312-50v12 — Frequently Asked Questions

Brute force only tests credential or input weaknesses; it generates noisy failed attempts that honeypots log and IDS alerts on, without exposing honeypot-specific fingerprints.

VMware virtual NICs often use known OUI prefixes, so seeing a VMware MAC on a supposed physical host is a strong virtualization artifact and honeypot clue.

Defense-in-Depth adds layered controls, but it does not by itself define the continuous prediction, prevention, detection, and response cycle the question asks for.

Risk Management identifies and treats risks, but the CEH scenario emphasizes an ongoing comprehensive defense strategy rather than a risk lifecycle process.

The CSP disallows inline scripts, so the browser blocks the payload before execution; a blocked probe cannot prove the input is exploitable.

Yes. If the injected input causes the allowed same-origin script to execute, that demonstrates script execution under the stated CSP and confirms the vulnerability.

Monitoring is continuous oversight that confirms fixes hold and surfaces new assets or drift, so it follows remediation and verification. Placing it early (option B) leaves nothing meaningful to monitor.

Verification re-tests the finding to prove the patch or configuration change actually closed it. Verifying before remediation, as options B and D do, checks a system that was never fixed.

A describes website footprinting or mirroring of site content; CEH defines web server footprinting as system-level data collection such as server names, OS versions, and account details.

A vulnerability scanner actively probes for weaknesses during scanning or vulnerability analysis; footprinting is earlier information gathering that builds the server's system-level profile before exploitation.

The stem asks for the attack technique Stephen used to gain entry; no HMI compromise is described, and the damage is the malware's later impact rather than the initial vector.

The email targeted a specific employee who manages sales software at the operational plant, making it a crafted, recipient-specific social engineering attack.

-T selects timing templates such as paranoid or sneaky; slower timing may reduce noise, but it is not the dedicated decoy switch that hides the scanner's source identity.

It adds spoofed decoy IP addresses to the scan so IDS and firewall logs see multiple apparent sources and struggle to identify the real attacker.

That is a BYOK model: the provider's encryption service still uses your key material to encrypt and decrypt, so key custody is shared; client-side encryption keeps all key operations with the client.

No. SSL/TLS protects data in transit between the client and the cloud; data at rest must be encrypted with keys the client controls, as in client-side encryption.

They let the IDS recognize and exclude known-benign files that currently trigger alerts, so analyst time is reserved for genuine threats; malware detection rules can remain active separately.

Broad all-file matching would likely increase noise and false positives, not reduce the goodware alerts; the question asks you to fix the known false-positive source first.

TCP/IP hijacking takes over an existing TCP session by manipulating sequence numbers; it does not rely on forged ICMP redirects and ARP spoofing to insert a host into the path.

RST hijacking sends forged TCP reset packets to drop a session, while the MITM ICMP/ARP technique reroutes traffic through the attacker's machine.

A wrong port would normally stop the TCP/LDAP connection entirely; because the stem says the connection succeeded, the fault is the ldap3 SSL configuration, not the port.

Use Server(host, port=636, use_ssl=True), then bind and search; without use_ssl=True the library does not initialize LDAPS correctly.

AXFR attempts a full zone transfer from a nameserver and is not a reverse lookup for IP addresses; it usually fails unless the server is misconfigured.

It runs standard enumeration and can return SOA, NS, A, AAAA, MX, SRV, and PTR data depending on the target and nameserver.

It spoofs packets from a zombie host and infers open ports by watching the zombie's IPID changes, so the target never sees the tester's real address.

No. -sA maps firewall behavior rather than open TCP ports and still sends probes from the scanner's IP address.

A honeypot lures and analyzes attackers after they probe the network; it does not stop an employee from being tricked into revealing credentials or granting access.

Only partially — EDR may catch malicious payloads on an endpoint, but it cannot prevent a user from authorizing a fraudulent wire transfer or disclosing information over the phone.

Scanning is mainly detective and occurs after the attachment lands or runs, so it may miss zero-day or obfuscated malware. Patching closes the vulnerabilities that let the payload execute.

No. Autorun settings control removable drives and optical media; they do not stop a user from opening an email attachment or a document that exploits an unpatched application.