312-50v13 — frequently asked questions

Delivery is the transmission step. Since it's not an option, and the question emphasizes 'creating' the backdoor, Weaponization is the intended focus.

Weaponization is assembling the exploit and payload. Exploitation is the actual triggering of that payload on the target system.

No, unless the contract specifies ongoing monitoring or implementation duties. Typically, liability for unpatched vulnerabilities lies with the client.

John should have clearly documented the risk acceptance process, ensuring the organization formally acknowledged the consequences of ignoring non-critical vulnerabilities.

Switches isolate traffic to specific MAC addresses. Without ARP Poisoning or port mirroring, Raw Sniffing cannot see traffic intended for other hosts.

Yes, in the context of penetration testing, it is an active sniffing technique used to facilitate Man-in-the-Middle attacks for traffic interception.

Agent-based scanners are installed on individual hosts and can scan peers or themselves. Network-based scanners are typically remote appliances or services that probe networks from outside or centrally without residing on the target hosts.

The classification depends on deployment. Since the scanner was installed on a victim machine (an agent), it fits the agent-based definition despite scanning network neighbors.

Zero-day refers to an unknown vulnerability, not the execution method. File-less malware specifically exploits whitelisting by using trusted apps, which fits the scenario better.

It resides in memory and uses legitimate system binaries, so there is no malicious file signature for traditional AV to detect on disk.

Session Fixation involves the attacker taking over the victim's session after the victim authenticates. Session Donation involves the victim submitting data into the attacker's already-established session.

Session hijacking typically implies stealing an active session token. Here, the attacker created the session beforehand and tricked the victim into contributing to it, fitting the 'donation' model.

Option D includes a trailing quote after the comment symbol '--'. Since '--' ignores all subsequent text, that quote is syntactically orphaned or ignored, making B the cleaner, standard injection payload that reliably bypasses the check.

Without '--', the SQL parser will attempt to execute the remaining parts of the original query (like the password comparison), likely causing a syntax error or failing the authentication check because the logical structure remains intact.

Tethered jailbreaking requires a computer to be connected every time the device reboots to restore the jailbreak. Untethered jailbreaking persists automatically after reboots without external help.

Option A (Tethered) is incorrect because it implies the device loses its jailbroken state upon reboot unless manually restored via a computer connection, which contradicts the 'no assistance' requirement of the question.

DNS Tunneling is used for covert data transmission or C2 channels. This scenario describes using domains to hide identity/location, which is an evasion/proxy tactic.

Data Staging is the process of collecting stolen data in a temporary directory on a compromised system before final exfiltration. It is unrelated to domain management.

THC-Hydra can perform dictionary attacks against various protocols and also support hash cracking for specific formats, making it relevant to password attacks.

Yes, Netcat can be used to exfiltrate cracked password files or establish reverse shells after gaining access, but it does not perform the cracking process itself.

ICMP pings are often blocked by restrictive firewalls. ARP operates at Layer 2 and is used for local address resolution, making it less likely to be filtered.

ACK scans can infer firewall rules but are not reliable for comprehensive host discovery, especially compared to ARP on the local segment.

AES uses 128-bit blocks and key sizes of 128/192/256 bits, whereas the question specifies 64-bit blocks and 56-bit keys.

It uses three 56-bit keys (K1, K2, K3), though often implemented as two keys (K1=K3) for backward compatibility.

Phishing is broad and often automated/scam-based. Honey trap specifically exploits romantic or sexual attraction to build a long-term deceptive relationship for intelligence gathering.

No. Baiting uses tangible rewards like free downloads or gifts. Honey trap uses emotional/romantic manipulation to trick the victim.

Phishing typically involves mass digital communications like emails. This scenario involves a direct, personalized phone call where the attacker offers a specific service.

Quid pro quo involves an exchange of a promised benefit (like support) for action. Elicitation focuses on drawing out information through conversation without necessarily offering a tangible service.

getuid displays the current user ID of the session, while getsystem attempts to elevate the session to SYSTEM privileges.

No, autoroute is used to add routes to the routing table so traffic can reach other networks via the compromised host.

Maimon scans use FIN/ACK flags, while Xmas scans use FIN/PSH/URG flags. Both aim to evade logging but have different flag compositions.

An open port ignores the FIN flag because the TCP handshake was never completed. It waits for further data or a reset, whereas a closed port immediately sends a RST.

IntentFuzzer is designed for fuzzing RESTful APIs to find web application vulnerabilities. It does not provide the network traffic analysis or anomaly detection capabilities needed to secure Industrial Control Systems.

Flowmon specializes in network flow analysis and uses Anomaly Detection Systems (ADS) to identify deviations from normal industrial protocol behavior, making it ideal for detecting threats in OT networks without causing disruption.

Yes, LDAP supports anonymous binds by default, but this allows anyone to query the directory. Authentication protocols like NTLM or Kerberos are needed to restrict this.

RADIUS is primarily for network access control (like Wi-Fi or VPN), whereas NTLM/Kerberos are native to the Windows domain environment where LDAP resides.

An Evil Twin requires a rogue AP mimicking the SSID. The prompt specifies they accessed Jane's actual network, implying the genuine hardware was used.

This suggests the network was temporarily opened, or they exploited a vulnerability that bypassed authentication, which falls under piggybacking usage.

UDP Flood focuses on bandwidth saturation via high packet rates, whereas the prompt specifically highlights packet size violations, which is unique to Ping of Death.

Most modern operating systems have patched against Ping of Death by handling fragmented packets safely, but it remains a critical concept for certification exams regarding historical DoS vectors.

While Adaptive Security is modern, CEH exams prioritize Defense-in-Depth as the fundamental architectural principle for reducing single points of failure against unknown threats.

No, Risk Management is a governance framework for identifying and treating risks, not a technical defense strategy like Defense-in-Depth used to harden infrastructure.

The question states the attacker intends to use UNION. Switching to time-based changes the core tactic, whereas encoding allows the original UNION plan to proceed despite filters.

Encoding transforms special characters into alternative representations (like hex or URL encoding) that pass through text-based filters but are decoded back to their original form by the database.

UNION SELECT only extracts data (Confidentiality), whereas DROP TABLE destroys data (Integrity/Availability). Destruction is considered a higher impact.

It usually refers to the worst-case scenario outcome, such as total data loss, system takeover, or denial of service, rather than just information gathering.

Training reduces human error but cannot technically block the installation of a malicious or non-compliant app on a personal device.

MDM typically only enforces policies on a 'work profile' or container, leaving personal data and apps untouched, thus preserving user autonomy.

Inference-based starts with protocol inventory to deduce services, while service-based typically scans against a pre-defined list of known services.

Product-based refers to the type of tool (commercial vs open source), not the logical methodology of how vulnerabilities are selected during the scan.

DLL injection is a method, but privilege escalation is the strategic outcome and greater risk when admin rights are already granted.

Not always, but combined with existing admin permissions for unknown users, it significantly lowers the barrier for escalating to full control.

A warning is advisory only. It does not cryptographically prevent an attacker from spoofing the AP or intercepting data if the user connects anyway.

WPA3 requires device support. However, most modern smartphones and laptops support it natively without extra software, fitting the 'no additional software' constraint.

It performs standard enumeration, querying for SOA, NS, A, AAAA, MX, and SRV records.

Use -t brt when you need to discover subdomains or hosts by guessing names against a dictionary, rather than querying existing records.

No, nbtstat is primarily designed for IPv4-based NetBIOS name resolution. It generally cannot resolve or query NetBIOS names directly using IPv6 addresses.

Nmap has native IPv6 support and robust scripting engines (NSE) that can perform service detection and enumeration on IPv6 networks, unlike legacy Windows commands.

SYN scan hides the connection state but sends packets from your IP. The target logs your source address, so you are not anonymous.

An idle host with predictable IPID increments. The attacker manipulates its IPID to infer open/closed ports on the real target without direct contact.

WAFW00F identifies Web Application Firewalls but does not analyze traffic patterns or determine user geography.

Web-Stat analyzes traffic and user metrics, while WebSite-Watcher monitors websites for content changes or updates.

Segmentation is a control to limit impact, not a method to identify existing vulnerabilities. You must assess first to know what to segment or protect.

Many IoT devices have limited resources and cannot run traditional antivirus. Even if they could, AV is a remediation tool, not an identification step.

Thin Whois stores minimal data (registrar info) at the registry level, while Thick Whois stores complete registrant details centrally.

No, if the system uses a Thin Whois model, incomplete data is expected and indicates normal operation, not an error.

ARIN only covers North America, Canada, and parts of the Caribbean. France is in Europe, which falls under RIPE NCC's jurisdiction.

RIPE stands for Réseaux IP Européens. It is the RIR for Europe, the Middle East, and parts of Central Asia.

Grover's algorithm reduces AES-128's effective security to 64 bits, which is vulnerable to quantum attacks. AES-256 retains 128-bit effective security, meeting modern standards.

No. ECC is highly vulnerable to Shor's algorithm, which can break it exponentially faster. Symmetric AES is much more resistant to quantum attacks when key sizes are increased.

No, eMailTrackerPro only logs activity when the tracking pixel is loaded. If the email is deleted or viewed in text-only mode without loading images, no data is sent.

It provides the geolocation associated with the IP address at the moment the email is opened, not continuous real-time GPS tracking.

Dumpster diving allows attackers to recover discarded documents containing sensitive info like IP addresses or network diagrams without needing direct interaction or physical access to active systems.

It provides business intelligence that can reveal key projects, personnel changes, or security policies, which can be used to craft more convincing phishing campaigns or identify high-value targets.

The link: operator helps map relationships between websites and can identify backlinks to known vulnerable VPN portals, whereas location data is masked by the VPN.

Yes, GHDB contains queries designed to find exposed configuration files, login pages, and admin panels that may contain weak or default VPN credentials.

While limiting range reduces detection distance, it often creates coverage gaps inside the store, harming the customer experience which the question explicitly seeks to preserve.

No. Wardriving tools can easily detect hidden SSIDs by analyzing network traffic (probe requests/responses), making this a weak security control compared to encryption.

ICMP ECHO pings are often blocked by strict firewall rules designed to prevent network reconnaissance, leading to missed live hosts.

TCP SYN Ping performs a half-open scan, never completing the three-way handshake, making it faster and less detectable than a full connect scan.

While TLS includes integrity checks, IPsec provides explicit network-layer authentication headers (AH/ESP) that are often cited in exams as the robust solution for ensuring packet integrity against modification.

No. AES is an encryption algorithm that provides confidentiality. It scrambles data but does not inherently include a hash-based mechanism to verify that the data arrived exactly as sent without alteration.

The first probe causes the zombie to send a packet (increment 1). If the port is open, the target replies to the zombie, causing a second increment. The second probe adds a third increment, but we measure the difference between the two initial states, showing a net change of 2.

No, the IDLE scan uses a zombie host. The firewall's effect on the zombie's IPID is minimal if the zombie is chosen correctly. The IPID+2 specifically reflects the zombie's activity triggered by the target's response.

SQL injection requires injecting commands into a database query. This scenario shows direct memory access violation in application code, which is a buffer overflow.

Look for mentions of arrays, buffers, indices, 'out of bounds', 'crash', or 'memory corruption'. If the exploit breaks memory boundaries, it's a buffer overflow.

Closing the connection terminates the session, preventing the hacker from assessing vulnerabilities or exploiting services on that port.

No, the scenario focuses on the currently established connection. Standard practice is to analyze the active service before moving to other targets.

Polymorphic malware encrypts its payload with different keys each time, while Metamorphic malware rewrites its own code structure entirely to change its signature.

A Rootkit often maintains persistence by modifying system registries, startup folders, or boot sectors to ensure it loads automatically upon system reboot.

Hybrid attacks broadly combine dictionary and brute-force methods. Rule-based attacks are more specific, applying defined transformation rules to dictionary words, which fits the 'adding numbers' pattern perfectly.

Brute-force tries every combination blindly. Rule-based uses intelligence about the user's habits (e.g., 'add 123') to generate only plausible candidates, making it faster and more targeted.

No, HTTPOnly cookies cannot be accessed via JavaScript (document.cookie). Attackers must rely on other vectors or social engineering.

It bypasses input sanitizers that only check for raw script tags but fail to decode and evaluate HTML entities before rendering.

While both use fake towers, aLTEr specifically exploits LTE encryption flaws to redirect traffic, whereas IMSI catchers primarily capture identifiers.

KRACK targets WPA2 Wi-Fi security protocols, not the LTE cellular infrastructure used in the described scenario.

ACK probes often elicit no response from BSD stacks if the port isn't part of an established session, making them harder to detect via logging compared to Xmas scans which may trigger RST responses.

No, it sends only the ACK flag. Since no prior SYN was sent, the connection is not established, allowing it to evade stateful firewalls that track full handshakes.

Hit-list scanning skips non-vulnerable IPs entirely, focusing only on known targets, whereas subnet scanning must check every address in a range.

By targeting specific machines from a list rather than broadcasting scans across a subnet, it reduces noise and avoids triggering threshold-based IDS alerts.

White Hats must have explicit prior authorization to test systems. Since Nicolas did not get permission before interacting with the system, he cannot be classified as a White Hat.

Gray Hats discover and disclose vulnerabilities without permission but do not attack attackers. Red Hats (Vigilantes) actively fight back against black hat hackers, often by compromising their systems.

Phishing typically sends malicious emails directly to victims. A watering hole attack compromises third-party websites that the specific target audience already trusts and visits.

No, MarioNet is a framework for building and managing botnets, often used for DDoS or crypto mining, but it is not the specific technique described in the scenario.

VRFY verifies if a single specific user exists. EXPN expands a mailing list to show all its members.

RCPT TO defines the recipient for a transaction but doesn't explicitly return a validity check response code for existence like VRFY does.

In-memory exploits describe how the malware runs after execution. The question asks for the technique used to deliver or launch the attack, which was Phishing.

Fileless malware operates in RAM without writing files to disk. Here, the 'fileless' aspect refers to the exploit, while 'Phishing' refers to the delivery method.

Union-based requires the application to display combined query results. The scenario specifies inferring true/false outcomes, which implies a blind injection context where direct data is not shown.

Boolean-based relies on observing differences in application responses (like text changes) for true/false conditions. Time-based relies on measuring the delay in server response times to infer truth.

Bug bounties are crowdsourced, ongoing, and incentivized by rewards per finding. Pentests are usually time-bound, scoped engagements performed by specific firms or individuals.

White-hat hacking describes the ethics of the hacker, not the specific business model or platform-based program structure that defines a bug bounty initiative.

Tier-3 is for storage and distribution. Abel is actively verifying and signing, which is a pre-storage security check done in Tier-2.

Tier-1 is for development and initial creation of the image. Tier-2 is for independent testing, validation, and cryptographic signing of that image.

LNMIB2 is a legacy or vendor-specific MIB. MIB-II is the IETF standard (RFC 1213) that universally defines the object types for network interfaces and services mentioned in the scenario.

MIB stands for Management Information Base. It is a virtual database containing network device information managed by SNMP.