ECCouncil 312-50v13 - Certified Ethical Hacker Exam (CEH v13 AI)

Side-channel attacks, as explained in CEH v13 OT and SCADA Security, extract sensitive information by observing physical characteristics of a system rather than exploiting software flaws directly. These characteristics may include power consumption, electromagnetic emissions, timing variations, or thermal output.

In SCADA environments, side-channel attacks are especially dangerous because they bypass traditional network defenses. The most reliable way to confirm such an attack is by analyzing hardware-level anomalies—such as unexpected power usage spikes or irregular signal emissions during normal device operations.

Option B directly aligns with CEH v13 guidance.

Options A, C, and D focus on software, cryptography, or network behavior, which are not primary indicators of side-channel exploitation.

Therefore, Option B is correct.

Qualys VM is the best match because the scenario emphasizes enterprise vulnerability management for a hybrid environment with agent-based endpoint coverage, continuous monitoring, alerting, and centralized visibility across both on-premises and cloud systems. In CEH-aligned security operations concepts, vulnerability management is not only about running periodic scans, but also about maintaining an accurate, continuously updated view of asset exposure, prioritizing risk, and producing actionable remediation workflows. A platform designed for hybrid infrastructures commonly includes lightweight agents for endpoints, cloud connectors, unified dashboards, continuous assessment, and notification or alerting features to support real-time risk decisions. Qualys VM is widely recognized for delivering vulnerability management through a centralized cloud platform with broad asset visibility and support for continuous assessment models that align with large-scale, distributed environments.

The other options are less aligned with the full requirement set. Nikto is a focused web server and web application scanner and does not represent an enterprise-wide vulnerability management platform for endpoints and hybrid assets. OpenVAS is a capable open-source vulnerability scanner, but it is typically implemented as a scanning solution rather than a full hybrid vulnerability management platform with the same level of integrated agent-based endpoint coverage, centralized cloud visibility, and operational alerting described. Nessus is a strong vulnerability scanner and can support agents in some deployments, but the scenario’s emphasis on broad hybrid infrastructure visibility and centralized, continuous monitoring with alerting most strongly aligns with Qualys VM as a vulnerability management platform.

The Certified Ethical Hacker (CEH) Cryptography and Quantum Computing section introduces the concept known as “Harvest Now, Decrypt Later”. This threat model describes adversaries capturing encrypted data today, even if they cannot decrypt it immediately, with the expectation that future quantum computers will be able to break currently secure public-key algorithms such as RSA and ECC.

Option A accurately reflects this concept.

Option B describes a method (Shor’s algorithm) but not the threat model itself.

Option C is unrelated to cryptographic attacks.

Option D refers to quantum communication attacks, not classical encrypted data harvesting.

CEH emphasizes post-quantum cryptography as a mitigation strategy.

The correct answer is C. S/MIME.

S/MIME, or Secure/Multipurpose Internet Mail Extensions, is the email security standard used to provide encryption and digital signing for MIME-based email messages. The CEH cryptography reference describes S/MIME as a standard for public-key encryption and signing of MIME data . It is also defined as a standard for encrypting and authenticating MIME data, primarily used for Internet email .

This directly matches the scenario because the organization requires:

Confidentiality through email encryption.

Authentication through digital signatures.

PKI-based trust using certificates.

Compatibility with Microsoft Outlook environments.

Option A. FlowCrypt is incorrect because it is an email encryption tool/service, mainly associated with OpenPGP-based email encryption, not the standard being asked for.

Option B. RMail is incorrect because it is a secure email service/platform, not the core standardized PKI-based email encryption framework.

Option D. OpenPGP is incorrect because OpenPGP supports encryption and signatures, but it is not the best match where the requirement specifically emphasizes certificate authority-based PKI trust and Outlook-style enterprise certificate validation.

Therefore, the best answer is C. S/MIME.

This scenario aligns with a Golden SAML attack because the attacker is not stealing a user password or bypassing MFA directly; instead, the attacker compromises the identity trust mechanism itself and forges valid authentication assertions. In federated cloud environments, the identity provider issues signed assertions that cloud services trust. Once the signing material is obtained, an attacker can create forged SAML tokens that appear fully legitimate to the relying cloud applications. That is why the access in logs appears normal and why no credential replay or multifactor prompt is required. This distinguishes the technique from Man-in-the-Cloud, which commonly abuses synchronization tokens, and from Cloud Hopper, which is associated with service-provider pivoting and long-term intrusion campaigns. CEH cloud coverage emphasizes that cloud trust relationships, identity infrastructure, and the mechanisms used to broker access are critical attack surfaces because compromise at that layer can grant broad service access with little visible anomaly. In practical defensive terms, protecting token-signing infrastructure is as important as protecting privileged user credentials in a cloud identity architecture.

The correct answer is A. Golden SAML Attack.

A Golden SAML Attack occurs when an attacker obtains the private signing material used by an identity provider and then forges valid SAML authentication assertions. Because the forged assertions are signed with trusted material, cloud service providers may treat them as legitimate authentication responses.

The scenario clearly states that the consultant extracted signing material used in trust relationships between the internal identity provider and cloud services, then generated authentication responses that granted cloud application access without passwords or MFA. This is the defining behavior of a Golden SAML attack.

CEH-aligned cloud security material identifies cloud account hijacking and insecure cloud authentication paths as major concerns, especially where cloud services depend on authentication, authorization, and API trust relationships . The Golden SAML technique specifically abuses federated authentication trust rather than stealing a normal user password.

Option B. Living off the Cloud (LotC) Attack is incorrect because LotC involves abusing legitimate cloud-native services and tools to perform attacker operations while blending into normal cloud activity. It does not specifically describe forging SAML authentication assertions.

Option C. Cloud Hopper Attack is incorrect because Cloud Hopper refers to attacks that target managed service providers or cloud service providers to reach downstream customers.

Option D. Man-in-the-Cloud (MITC) Attack is incorrect because MITC typically abuses synchronization tokens or cloud sync mechanisms, not identity-provider signing keys.

Therefore, the best answer is A. Golden SAML Attack.

The correct answer is C. Initial Sequence Number (ISN).

The question specifically states that the analyst records the sequence numbers returned in SYN/ACK responses and analyzes whether those values are predictable or incremental. That means the analyst is examining the target’s Initial Sequence Number generation behavior.

CEH session hijacking material explains that during the TCP three-way handshake, the server responds with a SYN/ACK that includes an ISN, or Initial Sequence Number . It also states that sequence numbers are important for reliable communication and can be crucial in hijacking because an attacker must successfully guess or predict sequence numbers . Another CEH-aligned reference explains that the ISN is exchanged during the handshake and that sequence-number behavior can reveal implementation characteristics .

Option A. TCP Timestamp Analysis is incorrect because TCP timestamp analysis examines timestamp option values, clock behavior, or uptime estimation, not SYN/ACK sequence-number generation.

Option B. TCP Window Size is incorrect because TCP window size refers to how much data can be sent before acknowledgment is required. It is not the sequence-number attribute described in the question.

Option D. Time to Live (TTL) is incorrect because TTL is an IP header field used to limit packet lifetime and can help infer OS or hop distance, but it is unrelated to SYN/ACK sequence-number predictability.

Therefore, the best answer is C. Initial Sequence Number (ISN).

White-hat hackers perform security assessments with authorization. CEH defines ethical hacking as legal, structured testing of network defenses with the goal of improving security rather than causing harm.

The correct answer is B, Reaver. Reaver is the well-known wireless attack tool used to target Wi-Fi Protected Setup, especially the WPS PIN mechanism. In wireless hacking, WPS PIN attacks attempt to recover or validate the router’s WPS PIN and then derive access to the WPA/WPA2 pre-shared key. This is different from normal WPA/WPA2 cracking, where attackers commonly capture authentication handshakes and use dictionary or brute-force attacks against the passphrase. CEH wireless-hacking material notes that WPA/WPA2 cracking commonly involves capturing WPA/WPA2 authentication traffic and using tools such as Aircrack for offline cracking. Kismet is mainly used for wireless discovery/sniffing, and Wireshark is a packet analyzer, not a WPS PIN attack tool. Aircrack is associated with WEP/WPA/WPA2 cracking, but not specifically WPS PIN attacks. Therefore, the tool that specifically targets WPA/WPS PIN weakness is Reaver.

The correct answer is A, Mimikatz. In CEH system hacking and post-exploitation topics, Windows credential attacks commonly focus on hashes, cached credentials, Kerberos tickets, and authentication material stored in memory or in Windows credential stores. The CEH-related material identifies Mimikatz as the de facto standard tool for extracting credentials from Windows memory and states that it can steal hashes, PIN codes, and Kerberos tickets from memory, as well as support pass-the-hash, pass-the-ticket, and Golden Ticket attacks. This directly matches the question’s phrase “dumps Windows hashes.” John the Ripper is mainly a password-cracking tool used after hashes are obtained. Hydra is primarily an online login/password attack tool for network services. Aircrack-ng is used mainly for wireless password/key cracking. Therefore, among the options, Mimikatz is the tool most specifically associated with dumping Windows credentials and hashes during the system hacking phase.

The correct answer is A. Broken Object Level Authorization (BOLA).

The scenario describes an authenticated user changing an object identifier in an API request and gaining access to another client’s dashboard data. The user remains authenticated, but the application fails to verify whether that user is authorized to access the specific object referenced by the identifier.

This is the API security equivalent of an insecure direct object reference. CEH-aligned web application material explains that applications often use objects or IDs to distinguish user records and that if a user can change an identifier, such as id=1 to id=2, and access another user’s data, the flaw is an insecure direct object reference . In OWASP API Security terminology, this is classified as Broken Object Level Authorization (BOLA).

Option B. Broken Object Property Level Authorization is incorrect because that involves unauthorized access to specific object properties or fields, not the entire object identified by an ID.

Option C. Broken Function Level Authorization is incorrect because the user is not accessing an unauthorized function or administrative endpoint; they are accessing another object through the same function.

Option D. Broken Authentication is incorrect because the session remains valid and authentication is not bypassed. The failure is authorization at the object level.

Therefore, the best answer is A. Broken Object Level Authorization (BOLA).

This scenario clearly indicates a SYN Flood attack, a classic Denial-of-Service technique discussed in CEH v13 Network and Perimeter Hacking. In a normal TCP three-way handshake, a client sends a SYN, the server responds with SYN-ACK, and the client completes the connection with an ACK. In a SYN flood, attackers send a massive number of SYN packets but never complete the handshake.

As described in CEH v13, the server allocates memory and resources for each half-open connection, placing them in the SYN_RECEIVED state. When these connections are not finalized, the server’s connection table becomes saturated, preventing legitimate users from establishing new sessions.

Other options are incorrect:

Smurf attacks rely on ICMP amplification, not TCP handshakes.

Ping of Death uses malformed ICMP packets.

UDP Floods overwhelm ports using UDP, not TCP session states.

CEH v13 emphasizes SYN floods as one of the most common Layer 4 DoS attacks due to their simplicity and effectiveness.

The TCP SYN scan, also known as a Stealth Scan, is emphasized in CEH v13 Network Scanning as the most effective balance between accuracy and stealth. It sends a SYN packet and analyzes the response without completing the TCP handshake.

Because the connection is never fully established, SYN scans are less likely to be logged by applications and are harder for IDS systems to detect compared to TCP Connect scans.

FIN and ACK scans are used for firewall rule mapping and evasion, but they do not reliably enumerate services. TCP Connect scans are noisy and easily detected. Therefore, Stealth (SYN) Scan is the best choice.

The correct answer is D. Spearphone Attack.

A Spearphone Attack uses motion sensor data, such as accelerometer readings, to infer or reconstruct speech played through a smartphone’s loudspeaker. The attack is notable because it does not require direct microphone access. Instead, it abuses sensor readings produced by speaker vibrations and acoustic coupling inside the device.

The scenario states that no microphone or camera permission change occurred, but an installed application continuously read motion sensor output while the loudspeaker was active. The collected measurements were then used to reconstruct acoustic characteristics. These details precisely match Spearphone.

CEH-aligned mobile security material highlights that mobile devices can be attacked through malware, insecure applications, and application/OS abuse, and that mobile malware is commonly used to steal personal or sensitive data from devices .

Option A. Camfecting is incorrect because camfecting involves unauthorized camera activation or camera spying.

Option B. StormBreaker Abuse is incorrect because StormBreaker is associated with phishing/social-engineering frameworks that may capture device data, but the scenario specifically involves motion-sensor acoustic reconstruction.

Option C. Android Camera Hijack Attack is incorrect because no camera misuse is described.

Option D. Spearphone Attack is correct because the attack reconstructs speech from motion sensor readings while the loudspeaker is active.

Therefore, the best answer is D. Spearphone Attack.

The Certified Ethical Hacker (CEH) Social Engineering module defines whaling as a highly targeted phishing attack aimed specifically at senior executives or high-ranking personnel.

This scenario exhibits all whaling characteristics: personalization, impersonation of leadership, business-themed content, and tailored malware delivery.

Option D is correct.

Option A involves copying legitimate emails, but does not necessarily target executives.

Option B lacks targeting.

Option C is unrelated to email-based attacks.

CEH stresses executive awareness training to counter whaling attacks.