ECCouncil : 312-50v13 Questions & Answers

While conducting a red team exercise at a corporate office in San Diego, California, you observe employees working in an open-plan area. By discreetly watching their screens and hand movements as they log into internal systems, you are able to capture several usernames and partial passwords without touching any devices or interacting with the staff. Which social engineering technique does this scenario best illustrate?

• A. Dumpster Diving
• B. Tailgating
• C. Shoulder Surfing
• D. Impersonation

During a red team operation on a segmented enterprise network, the testers discover that the organization's perimeter devices deeply inspect only connection-initiation packets (such as TCP SYN and HTTP requests).
Response packets and ACK packets within established sessions, however, are minimally inspected. The red team needs to covertly transmit payloads to an internal compromised host by blending into normal session traffic. Which approach should they take to bypass these defensive mechanisms?

• A. SYN scanning
• B. Port knocking
• C. ACK tunneling
• D. ICMP flooding

An online retail company in San Diego, California operates a widely used e-commerce platform that processes large numbers of customer purchases each day. During an authorized security assessment, an ethical hacker reviews unusual reports from customers who completed legitimate transactions but later experienced unauthorized use of their payment cards.
Investigation of the checkout workflow reveals that the payment page loads several external client-side scripts responsible for rendering product details and handling form submissions. Closer inspection shows that one of these scripts has been modified to silently collect information entered into the payment form fields and transmit it to an external server controlled by an unknown party.
The altered script does not disrupt checkout. Customers successfully complete purchases while their card details are copied and transmitted in the background.
Determine the web application attack category that most accurately explains this activity.

• A. JavaScript Hijacking
• B. Cross-Site Scripting (XSS)
• C. Magecart Attack
• D. Watering Hole Attack

Arjun Mehta, a red team specialist at Sentinel Dynamics, is conducting a controlled reconnaissance assessment against the company's perimeter network. During testing, the security operations team observes that the firewall logs display several different originating systems associated with the same scanning activity.
Arjun's objective is to ensure that his actual testing machine cannot be easily distinguished from other recorded entries.
What technique is Arjun using in this scenario?

• A. Source Routing
• B. Source Port Manipulation
• C. IP Address Spoofing
• D. IP Address Decoy

A regional logistics provider in Charlotte, North Carolina operates its shipment tracking and partner API services on an Apache web platform configured to support a modern multiplexed communication protocol to improve efficiency under concurrent load. During a controlled stress assessment, testers simulate sustained client activity that repeatedly initiates and completes numerous lightweight exchanges over persistent connections.
Over time, system monitoring reveals that memory utilization steadily increases despite stable request volume and no proportional rise in active sessions. Even after the simulated clients disconnect normally, resource usage does not return to baseline levels. After several cycles, the service becomes sluggish and must be restarted to restore normal responsiveness. No unusual disk activity or database errors are observed during the test window.
The behavior is only present when the multiplexed protocol mode is enabled; reverting to legacy handling eliminates the issue.
Which Apache vulnerability best explains this behavior?

• A. Insecure Default Configuration
• B. mod_macro Buffer Over-read
• C. DoS in HTTP/2 with Initial Window Size 0
• D. HTTP/2 Stream Memory Not Reclaimed on RST