ECCouncil 312-50v13 - Certified Ethical Hacker Exam (CEHv13)

The correct answer is C. MITRE ATT & CK. In CEH v13-aligned security operations and threat intelligence concepts, MITRE ATT & CK is used to understand and map adversary behavior during cyberattacks. ATT & CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It organizes attacker actions into tactics, techniques, and sub-techniques, helping security teams understand what an attacker is trying to achieve and how the attacker may perform each step. Tactics represent the attacker’s objective, such as initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, command and control, exfiltration, and impact. Techniques describe the specific methods used to achieve those objectives. NIST CSF 2.0 is a cybersecurity risk management framework, not a detailed adversary TTP framework. ISSF is not the standard CEH answer for adversary behavior mapping, and ISC 28901 is not used for cataloging cyberattack TTPs. Therefore, MITRE ATT & CK is the best answer.

This scenario precisely matches polymorphic malware, a type of advanced malware described in CEH v13 Malware Threats. Polymorphic malware dynamically alters its code, encryption, or signature each time it propagates, allowing it to evade traditional signature-based antivirus detection.

Additionally, the malware’s ability to remain dormant until triggered indicates logic-based activation, which is common in advanced threats designed to avoid sandbox detection.

CEH v13 emphasizes that polymorphic malware cannot be reliably detected using static signatures. Instead, organizations must rely on behavior-based detection, heuristic analysis, and advanced threat protection systems capable of identifying suspicious runtime behavior.

Options A, C, and D do not match the described behavior. Adware focuses on advertising. Worms self-propagate aggressively. Rootkits focus on stealth and persistence, not code mutation.

Therefore, Option B is the correct answer.

The correct answer is A. Risk management framework. The question describes an enterprise-level risk management approach used by management and other personnel to identify events that may affect business objectives, manage risks and opportunities, and provide reasonable assurance that objectives will be achieved. In CEH-aligned information security concepts, risk management focuses on identifying organizational assets, threats to those assets, and vulnerabilities, then selecting countermeasures to reduce risk and improve the organization’s security posture. EC-Council risk management phases include Risk Identification, Risk Assessment, Risk Treatment, Risk Tracking, and Risk Review. Qualitative risk assessment is only one method of assessing risk using descriptive ratings such as low, medium, and high; it is not the full enterprise framework. PCI-DSS applies specifically to payment card data security, and NIST SP 800-37 is a specific federal information-system risk management publication. Therefore, the best general CEH answer is Risk management framework.

The attack described is website defacement, which occurs when an attacker gains the ability to modify the content of a website—often the homepage—to display unauthorized messages, propaganda, or vandalism. The scenario explicitly says Mia “alter[s] visible content on the homepage, replacing it with unauthorized messages,” and emphasizes the reputational harm even without data theft. That reputational impact is a hallmark of defacement: it undermines customer trust, signals weak security, and can create regulatory/brand consequences even if no confidential information is exfiltrated.

The stated entry point—“exploiting an unpatched vulnerability in the web server”—is also consistent with defacement. Attackers frequently leverage web server or web application weaknesses (misconfigurations, known CVEs, weak credentials, vulnerable plugins, or insecure file permissions) to gain write access to web content or templates. Once write access is achieved, the attacker can replace HTML pages, alter templates, inject malicious scripts, or modify assets so that visitors see the attacker’s message.

Why the other options are less appropriate:

DNS hijacking (A) redirects users by changing DNS resolution so that the domain points to an attacker-controlled server. That can lead to a fake site, but it’s not the same as modifying the real server’s homepage content.

Frontjacking (B) typically involves UI deception—overlaying or framing content to trick users—rather than server-side modification of the homepage.

File upload exploits (C) are a method that can be used to gain code execution or place malicious files on a server, but the question asks for the type of web server attack being demonstrated. The visible outcome described—unauthorized homepage changes—is best categorized as defacement.

Therefore, Mia is most likely demonstrating D. Website Defacement.

Blowfish is the only option that matches all the technical characteristics described. In CEH cryptography concepts, symmetric algorithms are commonly distinguished by their structure (block cipher versus stream cipher), block size, and supported key lengths. The question states the algorithm encrypts data in 64-bit blocks and supports a variable key size ranging from 32 bits up to 448 bits, and it was introduced as a replacement for DES. Blowfish fits precisely: it is a symmetric block cipher with a 64-bit block size and a configurable key length from 32 to 448 bits, designed to be fast in software and positioned historically as an alternative to older ciphers such as DES.

The other choices do not align with these identifying properties. RC4 is a stream cipher and does not operate on fixed-size blocks, so it cannot match the 64-bit block requirement. AES is a block cipher but uses a 128-bit block size with fixed key sizes of 128, 192, or 256 bits, not 32 to 448 bits. Twofish, while related historically as a successor-era design, also uses a 128-bit block size and fixed key sizes up to 256 bits, so it does not match either.

From a CEH perspective, the mention of variable key sizes also hints at risk evaluation: shorter keys in any cipher can be brute-forced, so secure deployments require strong key length selection and proper key management. Additionally, Blowfish’s 64-bit block size can be a concern in large-volume encryption scenarios due to block collision risks, which is why modern systems often prefer 128-bit block ciphers for new designs.

The correct answer is B. ARP Spoofing because the described outcome—silently redirecting traffic between two hosts through the attacker’s machine on a LAN without changing switch configurations—is the classic effect of ARP poisoning (also called ARP spoofing). In CEH-aligned network sniffing and man-in-the-middle (MITM) techniques, ARP spoofing works by sending forged ARP replies onto the local network so that a victim host associates the attacker’s MAC address with the IP address of a legitimate system (commonly the default gateway or another target host). Once the victim’s ARP cache is poisoned, frames intended for the real destination are instead sent to the attacker, who can then forward them to the legitimate host to maintain connectivity while inspecting or altering the traffic.

The scenario states David “injects crafted messages” and then “all traffic between a finance workstation and the authentication server is silently routed through his system.” That behavior strongly indicates ARP spoofing performed in both directions: poisoning the workstation to believe the attacker is the authentication server (or gateway) and poisoning the server to believe the attacker is the workstation (or gateway). This enables a transparent MITM position where credentials can be observed—especially if protocols are unencrypted or if the attacker can downgrade or strip protections. The fact that “no proxy or VPN is in use” supports the idea that the redirection is happening at Layer 2/Layer 3 on the local segment rather than via an explicit application-level proxy.

Why the other options are less accurate: Switch port stealing targets switch CAM tables to redirect frames, but it is less directly described than ARP cache poisoning between two IP endpoints. An STP attack manipulates spanning tree to become the root bridge and can influence paths, but it is a different control-plane attack and usually affects broader Layer 2 topology. IRDP spoofing involves ICMP Router Discovery Protocol to advertise a rogue router, but the scenario fits the much more common and direct MITM sniffing technique on a switched LAN: ARP spoofing.

Therefore, David most likely used ARP spoofing.

The correct answer is C. Scanning Modbus Devices.

The scenario describes a targeted scan against a TCP service used by industrial controllers that support function-code exchanges for reading and writing memory/register areas. This directly maps to Modbus/TCP, which commonly runs on TCP port 502 and uses function codes to read coils, read registers, write coils, and write registers.

The referenced OT/ICS material identifies Modbus as a protocol used in industrial control systems and shows Modbus scanning examples such as modscan.py -a < target > -p 502 and modpoll -m tcp, including the use of Modbus function codes for reading input registers . Another reference also lists ICS reconnaissance using nmap -p 102,502 -sV < target_ip > and identifies port:502 modbus as a search pattern for Modbus servers commonly used in ICS environments .

Option A. Capturing Modbus/TCP traffic using Wireshark is incorrect because the scenario describes an active targeted scan, not passive packet capture.

Option B. Scanning Siemens SIMATIC S7 PLCs is incorrect because Siemens S7 communication is commonly associated with TCP port 102, not the Modbus function-code pattern described here.

Option C. Scanning Modbus Devices is correct because Modbus/TCP uses TCP port 502 and function codes for reading and writing industrial data.

Option D. Scanning Omron PLC Devices is incorrect because Omron PLC reconnaissance commonly involves protocols such as FINS, not the Modbus/TCP function-code behavior described.

Therefore, the best answer is C. Scanning Modbus Devices.

The question focuses on passive reconnaissance using Google advanced search operators, a technique commonly referred to in CEH materials as Google hacking or Google dorking. This method leverages publicly indexed data without directly interacting with the target systems, making it a non-intrusive reconnaissance approach. The goal here is to locate potentially exposed administrative interfaces within .edu domains.

Option C, site:.edu inurl:admin, is the most effective query for this purpose. The site operator restricts results to the .edu top-level domain, ensuring that only educational institutions are searched. The inurl operator filters results to pages where the term “admin” appears in the URL itself. Administrative panels and backend management interfaces frequently include terms such as admin, administrator, or adminpanel directly in the URL path. Therefore, this search string increases the likelihood of discovering exposed login portals or backend directories.

Option A focuses on PDF files with “admin” in the title, which is unlikely to reveal active administrative interfaces. Option B searches for pages with “admin login” in the title, which may find login pages but is less precise than filtering by URL structure. Option D searches anchor text references, which does not directly identify actual admin pages.

In CEH methodology, properly constructed Google dorks such as inurl:admin combined with site-specific filtering are effective in identifying exposed resources while maintaining passive reconnaissance discipline.

CEH v13 highlights behavioral analytics as one of the most effective techniques for identifying ambiguous or stealthy threats such as data exfiltration, command-and-control traffic, and insider abuse. When interactions appear suspicious but not definitively malicious, behavioral profiling provides the most direct visibility.

Behavioral analytics tools establish a baseline of normal system and network behavior, including typical communication patterns, data transfer volumes, destinations, and timing. Deviations from this baseline trigger alerts, allowing analysts to detect previously unknown threats without relying on signatures.

Option C is the most appropriate because it both identifies anomalies and supports continuous mitigation. A full zero-trust shutdown (Option A) is disruptive. Forensics (Option B) is reactive and better suited after confirmation of compromise. Training (Option D) does not address system-level interactions.

CEH v13 emphasizes that modern attacks often blend into normal traffic, making behavioral analysis essential. Therefore, Option C is the correct answer.

SMS Phishing, commonly called smishing, is the correct answer because the attack method is a deceptive text message sent to mobile devices that lures recipients into clicking a malicious link. In CEH-aligned social engineering coverage, smishing is a direct extension of phishing that uses SMS as the delivery channel. The attacker typically creates urgency or authority, such as “critical account update needed,” to trigger fast compliance. The message then pushes the victim to a malicious URL that can deliver malware, prompt credential entry, or enroll the device into a monitoring or management profile depending on platform and permissions. The key indicators in the question are company phones, a crafted message, and a link that installs monitoring software, which fits smishing exactly.

Bluebugging is a Bluetooth-based attack where the attacker exploits Bluetooth weaknesses to gain unauthorized access to a device, read data, place calls, or send messages, and it does not rely on sending a deceptive SMS link. Call spoofing is manipulating caller ID to impersonate a trusted number during voice calls, not delivering a malicious installation link through text. OTP hijacking focuses on intercepting or tricking users into revealing one-time passwords, often through SIM swapping, malware, or real-time phishing, but the scenario emphasizes installing monitoring software through a link rather than capturing a one-time code.

Defenses highlighted in ethical security training include mobile security awareness, blocking unknown links, using mobile threat defense, restricting app installation from untrusted sources, enforcing MDM controls, and monitoring SMS-based social engineering indicators.

The tool described matches Fern WiFi Cracker because CEH wireless assessment workflows commonly reference GUI-based auditing utilities that combine packet capture, wireless injection support, and key recovery attempts in one interface. The scenario specifically mentions three core capabilities: capturing wireless packets, sending de-authentication frames to trigger client reconnects, and attempting to recover the encryption key. Those steps align with the typical WPA cracking methodology discussed in CEH learning paths: capture the WPA handshake when a client connects, optionally force a reconnection by sending de-authentication frames, then perform an offline attack against the captured handshake using a wordlist or brute-force approach. Fern WiFi Cracker is known for presenting these functions through a graphical interface, making it a common example of an “all-in-one” Wi-Fi auditing tool.

The other options are defensive monitoring and prevention platforms, not offensive auditing tools used to actively deauthenticate clients or attempt key recovery. RFProtect, Cisco Adaptive Wireless IPS, and WatchGuard Wi-Fi Cloud WIPS are Wireless Intrusion Prevention and Monitoring solutions designed to detect rogue access points, identify attacks such as deauthentication floods, enforce wireless security policies, and generate alerts for security teams. They are used to stop or respond to attacks rather than conduct packet capture plus key-recovery attempts as part of an assessment.

Because the question emphasizes a single graphical interface that captures traffic, injects deauth frames, and attempts key recovery, the correct match among the choices is Fern WiFi Cracker.

CEH v13 explains that directory traversal (also called path traversal) occurs when an application improperly handles user-supplied input used for file path generation. Attackers exploit this by inserting traversal sequences such as ../ beyond the intended directories, gaining access to sensitive files like /etc/passwd, configuration data, or source code. The vulnerability arises from missing input validation and failure to restrict file access to safe directories. CEH stresses that directory traversal is common in file handling functions such as view, download, or include operations. Brute-forcing credentials (Option A) is unrelated. XSS (Option C) targets script injection into web pages, not file access. Buffer overflow (Option D) manipulates memory, not file paths. Therefore, the scenario represents classic directory traversal exploitation.

WPA2-PSK networks authenticate users using a pre-shared key derived from a passphrase. After capturing the 4-way handshake, CEH teaches that the standard and most effective method to recover the key is to perform an offline dictionary attack, where wordlist entries are hashed and compared against the captured handshake values. Offline cracking avoids detection and is significantly faster than brute-force attempts.

The indicators described align most strongly with the Search and Exfiltration phase of the APT lifecycle. In CEH-aligned APT models, attackers typically progress from initial access to establishing footholds, expanding access through internal reconnaissance and lateral movement, then locating valuable data and exfiltrating it. While spear-phishing is a common Initial Intrusion technique, the scenario explicitly includes multiple signals that the attackers are already deep inside the environment and actively handling sensitive information.

The key evidence is the “unusually large data transfers during non-business hours” tied to the R & D department and “unexpected outbound traffic to unfamiliar IP addresses.” Those are classic signs of staging and exfiltration, where collected data is aggregated internally and then sent out to attacker-controlled infrastructure, often at times chosen to reduce detection. The observation that attackers have “intimate knowledge of the organization’s internal data structure” further supports that they have already performed internal discovery and are now targeting specific high-value repositories.

Unauthorized firmware on printers and routers suggests the attackers may have created durable internal collection points or covert channels, but that activity supports and enables the data-theft mission rather than being the primary phase indicated by the full pattern of events. Therefore, the combination of targeted access to R & D resources, anomalous outbound connections, and large off-hours transfers most closely matches the Search and Exfiltration phase in CEH APT lifecycle coverage.