practice referenced in CEH materials. It requires maintaining:

3 copies of data

Stored on 2 different media types

With 1 copy stored offsite

This approach ensures that even if cloud backups are compromised or altered, clean and uncompromised versions remain available. CEH documentation highlights this model as a core defense against data integrity attacks in cloud environments.

Option D directly mitigates the risk of backup tampering.

Options A, B, and C address unrelated security concerns and do not protect backup integrity.

In the CEH SQL injection methodology, the initial stages focus on understanding where and how user-controlled input enters the application and reaches backend components such as database queries. The activity described is reconnaissance and mapping of input vectors: Rachel is observing the shipment search function, watching HTTP GET parameters, and determining whether those parameters are processed in a way that could influence SQL logic. This directly corresponds to the phase commonly described as identifying data entry paths, where the tester locates all possible points of injection such as URL query strings, form fields, cookies, HTTP headers, and API parameters.

At this stage, the ethical hacker is not yet executing payloads to exploit the database. Instead, they are profiling the request structure, parameter names, values, and server responses to understand how the application behaves when supplied with different inputs. CEH guidance emphasizes that effective SQL injection testing begins by enumerating input sources and determining which of them appear to be reflected in server-side operations. Monitoring HTTP GET requests is a typical technique because query string parameters often map to backend search queries, filters, or record lookups, making them frequent injection candidates if server-side validation and query construction are weak.

The other options occur later. Launching SQL injection attacks involves actively injecting test characters and payloads to confirm injection. Database enumeration happens after a vulnerability is confirmed, to extract schema information and data. Advanced SQL injection refers to more specialized techniques such as out-of-band, time-based blind, or WAF evasion. Since the task here is identifying and assessing potential injection points, the correct step is identifying data entry paths.

The scenario points directly to information gathering from the robots.txt file. A robots.txt file is typically located at the root of a website (e.g., https://example.com/robots.txt) and is intended to instruct search engine crawlers which paths should or should not be indexed. During web reconnaissance, testers often review robots.txt because it can unintentionally disclose sensitive directories, administrative panels, staging paths, backup locations, or restricted areas that the organization hoped would remain obscure. The scenario explicitly says Sofia found “a crawler directive at the server’s root” that “allows unintended indexing of restricted areas,” and that this “reveals internal paths.” That is exactly the kind of leakage that can come from misconfigured or overly revealing crawler directives.

This is considered an early-stage reconnaissance / information gathering technique because it does not require exploitation. It leverages publicly accessible configuration hints to map the application’s hidden structure. Even when robots.txt is used correctly, the listed disallowed entries can still serve as a roadmap of interesting targets; if configured incorrectly (for example, allowing indexing or exposing sensitive paths), it can increase exposure by helping those paths surface in search results or be discovered faster by attackers.

Why the other options are less accurate:

Vulnerability Scanning (A) implies using scanners to identify known flaws; here, the tester is manually/strategically inspecting a crawler directive for exposed paths.

Web Server Footprinting/Banner Grabbing (C) focuses on identifying server type/version and technologies via headers or responses, not discovering hidden paths from crawler directives.

Directory Brute Forcing (D) uses wordlists to guess directories; Sofia’s discovery comes from a disclosed list of paths, not brute-force guessing.

Therefore, the technique is B. Information Gathering from robots.txt File.

Wireshark is the primary packet-sniffing tool covered in CEH v13 Network Sniffing. It captures and analyzes live traffic, allowing analysts to view plaintext HTTP packets.

Nessus is a vulnerability scanner, Nmap is for scanning, Netcat is a networking utility. None provide protocol-level inspection like Wireshark.

Thus, Option D is correct.

This scenario most clearly illustrates shoulder surfing, a social engineering technique where an attacker obtains sensitive information by observing a victim’s screen, keystrokes, or written notes—often from a nearby position—without directly interacting with the victim or their device. The key indicators are that the tester is “discreetly watching their screens and hand movements” during login and is able to capture “usernames and partial passwords” without touching anything. That is the defining pattern of shoulder surfing: passive observation to harvest credentials or other confidential information.

Shoulder surfing is particularly effective in open-plan offices, shared workspaces, airports, cafés, or any environment where people can be observed entering credentials. Attackers may watch directly, use reflections (e.g., glass surfaces), or position themselves to see the keyboard and screen. Even partial password capture can be valuable when combined with other information (usernames, password patterns, reset questions, or subsequent observation), and it can help an attacker craft more convincing follow-on social engineering attempts.

Why the other options do not fit:

Dumpster diving (B) involves retrieving sensitive information from trash (printed documents, media, badges, notes), not observing logins in real time.

Impersonation (C) requires actively posing as a trusted person (IT staff, vendor, employee) to persuade someone to disclose information or grant access; the scenario explicitly avoids interaction with staff.

Tailgating (D) is physically following someone through a secure door to gain unauthorized entry; it’s about bypassing physical access controls rather than capturing credentials.

Because the technique relies on visual observation of screens and keystrokes to obtain login details, the correct answer is A. Shoulder Surfing.

According to the Certified Ethical Hacker (CEH) IoT, OT, and SCADA Security module, side-channel attacks exploit indirect information leaks such as power consumption, electromagnetic emissions, timing variations, or thermal output rather than software vulnerabilities.

Option A is correct because monitoring hardware-level anomalies is the primary method for detecting side-channel exploitation. CEH materials emphasize that these attacks bypass traditional security controls.

Option B relates to cryptographic weaknesses, not side-channel analysis.

Option C addresses interface misuse, not covert data leakage.

CEH highlights that SCADA systems are especially vulnerable due to legacy hardware and limited monitoring capabilities.

The correct answer is DNS interrogation. CEH reconnaissance guidance explains that active footprinting involves direct interaction with the target environment, which can generate logs or alerts. DNS interrogation is an active technique used to query name servers for information about domain structure, hostnames, mail servers, subdomains, and other records that reveal how public-facing systems are logically arranged. The question specifically says Justin is retrieving structural details about the organization’s public-facing systems and that his activity is logged by the target, which is consistent with active DNS queries. Network or port scanning is also active, but it focuses on discovering open ports and reachable services rather than the logical naming and organizational structure of public systems. Social engineering is human-focused, and user and service enumeration typically aims at accounts or system services rather than domain structure. CEH materials repeatedly emphasize DNS as a rich reconnaissance source because records such as A, MX, NS, TXT, and SOA can reveal infrastructure relationships and naming conventions. Since the goal is to understand how the organization’s internet-facing systems are organized and represented, DNS interrogation is the best fit.

The correct answer is B because the scenario describes an unknown vulnerability in a well-known application and an exploit created to leverage it. In CEH terminology, a zero-day vulnerability/exploit exists when a flaw is not yet publicly known or no patch/fix has been developed; such vulnerabilities are especially dangerous because affected systems remain exposed until a patch or compensating control is available. The guide also defines an exploit as a method of taking advantage of a vulnerability, possibly enabling unauthorized access. Clark is not correctly classified as a white hat hacker because ethical hacking requires defensive intent and prior authorization; white hats use skills for defensive purposes, while ethical hacking is performed with legal/written permission and reporting of findings. He is also not best described as a suicide hacker, because that term refers to attackers who aim to bring down critical infrastructure without concern for punishment. The most precise CEH answer is therefore that Clark developed a zero-day exploit.

The correct answer is D. Expansion because the scenario emphasizes that, after the initial foothold, the attacker harvests credentials and moves laterally to compromise additional systems—routers, printers, and file servers—thereby broadening control across the internal environment. In CEH-aligned APT lifecycle descriptions, this stage is commonly associated with internal reconnaissance, privilege/credential access, lateral movement, and widening the foothold to increase resilience and reach. The attacker is no longer limited to the original compromised endpoint; instead, they are deliberately spreading to other networked assets to build operational advantage.

The sequence in the prompt is important. Initial Intrusion (A) already occurred via spear-phishing delivering the first payload to the manager’s laptop. The question asks what phase is being simulated at this point, after access is gained and the attacker is actively moving through the network. Persistence (B) refers to establishing mechanisms to maintain access (e.g., backdoors, scheduled tasks, services, persistence in credentials/accounts) so the attacker can survive reboots, password changes, or cleanup attempts. While an attacker might establish persistence during expansion, the defining action here is lateral movement and compromise of multiple internal systems, which is more directly expansion than persistence.

Search & Exfiltration (C) would involve identifying and collecting target data (in this case, sensitive research data) and transferring it out of the environment. The prompt explicitly states Alex has not yet targeted sensitive research data, which rules out the search/exfiltration phase as the primary activity being simulated right now.

Therefore, the phase of the APT lifecycle best matching credential harvesting followed by lateral movement and compromise of multiple internal devices/servers to build a broader foothold is Expansion.

According to CEH v13 Web Application and Server Security, regular patching and updates are the most effective way to reduce server attack surfaces. Vulnerabilities in web servers, proxies, and supporting services are frequently exploited if patches are delayed.

While architectural choices and directory placement influence organization, they do not mitigate known vulnerabilities. Changing IP addresses does not prevent exploitation, and moving directories does not address underlying software flaws.

CEH v13 consistently emphasizes patch management as a primary defensive control. Therefore, Option C is correct.

In the Aircrack-ng suite referenced throughout CEH wireless hacking coverage, Aireplay-ng is the tool used to inject frames into a wireless network. The key phrase in the question is “transmit packets that force client devices to disconnect and reconnect.” That describes a deauthentication attack, where the tester sends 802.11 deauth frames to a client or to the access point, causing the client to drop its association and then reconnect. When a WPA2 client reconnects, the WPA2 four-way handshake is performed again. By forcing this reconnection, an ethical hacker can capture the handshake and later attempt password recovery in an offline process.

Airodump-ng is primarily a passive capture and monitoring tool used to list access points and clients, hop channels, and capture packets and handshakes, but it does not perform packet injection itself. Aircrack-ng is the cracking component that attempts to recover the WPA/WPA2 pre-shared key from a captured handshake using a wordlist or other offline techniques; it is not the tool that kicks clients off the network. Airbase-ng is used for creating a rogue access point or conducting evil twin style attacks, which is different from transmitting deauthentication frames to trigger a handshake.

Therefore, the tool that matches the described action of actively sending frames to force disconnect and reconnect is Aireplay-ng.