312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

The CEH Network Scanning module explains that ICMP Echo Requests are often filtered or blocked by firewalls, routers, or host-based security controls as a defensive measure to reduce reconnaissance exposure.

When systems fail to respond to ICMP Echo Requests but continue to function normally for other services, CEH indicates that this behavior typically means ICMP traffic is being blocked, not that the host is offline or compromised.

Option B is correct.

Option A would affect all services.

Option C lacks supporting indicators.

Option D is speculative and unreliable.

CEH emphasizes that ICMP filtering is common in hardened networks.

Information Leakage is the most accurate threat category because the scenario centers on sensitive data becoming publicly accessible through unintended disclosure. In CEH coverage, information leakage refers to the exposure of confidential or internal details to unauthorized parties through oversharing, misconfiguration, poor operational security, or improper handling of information. Here, the data is already visible on public forums, meaning an attacker does not need to exploit a vulnerability in a system directly at first; they can simply collect and correlate exposed details such as employee names, email formats, internal hostnames, software versions, configuration snippets, IP ranges, or screenshots.

This aligns strongly with reconnaissance and OSINT techniques emphasized in CEH: adversaries routinely harvest publicly available information to build an attack plan, identify privileged targets, guess usernames, craft phishing lures, locate externally exposed services, or tailor further exploitation using revealed versions and settings. While social engineering can be a follow-on step, the core issue described is not persuading users to reveal information interactively. Instead, the organization’s risk stems from information already leaked due to careless online behavior.

Corporate espionage is a motive rather than a specific technique category, and system and network attacks describe active exploitation and intrusion attempts, which come after the intelligence-gathering stage. Therefore, to simulate the adversary’s method of gathering what has been exposed, Michael should focus on information leakage: identifying what is publicly disclosed, how it can be aggregated, and what attack paths it enables, then recommending containment and policy and awareness controls.

The correct answer is A. HTTP Response Splitting Attack because the scenario describes a flaw where one crafted request is interpreted in a way that causes the server (or an intermediary) to treat it as two separate HTTP messages, enabling the attacker to inject malicious data into the HTTP response stream. This is a classic input validation and header injection issue, typically involving the insertion of carriage return and line feed (CRLF) characters (\r\n) into user-controlled input that is later placed into HTTP headers (for example, in redirects, cookies, or custom headers). By injecting CRLF sequences, an attacker can “split” the server’s response: the first part completes a legitimate response header section, and the injected content begins a second, attacker-controlled response.

This aligns with the prompt’s emphasis that “a single crafted request is processed as two separate ones,” which is the fundamental mechanic of response splitting—turning one transaction into multiple interpreted HTTP entities. Once response splitting is possible, attackers may set or manipulate headers (such as Set-Cookie), inject arbitrary content, perform cross-user defacement, facilitate cache poisoning, or enable more effective delivery of client-side attacks by making browsers or proxies store and serve malicious content.

The question also frames it alongside XSS, CSRF, and SQL injection as “input validation flaws.” That matches response splitting’s root cause: insufficient sanitization/validation of untrusted input before including it in HTTP headers or responses.

Why the other options are incorrect: Password cracking is unrelated to HTTP parsing and input validation. Directory traversal abuses path handling to access files (e.g., ../) and does not involve splitting HTTP messages. Web cache poisoning can be a consequence of response splitting, but the described behavior—splitting a single request/response into two—most directly identifies HTTP response splitting as the demonstrated attack.

The best answer is D. Insecure routing protocols because the scenario describes legacy neighbor-to-neighbor device communications that lack encryption and integrity validation, allowing operational routing data to be exchanged without verification. In CEH-aligned network hacking concepts, this is a classic weakness of older or improperly secured routing protocols (and related network control-plane exchanges) where routers trust updates from neighbors and do not cryptographically validate the authenticity and integrity of routing information.

When routing updates are accepted without strong verification, an attacker who can position themselves on the same segment (or spoof a trusted neighbor) may inject or manipulate routing information. This can enable attacks such as route injection, route poisoning, man-in-the-middle (MITM) traffic redirection, blackholing traffic, or causing instability/denial of service by continuously advertising bad routes. The mention of “neighboring systems” and “operational data” strongly maps to routing adjacencies where devices exchange reachability and topology information. The absence of integrity checks makes it feasible to alter routing messages in transit or forge them, and the absence of encryption can expose routing details that further assists reconnaissance and targeted manipulation.

Why the other options are less accurate:

Firewall vulnerabilities relate to filtering and policy enforcement, but the core issue here is the trust model and protection of routing/control messages, not firewall rule flaws.

Lack of password protection is too generic and typically refers to weak/no credentials on management access, not unauthenticated routing exchanges.

Lack of authentication is conceptually related, but the question asks for the type of vulnerability most clearly present given “legacy communication mechanisms” between neighbors carrying operational data—this is most specifically categorized in CEH terms as insecure routing protocols (i.e., routing updates lacking authentication/integrity and sometimes encryption).

In practice, organizations mitigate this by enabling routing protocol authentication (where supported), using cryptographic integrity protections, restricting routing adjacencies, and segmenting or filtering routing/control-plane traffic to trusted peers only.

The correct answer is D. Anomaly-Based Detection because the scenario explicitly states that the system “monitors traffic for deviations from established baselines” and flags behavior that does not match normal network activity. In CEH-aligned IDS/IPS concepts, anomaly-based detection (also called behavior-based detection) works by building a profile of what “normal” looks like—such as typical packet rates, protocol usage, session patterns, timing, connection distributions, and expected traffic flows—and then identifying events that deviate significantly from those norms. This makes it particularly useful against evasion techniques and previously unseen patterns, because it is not limited to matching known signatures.

Sophia’s tactic—packet fragmentation—is a classic evasion approach intended to bypass simplistic inspection systems by splitting malicious payloads or attack patterns across multiple fragments so they are harder to reconstruct or match. A baseline-driven anomaly system can still detect the attack because fragmentation itself (or the resulting traffic characteristics) may appear abnormal: unusual fragment counts, unexpected fragment sizes, atypical reassembly behavior, irregular session characteristics, or protocol violations compared to normal traffic profiles. Because the detection is based on behavior rather than a fixed pattern, it can trigger alerts even if the exact malicious payload is not recognized.

Why the other options are less correct: Signature-based detection relies on known patterns and may be evaded when attackers modify payloads or fragment traffic to avoid matches. Stateful packet inspection tracks connection state and can help with session validation, but it is not inherently a baseline deviation detector. Deep packet inspection inspects packet contents and can sometimes reassemble fragments depending on implementation, but the question’s key clue is “deviations from established baselines,” which directly points to anomaly-based detection.

Therefore, the IT team is most likely using anomaly-based detection.

The correct answer is C. Web Cache Poisoning Attack.

The key indicators are:

The altered content is served to other users.

The origin server still returns the legitimate response.

The issue disappears after cache expiration or replacement.

The crafted request uses headers and parameters that influence cached output.

CEH-aligned web server material explains that Web Cache Poisoning occurs when an attacker sends a crafted request into the cache and stores fake entries, causing users to be redirected or served malicious content . Another CEH-aligned reference explains that a web cache stores copies of responses to speed up future requests, and if an attacker forces malicious or manipulated content into the cache, later visitors can receive that poisoned response .

Option A. DNS Server Hijacking is incorrect because DNS records or DNS server settings are not being modified.

Option B. DNS Rebinding Attack is incorrect because the scenario concerns cached web content, not browser access to private-network resources through DNS rebinding.

Option D. SQL Injection Vulnerability is incorrect because the behavior is tied to delivery-layer caching, not database query manipulation.

Therefore, the best answer is C. Web Cache Poisoning Attack.

When partial root access exists, preventing further privilege abuse is the immediate priority. CEH v13 explains that Mobile Application Management (MAM) enforces granular access control, application isolation, and permission enforcement—even on compromised devices.

Secure coding (Option A) and testing (Option C) are preventative measures but do not contain an active compromise. Certificate pinning (Option B) protects communications, not application control.

MAM solutions allow administrators to revoke access, enforce policies, and isolate apps, limiting attacker capabilities post-compromise. Therefore, Option D is correct.

The requirement is specifically for a framework that explains how to identify, assess, and treat information security risks within the context of an Information Security Management System (ISMS). The ISO standard dedicated to information security risk management is ISO/IEC 27005. It provides guidance on establishing a risk management process aligned with the ISO/IEC 27000 family and supports the ISMS by describing risk context, risk identification, risk analysis, risk evaluation, risk treatment, risk acceptance, and ongoing risk communication and monitoring.

This focus on the “how” of risk management is what distinguishes ISO/IEC 27005 from the other options. ISO/IEC 27001:2022 is the standard that specifies the requirements to establish, implement, maintain, and continually improve an ISMS. It requires that risk assessment and treatment be performed, but it is not primarily a detailed methodology standard for conducting those activities. ISO/IEC 27002:2022 is a code of practice that provides a catalog of security controls (the “what” controls you can select), rather than a risk assessment/treatment methodology. ISO/IEC 27701:2019 extends ISO/IEC 27001/27002 to privacy information management (PIMS) and focuses on privacy controls and requirements—not the general information security risk management lifecycle.

Because the question asks for a standard that addresses identification, assessment, and treatment of information security risks as part of an ISMS, ISO/IEC 27005 is the best match. It complements ISO/IEC 27001 by giving organizations practical guidance for building and running the risk management process that ISO/IEC 27001 requires, ensuring risk decisions are systematic, repeatable, and suitable for governance and continual improvement.