Eccouncil Certified Ethical Hacker 312-50 CEH-AI Exam Questions

Answer : B

SMS Phishing, commonly called smishing, is the correct answer because the attack method is a deceptive text message sent to mobile devices that lures recipients into clicking a malicious link. In CEH-aligned social engineering coverage, smishing is a direct extension of phishing that uses SMS as the delivery channel. The attacker typically creates urgency or authority, such as ''critical account update needed,'' to trigger fast compliance. The message then pushes the victim to a malicious URL that can deliver malware, prompt credential entry, or enroll the device into a monitoring or management profile depending on platform and permissions. The key indicators in the question are company phones, a crafted message, and a link that installs monitoring software, which fits smishing exactly.

Bluebugging is a Bluetooth-based attack where the attacker exploits Bluetooth weaknesses to gain unauthorized access to a device, read data, place calls, or send messages, and it does not rely on sending a deceptive SMS link. Call spoofing is manipulating caller ID to impersonate a trusted number during voice calls, not delivering a malicious installation link through text. OTP hijacking focuses on intercepting or tricking users into revealing one-time passwords, often through SIM swapping, malware, or real-time phishing, but the scenario emphasizes installing monitoring software through a link rather than capturing a one-time code.

Defenses highlighted in ethical security training include mobile security awareness, blocking unknown links, using mobile threat defense, restricting app installation from untrusted sources, enforcing MDM controls, and monitoring SMS-based social engineering indicators.

Answer : B

CEH courseware categorizes hackers based on intent, authorization, and affiliation. State-sponsored hackers are defined as individuals or teams who conduct cyber operations on behalf of a government to advance national interests. These operations often include espionage, cyber warfare, intelligence gathering, and covert offensive actions. Unlike organized hackers or cybercriminal groups, whose motivations may include financial gain or ideological activism, state-sponsored units follow strategic directives issued by government agencies. CEH materials explain that such groups operate with access to advanced tools, long-term funding, and classified intelligence, enabling them to execute highly sophisticated and covert operations targeting foreign governments, corporations, or critical infrastructure. Hacktivists pursue political or social causes, while gray-hat hackers operate without explicit permission but without malicious intent. Only state-sponsored hackers match the scenario where cyber experts are formally trained, resourced, and authorized by a national government to conduct operations that remain undetected. Therefore, the correct classification is state-sponsored hackers.

Answer : A

The correct answer is A. Golden SAML Attack.

A Golden SAML Attack occurs when an attacker obtains the private signing material used by an identity provider and then forges valid SAML authentication assertions. Because the forged assertions are signed with trusted material, cloud service providers may treat them as legitimate authentication responses.

The scenario clearly states that the consultant extracted signing material used in trust relationships between the internal identity provider and cloud services, then generated authentication responses that granted cloud application access without passwords or MFA. This is the defining behavior of a Golden SAML attack.

CEH-aligned cloud security material identifies cloud account hijacking and insecure cloud authentication paths as major concerns, especially where cloud services depend on authentication, authorization, and API trust relationships . The Golden SAML technique specifically abuses federated authentication trust rather than stealing a normal user password.

Option B. Living off the Cloud (LotC) Attack is incorrect because LotC involves abusing legitimate cloud-native services and tools to perform attacker operations while blending into normal cloud activity. It does not specifically describe forging SAML authentication assertions.

Option C. Cloud Hopper Attack is incorrect because Cloud Hopper refers to attacks that target managed service providers or cloud service providers to reach downstream customers.

Option D. Man-in-the-Cloud (MITC) Attack is incorrect because MITC typically abuses synchronization tokens or cloud sync mechanisms, not identity-provider signing keys.

Therefore, the best answer is A. Golden SAML Attack.

Answer : C

The correct answer is C. Botnet Trojan.

The scenario describes systems infected through a phishing attachment, silently connecting to a centralized command-and-control server, waiting for instructions, and executing distributed traffic bursts. This is characteristic of a botnet.

CEH-aligned material explains that a botnet is commonly established by installing a bot on a victim system using a Trojan horse. Once executed, the victim system becomes infected and waits for instructions from a command-and-control handler. The handler then sends instructions to infected systems, or bots, to perform attacks such as distributed denial-of-service activity . Another reference also defines botnet Trojans as Trojans used to infect many systems and then use the compromised systems together to attack a victim system, commonly for distributed denial-of-service attacks .

Option A. E-banking Trojan is incorrect because e-banking Trojans focus on stealing banking credentials or manipulating financial transactions.

Option B. Rootkit Trojan is incorrect because a rootkit Trojan focuses on hiding malicious activity or maintaining stealth at a low system level.

Option D. Backdoor Trojan is incorrect because a backdoor Trojan provides unauthorized remote access, but the coordinated command-and-control behavior across multiple infected systems best matches a botnet Trojan.

Therefore, the best answer is C. Botnet Trojan.

Answer : C

The correct answer is C. Capability.

In the Diamond Model of Intrusion Analysis, the four core elements are Adversary, Infrastructure, Capability, and Victim. The Capability element represents the tools, techniques, malware, exploits, procedures, and technical methods used by the adversary to carry out the attack.

Option A. Adversary is incorrect because it represents the attacker, threat actor, or organization responsible for the intrusion.

Option B. Infrastructure is incorrect because it represents the systems, domains, IP addresses, command-and-control servers, or delivery mechanisms used to conduct the operation.

Option D. Victim is incorrect because it represents the target entity, affected system, user, or business unit.

Therefore, the best answer is C. Capability.

Answer : B

OSINT-based reconnaissance includes using search engines to identify publicly exposed cloud assets. CEH highlights Google dorking as a passive method to reveal S3 buckets indexed in search engines through patterns such as site:s3.amazonaws.com or keyword-based queries.

Answer : B

The scenario best matches Traffic IQ Professional because it describes a tool used to generate and replay diverse traffic patterns through a firewall to validate rule enforcement and detection under simulated attack conditions. The key functions here are traffic generation, replay, and the ability to model both legitimate and malicious flows to test whether the firewall correctly handles evasion attempts and policy enforcement. Traffic generation/replay platforms are used in security validation and firewall testing to emulate real-world network behaviors at scale and to assess how devices respond to crafted or replayed traffic profiles.

Why the other tools are less suitable:

Nmap (A) is primarily a scanner for host discovery, port scanning, and service enumeration, with some scripting capabilities. It is not chiefly a traffic generation/replay system for exercising a firewall with diverse controlled flows.

Colasoft Packet Builder (C) can craft packets and build custom traffic at the packet level, which is useful for creating specific test packets. However, the scenario emphasizes broader ''diverse traffic patterns'' and replay of flows in a way typically associated with traffic modeling/validation suites rather than single-packet construction.

Metasploit (D) is an exploitation framework used to develop and execute exploits and payloads. While it can generate certain traffic, its primary purpose is not comprehensive traffic generation and replay to validate firewall policies under many traffic types.

Traffic IQ Professional is the best fit because it aligns with a firewall test plan focused on simulating legitimate and malicious traffic profiles, including evasion-style patterns, and demonstrating how the perimeter device behaves under controlled conditions. This approach is often used to evaluate whether a firewall can consistently enforce security policies, detect anomalies, and resist evasion techniques without overblocking legitimate traffic.

Therefore, the most likely tool is B. Traffic IQ Professional.