312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

The correct answer is D because PowerShell script block logs provide the most direct visibility into PowerShell-based attacker activity. In CEH-style security operations and incident response, defenders must review logs that are closest to the suspicious activity being investigated. PowerShell is widely used for Windows automation, administration, and post-compromise actions; the CEH-related material notes that PowerShell can automate tasks on Microsoft Windows systems and can be used after compromising a Windows target. Script block logging records the actual PowerShell code blocks executed, including suspicious commands, encoded commands, download cradles, privilege escalation scripts, and in-memory execution attempts. DNS logs may show domain lookups, and firewall logs may show network connections, but neither reveals the PowerShell commands themselves. Syslog is generic and more common in Unix/Linux or centralized logging contexts. Since the attacker is abusing PowerShell heavily, PowerShell script block logs give investigators the strongest evidence of command content, execution behavior, and malicious intent. Therefore, option D is the best answer.

The scenario describes a host-level monitoring agent installed on a single workstation that records local system events such as file access, configuration changes, and unauthorized process execution. These are classic indicators of Host-Based Intrusion Detection System (HIDS) functionality. A HIDS runs on an endpoint (server or workstation) and monitors activity on that host, including operating system logs, file integrity, registry/config changes, system calls, application logs, and process behavior. Because it has direct visibility into what is happening locally, it can detect suspicious activity that may not be obvious from network traffic alone.

The clue that “attackers often attempt to disable or evade this type of monitoring to avoid being detected at the host level” also aligns strongly with HIDS. Adversaries commonly try to stop endpoint agents, tamper with logs, or evade detection by living-off-the-land techniques precisely because host-based sensors can catch actions like privilege escalation attempts, persistence mechanisms, malicious process launches, or unauthorized modifications to critical files and configurations.

Why the other options are not the best match:

A Network-Based Firewall (A) is a perimeter or network control that filters traffic based on rules (IPs, ports, protocols). It does not typically record detailed local file/process/configuration events on a single workstation.

A Host-Based Firewall (B) resides on the endpoint but primarily controls inbound/outbound network connections at that host. While it can log connection attempts, it is not chiefly designed to track file access, configuration integrity, or process execution.

A Network-Based IDS (C) analyzes traffic on the network segment (via taps/SPAN) to identify suspicious patterns. It does not require installing an agent on a single workstation and lacks direct visibility into local file and process events.

Therefore, the security system Olivia is demonstrating is D. Host-Based Intrusion Detection System.

The correct answer is B, Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an attacker or ethical hacker collects as much data as possible about a target before deeper technical testing or attack activity. The retrieved CEH-related material describes reconnaissance as gathering information about the target using active or passive means, and it specifically includes collecting initial information about the target system or organization. Visiting an organization’s public website to collect employee names, email addresses, and phone numbers is passive information gathering because the tester is using publicly available sources rather than directly probing systems. Footprinting, which is part of reconnaissance, can include gathering employee information, phone numbers, and emails. Fingerprinting is more specific to identifying systems, services, or operating systems. Scanning and enumeration involve actively probing hosts, ports, and services. Gaining access occurs later, when vulnerabilities are exploited. Therefore, this activity corresponds to reconnaissance.

The correct answer is B. hashdump because the output described—“a long list of alphanumeric strings representing LM and NTLM values”—matches the Windows password hash formats typically extracted from the local Security Account Manager (SAM) database (with supporting data from the SYSTEM hive). In CEH-aligned post-exploitation and credential access concepts, attackers frequently target LM/NTLM hashes rather than plaintext passwords. Hashes can be taken offline for password recovery attempts (e.g., dictionary/brute-force and rule-based cracking), which aligns with the scenario where the values are transferred to a cracking rig.

Within a Meterpreter context, hashdump is the command commonly associated with dumping local account password hashes from a compromised Windows host. The hashes are useful for simulating credential compromise across an environment because recovered passwords may be reused on other systems, and even without recovery, hashes can sometimes be leveraged in authentication abuse scenarios depending on controls in place.

Why the other options are incorrect:

keyscan_start initiates keystroke logging in Meterpreter; it would not output LM/NTLM hash strings.

getsystem attempts privilege escalation to SYSTEM-level (or equivalent). While higher privileges may be required before successfully dumping hashes, getsystem itself does not produce a list of hashes; it changes/attempts to change the privilege context.

screenshot captures the user’s screen and has no relationship to credential hash extraction.

The “post-exploitation phase” detail is important: credential dumping is a classic activity after gaining a foothold, used to expand access (pivoting/lateral movement) and assess the impact of poor password hygiene. From a defensive perspective, this highlights the need for least privilege, credential protection controls, restricted local admin, strong password policies, and monitoring for suspicious credential-access behaviors.

The correct answer is D. Hardware/Firmware Rootkit because the scenario describes persistence that remains even after multiple OS reinstalls and executes before the operating system loads, while evading OS-level antivirus and forensic scans. In CEH-aligned malware/rootkit concepts, hardware/firmware rootkits embed malicious code into firmware components such as BIOS/UEFI, device firmware (for example, NIC firmware, storage controller firmware, HDD/SSD firmware), or other embedded hardware layers. Because firmware is separate from the operating system’s file system, reinstalling the OS typically does not remove the implant.

The clue “resides deep inside the system hardware” and “executes before the OS is loaded” aligns with firmware-level execution in the boot chain. Firmware rootkits can run during early startup, initialize malicious hooks, and then hand off control to the OS in a way that hides their presence. This makes them extremely difficult to detect using conventional host-based tools, because those tools operate after the OS is running and generally cannot easily inspect or validate firmware integrity. The mention of “unusual activity on network cards and storage devices” is also a strong indicator: compromised NIC or storage firmware can manipulate traffic, exfiltrate data, or alter reads/writes while remaining invisible to file-based scanning.

Why the other options are less accurate: a boot-loader-level rootkit typically infects the bootloader on disk; while it runs early, it may be removed by disk reimaging or certain reinstall workflows. A kernel-level rootkit resides within the OS kernel and is generally removed by reinstalling the OS. A hypervisor-level rootkit (virtualization-based) can be stealthy, but it still generally depends on software layers that may not survive repeated OS reinstalls unless paired with firmware persistence.

Therefore, the persistence across reinstalls and pre-OS execution most clearly indicate a hardware/firmware rootkit.

The correct answer is B. Rogue AP because the scenario describes an unauthorized access point that has been physically connected to the internal wired network and is providing network access on the corporate VLAN without approval or inventory records. In CEH-aligned wireless security concepts, a rogue access point is any AP that is installed on an organization’s network without authorization, creating an unmanaged entry point that bypasses standard security controls. The key indicators here are: it is “previously unknown,” “neither provisioned by IT nor listed in the asset inventory,” and it is “physically connected to the hospital’s internal switch.”

The fact that the device is issuing IP addresses suggests it may be running a DHCP service or bridging into the internal network in a way that places clients directly onto the corporate VLAN. This can allow attackers to gain internal access from nearby wireless range and can also cause network instability if its DHCP responses conflict with the legitimate DHCP infrastructure. Additionally, the device “relaying internal traffic and providing remote connectivity back to an external host” points to an attacker using it as a covert foothold—effectively an unauthorized wireless bridge into the internal network and a channel for command-and-control or remote access.

Why not the other options: a misconfigured AP implies a legitimate AP deployed by IT but configured insecurely (weak encryption, default credentials, poor segmentation). A honeypot AP is typically deployed deliberately (often by defenders) to attract attackers for detection and research, not stealthy backhaul to an external host. An evil twin AP is a spoofed wireless AP that impersonates a legitimate SSID to lure victims; it does not necessarily require being physically plugged into the internal switch, and the defining trait is impersonation of a real AP/SSID. The defining trait here is unauthorized installation on the wired network, which is most directly a rogue access point.

The correct answer is B because an API without request-rate limiting allows automated clients, bots, or scripts to repeatedly request large volumes of data from application endpoints. In CEH web application hacking concepts, web applications expose services to clients through front-end and back-end processing, and APIs are often used as direct interfaces to application data. When no rate limit, throttling, pagination control, quota enforcement, or anomaly detection exists, an attacker can enumerate records, harvest user profiles, pull product data, extract pricing information, or scrape sensitive business data at scale. This weakness is not XSS because no client-side script injection is described. It is not SQL injection because there is no malicious database query input. It is not CSRF because the attacker is not forcing a victim’s browser to submit authenticated requests. The missing control specifically enables repeated automated API access, making data scraping the best answer. Rate limiting should be enforced server-side, not only in client code.