312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

According to CEH v13 Cloud Computing, backup integrity and resilience are critical components of cloud security. The 3-2-1 backup model is a widely recommended best practice to mitigate unauthorized access, data corruption, and ransomware-related incidents.

The 3-2-1 rule dictates that organizations should maintain:

3 copies of critical data

Stored on 2 different media types

With 1 copy stored offsite or offline

This approach ensures that even if one backup is compromised, altered, or deleted—as described in the scenario—clean and trusted versions of the data remain available for restoration. CEH v13 emphasizes that offline or immutable backups significantly reduce the impact of malicious modification.

Option A focuses on physical security, which does not protect cloud backups. Option B addresses availability, not integrity. Option C is relevant to web application security, not backup protection.

CEH v13 explicitly highlights backup segregation and redundancy as key countermeasures against cloud data compromise. Therefore, Option D is the most direct and effective mitigation strategy.

The correct answer is D. SnmpWalk.

The scenario describes SNMP enumeration. SNMP uses a Management Information Base (MIB), which stores information in a hierarchical structure using object identifiers, or OIDs. CEH-aligned material explains that SNMP agents respond to requests by retrieving data from the MIB, and that MIB entries can identify the device, operating system, and usage statistics . Another reference describes the MIB as a hierarchically organized virtual database accessed through SNMP and addressed by OIDs .

SnmpWalk is the correct tool because it walks through the SNMP MIB tree and returns exposed management data such as device identifiers, contact information, interfaces, counters, and other OID-based values. The Red Team reference also shows practical snmpwalk usage for enumerating SNMP-exposed information such as services, open ports, installed software, users, and shared files .

Option A. SoftPerfect Network Scanner is incorrect because it is a general network scanning tool, not the specific command-line SNMP MIB traversal tool described.

Option B. Wireshark is incorrect because Wireshark is primarily used for packet capture and traffic analysis. The question specifically states that Jason does not want to passively observe traffic.

Option C. Nmap is incorrect because Nmap can perform scanning and some SNMP-related NSE checks, but the requirement is to systematically traverse the SNMP management object tree and redirect the complete output.

Option D. SnmpWalk is correct because it is designed to walk the SNMP MIB hierarchy and collect exposed SNMP data for review or automated processing.

Therefore, the best answer is D. SnmpWalk.

CEH v13 explains that reflected XSS occurs when malicious input supplied by an attacker is immediately returned in the HTTP response without sanitization. This type of XSS is typically exploited through a crafted URL containing embedded JavaScript payloads. When a victim clicks the link, the vulnerable server reflects the injected script back to the browser, executing it within the user’s session context. CEH emphasizes that reflected XSS relies on social engineering to deliver the payload, often via links sent through email, messaging platforms, or compromised pages. The goal may include stealing session cookies, redirecting users, or manipulating page content. Brute-forcing credentials (Option A) has no relation to XSS. SQL injection (Option C) targets backend databases, not client-side script execution. Directory traversal (Option D) concerns file path manipulation, not dynamic script injection. Therefore, embedding a malicious script in a URL is the correct method to exploit reflected XSS.

In CEH v13 Reconnaissance Techniques, passive monitoring of competitors’ online presence is a legitimate and effective intelligence-gathering activity. One of the most efficient tools for this purpose is Google Alerts.

Google Alerts allow analysts to receive automated notifications when new content containing specific keywords—such as company names, products, or executives—is indexed online. This enables continuous, passive surveillance without repeatedly visiting websites manually.

Option B directly addresses the analyst’s goal of staying updated efficiently.

Option A is illegal and unethical.

Option C involves direct interaction, which may reveal the analyst’s presence.

Option D provides anonymity but does not actively monitor changes.

CEH v13 strongly encourages automation in reconnaissance to reduce noise, effort, and detection risk. Therefore, Option B is the correct and CEH-aligned answer.

CEH v13 highlights the Idle Scan as one of the stealthiest reconnaissance methods available, designed specifically to avoid detection by IDS and security monitoring tools. Idle scanning leverages a “zombie host”—a system with a predictable IPID sequence—to route all probe packets through it. Since no packets ever originate directly from the attacker’s IP, IDS systems are unable to attribute the port scan to the attacker. CEH emphasizes that this technique creates zero direct traffic between the attacker and the target, making it extremely evasive and ideal for highly monitored networks. FIN scans (Option A) are somewhat stealthy but still originate from the attacker and are detectable. TCP Connect scans (Option C) are the most detectable because they complete full connections. ICMP Echo scans (Option D) are easily logged and flagged by IDS. Idle scanning is uniquely suited for bypassing advanced detection systems while still identifying open ports and live hosts.

The correct answer is Clone Phishing. CEH social engineering material explains that clone phishing occurs when an attacker takes a legitimate message previously received by the victim, duplicates its appearance and content, and modifies a malicious element such as a link or attachment. That matches this scenario exactly: the attacker reused genuine branding, the original format, sender display style, and subject line, then changed the embedded hyperlink so users would reauthenticate on a fake portal. Consent phishing is a different cloud-focused technique involving malicious OAuth authorization requests. Search engine phishing relies on manipulating search results so victims voluntarily navigate to a fake site. Tabnabbing involves changing the content of an inactive browser tab to a phishing page. None of those fit as closely as clone phishing. CEH guidance stresses that clone phishing is highly convincing because the message is based on a real prior communication that the victim may remember and trust. Since the attacker preserved almost everything from a legitimate message and altered only the actionable malicious link, the scenario is a textbook example of Clone Phishing.

The correct answer is C because LSASS, or Local Security Authority Subsystem Service, is a Windows process responsible for authentication-related operations. CEH system-hacking concepts associate LSASS access with attempts to extract credentials, password hashes, cached logon data, and Kerberos tickets from memory. The referenced CEH-aligned guide explains that Windows stores password hashes in memory while a user is logged on and that these hashes are loaded into LSASS, which is responsible for user authentication. It also notes that tools such as Mimikatz can extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Red-team material similarly links LSASS process dumping and Mimikatz analysis with extracting information from memory. Therefore, unknown processes accessing LSASS memory strongly indicate credential dumping. SQLi and XSS are web application attacks, and DoS targets availability, not authentication secrets.

The correct answer is B. Worm because the defining behavior described is self-replication and autonomous propagation across multiple systems without requiring additional user interaction after the initial infection. In CEH-aligned malware classifications, a worm is a standalone malicious program that can spread automatically over networks by copying itself to other hosts. Worms commonly leverage shared resources (such as shared folders), weak configurations, and credential weaknesses (such as weak administrative passwords or credential reuse) to move laterally and infect additional machines at scale.

The scenario includes multiple classic worm characteristics: (1) only one workstation is initially targeted, (2) the malware then “automatically copies itself into shared folders,” and (3) it spreads using “weak admin credentials,” resulting in rapid infection of “dozens of computers.” That pattern fits worm propagation mechanisms such as exploiting administrative shares, remote execution through obtained credentials, and leveraging network-accessible paths to drop copies of itself. The key discriminator is automation: after initial placement, the malware does the rest, scanning for reachable systems or shares and replicating to them without needing a user to click attachments or run the payload again.

Why the other options are not correct: a logic bomb is typically dormant code that triggers a malicious action when a specific condition or time is met; it is not defined by self-propagation. A backdoor provides unauthorized access for later control, but it does not inherently replicate across the network on its own. Fileless malware emphasizes execution primarily in memory using legitimate tools (e.g., PowerShell/WMI) and minimal disk artifacts; while fileless techniques can be used for lateral movement, the scenario’s emphasis is on the malware copying itself into shared folders and spreading widely, which is the hallmark of a worm.

Therefore, Sophia is most likely demonstrating a worm.