ECCouncil 312-50v13 : Certified Ethical Hacker Exam (CEH v13 AI)

Maya Patel from SecureHorizon Consulting is investigating a breach at Dallas General Hospital in Texas after a nurse misplaced a smartphone containing patient management software. Although the device remained active on the network, administrators had no way to identify its physical whereabouts, delaying incident response and allowing sensitive medical records to be exposed for hours. Which mobile security guideline would have most directly reduced the impact of this incident?

• A. Register devices with a remote locate and wipe facility
• B. Utilize a secure VPN connection while accessing public Wi-Fi networks
• C. Install device tracking software that allows the device to be located remotely
• D. Use anti-virus and data loss prevention (DLP) solutions

During a security assessment for a digital media company in San Diego, ethical hacker Daniel Ortiz evaluates the organization ' s web infrastructure for potential interception risks.
In a controlled simulation, he introduces a configuration change on a test workstation that redirects all outbound web requests through an intermediary system under his control. When users attempt to visit a legitimate collaboration portal, their requests are routed through this intermediary, which briefly presents a replica login interface before forwarding the requests to the legitimate website.
From the users ' perspective, normal browsing continues while the attacker ' s system is able to observe submitted credentials.
Determine the DNS poisoning technique illustrated in this scenario.

• A. Injecting Malicious Records through DNS Cache Poisoning
• B. Executing Proxy Server DNS Poisoning to Alter Resolution Paths
• C. Performing Intranet DNS Spoofing within the Local Network
• D. Conducting Internet DNS Spoofing from a Remote Network

A penetration tester is conducting a security assessment for a client and needs to capture sensitive information transmitted across multiple VLANs without being detected by the organization ' s security monitoring systems. The network employs strict VLAN segmentation and port security measures. Which advanced sniffing technique should the tester use to discreetly intercept and analyze traffic across all VLANs?

• A. Implement switch port mirroring on all VLANs
• B. Exploit a VLAN hopping vulnerability to access multiple VLANs
• C. Use ARP poisoning to perform a man-in-the-middle attack
• D. Deploy a rogue DHCP server to redirect network traffic

A city utility billing portal in Raleigh, North Carolina includes a search field used to retrieve customer records. During an authorized penetration test, an assessor submits repeated instances of a character commonly interpreted within SQL statements as part of the input value.
The application does not display detailed error messages, yet certain submissions result in irregular response behavior and partial rendering of results. The tester suspects the input may be affecting how the SQL command is internally constructed.
Which black-box testing technique is being applied?

• A. Sending special characters to detect SQL modification behavior
• B. Using right square bracket characters to detect identifier handling issues
• C. Sending arbitrary data to detect truncation issues
• D. Sending isolated quotation characters to detect unsanitized input

During a red team exercise at a technology consulting firm in San Francisco, analyst Evelyn deploys a malicious payload disguised within a software update installer. When the target runs the installer, the main application functions normally, but behind the scenes, additional malware components are silently placed on the system without the user ' s knowledge. These hidden components later activate to establish remote access for the red team.
Which technique was most likely used to deliver the hidden malware?

• A. Dropper
• B. Injector
• C. Wrapper
• D. Downloader