ECCouncil 312-50v13 - Certified Ethical Hacker Exam (CEH v13 AI)

The correct choice is D because the question is specifically about disrupting ICMP-based discovery by preventing error messages from being returned. In ICMP reconnaissance, attackers often rely not only on ICMP Echo (ping) but also on ICMP error messages to infer host availability, filtering behavior, and port reachability. A key ICMP error category is ICMP Type 3: Destination Unreachable, which includes several codes (for example, “port unreachable” and “communication administratively prohibited”) that can reveal whether a host exists, whether a firewall is filtering traffic, and whether specific ports are reachable or blocked. When these ICMP Type 3 messages are allowed to leave the network, they provide valuable feedback that helps attackers map the environment accurately.

By blocking inbound ICMP message types (to reduce direct ICMP probing) and blocking outbound ICMP Type 3 unreachable messages, the organization reduces the “informational signals” that external scanners can use to distinguish between live hosts, filtered hosts, and closed ports. This directly aligns with the requirement in the prompt: stopping ICMP discovery by preventing error messages from being returned.

Why the other choices are less precise:

A and C focus on general hardening (port/service reduction), which is good practice but does not directly address ICMP error-message feedback.

B (firewall/IDS detection) is helpful, but the prompt asks for an action that specifically disrupts ICMP discovery traffic by suppressing error responses, which is more directly achieved via ICMP filtering rules.

Operational note: while blocking ICMP Type 3 can reduce reconnaissance visibility, organizations should apply this carefully because some ICMP is important for normal network operations and troubleshooting.

This scenario describes Platform as a Service (PaaS) because the provider delivers a managed platform where developers can deploy and run custom applications while the provider manages the underlying infrastructure components—servers, operating systems, storage, and often middleware/runtime components. The customer is responsible for application code and logic (and usually data and application configuration), but not for provisioning or maintaining the base compute and OS layers.

The key phrasing is: “developers can deploy and test custom applications without managing the underlying servers, operating systems, or storage,” and “the firm controls the application logic but not the runtime infrastructure.” That is the hallmark responsibility split of PaaS: the provider handles infrastructure and platform operations, enabling rapid development and deployment through managed runtimes, build/deploy pipelines, and scalable services.

Why the other models don’t fit:

IaaS (A) would require the customer to manage the OS and many platform components (patching, runtime configuration, middleware), even though the provider supplies the virtualized infrastructure. The scenario explicitly says they do not manage OS or servers.

SaaS (C) provides a complete finished application that the customer uses; customers typically cannot deploy their own custom application logic onto it in the way described.

XaaS (D) is a broad umbrella term, not the specific NIST-style service model classification being asked.

Therefore, the correct answer is B. Platform as a Service (PaaS).

The Certified Ethical Hacker (CEH) Malware Threats module explains that modern malware increasingly uses fileless techniques and living-off-the-land strategies, communicating over legitimate protocols like HTTP and DNS to evade detection.

Because this traffic blends with normal activity, port-based blocking and signature-based antivirus are often ineffective. CEH highlights behavioral analytics and network traffic analysis as the most reliable detection mechanisms for identifying anomalies such as:

Unusual outbound DNS queries

Abnormal HTTP beaconing patterns

Suspicious process behavior

Option C is correct because it focuses on detecting behavioral anomalies, which CEH identifies as essential for combating advanced malware and command-and-control (C2) channels.

Option D may disrupt business operations and does not address DNS-based C2.

Option A is outdated.

Option B cannot detect unknown or fileless malware.

CEH strongly recommends anomaly detection and behavioral monitoring for advanced threats.

CEH v13 identifies AI-powered malware as an emerging advanced threat that adapts its execution based on environmental cues and user behavior. Unlike traditional polymorphic malware, AI-driven malware can dynamically decide when and how to execute actions to avoid detection.

The described traits—behavioral adaptation, idle-time exfiltration, encrypted communication—are hallmarks of AI-assisted malware.

Polymorphic viruses change signatures but do not adapt behavior intelligently. Rootkits focus on hiding presence. Worms propagate aggressively.

Therefore, Option A is correct.

The Certified Ethical Hacker (CEH) Web Application Hacking and DoS/DDoS module identifies Slowloris as an application-layer denial-of-service attack that targets web servers by maintaining a large number of half-open HTTP connections.

Slowloris works by sending partial HTTP requests very slowly, preventing the server from closing the connections. CEH documentation highlights that this attack does not rely on high bandwidth, making it difficult to detect using traditional network-based defenses.

Option C accurately matches the described symptoms and CEH’s definition.

Options A and B are network-layer flooding attacks, which were explicitly ruled out.

Option D is a packet fragmentation attack, not an application-layer DoS technique.

CEH stresses tuning connection timeouts and using reverse proxies as mitigations.

CEH v13 emphasizes that well-secured applications use HTTPS, secure cookies, and session regeneration to defend against common session hijacking techniques. In such hardened environments, traditional attacks like session fixation or simple XSS-based token theft often fail because session IDs change at login and secure flags prevent exposure. The remaining viable approach is session token prediction, an advanced attack that analyzes statistical patterns, entropy weaknesses, or timing issues in session ID generation algorithms. CEH discusses that weak pseudorandom number generators (PRNGs) or predictable sequences can allow attackers to compute a valid session ID without intercepting traffic. This method bypasses cookie security and does not rely on manipulating user input, making it suitable for environments with strong defenses. MITM attacks (Option A) require certificate compromise, which is impractical. Session fixation (Option B) fails because the application regenerates tokens. XSS (Option D) is ineffective when secure flags prevent JavaScript access to cookies. Thus, token prediction is the correct answer.

According to CEH v13 Mobile, IoT, and OT Hacking, Advanced Persistent Threat (APT) groups prioritize stealth, persistence, and long-term control. In IoT environments, the most attractive and effective entry point is firmware-level zero-day vulnerabilities.

IoT devices often:

Run outdated or proprietary firmware

Lack regular patching mechanisms

Operate with high privileges

Have minimal monitoring

Exploiting a zero-day vulnerability in firmware allows attackers to gain deep, persistent access that survives reboots and avoids traditional security controls. This aligns directly with APT objectives.

Credential theft (Option B) is common but less reliable for IoT systems. Encrypted MitM (Option C) is complex and less persistent. DDoS (Option D) disrupts services but does not provide control.

CEH v13 explicitly identifies firmware exploitation as the primary APT vector in IoT and OT environments. Therefore, Option A is correct.

The correct answer is D, Defense evasion. Windows Defender is an endpoint protection and anti-malware control. If it is disabled without administrator approval, the likely attacker objective is to avoid detection, prevent malware scanning, and reduce the chance that malicious processes, payloads, or tools will be blocked. CEH malware and system-hacking concepts describe several ways attackers try to avoid security controls, such as hiding malware from antivirus signatures, using packers or crypters to make malware harder to detect, and using rootkits or covering-track techniques to obscure compromise. This is not delivery, because the question does not describe sending or placing malware on the victim system. It is not persistence, because no mechanism for maintaining long-term access is described. It is not reconnaissance, because no information-gathering activity is occurring. Disabling Windows Defender is best mapped to defense evasion because the attacker is weakening monitoring and protection controls.

This scenario strongly suggests a race condition attack in the application’s token validation logic, as described in CEH v13 Web Application Hacking. A race condition occurs when an application processes multiple requests simultaneously and fails to properly synchronize validation checks.

The presence of multiple failed attempts using expired tokens followed by successful access within a short time window indicates the attacker exploited a timing flaw. During this window, the system may have inconsistently validated token expiration, allowing an expired token to be accepted.

Option A is unlikely because the logs specifically reference expired tokens. Option B is incorrect because replaying expired tokens should fail unless a validation flaw exists. Option C is highly improbable due to token entropy.

CEH v13 highlights race conditions as advanced logic flaws that are difficult to detect and often missed during standard testing. They are commonly exploited in authentication, payment processing, and session management systems.

Therefore, Option D is the correct and CEH-aligned answer.

The correct answer is B. Worm because the defining behavior described is self-replication and autonomous propagation across multiple systems without requiring additional user interaction after the initial infection. In CEH-aligned malware classifications, a worm is a standalone malicious program that can spread automatically over networks by copying itself to other hosts. Worms commonly leverage shared resources (such as shared folders), weak configurations, and credential weaknesses (such as weak administrative passwords or credential reuse) to move laterally and infect additional machines at scale.

The scenario includes multiple classic worm characteristics: (1) only one workstation is initially targeted, (2) the malware then “automatically copies itself into shared folders,” and (3) it spreads using “weak admin credentials,” resulting in rapid infection of “dozens of computers.” That pattern fits worm propagation mechanisms such as exploiting administrative shares, remote execution through obtained credentials, and leveraging network-accessible paths to drop copies of itself. The key discriminator is automation: after initial placement, the malware does the rest, scanning for reachable systems or shares and replicating to them without needing a user to click attachments or run the payload again.

Why the other options are not correct: a logic bomb is typically dormant code that triggers a malicious action when a specific condition or time is met; it is not defined by self-propagation. A backdoor provides unauthorized access for later control, but it does not inherently replicate across the network on its own. Fileless malware emphasizes execution primarily in memory using legitimate tools (e.g., PowerShell/WMI) and minimal disk artifacts; while fileless techniques can be used for lateral movement, the scenario’s emphasis is on the malware copying itself into shared folders and spreading widely, which is the hallmark of a worm.

Therefore, Sophia is most likely demonstrating a worm.

The scenario best matches Traffic IQ Professional because it describes a tool used to generate and replay diverse traffic patterns through a firewall to validate rule enforcement and detection under simulated attack conditions. The key functions here are traffic generation, replay, and the ability to model both legitimate and malicious flows to test whether the firewall correctly handles evasion attempts and policy enforcement. Traffic generation/replay platforms are used in security validation and firewall testing to emulate real-world network behaviors at scale and to assess how devices respond to crafted or replayed traffic profiles.

Why the other tools are less suitable:

Nmap (A) is primarily a scanner for host discovery, port scanning, and service enumeration, with some scripting capabilities. It is not chiefly a traffic generation/replay system for exercising a firewall with diverse controlled flows.

Colasoft Packet Builder (C) can craft packets and build custom traffic at the packet level, which is useful for creating specific test packets. However, the scenario emphasizes broader “diverse traffic patterns” and replay of flows in a way typically associated with traffic modeling/validation suites rather than single-packet construction.

Metasploit (D) is an exploitation framework used to develop and execute exploits and payloads. While it can generate certain traffic, its primary purpose is not comprehensive traffic generation and replay to validate firewall policies under many traffic types.

Traffic IQ Professional is the best fit because it aligns with a firewall test plan focused on simulating legitimate and malicious traffic profiles, including evasion-style patterns, and demonstrating how the perimeter device behaves under controlled conditions. This approach is often used to evaluate whether a firewall can consistently enforce security policies, detect anomalies, and resist evasion techniques without overblocking legitimate traffic.

Therefore, the most likely tool is B. Traffic IQ Professional.

CEH v13 identifies Idle (Zombie) Scanning as one of the most stealthy reconnaissance techniques. In this method, attackers use a third-party system (the zombie) to send probes to the target, obscuring the attacker’s true identity.

Because the attacker never directly interacts with the target, detection and attribution become extremely difficult. FIN and Xmas scans are stealthy but still originate from the attacker’s IP. TCP connect scans are noisy and easily detected.

CEH v13 highlights idle scanning as the gold standard for stealth reconnaissance, making option D correct.

The correct answer is C. DNS Rebinding Attack.

The key behavior is that an external website causes the victim’s browser to send requests to an internal, locally hosted IoT management interface. This is characteristic of DNS rebinding, where the attacker abuses browser trust and DNS resolution behavior so that a malicious web page can interact with private-network resources.

CEH-aligned IoT material identifies Insecure Web Interface and Insufficient Authentication/Authorization as important IoT weaknesses, especially because many device interfaces are intended to be exposed only on internal networks but can still be threatened from internal users or browser-based interaction paths . DNS rebinding specifically abuses this condition by using the victim’s browser as a bridge into the private network.

Option A. Forged Malicious Device Attack is incorrect because no rogue IoT device is being introduced.

Option B. SDR-Based Attack is incorrect because software-defined radio attacks target wireless/radio communications, not browser-based access to local web interfaces.

Option D. Distributed Denial-of-Service (DDoS) Attack is incorrect because the scenario is not about flooding or service exhaustion.

Therefore, the best answer is C. DNS Rebinding Attack.

In CEH v13 Maintaining Access, stealth and persistence are key goals after compromise. Placing a backdoor in a file type excluded from resource maps (such as image metadata, configuration files, or uncommon extensions) reduces the likelihood of discovery by automated scanners and integrity checks.

Option D is correct because many security tools focus on executable or commonly accessed web files. Files excluded from resource maps are less likely to be scanned or monitored.

Option A increases detection risk due to frequent changes. Option B increases signature visibility. Option C still exposes the file to access logs and monitoring.

CEH v13 highlights that attackers often hide backdoors in non-obvious locations to avoid detection. Therefore, Option D is correct.