EC-Council Certified Ethical Hacker (CEH v13) 312-50v13 Practice Questions with Explanations

Correct answer: B

Triple Data Encryption Standard (3DES) is characterized by using three 56-bit keys and operating on 64-bit blocks of data. It applies the DES algorithm three times to each block, making it the only option that matches all specified criteria: three keys of 56 bits each and 64-bit data blocks.

Why the other options are wrong:

• A. IDEA uses 128-bit keys and 64-bit blocks, not three 56-bit keys.
• C. AES uses 128, 192, or 256-bit keys and operates on 128-bit blocks, not 64-bit blocks.
• D. MD5 is a hash function, not a block cipher, and does not use keys in the traditional encryption sense.

Correct answer: B

The code snippet shows a character buffer of size 10 being assigned the value 'a', which appears to be demonstrating a buffer overflow vulnerability. Buffer overflow attacks occur when data is written beyond the allocated memory boundaries of a buffer, potentially overwriting adjacent memory and causing program crashes, unauthorized code execution, or privilege escalation. This is a classic example of how buffer overflow vulnerabilities are exploited in C/C++ programs.

Why the other options are wrong:

• A. SQL injection targets database queries with malicious SQL code, not memory buffers.
• C. CSRF (Cross-Site Request Forgery) is a web attack involving unauthorized requests, unrelated to buffer memory.
• D. XSS (Cross-Site Scripting) involves injecting malicious scripts into web pages, not exploiting memory buffers.

Correct answer: D

An Advanced Persistent Threat (APT) is characterized by an attacker gaining unauthorized access, remaining undetected for an extended period, and stealing sensitive information without disrupting operations. John's actions-stealthy long-term presence, information theft without sabotage-are hallmarks of an APT attack.

Why the other options are wrong:

• A. An insider threat involves someone with legitimate access; John is described as unauthorized.
• B. Diversion theft is not a recognized attack classification in cybersecurity frameworks.
• C. Spear-phishing sites are initial access vectors, not methods for maintaining persistent undetected presence in a network.

Correct answer: C

The command 'nmap -sT -O -T0' uses TCP connect scan (-sT), OS detection (-O), and timing template T0 (paranoid/slowest). The T0 timing is the slowest mode that sends one probe at a time with long delays, generating minimal network noise and traffic patterns that are least likely to trigger IDS detection compared to other options.

Why the other options are wrong:

• A. -A is aggressive scan mode with maximum noise; -Pn skips ping but doesn't reduce IDS detection.
• B. -sP is ping scan; -p-65535 scans all ports generating high traffic; -T5 is the fastest timing template creating maximum noise.
• D. -A is aggressive; --host-timeout doesn't reduce IDS evasion; -T1 (sneaky) is slower than T0 but less effective than pure T0 with stealth-focused options.

Correct answer: B

WPA3-Enterprise provides 192-bit minimum encryption strength and supports advanced cryptographic tools including GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption), HMAC-SHA384, and ECDSA with 384-bit elliptic curves. These are enterprise-grade security features designed for organizations requiring the highest protection standards.

Why the other options are wrong:

• A. WPA3-Personal provides 128-bit security, not 192-bit minimum strength.
• C. WPA2-Enterprise does not support 192-bit protocols or GCMP-256/HMAC-SHA384; it predates these advanced specifications.
• D. WPA2-Personal is the consumer-grade WPA2 version with lower security standards than WPA3-Enterprise.

Correct answer: C

The php.ini file is a common web server configuration file that, when misconfigured, can expose verbose error messages and sensitive debugging information. Settings like 'display_errors=On' in php.ini cause detailed error messages to be displayed to users, revealing valuable information about the application structure and backend systems.

Why the other options are wrong:

• A. httpd.conf controls Apache server behavior but is not typically the source of verbose error messages in the same way.
• B. administration.config is not a standard web server configuration file.
• D. idq.dll is an IIS component for indexing; while it can be exploited, it is not primarily misconfigured to show verbose error messages.

Correct answer: D

Bluto is an automated DNS reconnaissance tool designed to retrieve comprehensive DNS zone data including DNS domain names, computer names, IP addresses, DNS records, and network Whois information. It is specifically built for DNS footprinting and enumeration attacks, matching Gerard's described actions perfectly.

Why the other options are wrong:

• A. Towelroot is an Android rooting tool, not a DNS reconnaissance tool.
• B. Knative is a Kubernetes-based serverless platform, not related to DNS footprinting.
• C. zANTI is a mobile penetration testing framework, not specifically a DNS zone transfer or footprinting tool.

Correct answer: D

Netcat is a network utility for reading and writing data across network connections; it is useful for network reconnaissance and communication but has no cryptographic functionality for cracking or verifying hashed passwords. Hashcat and John the Ripper are specialized password cracking tools, and THC-Hydra performs brute-force attacks.

Why the other options are wrong:

• A. Hashcat is a GPU-accelerated password cracking tool specifically designed for hash cracking.
• B. John the Ripper is a widely-used password cracking tool that supports numerous hash formats.
• C. THC-Hydra performs brute-force password attacks and can be used against hashed password systems.

Correct answer: D

The 'related:' operator displays websites similar to a specified target URL. An attacker can use this to find competing or similar websites that may share similar vulnerabilities, configurations, or security postures as the target organization.

Why the other options are wrong:

• A. inurl: searches for keywords within URLs, not for similar websites.
• B. info: displays cached and link information about a specific URL, not similar sites.
• C. site: restricts search results to a specific domain, not for finding similar websites.

Correct answer: B

The scenario describes creating a client-side backdoor, which is a weaponization activity. Reconnaissance (stage 1) involves gathering information about targets. Weaponization (stage 2) involves creating malware and tools to exploit vulnerabilities. Command and Control (stage 4) involves establishing communication with compromised systems. Exploitation (stage 5) involves delivering and executing the weapon. Since the tester has already harvested emails (reconnaissance complete) and is now creating a backdoor to send, this is the weaponization stage where tools are being developed and prepared for delivery.

Why the other options are wrong:

• A. Reconnaissance was already completed when emails were harvested from public sources.
• C. Command and Control occurs after successful exploitation when maintaining access to compromised systems.
• D. Exploitation is the delivery and execution phase, which comes after weaponization.

Correct answer: A

The -sA (TCP ACK scan) option is specifically designed to probe firewall rules and determine if a firewall is stateful or stateless. This scan sends ACK packets and observes responses: stateless firewalls may allow ACK packets through, while stateful firewalls typically block them. The -sA flag is the standard tool for this type of firewall analysis.

Why the other options are wrong:

• B. The -sX (Xmas scan) is used for port discovery, not firewall state determination.
• C. The -sT (TCP Connect scan) performs full connection attempts for port scanning, not firewall analysis.
• D. The -sF (FIN scan) is used for port discovery on systems that implement RFC 793, not for firewall state analysis.

Correct answer: B

Martin's assessment focused on local system parameters including user directories, registries, file permissions, native configuration tables, and software configuration errors. These are all indicators of a host-based assessment, which evaluates individual systems for vulnerabilities at the operating system and application level by examining configuration, permissions, and local security settings.

Why the other options are wrong:

• A. Database assessment specifically targets database systems and their configurations, not general system directories and registries.
• C. Credentialed assessment uses valid credentials to scan for vulnerabilities, but the scenario doesn't mention credential usage.
• D. Distributed assessment involves testing multiple systems across a network simultaneously, not a single pre-issued system.

Correct answer: B

Website mirroring is the process of copying an entire website including all content, directory structure, files, images, and links to a local system for offline analysis and mapping. This technique allows penetration testers to understand the complete structure and organization of a target website without repeatedly accessing the live server.

Why the other options are wrong:

• A. Session hijacking involves stealing or intercepting active user sessions, not copying website content.
• C. Website defacement is modifying website content maliciously, not analyzing it locally.
• D. Web cache poisoning involves contaminating cached content to serve malicious data, not copying websites for reconnaissance.

Correct answer: D

James employed an inference-based assessment approach by first building an inventory of protocols and services, then using that information to intelligently select and execute only relevant vulnerability tests for each identified service. This method uses deductive reasoning and knowledge about service-specific vulnerabilities to optimize testing rather than running all tests indiscriminately.

Why the other options are wrong:

• A. Service-based solutions focus on assessing specific services but don't necessarily involve the intelligent filtering described.
• B. Product-based solutions evaluate commercial security products, not custom vulnerability assessment approaches.
• C. Tree-based assessment is not a standard vulnerability assessment methodology terminology.

Correct answer: B

Web-Stat is a web analytics tool designed to monitor website traffic, analyze visitor behavior, and track geographical location data of users visiting a website. This tool provides insights into website performance and user demographics through traffic analysis and location tracking.

Why the other options are wrong:

• A. Webroot is a cybersecurity and endpoint protection software, not a web analytics tool.
• C. WebSite-Watcher is used for monitoring website changes and updates, not for traffic analysis and geographical tracking.
• D. WAFW00F is a tool for identifying and fingerprinting Web Application Firewalls (WAF), not for analytics.

Correct answer: D

RIPE (Réseaux IP Européens) is the Regional Internet Registry responsible for Europe, the Middle East, and Central Asia. Since the IP allocation leads to Le Havre, France, which is in Europe, RIPE is the appropriate RIR to consult for detailed information about IP address allocation and registration details.

Why the other options are wrong:

• A. ARIN manages IP addresses for North America, where Becky is located but not where the IP is allocated.
• B. LACNIC manages IP addresses for Latin America and the Caribbean, which is unrelated to France.
• C. APNIC manages IP addresses for Asia-Pacific regions, not Europe.

Correct answer: A

Harry is in the Initial Intrusion phase of the APT lifecycle. This phase involves the attacker gaining their first foothold in the target network through techniques like spear-phishing and vulnerability exploitation. He has successfully deployed malware and established an outbound connection, which represents successful initial access but comes before the persistence phase where attackers would maintain long-term access.

Why the other options are wrong:

• B. Persistence occurs after initial intrusion and involves techniques to maintain long- term access to compromised systems.
• C. Cleanup is a final phase where attackers remove evidence of their activities before exfiltration.
• D. Preparation occurs before any intrusion attempts and involves reconnaissance and tool development.

Correct answer: B

Robin is performing an STP (Spanning Tree Protocol) attack by introducing a rogue switch with a lower priority to become the root bridge. This allows him to position himself in the middle of network traffic flows, enabling traffic sniffing and man-in-the-middle attacks. The attacker manipulates STP by controlling bridge priority to intercept data.

Why the other options are wrong:

• A. ARP spoofing involves falsifying MAC-to-IP address mappings, not STP manipulation.
• C. DNS poisoning corrupts DNS cache entries, unrelated to switch priority and root bridge election.
• D. VLAN hopping exploits VLAN configuration flaws, not STP root bridge mechanisms.

Correct answer: D

An evil-twin attack occurs when an attacker sets up a fake wireless access point with a legitimate-looking SSID to deceive users into connecting. The Wi-Fi Pineapple tool is commonly used for this purpose. Once users connect, attackers can capture credentials, passwords, and sensitive data transmitted over the fake network.

Why the other options are wrong:

• A. MAC spoofing changes MAC addresses but doesn't create a fake legitimate-looking access point.
• B. War driving involves driving around to discover wireless networks, not creating fake ones.
• C. Phishing uses social engineering through emails or messages, not fake wireless networks.

Correct answer: A

Whitelist validation is a defensive technique that only accepts data matching an approved list of acceptable values, types, ranges, and sizes. This approach is more secure than blacklisting because it explicitly defines what is allowed rather than trying to block known bad inputs. Bob's practice of approving specific data characteristics exemplifies whitelist validation.

Why the other options are wrong:

• B. Output encoding converts data into safe formats for display but doesn't prevent injection at input stage.
• C. Blacklist validation blocks known bad inputs but can be bypassed by new attack variations.
• D. Least privilege restricts user permissions but doesn't validate input data characteristics.

Correct answer: D

In the NIST cloud deployment reference architecture, a cloud carrier is an entity that provides connectivity and transport services between cloud consumers and cloud service providers. The telecom company supplying Internet connectivity and transport services between the organization and the cloud provider fits this definition perfectly.

Why the other options are wrong:

• A. Cloud consumer is the organization using cloud services, not the telecom provider.
• B. Cloud broker provides management services between consumers and providers, not transport connectivity.
• C. Cloud auditor performs independent assessments, not provides transport services.

Correct answer: A

An aLTEr attack involves intercepting 4G/LTE communications by setting up a fake cellular tower (base station) between a victim and legitimate network infrastructure. The attacker intercepts and manipulates traffic, potentially redirecting users to malicious sites. This attack specifically targets cellular networks using intermediary towers to hijack sessions.

Why the other options are wrong:

• B. Jamming signal attacks disrupt communications but don't intercept or redirect traffic to malicious sites.
• C. Wardriving involves passively discovering wireless networks, not intercepting or hijacking sessions.
• D. KRACK attacks exploit WPA2 handshake vulnerabilities in wireless protocols, not cellular networks.

Correct answer: C

JXplorer is a GUI-based LDAP browser and editor tool that can be used to query and browse LDAP directory services. An attacker can use it to anonymously query LDAP servers and extract sensitive information such as usernames, addresses, organizational details, and server names for reconnaissance and further attack planning.

Why the other options are wrong:

• A. ike-scan is used for discovering and fingerprinting IKE services, not LDAP directories.
• B. Zabasearch is a people search engine for finding personal information online, not an LDAP tool.
• D. EarthExplorer is a satellite imagery and geospatial data tool, unrelated to LDAP services.

Correct answer: B

The Docker daemon is the server component in the Docker client/server architecture that processes API requests and manages Docker objects including containers, volumes, images, and networks. It runs in the background and handles all container management operations initiated by the Docker client.

Why the other options are wrong:

• A. Docker objects are the entities being managed (containers, images, volumes), not the component processing requests.
• C. Docker client sends commands but does not process API requests or manage objects directly.
• D. Docker registries store and distribute images but don't process API requests for container management.

Correct answer: A

FCC ID search is an online tool that allows users to query the Federal Communications Commission database to find information about devices, including IoT devices. This search reveals device models, technical specifications, certifications, and other regulatory details that help attackers gather reconnaissance information about target devices.

Why the other options are wrong:

• B. Google image search finds images but doesn't provide device certifications or official model information.
• C. search.com is a generic search engine, not specialized for IoT device certifications and models.
• D. EarthExplorer is a geospatial imagery tool, unrelated to IoT device specifications or certifications.

Correct answer: D

The TPM (Trusted Platform Module) is a hardware security module on the motherboard that generates and stores encryption keys. It is specifically designed to bind encryption keys to the hardware, ensuring that encrypted data (such as BitLocker-encrypted drives) cannot be decrypted if the drive is moved to different hardware without the TPM's authorization. This prevents unauthorized access to encrypted disks on different machines.

Why the other options are wrong:

• A. The CPU performs computations but does not generate or manage encryption keys in this manner.
• B. UEFI is firmware that manages boot processes, not encryption key generation.
• C. The GPU handles graphics processing and has no role in encryption key management.

Correct answer: A

The scenario describes a centralized web API using HTTP methods (PUT, POST, GET, DELETE) with emphasis on performance, visibility, scalability, reliability, and portability. These are hallmark characteristics of RESTful APIs. While REST API (option D) and RESTful API (option A) are often used interchangeably, RESTful API is the more precise term that emphasizes adherence to REST principles and constraints.

Why the other options are wrong:

• B. JSON-RPC is a remote procedure call protocol that does not primarily use HTTP methods.
• C. SOAP API is an XML-based protocol that is more complex and heavyweight than REST.
• D. REST API is essentially equivalent, but RESTful API is the more specific terminology for this scenario.

Correct answer: C

The hit-list scanning technique involves an attacker pre-collecting information about vulnerable machines to create an initial target list, then dividing this list among newly compromised machines to perform parallel scanning and infection. This exponential distribution significantly accelerates the spread of malware across networks, which matches the described scenario of rapid simultaneous scanning and installation.

Why the other options are wrong:

• A. Subnet scanning focuses on scanning entire subnets sequentially, not dividing hit- lists among compromised machines.
• B. Permutation scanning uses a shared random permutation order to prevent detection, not a divided hit-list approach.
• D. Topological scanning targets network topology, not the pre-collected hit-list distribution method described.

Correct answer: B

Nicolas is a white hat hacker because he discovered a zero-day vulnerability and responsibly disclosed it by informing both the affected system owner and Microsoft (the vendor). White hat hackers practice ethical hacking and responsible disclosure to help organizations fix vulnerabilities. His actions follow proper disclosure procedures by notifying stakeholders and providing protection guidance.

Why the other options are wrong:

• A. Black hat hackers exploit vulnerabilities maliciously for personal gain, not for protection.
• C. Gray hat hackers operate in a morally ambiguous zone; Nicolas's responsible disclosure clearly aligns with ethical practices.
• D. Red hat is not a standard classification in hacker typologies.

Correct answer: A

Evilginx is a specialized tool designed for creating sophisticated phishing pages and spoofed emails that can capture credentials. It is specifically used to create deceptive login pages that mimic legitimate social media platforms, allowing attackers to harvest credentials from victims. The scenario of a fake email with a deceptive login page directly matches Evilginx's capabilities.

Why the other options are wrong:

• B. Slowloris is a denial-of-service tool that floods servers with slow HTTP requests.
• C. PLCinject is used for injecting code into industrial control systems, not for creating phishing pages.
• D. PyLoris is another DoS tool variant, not a phishing or spoofing tool.

Correct answer: B

The scenario describes an agent-like tool installed on a compromised machine that scans other machines on the same network for vulnerabilities. This is characteristic of a network- based scanner, which operates from within the network to identify vulnerable systems. The scanner identifies vulnerabilities across multiple networked machines from a single compromised point, which is the definition of network-based scanning.

Why the other options are wrong:

• A. Agent-based scanners install agents on each individual target machine to be scanned, not scanning from one machine to many others.
• C. Cluster scanner is not a standard vulnerability assessment tool classification.
• D. Proxy scanner routes scanning through a proxy, but does not fit the description of scanning multiple machines on the same network from an installed agent.

Correct answer: A

A watering hole attack involves identifying websites frequently visited by target employees, injecting malicious code into those websites, and waiting for victims to visit the compromised site to deliver malware. This matches the exact scenario where Joel identifies frequently visited websites, injects malicious scripts to redirect and deliver malware, and waits for employees to access the infected web applications.

Why the other options are wrong:

• B. DNS rebinding attacks manipulate DNS responses to redirect traffic, not inject scripts into frequently visited websites.
• C. MarioNet is not a recognized attack technique in cybersecurity literature.
• D. Clickjacking involves tricking users into clicking hidden elements, not injecting malware on legitimate websites.

Correct answer: A

Fileless malware operates entirely in memory (RAM) without writing files to disk, making it invisible to traditional antivirus tools and application whitelisting mechanisms that focus on detecting executable files. Since AV tools found nothing and IDS/IPS detected no nonwhitelisted programs, the attacker used fileless malware that leverages legitimate system tools (like PowerShell or WMI) to execute malicious code entirely in memory, allowing data exfiltration without detection.

Why the other options are wrong:

• B. Zero-day malware would likely still be detected by IDS/IPS or trigger behavioral alerts.
• C. Phishing malware typically requires user interaction and would leave file artifacts.
• D. Logic bomb malware is designed for time-triggered or event-triggered payloads, not for bypassing application whitelisting through memory-only execution.

Correct answer: C

Digital signatures use asymmetric cryptography where the sender signs with their private key to prove authenticity and non-repudiation. The recipient verifies using the sender's public key to confirm the message came from that specific sender and hasn't been altered. This is the fundamental principle of digital signatures in email and other communications.

Why the other options are wrong:

• A. Public keys cannot be used to sign; they are used for encryption and verification only.
• B. Dorian would never use Poly's private key, which only Poly should possess, and verification wouldn't work with Dorian's public key in this context.
• D. Dorian cannot sign with Poly's public key, which is not his to use, and the verification mechanism is incorrect.

Correct answer: D

DNS hijacking redirects users to fraudulent websites by compromising DNS resolution. The attacker intercepts or modifies DNS queries so that www.bank.com resolves to a malicious IP address instead of the legitimate bank's server. This explains why Joe sees an insecure connection, a different URL appearance, and is prompted to re-enter credentials on the fake site.

Why the other options are wrong:

• A. DHCP spoofing assigns incorrect IP addresses but doesn't directly cause URL redirection or fake banking websites.
• B. DoS attacks flood systems with traffic to cause unavailability, not redirect users to fake sites.
• C. ARP cache poisoning redirects traffic on the local network but doesn't typically cause the specific symptoms of a fake banking website with URL changes.

Correct answer: D

Session fixation attacks occur when an attacker forces a known session ID onto a victim. The attacker first logs in to obtain a valid session ID, then tricks the victim into using that same session ID. When the victim logs in, their authenticated session is actually linked to the attacker's account, allowing the attacker to access the victim's subsequent activities and sensitive data entry.

Why the other options are wrong:

• A. Forbidden attack is not a standard attack classification in security terminology.
• B. CRIME attack is a compression-based side-channel attack targeting HTTPS/TLS, not related to session manipulation.
• C. Session donation is not a recognized attack type; session fixation is the correct classification for this scenario.

Correct answer: C

Obfuscation involves encoding or transforming data in ways that hide its true content from detection systems while remaining interpretable to the target application. By encoding packets with Unicode characters, Kevin's packets bypass the IDS signature detection but the web server can still decode and process them normally. This is a classic IDS evasion through obfuscation.

Why the other options are wrong:

• A. Session splicing involves fragmenting attack data across multiple packets or sessions, not encoding with Unicode.
• B. Urgency flag is not a standard IDS evasion technique.
• D. Desynchronization causes the IDS and target system to process packets differently, but doesn't specifically involve Unicode character encoding.

Correct answer: B

When the username input 'attack' or 1=1 -- is entered into a vulnerable SQL query without proper parameterization, the single quotes around the username field are closed by the first quote after 'attack', leaving the rest of the input as executable SQL code. The text 'or 1=1' becomes part of the WHERE clause logic, and the -- (SQL comment syntax) comments out the remainder of the query including the password check. This results in: select * from Users where UserName = 'attack' or 1=1 -- and UserPassword = '123456', where the condition 'or 1=1' makes the WHERE clause always true, bypassing authentication.

Why the other options are wrong:

• A. This option incorrectly shows an extra single quote after 'attack' that wouldn't be present in the actual vulnerable query execution.
• C. This option is missing the closing single quote after 'attack', which contradicts how SQL string literals are properly formed even in injection scenarios.
• D. This option places the comment marker before a single quote, which doesn't correctly represent how the input string would be parsed and executed by the SQL Server.

Correct answer: C

The VRFY command in SMTP is used to verify valid user accounts on a mail server. It requests confirmation of whether a given mailbox exists on the system, making it a valuable reconnaissance tool for attackers to enumerate valid usernames without sending actual emails.

Why the other options are wrong:

• A. RCPT is used to specify the recipient during message transmission, not to check user validity.
• B. CHK is not a standard SMTP command.
• D. EXPN expands mailing lists but doesn't verify individual user accounts in the same way VRFY does.

Correct answer: A

FTPS (FTP Secure) encrypts file transfers using SSL/TLS and uses digital certificates for authentication. It addresses the plaintext vulnerability of standard FTP by adding encryption and certificate-based security, preventing sensitive credentials and data from being exposed during transfer and protecting against session hijacking.

Why the other options are wrong:

• B. FTP sends data in plaintext without encryption, which is the original vulnerability described.
• C. HTTPS is for web/HTTP traffic, not file transfer protocols, though it serves a similar security purpose.
• D. IP is a network layer protocol and doesn't provide encryption or certificate-based security for data transfer.

Correct answer: D

In PGP encryption, the sender encrypts messages using the recipient's public key. Only the recipient with their corresponding private key can decrypt the message. This ensures confidentiality because only Marie (who has her private key) can decrypt the sensitive information John sends, even if the network is untrusted.

Why the other options are wrong:

• A. John's private key should never be used to encrypt messages; it's used for signing to prove authenticity.
• B. John's public key is shared and anyone could decrypt with it, providing no security.
• C. John should never have access to Marie's private key, which only she possesses.

Correct answer: D

In CVSS v3.1, severity ratings are defined as: Low (0.1-3.9), Medium (4.0-6.9), High (7.0- 8.9), and Critical (9.0-10.0). Medium severity vulnerabilities fall within the 4.0-6.9 score range, representing issues that pose a moderate risk but are not immediately critical.

Why the other options are wrong:

• A. 4.0-6.0 is too narrow and excludes medium vulnerabilities scoring between 6.0 and 6.9.
• B. 3.9-6.9 includes Low severity scores, which start at 0.1 and go up to 3.9, not 3.9.
• C. 3.0-6.9 incorrectly includes Low severity scores that start higher than 3.0.

Correct answer: B

UDP port 161 is used by SNMP (Simple Network Management Protocol). SNMPv1 and SNMPv2c transmit credentials in plaintext, making them unencrypted and insecure. SNMPv3 introduces encryption and authentication mechanisms, making it the secure alternative. SNMPv2 does not provide encryption despite the option claiming otherwise.

Why the other options are wrong:

• A. RPC uses different ports (135, 445) and disabling it completely is not a practical solution.
• C. SNMPv2 does not provide encryption; only SNMPv3 adds encryption capabilities.
• D. SNMP can carry sensitive device configuration and management data that should be protected.

Correct answer: A

The -sV parameter enables version detection in Nmap, which probes open ports to determine the service type and version number running on those ports. In the output shown, we can see port 80 is open with http service, but to identify the specific web server type and version (e.g., Apache 2.4.41, Nginx 1.18.0, etc.), the -sV flag must be used to perform service version enumeration.

Why the other options are wrong:

• B. -sS performs a TCP SYN scan to identify open/closed ports but does not detect service versions.
• C. -Pn skips host discovery and assumes the host is up, but does not identify service versions.
• D. -V displays the Nmap version number itself, not the version of services running on target hosts.

Correct answer: D

HIPAA (Health Insurance Portability and Accountability Act) and its associated PHI (Protected Health Information) regulations are specifically designed to protect patient medical records and personal health information. This is the primary regulation violated when medical records are exposed. HIPAA violations carry significant penalties for healthcare organizations.

Why the other options are wrong:

• A. PCI DSS applies to payment card data, not medical records.
• B. PII (Personally Identifiable Information) is too broad; PHI is the specific category for health data.
• C. ISO 2002 does not exist; ISO standards relevant to healthcare would be ISO 27001 or similar, but HIPAA/PHI is the specific requirement here.

Correct answer: B

The ethical hacking methodology phases are Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Clearing Tracks. Infecting systems with malware and using phishing to obtain credentials are both active exploitation techniques used to gain unauthorized or authorized access to systems, which defines the 'Gaining Access' phase.

Why the other options are wrong:

• A. Scanning involves identifying open ports and services, not deploying malware or phishing.
• C. Maintaining access involves installing backdoors or rootkits to persist after initial compromise.
• D. Reconnaissance is the passive information gathering phase before active attacks begin.

Correct answer: B

Limiting administrator or root-level access to the minimum number of users is a fundamental principle of least privilege in security hardening. This reduces the attack surface and limits potential damage from compromised privileged accounts. This is a critical countermeasure for securing web server accounts.

Why the other options are wrong:

• A. Unused modules and extensions should be removed, not retained, to reduce vulnerabilities.
• C. Non-interactive accounts should be disabled if they don't require login, not enabled.
• D. Default user accounts should be disabled or removed during hardening, not enabled.

Correct answer: B

A Community cloud is a shared cloud environment used by a specific group of organizations or users with common interests, compliance requirements, or mission objectives. It allows cost sharing among related entities while maintaining some isolation from the public cloud and other communities.

Why the other options are wrong:

• A. Private cloud is dedicated to a single organization with complete control and isolation.
• C. Public cloud is available to the general public with shared resources among many unrelated customers.
• D. Hybrid cloud combines multiple deployment models but doesn't specifically describe a community sharing arrangement.

Correct answer: D

The Agent Smith attack is a sophisticated mobile malware that replaces legitimate applications with malicious ones that appear legitimate. It also displays aggressive advertising and can spread to other devices. This matches the scenario where legitimate apps were replaced by deceptive applications with excessive advertisements.

Why the other options are wrong:

• A. SIM card attacks involve compromising the SIM card itself, not app replacement.
• B. Clickjacking tricks users into clicking elements they don't intend; it doesn't replace apps.
• C. SMS phishing sends deceptive text messages but doesn't replace installed applications.

Correct answer: B

DROWN (Decrypting RSA Using Obsolete and Weakened eNcryption) is an attack that exploits the presence of SSLv2 on a server sharing the same RSA private key with other servers. SSLv2 has critical weaknesses that allow attackers to decrypt TLS connections on other servers using the same key. This precisely matches the vulnerability described in the scenario.

Why the other options are wrong:

• A. Padding oracle attacks exploit padding validation in cipher modes, not SSLv2 weaknesses.
• C. DUHK attacks target Hardware RNG implementations, not SSLv2 protocol vulnerabilities.
• D. Side-channel attacks exploit implementation details; DROWN is specifically about SSLv2 protocol weakness.