312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

CEH defines botnets as networks of compromised machines controlled remotely to perform coordinated activities such as DDoS attacks, spam campaigns, and credential theft. Systems showing outbound connections to unknown IPs and participating in mass spam dissemination are characteristic indicators of botnet infection.

The correct answer is B. Stealth Virus because the defining characteristic described is hiding malicious presence by intercepting operating system calls and masking changes so that normal tools (including antivirus scans) do not observe the infection. In CEH-aligned malware concepts, stealth viruses are designed to evade detection by concealing modifications to files, boot records, or system areas. They commonly do this by hooking system functions or APIs so that when the OS or a security product requests file contents, sizes, checksums, directory listings, or other metadata, the virus returns clean-looking or original data instead of the infected/modified version. This makes infected files appear to “function normally,” while the malware remains active in memory and persists on disk.

The scenario explicitly mentions that “infected files continue to function normally” and that the malware “conceals its modifications by intercepting operating system calls.” That is the classic behavior of stealth techniques: manipulate what the system reports, not necessarily change the outward behavior of the application. The repeated “no threats detected” results also align: signature-based or basic scanning can be blinded when the malware controls the interface through which the scanner reads target files or system structures.

Why the other options are less correct: a polymorphic virus focuses on changing its code/signature between infections to evade signature-based detection, but the key clue here is OS call interception and hiding modifications, not code mutation. A macro virus targets macro-enabled documents and spreads through macro execution in office applications; it is not primarily defined by OS-level call hooking. A cavity virus (spacefiller) hides by inserting itself into unused areas of a file without changing the file size, but the scenario’s emphasis is on intercepting OS calls to conceal changes, which is more directly the stealth-virus behavior.

Therefore, Ryan most likely deployed a stealth virus.

The correct answer is C. HTTP/S Tunneling.

The scenario describes persistent outbound command-and-control traffic that resembles legitimate service requests and is designed to pass through normal egress controls. HTTP and HTTPS traffic are commonly allowed through perimeter firewalls, making HTTP/S tunneling a strong match.

CEH firewall-evasion material describes HTTP tunneling as a method of bypassing firewall restrictions by encapsulating attacker data inside HTTP traffic, allowing activity to pass through permitted web ports such as port 80 . CEH material also describes a reverse WWW shell in which an internal host makes what appears to be a legitimate HTTP request to an attacker-controlled web server, while the returned response actually contains commands for the compromised host to execute .

Option A. ICMP Tunneling is incorrect because ICMP tunneling uses ICMP echo request/reply traffic, not web-like service requests.

Option B. TCP Sequence Tunneling is incorrect because the scenario does not describe hiding data in TCP sequence fields.

Option D. DNS Tunneling is incorrect because DNS tunneling usually appears as unusual DNS queries and encoded subdomains, not web-service-like request/response behavior.

Therefore, the best answer is C. HTTP/S Tunneling.

The scenario describes a program that appears legitimate (a software update installer that “functions normally”) while secretly placing additional malicious components onto the system, which later execute to establish remote access. That is the defining behavior of a dropper. A dropper’s primary role is to deliver (drop) malware payloads onto a host—writing files to disk or unpacking embedded components—often while disguising itself as a benign application. The malicious components may then be executed immediately or staged for later activation to reduce suspicion and increase persistence.

This differs from a downloader, which typically contains minimal payload and focuses on contacting a remote server to fetch malware after initial execution. In this case, the description emphasizes that “additional malware components are silently placed on the system,” implying the payload is being installed/deposited locally by the initial program rather than primarily downloaded. An injector focuses on injecting code into another running process (process injection) to evade detection or run under another process context; it does not inherently describe the act of placing additional components as separate hidden files. A wrapper is a technique where a malicious program is bound or “wrapped” with a legitimate one so that both run; while wrappers can be used in trojanized installers, the question emphasizes the behind-the-scenes placement of additional components for later activation, which is the classic dropper behavior.

The key indicators are: (1) user executes an installer that appears normal, (2) hidden malware components are deposited without the user’s knowledge, and (3) those components later activate for remote access. That chain matches a dropper’s purpose: stealthy malware delivery and staging.

Therefore, the correct answer is D. Dropper.

The correct answer is D. Detect.

The activity described is the continuous review of enterprise operational data to identify irregular patterns that may indicate malicious activity. This is a detection function.

CEH-aligned IDS material explains that intrusion detection systems monitor packets and attempt to discover whether an attacker is trying to break into a system or cause a denial-of-service condition. It also describes anomaly detection as measuring a baseline of activity, such as CPU utilization, disk activity, user logins, and file activity, so that abnormal behavior can be identified .

Option A. Predict is incorrect because prediction focuses on anticipating risks and likely threats before they occur.

Option B. Protect is incorrect because protection focuses on safeguards and controls that reduce the likelihood or impact of attacks.

Option C. Respond is incorrect because response occurs after an event or incident is detected.

Option D. Detect is correct because the team is monitoring data to identify suspicious or abnormal behavior.

Therefore, the best answer is D. Detect.

CEH v13 teaches that NetBIOS enumeration is a key technique for gathering information in Windows environments without raising alarms. Ports 137 and 139 indicate that NetBIOS Name Service (NBNS) and SMB services are active. The tool nbtstat -A < IP > retrieves valuable information including computer names, logged-in users, domain/workgroup membership, and system roles—all passively and without authentication. CEH emphasizes that querying NetBIOS is often overlooked by defenders and generates minimal noise, making it ideal for stealth enumeration. LDAP enumeration (Option A) requires directory access and tends to trigger logs. Psloggedon and pspasswd (Options B and D) involve active interaction and authentication attempts, which are far more detectable. nbtstat is the CEH-recommended tool for initial reconnaissance on Windows networks using NetBIOS and SMB, especially when quiet enumeration is required.

A Distributed Control System (DCS) is the best match because the scenario describes multiple automated control loops (temperature, pressure, conveyor speed) that are coordinated by a centralized supervisory network linking multiple controllers across a facility. In industrial environments, a DCS architecture distributes control functions across many controllers located near the process equipment, while supervisory control and operator interfaces coordinate and monitor the overall process. This makes DCS common in continuous and process industries such as steel, chemical, oil and gas, and manufacturing plants where many interdependent loops must operate reliably together.

The scenario’s “centralized supervisory network” is a key DCS hallmark: operators and supervisory systems (often including engineering workstations and HMIs) provide centralized monitoring, setpoints, alarms, and coordination, while the actual loop control is executed by distributed controllers. This differs from a single isolated controller or purely manual operation. The purpose is to maintain stable process control and ensure coordinated behavior across different production areas.

Why the other options don’t fit:

A manual loop (A) implies human-operated control rather than automated feedback loops. The plant is described as having “numerous automated loops,” so manual loop is incorrect.

Open loop (C) control does not use feedback from the output to adjust the input; it is not typical for precise regulation of temperature and pressure where feedback is essential.

Closed loop (D) does describe feedback-based regulation and is true of many industrial loops; however, the question asks for the OT system concept applied based on the overall facility design—specifically a supervisory network coordinating multiple controllers—pointing to the architecture (DCS) rather than the loop type.

Therefore, the correct answer is B. Distributed Control System (DCS).