312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

The vulnerability described is characteristic of XML External Entity (XXE) Injection. In CEH web application security coverage, XXE occurs when an application parses XML input without properly disabling external entity resolution. If the XML parser is configured insecurely, an attacker can define a malicious external entity that references local files or internal system resources. When the parser processes the XML document, it resolves the external entity and may return the contents of sensitive files in the server’s response.

The scenario clearly states that the issue arises from “handling of external references in document parsing” and results in exposure of internal file paths and database connection strings. This aligns directly with XXE behavior, where attackers leverage external entity declarations to retrieve local files such as configuration files, environment settings, or system credentials. In some cases, XXE can also enable server-side request forgery by forcing the server to make internal network requests.

The other options do not match the described behavior. Identification and authentication failures relate to improper access controls, not document parsing. HTTP response splitting involves manipulating headers to inject malicious responses. Security logging and monitoring failures refer to detection gaps, not data exposure through parsing. CEH-recommended mitigation strategies include disabling DTD processing, turning off external entity resolution in XML parsers, validating input formats, implementing least privilege on file access, and using secure parsing libraries that prevent XXE exploitation.

The correct answer is C. Impersonation.

The scenario’s central action is that the assessor pretends to be a third-party IT technician to gain trust and physical access. CEH-aligned social engineering material defines impersonation as a technique where the social engineer pretends to be someone or something he or she is not, such as an employee, valid user, repairman, executive, help desk person, or IT security expert. This can result in physical access to restricted areas and disclosure of sensitive information, including credentials .

Option A. Shoulder Surfing is incorrect because shoulder surfing specifically involves looking over a user’s shoulder to observe credentials or sensitive activity. Although the assessor observes the environment, the primary technique used to gain access is impersonation.

Option B. Eavesdropping is incorrect because eavesdropping involves covertly listening to conversations or communications.

Option D. Dumpster Diving is incorrect because dumpster diving involves searching through trash or discarded materials for useful information. Sticky notes and printouts are mentioned, but the defining technique is the assumed identity of an IT technician.

Therefore, the best answer is C. Impersonation.

CEH v13 explains that mobile antivirus solutions rely heavily on signatures and known exploit patterns. A custom exploit using obfuscation is far more likely to evade detection.

Metasploit payloads and rootkits are commonly flagged, and SMS phishing relies on user interaction. Therefore, custom obfuscated exploit code is the most stealthy and effective method.

In CEH v13 Cryptography, this threat is formally referred to as “Harvest Now, Decrypt Later” (HNDL). It describes a long-term cryptographic risk where adversaries intercept and store encrypted communications today, even though they cannot decrypt them with current computational capabilities. The expectation is that future quantum computers will be powerful enough to break widely used public-key cryptographic algorithms.

CEH v13 emphasizes that quantum algorithms such as Shor’s Algorithm can theoretically break RSA, DSA, and ECC by efficiently solving integer factorization and discrete logarithm problems. However, the defining feature of this threat is not the act of breaking encryption itself, but rather the strategic collection and storage of encrypted data in advance.

Option C is incomplete because it focuses only on the cryptographic mechanism rather than the threat model. Options B and D are unrelated to the scenario described and refer to quantum communication integrity issues, not long-term cryptographic exposure.

CEH v13 highlights that sensitive data with long confidentiality lifetimes—such as government records, financial data, healthcare information, and intellectual property—is especially vulnerable to this threat. As a result, organizations are encouraged to adopt quantum-resistant (post-quantum) cryptographic algorithms proactively.

Thus, Option A accurately describes the threat model and aligns with CEH v13’s treatment of future cryptographic risks.

The most critical benefit in this scenario is scalability. CEH-aligned guidance on modern ethical hacking emphasizes that large, distributed enterprise environments create a fundamental operational challenge: the number of assets, configurations, cloud services, and remote endpoints is too large for purely manual assessment methods to maintain consistent coverage within acceptable timelines. The question highlights exactly this constraint by stating “highly complex and distributed” infrastructure and the “sheer scale of the environment.” An AI-driven platform that “automatically scans the entire network” and continuously flags anomalies is primarily valuable because it can expand assessment coverage across many systems simultaneously, helping the red team evaluate more of the attack surface efficiently.

While predictive analysis is a real AI capability, the scenario’s success requirement is not forecasting future attacks; it is executing assessment activities at enterprise scale and keeping pace as conditions change. Simulation and testing is what red teams do regardless of AI, but AI’s differentiator here is the ability to perform continuous, large-scale discovery and prioritization across cloud, servers, and endpoints without proportional increases in human effort. Enhanced reporting helps communicate results, but it is not the primary operational limiter described.

Additionally, the prompt mentions adapting detection models as new behaviors appear. That supports continuous operation, but the deciding factor is still the ability to operate across a massive environment and maintain broad visibility. Therefore, scalability is the key benefit most critical to success in this scenario.

The correct answer is A. Design Flaws because the weaknesses originate from fundamental development-time decisions in how the application was architected—specifically (1) selecting or creating a weak custom encryption algorithm and (2) implementing session validation in a way that allows requests to bypass access controls. In CEH-aligned vulnerability classification, design flaws are problems embedded in the application’s design and logic, not merely bugs from implementation mistakes, misconfiguration of a server setting, or missing vendor patches. They are often systemic: even if the code is “working as intended,” the intent itself is insecure.

The prompt explicitly states the issues are “traced back to flawed system logic and poor encryption design decisions made during the development phase.” That description maps directly to design flaws: using “homegrown crypto” instead of vetted cryptographic primitives and protocols is a classic design error because it typically lacks proper peer review, threat modeling, and proven resistance to cryptanalysis. Likewise, session validation that permits bypassing access controls indicates the application’s authorization/session model was designed incorrectly (for example, trusting client-side state, failing to enforce server-side checks consistently, or allowing unauthenticated endpoints to access privileged operations).

Why the other options are less accurate: Application flaws is a broad label that can include coding bugs, but the question is asking for the best category given that the root cause is architectural decisions rather than a narrow coding mistake. Misconfigurations/weak configurations usually refer to insecure settings in deployment (default credentials, permissive headers, weak TLS configuration), not a custom crypto algorithm and flawed session logic baked into the app. Poor patch management concerns failing to update known vulnerable components; here, the weakness is custom logic, not an unpatched third-party vulnerability.

Therefore, the most accurate category for these development-phase encryption and session/authorization weaknesses is Design Flaws.

Side-channel attacks, as explained in CEH v13 OT and SCADA Security, extract sensitive information by observing physical characteristics of a system rather than exploiting software flaws directly. These characteristics may include power consumption, electromagnetic emissions, timing variations, or thermal output.

In SCADA environments, side-channel attacks are especially dangerous because they bypass traditional network defenses. The most reliable way to confirm such an attack is by analyzing hardware-level anomalies—such as unexpected power usage spikes or irregular signal emissions during normal device operations.

Option B directly aligns with CEH v13 guidance.

Options A, C, and D focus on software, cryptography, or network behavior, which are not primary indicators of side-channel exploitation.

Therefore, Option B is correct.

The correct answer is A. Key Reinstallation Attack (KRACK).

The scenario describes retransmitting a captured WPA2 handshake message so that the client reinstalls an already negotiated key. This is the defining behavior of KRACK, or Key Reinstallation Attack.

CEH wireless material explains that KRACK is a replay-style attack against WPA2 that abuses the four-way handshake. By repeatedly replaying the third handshake message, an attacker can cause the victim to reinstall the same encryption key, which can result in reuse of cryptographic values and weakening of traffic protection .

Option B. Replay Attack is too general. KRACK uses replay behavior, but the specific wireless technique is key reinstallation.

Option C. Man-in-the-Middle Attack is also too broad because the core weakness is not merely interception but forced key reinstallation.

Option D. WPA2 PSK Offline Cracking is incorrect because the scenario does not describe capturing a handshake and cracking the pre-shared key offline.

Therefore, the best answer is A. Key Reinstallation Attack (KRACK).