312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

The correct answer is C. Preparation.

The activity described occurs before credential abuse, lateral movement, persistence, or internal expansion. The adversary is gathering intelligence, mapping exposed services, preparing exploit frameworks, and testing malware against defensive tools. These actions represent the pre-attack preparation stage of an Advanced Persistent Threat.

APT activity is characterized by defined objectives, long-term probing, advanced resources, specialized skills and methods, and a high tolerance for remaining undetected . The scenario clearly describes these characteristics: the attacker spends months gathering intelligence, building tools, testing malware, and preparing a coordinated attack plan.

Option A. Persistence is incorrect because persistence occurs after initial access, when the attacker establishes a way to maintain access to the compromised environment.

Option B. Expansion is incorrect because expansion involves moving deeper into the environment, escalating privileges, or spreading laterally after compromise.

Option D. Initial Intrusion is incorrect because initial intrusion refers to the first successful compromise of the target environment. The scenario specifically states that these activities occurred before credential abuse or lateral movement.

Therefore, the best answer is C. Preparation.

The strongest indicator in this scenario is that multiple compromised hosts are “behaving like zombies,” communicating outbound to a single unfamiliar external IP over high ports, and “silently accept remote instructions” while performing “coordinated background tasks.” In CEH-aligned malware terminology, these are hallmark characteristics of a botnet: a collection of infected endpoints (bots/zombies) under centralized or semi-centralized command-and-control. Worm-like propagation explains how the compromise rapidly expanded across the internal network—using shared folders and stolen credentials for lateral spread—while the “backdoor component” provides persistent remote control functionality once a system is infected. The observed coordination across many hosts strongly suggests the attacker’s goal is not merely individual surveillance of a single machine, but scalable remote control of many machines at once.

Option A, data exfiltration, is plausible in many intrusions, but the question emphasizes orchestration and remote tasking across many endpoints rather than targeted theft from specific repositories. Option B is inconsistent because there is no mention of encryption, ransom notes, or disruption-focused behavior. Option D, a RAT, typically describes remote control of a host, but the scenario’s defining feature is the creation of many “zombies” with coordinated behavior—this aligns more precisely with building a botnet for command and control, which can later be used for data theft, DDoS, spam, or further intrusion operations.

CEH defensive guidance includes monitoring egress traffic anomalies, detecting C2 patterns, segmenting networks to limit worm spread, disabling unnecessary shares, enforcing strong credential hygiene, and using EDR to identify backdoors and lateral movement behaviors.

The finding most directly demonstrates insecure data transfer and storage. The scenario includes two explicit problems: (1) sensitive business records are transmitted “across the network without encryption,” and (2) the same records are “stored in a retrievable format” in the cloud platform. Those two conditions map exactly to data-in-transit and data-at-rest weaknesses. When IoT devices transmit sensitive data without encryption (e.g., plain HTTP, unprotected MQTT, insecure proprietary protocols), attackers who gain network visibility can intercept, read, and potentially modify that data. Similarly, when cloud-stored data is kept in an easily retrievable or improperly protected form (e.g., weak access controls, lack of encryption at rest, overly permissive storage buckets, exposed APIs), attackers can access business records long after transmission.

In IoT ecosystems, data typically flows from sensors to gateways, then to cloud dashboards and analytics services. If encryption and strong access control are not consistently applied across these hops, confidentiality and integrity are at risk. This can lead to competitive harm (exposed inventory/business records), privacy impact (if customer data is included), and operational disruption (tampered records leading to wrong decisions). The scenario is not about the IoT device exposing services like Telnet/FTP (network services), nor about default passwords; it is specifically about how data is transported and stored.

Why the other options are less accurate:

Insecure ecosystem interfaces (A) focuses on APIs, web/mobile apps, and cloud interfaces; while cloud storage access might involve interfaces, the core weakness described is lack of encryption and retrievable storage, which is more directly the data transfer/storage category.

Insecure network services (C) refers to exposed services/ports on IoT devices, not data confidentiality across the pipeline.

Insecure default settings (D) relates to factory defaults (passwords, open ports, insecure configs), not specifically unencrypted transport and weak storage protection.

Therefore, the correct answer is B. Insecure data transfer and storage.

According to CEH v13 Cloud Computing, improper identity and access management (IAM) is one of the most common causes of cloud security incidents. When former employees retain access to cloud resources, it represents a failure in user lifecycle management, specifically in the de-provisioning phase.

Timely user de-provisioning ensures that when an employee leaves the organization or changes roles, all associated access rights—API keys, IAM roles, credentials, tokens, and permissions—are immediately revoked. CEH v13 emphasizes that cloud environments magnify this risk because access is often centralized and remote, meaning former employees can access systems from anywhere.

Options A, B, and C are supportive security practices but do not directly address the root cause. Multi-cloud models do not prevent unauthorized access. Traffic analysis may detect misuse after the fact but does not prevent it. Penetration testing identifies vulnerabilities but does not manage user access.

CEH v13 explicitly identifies timely de-provisioning as a critical cloud security control to prevent insider threats, privilege abuse, and compliance violations. Therefore, Option D is the correct answer.

The behavior described matches Boolean-based blind SQL injection, which is represented here as Boolean Exploitation. In this technique, the tester injects conditions that evaluate to TRUE or FALSE and then infers the backend query behavior by observing differences in the application’s response—such as returning normal content versus returning an empty page—without relying on explicit database error messages or time delays.

The scenario’s key indicators are:

The injected payloads include conditional logic like AND 1=2, which is a classic always-false test.

When a true condition is used, the portal returns the expected claim details; when a false condition is used, it returns “no results.”

The tester repeats these true/false tests specifically “without error messages or delays,” which rules out error-based and time-based approaches and confirms the “blind” inference method.

Why the other options don’t fit:

UNION SQL Injection (A) relies on combining a malicious UNION SELECT with the original query to extract additional rows/columns directly into the response. The scenario is not extracting unioned data; it is observing response differences from boolean conditions.

Error-based SQL Injection (B) depends on triggering database errors and reading error output. The scenario explicitly notes no error messages are involved.

Time-based Blind SQL Injection (C) infers truth values by forcing delays (e.g., SLEEP()), which is explicitly not occurring here.

Therefore, the technique is best identified as D. Boolean Exploitation (Boolean-based blind SQL injection).

The correct answer is B. Replay Attack.

A replay attack occurs when an attacker captures a valid communication and later retransmits it to make the receiving system accept the old message as legitimate. The important clue is that the analyst does not decrypt or modify the signal; the captured transmission is simply reused.

CEH-aligned material describes replay attacks as attacks in which captured traffic is reused to gain access or reproduce a valid transaction . CEH IoT material also lists Replay Attack among IoT attack types .

Option A. BlueBorne Attack is incorrect because BlueBorne targets Bluetooth vulnerabilities.

Option C. Rolling Code Attack is incorrect because rolling-code attacks involve capturing or interfering with changing code sequences, often while jamming the receiver. The scenario says the original transmission is simply replayed.

Option D. Sybil Attack is incorrect because a Sybil attack uses multiple forged identities to influence a network.

Therefore, the best answer is B. Replay Attack.

Ransomware encrypts user data and extorts payment for restoration. CEH covers ransomware as a major threat in system hacking, highlighting encryption-based extortion as its defining behavior.