312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

The CEH Malware and Rootkit Analysis module emphasizes that kernel-level rootkits compromise the most trusted components of the operating system. Once a kernel is compromised, no tool running on that system can be fully trusted.

CEH explicitly states that the only reliable remediation for kernel-mode rootkits is:

Full system wipe

Reinstallation from a known, trusted source

Restoration of verified clean data

Option C is correct and represents CEH best practice.

Option A may work for user-mode rootkits but is unreliable for kernel-level infections.

Option B is a research tactic, not remediation.

Option D is containment, not eradication.

Jordan is in the vulnerability scanning step because he has already moved past identification/cataloging (information gathering) and is now actively testing IoT devices for weaknesses such as outdated firmware, default credentials, and exposed/open service ports. In IoT hacking methodology, information gathering focuses on discovering devices, mapping the environment, identifying device types, interfaces, protocols, and versions, and understanding how data flows between endpoints, gateways, mobile apps, and cloud services. Once that baseline inventory exists, the next step is to assess the devices and their ecosystem components for known and observable security gaps.

The specific checks described are classic vulnerability scanning targets in IoT environments:

Outdated firmware can indicate known vulnerabilities, missing security fixes, and unpatched components.

Default passwords are a common IoT weakness and can enable trivial compromise when not changed.

Open service ports reveal exposed management interfaces or unnecessary services that can be enumerated or exploited.

Running “specialized tools” to systematically evaluate these elements is consistent with vulnerability scanning because it is structured assessment aimed at finding exploitable conditions, but it stops short of actually exploiting or establishing persistence.

Why the other options do not fit:

Information gathering (C) would focus on identifying devices and collecting details, not actively checking them for outdated firmware/default passwords/open ports as vulnerabilities.

Gain remote access (B) implies exploitation or obtaining unauthorized control/access, which the scenario does not indicate—he is checking and assessing.

Launch attacks (D) implies executing exploitation, disruption, or compromise steps. The question explicitly frames this as testing for weaknesses, not carrying out attacks.

Therefore, Jordan is performing A. Vulnerability scanning.

The correct answer is C. Regenerate the session ID after a successful login.

The scenario describes session fixation. In a session fixation attack, the attacker causes the victim to use a known session identifier before authentication. After the victim successfully logs in, the application continues using the same session ID, allowing the attacker to reuse that fixed value.

CEH-aligned session hijacking material explains that session fixation allows an attacker to provide a valid session ID and force the victim’s browser to use it. After the victim logs in, the web server continues the same session, and the attacker can use the known session ID to access the legitimate user account . CEH web application material also states that if an application uses the same session ID before and after login, it can result in session fixation; therefore, the application must generate a new session ID before and after login and invalidate the old one on termination .

Option A is incorrect because cache directives reduce caching of sensitive responses but do not prevent fixed session IDs.

Option B is incorrect because SSL/TLS protects traffic in transit, but it does not stop an attacker from pre-setting a session identifier.

Option D can reduce exposure, but the direct and standard countermeasure is regenerating the session ID after successful authentication.

Therefore, the best answer is C. Regenerate the session ID after a successful login.

In CEH’s Cloud Computing module, one of the most common real-world causes of cloud data exposure is misconfiguration, especially overly permissive network access controls. Cloud platforms commonly use constructs like security groups / firewall rules / network ACLs to define inbound and outbound access. CEH highlights that exposing sensitive services (databases, storage endpoints, admin panels) to the public internet—whether by “0.0.0.0/0” rules, overly broad ports, or unintended administrative access—frequently results in unauthorized access and data leakage even without sophisticated exploit chains.

Option D is therefore the most likely, because misconfigured security groups can directly expose customer data stores or management interfaces, enabling data theft through normal connectivity rather than exploiting a rare hypervisor flaw.

Option A (hypervisor side-channel attack) is advanced and less common; it typically requires high attacker capability and conditions not implied here. Option B (DoS) impacts availability, not confidentiality, so it doesn’t best explain data exposure. Option C (brute force passwords) is possible, but the question emphasizes an “unknown vulnerability” in the cloud environment—CEH teaching often frames “unknown vulnerability” in cloud incidents as misconfiguration or uncontrolled exposure rather than authentication guessing alone.

CEH countermeasures include least-privilege security group rules, segmentation, continuous configuration monitoring, cloud security posture management, and auditing publicly exposed resources.

The correct answer is F because the Windows Administrator account is identified by its RID value, not merely by the visible username. In Windows enumeration, a Security Identifier, or SID, uniquely identifies user, group, and computer accounts. The last portion of the SID is the Relative Identifier, or RID. CEH-aligned material explains that Windows uses SIDs and RIDs to track account rights and permissions, and the RID value 500 identifies the built-in Administrator account. The Guest account normally uses RID 501, while standard created users usually begin at 1000 and increment upward. Therefore, when SIDExtractor displays multiple users, the account whose SID ends in -500 is the system administrator account, even if the Administrator account has been renamed. Enumeration tools such as sid2user and user2sid are used to map usernames to SIDs and SIDs to usernames. In this question, John corresponds to the administrator RID, so option F is correct.

CEH v13 identifies URL parameters used in dynamic SQL queries as common injection points. When user-controlled values are passed directly into database queries without validation, attackers can manipulate query logic. Injecting a test payload such as 1 OR 1=1 into the userID parameter is a standard method to determine whether the application concatenates input into SQL statements. If the page displays all user orders instead of only the authenticated user ' s orders, this confirms SQL injection. CEH teaches that conditional tautologies are one of the safest and most reliable ways to probe SQL vulnerabilities, especially in GET parameters. JavaScript injection (Option A) tests XSS, not SQLi. Directory traversal (Option C) targets filesystem issues, not database logic. Brute-forcing user credentials (Option D) does not test query sanitization. Therefore, modifying the userID parameter with a SQL injection payload is the correct CEH-aligned method.

The symptoms strongly match MAC flooding, a classic Layer 2 sniffing-related attack discussed in CEH under switch-based network attacks. Ethernet switches maintain a CAM table that maps MAC addresses to physical switch ports. This table allows the switch to forward frames only to the correct destination port, preventing other hosts from seeing traffic not intended for them. In a MAC flooding attack, an attacker generates a very large number of frames with spoofed, random source MAC addresses. The goal is to overflow the switch CAM table so it can no longer reliably store legitimate MAC-to-port mappings.

When the CAM table is full or unstable, many switches fail open by flooding frames out of multiple ports, behaving more like a hub for unknown destinations. That leads to exactly what Marcus observes: devices on segments that should be isolated start receiving traffic they normally would not see, and overall performance degrades due to excessive broadcast-like forwarding. The prompt also mentions “abnormal traffic patterns overwhelming the network,” which aligns with the high-volume frame injection required to poison or overflow the CAM table.

ARP poisoning would primarily redirect traffic through the attacker by manipulating IP-to-MAC mappings within a VLAN, but it would not typically cause widespread flooding and generalized delays across multiple VLANs. DNS cache poisoning affects name resolution rather than Layer 2 forwarding behavior. Switch port stealing targets a specific victim MAC entry to redirect that host’s traffic, but the widespread flooding and overload indicators are more characteristic of MAC flooding. Therefore, MAC flooding is the most likely technique in this scenario.

The correct answer is B. NetBIOS Enumeration because the ports and services described map directly to NetBIOS over TCP/IP (NBT) and the actions align with querying NetBIOS name table and session services. In Windows networking (especially older systems), NetBIOS provides naming and session-layer services that can reveal valuable host and user information. Specifically, UDP 137 is used for the NetBIOS Name Service (NBNS), UDP 138 for NetBIOS Datagram Service, and TCP 139 for NetBIOS Session Service. Observing activity on UDP 137/138 and an open TCP 139 strongly indicates that NetBIOS services are reachable and can be interrogated.

The scenario states Jake “uses a utility to query the name table and session services,” which is a hallmark of NetBIOS enumeration. NetBIOS name table queries can disclose machine names, domain/workgroup names, and sometimes logged-in usernames (depending on configuration and what names are registered). Session/service enumeration can reveal information about active sessions and available resources. The fact that Jake obtains machine names, usernames, and shared folders without authentication is consistent with weakly configured legacy Windows networking where NetBIOS/SMB information disclosure is possible through null/unauthenticated queries.

Why not the other options: NFS enumeration targets UNIX/Linux file sharing and is unrelated to ports 137–139. SNMP enumeration uses UDP 161/162 and relies on SNMP communities, not NetBIOS naming/session queries. SMB enumeration is closely related and often overlaps operationally, but the question emphasizes “query the name table and session services” and explicitly references the classic NetBIOS port set (137/138/139), making NetBIOS enumeration the most precise classification for this behavior.

In practice, defenders mitigate this exposure by disabling NetBIOS where unnecessary, restricting these ports at network boundaries, enforcing SMB hardening, and limiting anonymous/null session information disclosure.