312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

HTTP cookies may store authentication tokens, allowing users to remain logged in. If a browser retains cookies after closing, an attacker with access to the device could hijack active sessions.

Automatically deleting cookies upon termination reduces the window of opportunity for session hijacking.

Reference – CEH v13 Official Study Guide:

Module 11: Hacking Web Applications

Topic: Session Management

Quote:

“Session hijacking exploits persistent cookies or session IDs stored in browsers. Enforcing cookie deletion helps prevent this attack.”

Incorrect Options:

A. SQL databases are unrelated to browser cookies.

C. Browser cookies don’t store OS-level passwords.

D. This may be a secondary concern, but not the primary mitigation.

===========

Scammers often impersonate legitimate organizations using free email services like @yahoo.com. "Yahoo Bank" is not a legitimate institution, and a real financial entity would use an official domain (e.g., @yahoobank.com). This is a textbook phishing/smishing attempt.

Reference – CEH v13 Official Study Guide:

Module 9: Social Engineering

Quote:

“Attackers often use free email services and impersonate authority figures to trick users. Always verify the sender’s domain and context.”

Incorrect Options:

B. Irrelevant—legitimate people may be unknown too.

C. Responding increases risk.

D. It is not from a verified organization.

===========

CEH v13 explains that WPA3 introduces SAE (Simultaneous Authentication of Equals), which resists traditional offline dictionary and brute-force attacks by removing crackable handshake material. Because WPA3 prevents attackers from capturing a reusable handshake, the most practical offensive method is to force a downgrade attack, tricking clients into associating using WPA2 instead of WPA3. Once the victim reconnects under WPA2-PSK, the attacker captures the standard 4-way handshake, which can then be cracked offline using dictionary or GPU-accelerated brute-force methods. CEH discusses downgrade attacks as a significant real-world threat when mixed-mode configurations are enabled or when access points fail to enforce strict WPA3-only operation. Options B and C are ineffective because WPA3 handshake materials cannot be brute-forced offline. Option D is unrelated to Wi-Fi encryption. Downgrading to WPA2 is the most effective and widely documented attack path.

In CEH v13 Module 01: Information Security Controls, the Remote Access Policy is defined as the guideline that governs:

Which remote access methods (VPNs, modems, RDP, etc.) are permitted.

Requirements for authentication and encryption.

Who is authorized to use them and under what conditions.

In This Case:

The use of a dial-out modem is considered a remote access method, especially if it bypasses the corporate firewall.

The analyst needs to check whether such remote access is permitted, and under what security controls.

The attack scenario is best described as Instant Messenger Applications, and the measure that could have prevented it is verifying the sender’s identity before opening any files. Instant Messenger Applications are communication tools that allow users to exchange text, voice, video, and file messages in real time. However, they can also be used as attack vectors for spreading malware, such as viruses, worms, or Trojans, by exploiting the trust and familiarity between the users. In this scenario, the attacker compromised one of the team member’s messenger account and used it to send malicious files to the other team members, who may have opened them without suspicion, thus infecting their systems. This type of attack is also known as an instant messaging worm12.

To prevent this type of attack, the users should verify the sender’s identity before opening any files sent through instant messenger applications. This can be done by checking the sender’s profile, asking for confirmation, or using a secure channel. Additionally, the users should also follow other security tips, such as using strong passwords, updating the application software, scanning the files with antivirus software, and reporting any suspicious activity34.

Weaknesses of LM hashes include:

A. Passwords are converted to uppercase before hashing.

B. In older Windows systems, LM hashes were transmitted over the network, sometimes in plaintext (or easily intercepted).

D. Passwords are split into two 7-character chunks, which are hashed independently, reducing entropy.

From CEH v13 Courseware:

Module 6: Malware and Password Threats

Module 4: Windows Enumeration

Incorrect Option:

C: LM uses DES encryption with 56-bit keys (not 32-bit).

In CEH v13 Module 04: Enumeration and Module 06: Malware Threats, when investigating Command-and-Control (C2) communication, it is important to determine whether the communication actually occurred and what data was sent.

C. Internet Firewall/Proxy log

Best source to confirm outbound connections to external IPs.

Proxy logs show which internal host made the connection, the timestamp, and sometimes even URL and payload.

Firewalls can indicate port usage, traffic volume, and connection duration.

This data gives a direct view of how severe the incident is, whether data exfiltration occurred, and which internal system is affected.

Why Other Options Are Less Effective Initially:

A. IDS Log: Only tells you that an alert was generated. May be false positive or triggered by a failed connection.

B. Event logs on Domain Controller: Useful for user account behavior, but not for network connections.

D. Event logs on the PC: May lack detail or be tampered with by malware.

A demilitarized zone (DMZ) is a buffer zone between a trusted internal network and an untrusted external network (usually the internet). Public-facing services like web servers, email servers, and DNS servers are typically placed in the DMZ. These nodes can be accessed from the internet, but the DMZ design ensures that unauthorized access to the internal network is blocked or highly restricted.

The purpose is to provide access to certain systems without exposing the internal network directly.