312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

The correct answer is D. SOA.

The SOA, or Start of Authority, record identifies the primary name server for a DNS zone and contains important administrative and technical information about that zone. The CEH reconnaissance reference states that the SOA record identifies the primary name server and contains the hostname of the server responsible for DNS records within the namespace, along with the basic properties of the domain .

The SOA record also provides zone metadata including:

Source host

Contact email

Serial number

Refresh time

Retry time

Expire time

TTL

These details match the question’s requirement to identify administrative and technical DNS metadata such as the serial number and refresh interval .

Option A. TXT is incorrect because TXT records usually store arbitrary text values, such as SPF, DKIM, DMARC, ownership verification, and other policy data. They do not provide zone authority metadata such as serial number or refresh interval.

Option B. MX is incorrect because MX records identify mail exchange servers for a domain, but they do not provide full zone administration details.

Option C. NS is incorrect because NS records identify authoritative name servers, but they do not include serial number, refresh time, retry time, expire time, or TTL values.

Option D. SOA is correct because it provides both the authoritative DNS information and administrative zone parameters needed during DNS reconnaissance.

Therefore, the best answer is D. SOA.

The correct answer is D. Botnet Agents.

The scenario describes multiple infected machines that periodically contact a central command server, receive instructions, and generate coordinated traffic when directed. These compromised systems are functioning as botnet agents, also called bots or zombies.

CEH-aligned DoS/DDoS material explains that a botnet is typically created by installing a bot on a victim system using a Trojan horse. Once executed, the victim system becomes infected and waits for instructions from a command-and-control handler. The handler then sends instructions to infected systems to perform attacks . Another reference explains that botnets are networks of hacked machines controlled remotely without the owners’ knowledge and used like an army to launch attacks against targets .

Option A. Spyware is incorrect because spyware primarily gathers user activity or sensitive data.

Option B. Scareware is incorrect because scareware tricks users with fake warnings to make them install software or pay for fraudulent services.

Option C. Potentially Unwanted Applications (PUAs) is incorrect because PUAs may be unwanted or intrusive, but they do not necessarily act as remotely controlled attack agents.

Option D. Botnet Agents is correct because the infected endpoints receive commands from a central controller and participate in coordinated activity.

Therefore, the best answer is D. Botnet Agents.

This refers to the CVSS (Common Vulnerability Scoring System), which CEH v13 identifies as the industry standard for vulnerability prioritization. A score of 9.8 indicates critical severity, combining metrics such as exploitability, impact, privileges required, and scope.

CVSS helps organizations prioritize remediation objectively, focusing resources on vulnerabilities with the highest business risk. It also allows consistent communication between technical and management teams.

Options B, C, and D misrepresent CVSS functionality. Therefore, Option A is correct.

According to the Certified Ethical Hacker (CEH) IDS/IPS and Evasion Techniques module, packet fragmentation is a technique attackers use to split malicious payloads into smaller fragments so that signature-based IDS sensors may fail to reassemble and inspect the complete packet.

CEH explains that anomaly-based IDS systems are more effective against fragmentation evasion because they analyze behavioral deviations rather than relying solely on known signatures. Fragmented traffic often deviates from baseline network behavior in terms of packet size, sequencing, and reassembly anomalies.

Option A is correct because anomaly-based detection can identify abnormal fragmentation behavior even if the payload itself does not match known signatures.

Option B is unreliable, as attackers do not use consistent intervals.

Option C is impractical, since legitimate traffic may be fragmented.

Option D is less effective because signature-based IDS systems can be bypassed by fragmentation techniques.

CEH recommends packet normalization and anomaly-based detection as effective countermeasures.

CEH v13 emphasizes that advanced injection attacks often evade input validation through encoding and obfuscation. A Web Application Firewall (WAF) with evasion detection can analyze request patterns, payload behavior, and anomalies in real time.

Code reviews are important but reactive. SIEM correlates logs after attacks. 2FA does not prevent injection.

Thus, Option B provides the most effective immediate protection.

CEH v13 follows the Incident Response Lifecycle, which prioritizes identification and analysis before containment, unless there is immediate risk of catastrophic damage. In this scenario, the attacker has escalated privileges, but the organization still needs to understand what actions are being taken, what systems are affected, and whether lateral movement is occurring.

Option C aligns with CEH v13 best practices. Real-time monitoring and documentation allow analysts to:

Identify attacker techniques and tools

Preserve volatile evidence

Understand scope and impact

Implement targeted containment

Immediately powering down the server (Option B) may destroy volatile forensic evidence and disrupt services unnecessarily. Engaging forensic teams (Option A) is important but premature without initial analysis. Running vulnerability scans (Option D) does not address the active threat.

CEH v13 stresses that informed containment is more effective than reactive shutdowns. Therefore, Option C is correct.

The correct answer is C. Initial Sequence Number (ISN).

The question specifically states that the analyst records the sequence numbers returned in SYN/ACK responses and analyzes whether those values are predictable or incremental. That means the analyst is examining the target’s Initial Sequence Number generation behavior.

CEH session hijacking material explains that during the TCP three-way handshake, the server responds with a SYN/ACK that includes an ISN, or Initial Sequence Number . It also states that sequence numbers are important for reliable communication and can be crucial in hijacking because an attacker must successfully guess or predict sequence numbers . Another CEH-aligned reference explains that the ISN is exchanged during the handshake and that sequence-number behavior can reveal implementation characteristics .

Option A. TCP Timestamp Analysis is incorrect because TCP timestamp analysis examines timestamp option values, clock behavior, or uptime estimation, not SYN/ACK sequence-number generation.

Option B. TCP Window Size is incorrect because TCP window size refers to how much data can be sent before acknowledgment is required. It is not the sequence-number attribute described in the question.

Option D. Time to Live (TTL) is incorrect because TTL is an IP header field used to limit packet lifetime and can help infer OS or hop distance, but it is unrelated to SYN/ACK sequence-number predictability.

Therefore, the best answer is C. Initial Sequence Number (ISN).

The most direct guideline is D. Register devices with a remote locate and wipe facility because the incident’s core impact came from two factors: loss of physical control of the device and continued exposure of sensitive records while the device remained active. A remote locate-and-wipe capability (commonly delivered through Mobile Device Management (MDM) / Enterprise Mobility Management (EMM) platforms) addresses both problems immediately: it enables administrators to identify the device’s last known location (or trigger location reporting) and, critically, to remotely lock or wipe the device to prevent ongoing unauthorized access to patient data.

In healthcare environments handling regulated data, the priority during a lost-device event is rapid containment. Even if device tracking alone can help find the phone, it does not guarantee that sensitive information stops being accessed during the search. Remote wipe (often paired with remote lock, enforced encryption, and policy-based access control) reduces exposure time by allowing responders to remove protected data and invalidate application access. This is particularly important when the device is still connected to the network, because an attacker (or unauthorized holder) could continue using cached sessions, stored tokens, or locally available records until access is cut off.

Why the other options are less direct: A (anti-virus/DLP) may help detect malware or control data movement, but it does not solve the immediate lost-device containment requirement. B (VPN on public Wi-Fi) is unrelated because the problem is physical loss and inability to control the endpoint. C (install tracking software) helps locate the device, but the scenario highlights that sensitive records were exposed for hours; the most direct impact reduction is achieved when the organization can both locate and wipe/lock the device through an enrolled, centrally managed capability.

Therefore, enrolling devices in a remote locate and wipe facility would have most directly reduced the breach impact.