EC-Council Certified Ethical Hacker CEH-AI v13 312-50 Exam Questions

Answer : D

The Certified Ethical Hacker (CEH) Network and Perimeter Hacking module describes MAC flooding as an attack targeting switch CAM (Content Addressable Memory) tables. The attacker overwhelms the switch by sending frames with spoofed MAC addresses, forcing the switch to broadcast traffic like a hub.

Option D is the correct indicator because MAC flooding results in many different MAC addresses being learned on a single switch port, which is abnormal behavior. CEH documentation identifies this as the primary forensic sign of a MAC flooding attack.

Option A relates more closely to ARP poisoning rather than MAC flooding.

Option B can occur in network misconfigurations but is not a primary MAC flooding indicator.

Option C is common in NAT environments and is not malicious by itself.

CEH emphasizes monitoring CAM table behavior and port security violations to detect MAC flooding attacks effectively.

Answer : D

The technique described is decoy scanning. In CEH network scanning methodology, decoy scanning is used to make IDS and logging systems attribute scan traffic to multiple apparent sources instead of the attacker's true IP address. The attacker configures the scanner to generate additional probe packets that appear to originate from several spoofed decoy IP addresses, mixed with the real attacker's probes. This creates ambiguity for defenders because IDS alerts and firewall logs show many potential ''scanners,'' complicating attribution and response actions such as blocking a single source.

A key detail in the prompt is that Lily ''includes multiple spoofed IP addresses alongside her own'' and still ''receives accurate results.'' That matches how decoy scanning works in tools like Nmap: the attacker's real IP must remain in the mix so that replies from the target return to the attacker, enabling accurate interpretation of port states. The decoys mainly exist to confuse monitoring and incident response teams by polluting the log trail.

Option C, IP spoofing, is too general and, by itself, typically prevents the attacker from receiving responses because return traffic goes to the spoofed address. Decoy scanning is a specific, structured use of spoofing combined with the real source to preserve results. Option A refers to stealth flag scans, which reduce handshake visibility but do not involve multiple spoofed sources. Option B, source routing, attempts to control packet paths and is not the described behavior. Therefore, the correct answer is Decoy Scanning.

Answer : C

In CEH-aligned cloud security discussions, protecting data across its lifecycle is a primary requirement, and a major risk area is how data moves between clients, applications, and cloud services. The scenario states the exposure occurred because there was no encryption during transmission between user devices and cloud storage. That maps directly to the Service and Data Integration risk area because it focuses on the security controls applied when cloud services exchange data with users and with other services, including secure communication channels, API protection, and proper cryptographic enforcement for data in transit.

When data is transmitted without TLS or with weak or misconfigured TLS, it becomes vulnerable to interception and manipulation through man in the middle attacks, traffic sniffing, SSL stripping, or downgrade attacks. In regulated environments such as healthcare, HIPAA expectations strongly align with implementing strong encryption in transit and ensuring secure session establishment, certificate validation, and modern cipher suites. This is not primarily a multi tenancy or physical security issue, which relates to isolation between tenants and the provider's datacenter controls. It is also not primarily an incident analysis and forensic support issue, which concerns detection, logging, evidence collection, and investigative capability after events occur. Infrastructure security is broader and can include network protections, but the question is specifically about preventing exposure during transmission, which is most precisely addressed by service and data integration controls.

Correct remediation typically includes enforcing HTTPS with modern TLS, enabling HSTS, disabling legacy protocols and weak ciphers, ensuring correct certificate management, using mutual TLS where appropriate, and securing cloud storage access through authenticated, encrypted endpoints and properly secured APIs.

Answer : B

The analyst is using the TCP Flow Control Method because the scenario focuses on monitoring TCP sequence values for irregularities. In TCP communications, sequence (and acknowledgment) numbers are fundamental to flow control and reliability. A legitimate TCP stream follows predictable rules: sequence numbers progress according to the amount of data transmitted, acknowledgments align with received bytes, and the relationship between seq/ack values is consistent for each direction of the session. When traffic is spoofed---especially if an attacker injects packets without fully participating in the legitimate TCP state---those packets often contain sequence numbers that do not match the expected window for the established connection. This can create anomalies such as out-of-window sequence values, incorrect acknowledgments, or resets triggered by the endpoints.By monitoring sequence-related behavior, defenders can spot signs of forged or injected packets that were not produced by the true endpoint. This technique is particularly relevant when dealing with suspected TCP session spoofing or injection, where attackers attempt to insert data or disrupt sessions by guessing or stealing sequence numbers.Why the other options don't match the ''sequence values'' clue:Packet Filtering (A) is a preventive control (blocking by rules), not a detection method based on analyzing sequence progression.IPID Monitoring (C) focuses on the IP Identification field behavior patterns to infer spoofing (often OS-specific IPID increments), but the scenario is clearly about TCP sequence values, not IP header ID patterns.Direct TTL Probes (D) examine TTL characteristics (hop count anomalies) to infer spoofing or path differences; again, not sequence-number analysis.Therefore, the spoofing detection technique described is B. TCP Flow Control Method.

Answer : B

Side-channel attacks, as explained in CEH v13 OT and SCADA Security, extract sensitive information by observing physical characteristics of a system rather than exploiting software flaws directly. These characteristics may include power consumption, electromagnetic emissions, timing variations, or thermal output.

In SCADA environments, side-channel attacks are especially dangerous because they bypass traditional network defenses. The most reliable way to confirm such an attack is by analyzing hardware-level anomalies---such as unexpected power usage spikes or irregular signal emissions during normal device operations.

Option B directly aligns with CEH v13 guidance.

Options A, C, and D focus on software, cryptography, or network behavior, which are not primary indicators of side-channel exploitation.

Therefore, Option B is correct.

Answer : A

This scenario aligns with a Golden SAML attack because the attacker is not stealing a user password or bypassing MFA directly; instead, the attacker compromises the identity trust mechanism itself and forges valid authentication assertions. In federated cloud environments, the identity provider issues signed assertions that cloud services trust. Once the signing material is obtained, an attacker can create forged SAML tokens that appear fully legitimate to the relying cloud applications. That is why the access in logs appears normal and why no credential replay or multifactor prompt is required. This distinguishes the technique from Man-in-the-Cloud, which commonly abuses synchronization tokens, and from Cloud Hopper, which is associated with service-provider pivoting and long-term intrusion campaigns. CEH cloud coverage emphasizes that cloud trust relationships, identity infrastructure, and the mechanisms used to broker access are critical attack surfaces because compromise at that layer can grant broad service access with little visible anomaly. In practical defensive terms, protecting token-signing infrastructure is as important as protecting privileged user credentials in a cloud identity architecture.

Answer : D

This is a SYN flood because the attack floods the target with TCP SYN packets (connection initiation). The server responds by allocating resources and sending SYN-ACK replies, moving each connection into a half-open state while it waits for the client's final ACK to complete the three-way handshake. In a SYN flood, that final ACK never arrives (often because the source addresses are spoofed or because the attacker deliberately does not complete the handshake). As a result, the server's backlog queue of pending connections fills up, consuming memory/connection slots and preventing legitimate users from establishing new sessions.

The scenario's language matches the mechanics precisely: ''flood of TCP connection initiation packets,'' ''exhausting the server's backlog of half-open connections,'' and ''never receives the final ACK.'' Those are the classic identifiers of SYN flooding.

Why the other options are incorrect:

ACK flood (A) involves flooding with TCP ACK packets; it does not primarily create half-open handshakes because ACKs are not the connection-initiation step.

TCP SACK Panic (B) refers to a specific vulnerability/issue related to TCP Selective Acknowledgment processing, not a generic handshake backlog exhaustion attack pattern.

APT attack (C) is not a DoS attack type; it refers to advanced persistent threat campaigns and is unrelated to TCP handshake flooding.

Therefore, Aisha is simulating D. SYN Flood Attack.