312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

The scenario describes the reuse of stolen Kerberos tickets to authenticate to other domain systems without cracking anything and without needing the user’s plaintext password. That behavior aligns directly with a Pass-the-Ticket (PtT) attack. In Kerberos-based environments (such as Active Directory domains), authentication relies on tickets (for example, Ticket Granting Tickets and service tickets). If an attacker can obtain valid ticket material from a compromised host—commonly from memory, credential caches, or ticket stores—they can present (“pass”) the ticket to access services as that user, as long as the ticket is still valid and accepted by the target service.

The key clues are: (1) Devon “intercepts Kerberos authentication material,” (2) “instead of cracking the data, he reuses the stolen tickets,” and (3) he authenticates “directly to other systems within the domain” to access resources. This is the essential advantage of PtT: it bypasses password guessing or hash cracking by leveraging the fact that possession of a valid ticket can be enough to authenticate to services (file shares, application servers, and other Kerberos-protected resources).

The question also rules out common alternatives:

Kerberoasting (C) involves requesting service tickets for SPNs and then offline cracking the encrypted portion to recover service account passwords. Devon is explicitly not cracking anything.

Pass-the-Hash (D) is an NTLM-based technique that reuses NTLM hashes to authenticate. The scenario explicitly states “No NTLM hashes.”

LLMNR/NBT-NS Poisoning (A) is a name-resolution poisoning technique used to capture/relay credentials on a local network. The scenario states no broadcast poisoning was involved and focuses instead on Kerberos ticket reuse.

Therefore, Devon most likely performed B. Pass-the-Ticket Attack.

The correct answer is A. Creepy because the task is specifically about extracting and analyzing geolocation information (geotags) from publicly shared media and mapping that data to real-world locations to infer employee movement patterns. In CEH-aligned reconnaissance/OSINT workflows, geolocation intelligence is a common element of footprinting because it can reveal sensitive operational details such as office locations, travel routines, meeting venues, home addresses, and patterns of presence/absence. Tools designed for geolocation OSINT help testers identify whether staff are unintentionally exposing location metadata through social media posts, uploaded photos, or other public sources.

Creepy is purpose-built for geolocation reconnaissance: it collects location metadata associated with content and presents results in a way that supports mapping and timeline-style analysis, helping analysts correlate people, posts, and coordinates. This directly supports the goal of evaluating whether employees are disclosing sensitive information about office routines by publishing geotagged images. When used in an authorized assessment, such tooling helps demonstrate risk in a measurable way—for example, showing clusters of posts around a specific building, repeated visits at predictable times, or regular travel routes that could support surveillance, targeted social engineering, or physical intrusion planning.

Why the other options are less suitable: Social Searcher is primarily used for monitoring and searching social media content by keywords, usernames, hashtags, and mentions; it is useful for broad OSINT collection but is not specifically focused on geotag extraction and movement mapping. Sherlock is designed to find a username across many platforms, helping link identities, but it does not specialize in geolocation mapping. Maltego is a powerful link-analysis platform that can correlate entities (people, domains, emails, social profiles) and can support OSINT investigations, but for the narrow requirement of extracting and mapping geotagged location data from media, Creepy is the most direct and purpose-specific tool.

Therefore, the best tool for this geotagged image movement analysis task is Creepy.

Non-repudiation is the security principle that prevents a sender from denying having performed a specific action, such as sending a message or approving a transaction. In CEH-aligned cryptography, non-repudiation is most commonly achieved using digital signatures backed by public key cryptography and, in many real-world deployments, supported by digital certificates and a trusted certificate authority. When Alice digitally signs the email contract, she uses her private key to create a signature that is mathematically tied to both her identity and the exact content of the message. Bob can then use Alice’s corresponding public key to verify the signature. If verification succeeds, it provides strong evidence that the message originated from the holder of Alice’s private key and that the content has not been altered since it was signed.

This is different from confidentiality, which is about preventing unauthorized disclosure of message contents through encryption. It is also distinct from integrity alone: integrity ensures the message was not modified, but non-repudiation adds accountability by binding the action to a specific signer in a way that can be demonstrated to a third party. Availability is unrelated here, as it concerns ensuring systems and data are accessible when needed.

CEH materials emphasize that non-repudiation depends on proper key management and trust infrastructure. If Alice’s private key is compromised, the evidentiary value is weakened. Therefore, protecting private keys with secure storage, access controls, and revocation mechanisms is essential to preserve non-repudiation.

White Hat Hacking is defined in CEH v13 as ethical hacking performed with explicit authorization to identify and remediate vulnerabilities. White hat hackers operate within legal frameworks and contractual agreements.

Grey hats act without permission but without malicious intent. Black hats conduct illegal attacks. Blue hats are external testers invited to find bugs before product release.

Thus, Option C is correct.

The correct answer is A. Activating Dynamic ARP Inspection to validate ARP packets.

The scenario describes a switch discarding ARP replies that do not match known IP-to-MAC and address-to-port bindings. This is the function of Dynamic ARP Inspection (DAI).

CEH-aligned sniffing and ARP defense material states that Dynamic ARP Inspection is used with DHCP snooping, where IP-to-MAC bindings are tracked from DHCP transactions to protect against ARP poisoning. It also notes that DHCP snooping is required to build the MAC-to-IP bindings used for DAI validation . The same material lists the configuration command ip arp inspection vlan < vlan number > and the verification command show ip arp inspection .

Option B is incorrect because displaying the DHCP snooping table only verifies bindings; it does not enforce ARP validation.

Option C is incorrect because DHCP Snooping builds the trusted binding database, but DAI is the feature that validates and drops invalid ARP packets.

Option D is incorrect because BPDU Guard protects spanning-tree edge ports from unexpected BPDUs. It does not validate ARP packets.

Therefore, the best answer is A. Activating Dynamic ARP Inspection to validate ARP packets.

The correct answer is D. Expansion because the scenario emphasizes that, after the initial foothold, the attacker harvests credentials and moves laterally to compromise additional systems—routers, printers, and file servers—thereby broadening control across the internal environment. In CEH-aligned APT lifecycle descriptions, this stage is commonly associated with internal reconnaissance, privilege/credential access, lateral movement, and widening the foothold to increase resilience and reach. The attacker is no longer limited to the original compromised endpoint; instead, they are deliberately spreading to other networked assets to build operational advantage.

The sequence in the prompt is important. Initial Intrusion (A) already occurred via spear-phishing delivering the first payload to the manager’s laptop. The question asks what phase is being simulated at this point, after access is gained and the attacker is actively moving through the network. Persistence (B) refers to establishing mechanisms to maintain access (e.g., backdoors, scheduled tasks, services, persistence in credentials/accounts) so the attacker can survive reboots, password changes, or cleanup attempts. While an attacker might establish persistence during expansion, the defining action here is lateral movement and compromise of multiple internal systems, which is more directly expansion than persistence.

Search & Exfiltration (C) would involve identifying and collecting target data (in this case, sensitive research data) and transferring it out of the environment. The prompt explicitly states Alex has not yet targeted sensitive research data, which rules out the search/exfiltration phase as the primary activity being simulated right now.

Therefore, the phase of the APT lifecycle best matching credential harvesting followed by lateral movement and compromise of multiple internal devices/servers to build a broader foothold is Expansion.

CEH teaches that ARP-based attacks vary in sophistication from basic poisoning to more specialized techniques such as switch port stealing. In environments where ARP poisoning defenses or inspection tools limit traditional attacks, attackers may exploit timing vulnerabilities in ARP reply behavior. Switch port stealing works by sending spoofed ARP replies at precisely the right moment—before the legitimate ARP response from the target host—causing the switch’s CAM table to update temporarily and associate the target’s IP address with the attacker’s MAC address. CEH emphasizes that switches trust the latest ARP update, so even brief timing windows enable partial packet interception. This is different from fully persistent ARP poisoning, which continuously overwrites ARP tables, and from passive sniffing, which cannot capture unicast traffic on a switched network. This attack is particularly useful when ARP spoofing is mitigated because it relies on opportunistic timing rather than full table poisoning. The intermittent nature of intercepted packets matches CEH’s description of switch port stealing behavior.

The correct answer is B. TCP. Sequence and acknowledgment numbers are key features of the Transmission Control Protocol. In CEH networking and session hijacking concepts, TCP is a connection-oriented protocol that establishes communication using the three-way handshake: SYN, SYN/ACK, and ACK. TCP uses sequence numbers to track byte order and acknowledgment numbers to confirm receipt of data. CEH-aligned references explain that TCP session hijacking depends on tracking session traffic, predicting sequence numbers, desynchronizing the connection, and injecting packets that appear valid to the target system. TCP is therefore the protocol associated with attacks involving manipulation of sequence and acknowledgment values. ICMP is mainly used for control and diagnostic messaging, such as ping and error reporting. UDP is connectionless and does not maintain TCP-style sequence and acknowledgment numbers. IP provides addressing and routing, but it does not manage reliable sessions or acknowledgments. Because the question specifically mentions manipulating sequence and acknowledgment numbers during a MITM/session hijacking scenario, TCP is the best answer.