312-50v13 ECCouncil Certified Ethical Hacker Exam (CEHv13) Free Practice Exam Questions (2026 Updated)

This scenario is a classic example of DLL hijacking (also called DLL search order hijacking). On Windows, when an application attempts to load a required DLL without using a fully qualified path, the operating system searches for that DLL in a defined search order (including, in many cases, the application directory and other locations that may be writable by a low-privileged user). If an attacker can place a malicious DLL with the same name as the expected library into a directory that is searched before the legitimate DLL’s location, Windows will load the attacker’s DLL first. When the trusted application starts, the malicious DLL is loaded into the process, causing the attacker’s code to execute in the context and privileges of that application.

The question’s clues align tightly with DLL hijacking:

A “non-privileged process loaded a malicious library instead of the intended library” indicates a library preloading/search-order issue rather than exploiting a kernel bug.

The attacker “placed the rogue file in a directory Windows searched before the legitimate location,” which directly describes search order manipulation.

“When the trusted application started, the attacker’s code executed with the application’s privileges” reflects how DLL hijacking can lead to privilege escalation when the target process runs with higher privileges (e.g., as admin or SYSTEM).

“No registry changes … were involved” helps rule out techniques like certain COM hijacks or registry-based persistence and also points away from UAC bypass methods that often rely on registry keys or auto-elevated behaviors.

Why the other options don’t fit:

Exploiting vulnerabilities (A) is too generic and would typically reference a software flaw (buffer overflow, kernel exploit, etc.).

Access token manipulation (C) involves stealing/impersonating tokens, not DLL search order behavior.

Bypassing UAC (D) targets elevation prompts and auto-elevation mechanisms, not DLL loading precedence.

Therefore, the technique is B. Privilege Escalation Using DLL Hijacking.

In the CEH SQL injection methodology, the initial stages focus on understanding where and how user-controlled input enters the application and reaches backend components such as database queries. The activity described is reconnaissance and mapping of input vectors: Rachel is observing the shipment search function, watching HTTP GET parameters, and determining whether those parameters are processed in a way that could influence SQL logic. This directly corresponds to the phase commonly described as identifying data entry paths, where the tester locates all possible points of injection such as URL query strings, form fields, cookies, HTTP headers, and API parameters.

At this stage, the ethical hacker is not yet executing payloads to exploit the database. Instead, they are profiling the request structure, parameter names, values, and server responses to understand how the application behaves when supplied with different inputs. CEH guidance emphasizes that effective SQL injection testing begins by enumerating input sources and determining which of them appear to be reflected in server-side operations. Monitoring HTTP GET requests is a typical technique because query string parameters often map to backend search queries, filters, or record lookups, making them frequent injection candidates if server-side validation and query construction are weak.

The other options occur later. Launching SQL injection attacks involves actively injecting test characters and payloads to confirm injection. Database enumeration happens after a vulnerability is confirmed, to extract schema information and data. Advanced SQL injection refers to more specialized techniques such as out-of-band, time-based blind, or WAF evasion. Since the task here is identifying and assessing potential injection points, the correct step is identifying data entry paths.

The correct answer is D. Date and time received by the originator’s email servers.

Email header tracing reveals hop-by-hop routing information, including mail servers, IP addresses, timestamps, and authentication-related details. CEH-aligned email footprinting material states that tracing an email using the header can reveal the destination address, sender’s IP address, sender’s mail server, time and date information, and authentication system information of the sender’s mail server .

The question asks for the exact moment the email was processed by the sender’s system. In an email header, this is best determined by examining the earliest relevant Received header added by the sender’s or originator’s mail infrastructure. That timestamp shows when the originator’s email server received or processed the message before forwarding it onward.

Option A. Sender’s mail server is incorrect because it identifies the system involved but does not by itself provide the processing time.

Option B. Date and time of message sent is less precise because the Date: header may be generated by the mail client and can be inaccurate or user-controlled.

Option C. Authentication system used by sender’s mail server is incorrect because SPF, DKIM, DMARC, or similar authentication details help validate sender authenticity, not the exact processing time.

Option D. Date and time received by the originator’s email servers is correct because it corresponds to the first trusted server-side timestamp in the message path.

Therefore, the best answer is D. Date and time received by the originator’s email servers.

According to CEH v13 Security Operations and Incident Response, zero-day vulnerabilities pose one of the highest operational risks because exploits exist before official remediation is available. When active exploitation is observed and no vendor patch exists, immediate compensating controls must be deployed.

The first and most effective action is implementing virtual patching, typically through a Web Application Firewall (WAF) or Intrusion Prevention System (IPS). CEH v13 defines virtual patching as a security measure that blocks exploitation attempts at the network or application layer without modifying the vulnerable software. This approach allows organizations to maintain service availability while reducing exposure.

Shutting down the server (Option A) may prevent exploitation but introduces unacceptable business disruption and is not recommended as a first response. Backups and incident response planning (Option C) are critical but do not actively prevent exploitation. Passive monitoring (Option D) allows attackers to continue exploiting the vulnerability unchecked.

CEH v13 emphasizes that virtual patching is the preferred first response for zero-day threats, especially when systems are mission-critical. It provides immediate risk reduction while allowing time for vendor patch development and controlled deployment.

Outdated server software often contains memory corruption flaws. CEH notes that buffer overflow exploits are a primary method for compromising vulnerable server binaries, allowing remote code execution. This approach targets the underlying service rather than application-layer input validation issues.

Tiny Fragments is the technique described because it relies on IP fragmentation to evade firewall or packet-filter inspection by splitting critical header and payload information across multiple fragments. In CEH-aligned network evasion concepts, some security devices make allow or deny decisions by inspecting specific fields and patterns in the first fragment of a packet or by performing limited reassembly. If the attacker deliberately crafts fragments that are unusually small, the first fragment may not contain enough of the TCP header or higher-layer data for the firewall to properly evaluate the packet against its rules and signatures. The remaining TCP header bytes or meaningful payload patterns can be pushed into subsequent fragments, which may pass through because the device cannot correlate them correctly or does not fully reassemble traffic before inspection.

The question’s key clue is that Ethan is “forcing some TCP header information into subsequent packets” to bypass checks. That phrasing is a direct match to fragmentation-based evasion rather than identity deception or tunneling. IP address spoofing changes the apparent source IP, but it does not specifically move TCP header details into later fragments. Source routing is an old technique to influence packet pathing using IP options and is typically blocked in modern environments; it also does not describe splitting TCP header content. HTTP tunneling encapsulates non-HTTP traffic inside HTTP to pass through proxies or firewalls, which is a different mechanism than fragmentation.

Therefore, the correct firewall bypass technique in this scenario is Tiny Fragments.

The vulnerability described is characteristic of XML External Entity (XXE) Injection. In CEH web application security coverage, XXE occurs when an application parses XML input without properly disabling external entity resolution. If the XML parser is configured insecurely, an attacker can define a malicious external entity that references local files or internal system resources. When the parser processes the XML document, it resolves the external entity and may return the contents of sensitive files in the server’s response.

The scenario clearly states that the issue arises from “handling of external references in document parsing” and results in exposure of internal file paths and database connection strings. This aligns directly with XXE behavior, where attackers leverage external entity declarations to retrieve local files such as configuration files, environment settings, or system credentials. In some cases, XXE can also enable server-side request forgery by forcing the server to make internal network requests.

The other options do not match the described behavior. Identification and authentication failures relate to improper access controls, not document parsing. HTTP response splitting involves manipulating headers to inject malicious responses. Security logging and monitoring failures refer to detection gaps, not data exposure through parsing. CEH-recommended mitigation strategies include disabling DTD processing, turning off external entity resolution in XML parsers, validating input formats, implementing least privilege on file access, and using secure parsing libraries that prevent XXE exploitation.

CEH courseware categorizes hackers based on intent, authorization, and affiliation. State-sponsored hackers are defined as individuals or teams who conduct cyber operations on behalf of a government to advance national interests. These operations often include espionage, cyber warfare, intelligence gathering, and covert offensive actions. Unlike organized hackers or cybercriminal groups, whose motivations may include financial gain or ideological activism, state-sponsored units follow strategic directives issued by government agencies. CEH materials explain that such groups operate with access to advanced tools, long-term funding, and classified intelligence, enabling them to execute highly sophisticated and covert operations targeting foreign governments, corporations, or critical infrastructure. Hacktivists pursue political or social causes, while gray-hat hackers operate without explicit permission but without malicious intent. Only state-sponsored hackers match the scenario where cyber experts are formally trained, resourced, and authorized by a national government to conduct operations that remain undetected. Therefore, the correct classification is state-sponsored hackers.

The correct answer is D, Least privilege. In Linux, sudo temporarily grants elevated/root-level privileges to execute administrative commands. The CEH-aligned principle of least privilege requires that users, services, and processes receive only the minimum permissions needed to perform their authorized tasks. Allowing passwordless sudo for multiple commands weakens this control because a normal user can execute privileged actions without reauthentication, increasing the risk of accidental misuse, insider abuse, credential compromise, or privilege escalation. CEH materials emphasize least privilege as an authorization control and also note that sudo provides temporary root privileges. Zero trust is broader and focuses on continuous verification, defense in depth uses layered controls, and CIA refers to confidentiality, integrity, and availability. The specific misconfiguration here is excessive privilege assignment, so the violated security principle is least privilege. A secure configuration should tightly scope sudo permissions to only required commands and users, require authentication where appropriate, and log privileged actions.

The described evasion relies on preventing the IDS from correctly reassembling packets, which points directly to packet fragmentation. In fragmentation-based evasion, the attacker breaks the probe payload into multiple IP fragments. Some IDS sensors—especially if misconfigured, overloaded, or using limited reassembly logic—may fail to fully reconstruct the original packet stream, causing the malicious or suspicious content to evade signature matching and detection. Meanwhile, the target host (or a downstream device) may correctly reassemble the fragments and process the probe normally. This mismatch between what the IDS “sees” and what the target ultimately receives is the core concept behind fragmentation evasion.

The scenario explicitly says “IDS devices are unable to reassemble the packets correctly,” which is essentially the textbook rationale for fragmentation as an IDS evasion method. Attackers may vary fragment size, overlap fragments, or manipulate offsets to stress or confuse reassembly engines. Even when modern IDS systems support reassembly, fragmentation can still be used to reduce detection reliability if sensors are under resource pressure or if traffic normalization is not enforced.

Why the other options don’t match:

Source routing (B) attempts to influence the path packets take through the network; it does not inherently prevent IDS reassembly.

Decoy scanning (C) floods the target/IDS with scans from multiple spoofed addresses to obscure the true scanner source. This is about attribution noise, not packet reassembly failure.

IP spoofing (D) for scanning can disguise origin, but it does not inherently cause IDS reassembly problems.

Therefore, Maria is applying A. Packet Fragmentation.

The correct answer is D. Obtain written permission to hack. In CEH methodology, the ethical difference between a hacker and an ethical hacker is authorization. Before any testing, scanning, exploitation, or information gathering begins, the ethical hacker must have written approval from the system owner. The CEH-aligned penetration testing lifecycle places rules of engagement, customer requirements, scope definition, legal agreements, contracts, and NDAs in the pre-attack or preparation phase before active testing begins. Written permission defines what systems may be tested, which techniques are allowed, when testing may occur, who must be notified, and what liability protections apply. Verbal permission is not sufficient because it is difficult to prove and may not clearly define legal boundaries. Hacking the web server before permission would be unauthorized activity, and gathering target information before approval may also violate scope and legal requirements. Therefore, the most important pre-assessment action is to obtain written authorization. CEH exam guidance also emphasizes that an ethical hacker always obtains written permission before testing.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is A. hashing algorithms. In information security and cryptography, hashing algorithms are specifically designed to provide data integrity. A hash function takes an input message, file, or data block and produces a fixed-length value known as a hash, message digest, or checksum. If even a single bit of the original data changes, the resulting hash value changes significantly, making unauthorized modifications easy to detect.

Common cryptographic hash algorithms include SHA-256, SHA-384, and SHA-512. These algorithms are widely used to verify the integrity of files, software downloads, digital documents, emails, and transmitted network data. During verification, the recipient calculates the hash of the received data and compares it to the original hash value. If the values match, the data has maintained its integrity.

Option B is incorrect because “integrity algorithms” is not a standard cryptographic algorithm category. Option C (symmetric algorithms) such as AES and DES primarily provide confidentiality through encryption, while Option D (asymmetric algorithms) such as RSA and ECC are mainly used for encryption, key exchange, authentication, and digital signatures. Although digital signatures can support integrity verification, the fundamental mechanism used to detect changes in data is the cryptographic hash function. Therefore, hashing algorithms are the best answer for guaranteeing message integrity.

In Certified Ethical Hacker cloud computing coverage, the essential characteristics of cloud services align with the widely adopted NIST cloud model. The requirement in this scenario is twofold: efficient sharing of resources across multiple users and the ability to scale to meet spikes in demand such as Black Friday traffic. The cloud characteristic that directly addresses efficient sharing is resource pooling. Resource pooling means the cloud provider aggregates compute, storage, memory, and network resources into a shared pool that serves multiple customers using a multi-tenant model. Resources are dynamically assigned and reassigned according to consumer demand, which enables rapid scaling without requiring the organization to purchase and install new physical infrastructure for each surge.

This matches the scenario’s emphasis on optimizing resource allocation and ensuring scalability. With resource pooling, the platform can draw from shared infrastructure capacity when demand rises and release it when demand drops, improving efficiency and cost effectiveness. In CEH terms, this also influences security considerations such as tenant isolation, hypervisor security, and access control, because multiple customers may rely on the same underlying physical hardware while remaining logically separated.

The other options are not the best match for “efficiently shared across multiple users.” Measured service focuses on metering and pay-as-you-go billing. Broad network access describes availability over networks and standard client platforms. On-demand self-service refers to a consumer’s ability to provision resources automatically without human interaction from the provider. Those are important cloud traits, but the one that specifically enables shared infrastructure and elastic allocation is resource pooling.

The correct answer is B because signature-based IDS detection depends on matching known byte patterns, strings, payload structures, or attack signatures. Polymorphism is highly effective against this model because it changes the appearance of the payload while preserving the same functionality. CEH-aligned material explains that IDSs mainly work by comparing traffic against a signature database, and signature detection only identifies attacks whose signatures exist in that database. It also states that polymorphic shellcodes evade IDS by modifying the attack payload so it no longer matches the default IDS signature. Obfuscation is a broader technique and may include encoding or formatting changes, but polymorphism is more directly aimed at defeating static signatures. Encryption can hide traffic from inspection, but it depends on whether the IDS can decrypt or inspect the session. Port scanning is reconnaissance, not IDS bypass. Therefore, polymorphism is the most precise CEH answer.

The correct answer is RSA. CEH cryptography coverage describes RSA as a widely used asymmetric algorithm that supports encryption and digital signatures and is commonly deployed in public-key infrastructures. The question states that the transaction data is hashed, the hash is signed with the sender’s private key, and the recipient verifies the signature with the matching public key. That is the classic RSA signature model presented in CEH materials. The additional clue is that the same algorithm is said to support encryption, digital signatures, and secure communications use cases. Diffie-Hellman is mainly a key exchange mechanism and is not used for digital signatures in the way described here. DSA is designed for digital signatures, but not for general encryption. ElGamal can support encryption and signatures, but CEH exam framing most strongly associates this full combination of encryption plus digital-signature verification with RSA. CEH references repeatedly emphasize RSA as the standard asymmetric cryptosystem for confidentiality, authentication, integrity, and nonrepudiation in enterprise communications. Because the described implementation combines hashing, private-key signing, and public-key verification within a broad asymmetric framework, RSA is the most accurate answer.

White Hat Hacking is defined in CEH v13 as ethical hacking performed with explicit authorization to identify and remediate vulnerabilities. White hat hackers operate within legal frameworks and contractual agreements.

Grey hats act without permission but without malicious intent. Black hats conduct illegal attacks. Blue hats are external testers invited to find bugs before product release.

Thus, Option C is correct.

This scenario strongly suggests a race condition attack in the application’s token validation logic, as described in CEH v13 Web Application Hacking. A race condition occurs when an application processes multiple requests simultaneously and fails to properly synchronize validation checks.

The presence of multiple failed attempts using expired tokens followed by successful access within a short time window indicates the attacker exploited a timing flaw. During this window, the system may have inconsistently validated token expiration, allowing an expired token to be accepted.

Option A is unlikely because the logs specifically reference expired tokens. Option B is incorrect because replaying expired tokens should fail unless a validation flaw exists. Option C is highly improbable due to token entropy.

CEH v13 highlights race conditions as advanced logic flaws that are difficult to detect and often missed during standard testing. They are commonly exploited in authentication, payment processing, and session management systems.

Therefore, Option D is the correct and CEH-aligned answer.

The correct answer is D. Twofish because the question explicitly describes a symmetric cipher that: (1) works on 128-bit blocks, (2) supports keys up to 256 bits, and (3) was a finalist in the AES selection process intended to replace DES. Twofish matches all of these characteristics. It is a symmetric block cipher designed by Bruce Schneier and colleagues, and it was one of the five AES finalists (along with Rijndael, Serpent, RC6, and MARS). Twofish uses a 128-bit block size and allows key sizes of 128, 192, or 256 bits, aligning precisely with the “up to 256-bit keys” clue.

Why the other choices do not fit: RC4 is a stream cipher, not a 128-bit block cipher, and it is not an AES finalist. AES itself (Rijndael) is the algorithm that ultimately won the AES competition; the prompt says the algorithm was a finalist, not necessarily the winner, and the description is intended to distinguish a finalist option from AES itself. Blowfish supports variable key lengths up to 448 bits but uses a 64-bit block size, not 128-bit blocks, and it was not an AES finalist (Twofish was designed as Blowfish’s successor with a larger block size to address modern requirements).

In practical terms, the block size and key size characteristics matter for security and performance: 128-bit blocks are standard for modern symmetric encryption, and 256-bit keys provide a high security margin for long-term protection of sensitive logs. The mention of AES finalization also signals that this algorithm belongs to the same generation of modern block ciphers designed with strong resistance to cryptanalysis and efficient software/hardware implementation.

Therefore, based on the stated properties and its AES finalist status, the symmetric encryption algorithm is Twofish.

According to CEH v13 Security Operations and Incident Response, backdoors are stealth mechanisms that allow attackers persistent access. Indicators such as unexplained outbound traffic, unauthorized file modifications, and irregular reboots strongly suggest post-compromise persistence mechanisms.

CEH v13 recommends a behavioral and host-based detection approach for backdoor identification. Continuous monitoring of system and file activity helps detect unauthorized binaries, registry changes, and scheduled tasks. Anomaly detection identifies deviations from normal system behavior, which is critical for uncovering hidden backdoors that evade signature-based detection.

Additionally, advanced anti-malware tools with heuristic and memory analysis capabilities are essential to identify sophisticated backdoors that traditional antivirus may miss. These tools can detect rootkits, fileless persistence, and covert communication channels.

The other options are preventative but not investigative. Immediate reboots may destroy volatile evidence, while password policies and ACLs do not detect existing compromises. Therefore, option B provides the most effective and CEH-aligned response.

The correct answer is C. Scanning Modbus Devices.

The scenario describes a targeted scan against a TCP service used by industrial controllers that support function-code exchanges for reading and writing memory/register areas. This directly maps to Modbus/TCP, which commonly runs on TCP port 502 and uses function codes to read coils, read registers, write coils, and write registers.

The referenced OT/ICS material identifies Modbus as a protocol used in industrial control systems and shows Modbus scanning examples such as modscan.py -a < target > -p 502 and modpoll -m tcp, including the use of Modbus function codes for reading input registers . Another reference also lists ICS reconnaissance using nmap -p 102,502 -sV < target_ip > and identifies port:502 modbus as a search pattern for Modbus servers commonly used in ICS environments .

Option A. Capturing Modbus/TCP traffic using Wireshark is incorrect because the scenario describes an active targeted scan, not passive packet capture.

Option B. Scanning Siemens SIMATIC S7 PLCs is incorrect because Siemens S7 communication is commonly associated with TCP port 102, not the Modbus function-code pattern described here.

Option C. Scanning Modbus Devices is correct because Modbus/TCP uses TCP port 502 and function codes for reading and writing industrial data.

Option D. Scanning Omron PLC Devices is incorrect because Omron PLC reconnaissance commonly involves protocols such as FINS, not the Modbus/TCP function-code behavior described.

Therefore, the best answer is C. Scanning Modbus Devices.

This scenario demonstrates a classic case of Session Fixation, a session hijacking technique explicitly covered under the CEH v13 Web Application Hacking module. Session fixation occurs when an attacker sets or predicts a valid session identifier and forces a victim to authenticate using that same session ID.

In the given question, two critical vulnerabilities are highlighted:

The session ID is embedded in the URL

The application does not regenerate the session ID after login

According to CEH v13, secure applications must regenerate session identifiers after successful authentication to prevent fixation attacks. If this does not occur, an attacker can craft a URL containing a known session ID and trick the victim into clicking it. Once the victim logs in, the attacker reuses the same session ID to gain unauthorized access.

CEH documentation states that session fixation is particularly effective when:

Session IDs are passed via URL parameters

Sessions persist across authentication

Secure cookie attributes are not enforced

Other options are incorrect because:

XSS-based cookie theft requires client-side script injection.

DNS cache poisoning is unrelated to session management.

CSRF exploits user trust but does not directly hijack sessions.

Thus, Session Fixation by pre-setting the token in a URL is the most effective attack in this case.

CEH v13 highlights HTML smuggling as a modern technique used to bypass perimeter defenses by leveraging browser-side execution. Instead of downloading a malware file directly—which firewalls and IDS can detect—an attacker embeds obfuscated JavaScript or HTML within an attachment. When the victim opens the file, the browser reconstructs the payload locally using APIs like Blob or URL.createObjectURL. This method avoids external network transfers during the payload creation stage, allowing it to bypass content filters, sandboxing, and inline inspection tools. CEH emphasizes that HTML smuggling is especially dangerous because it operates within the browser environment, which security appliances implicitly trust. Port forwarding (Option B) relates to tunneling traffic, not file reconstruction. XSS (Option C) requires injecting scripts into web pages, not delivering malware. HTTP header spoofing (Option D) manipulates request metadata, not payload construction. Therefore, HTML smuggling precisely matches the described behavior.

The correct answer is A. Honey trap. In CEH social engineering concepts, a honey trap is a technique in which an attacker creates a fake attractive identity, often on social media or dating platforms, to build emotional trust with a target. The attacker then uses that trust to extract sensitive personal, corporate, or security-related information.

In this scenario, Steve created a fake social media profile and used an appealing profile picture and description to attract Stella. Once Stella accepted the request and began communicating with him, Steve gradually asked questions about her company and collected important organizational information. This matches the honey trap method because the attacker used attraction, trust, and manipulation to obtain confidential information.

Option B, diversion theft, involves redirecting deliveries or information to the wrong location. Option C, piggybacking, means gaining physical access by following an authorized person. Option D, baiting, uses an enticing object or offer, such as infected USB media, to lure victims. Therefore, the best answer is Honey trap.

The correct answer is A. ms-sql-m because TCP/1434 is commonly associated with Microsoft SQL Server Monitor / SQL Server Browser–related services, which are used to help clients discover SQL Server instances and their connection details. In standardized service naming, ms-sql-m corresponds to Microsoft SQL “monitor” functionality tied to instance discovery and related metadata exposure. When this port is reachable from networks where it is not needed, it can increase attack surface by exposing information that helps attackers identify database instances, target the correct ports, and focus exploitation attempts.

In the context of a legacy server that is “not listed in the company’s active inventory,” an open 1434 is a red flag because it suggests an unnecessary or unmanaged database discovery component may be running. Attackers often use exposed database-related ports for reconnaissance (identifying instance names, versions, and listening endpoints) and then pivot to authentication attacks or exploitation of known weaknesses. Even when the core SQL service port is controlled, discovery services can still leak useful environment details that lower the cost of an attack.

Why the other options are incorrect:

ms-sql-s typically refers to the primary Microsoft SQL Server service, most commonly associated with TCP/1433 (the default SQL Server port), not 1434.

sql*net is associated with Oracle SQL*Net/Net8 traffic, typically using Oracle listener ports such as 1521, not 1434.

sqlsrv is not the standardized assignment for 1434 in the way ms-sql-m/ms-sql-s are used for Microsoft SQL-related services.

Therefore, based on standardized port associations and the database discovery/monitoring role of this service, the exposure most likely indicates ms-sql-m on TCP/1434, and it warrants further review and potential restriction if not required.

The correct answer is C because LSASS, or Local Security Authority Subsystem Service, is a Windows process responsible for authentication-related operations. CEH system-hacking concepts associate LSASS access with attempts to extract credentials, password hashes, cached logon data, and Kerberos tickets from memory. The referenced CEH-aligned guide explains that Windows stores password hashes in memory while a user is logged on and that these hashes are loaded into LSASS, which is responsible for user authentication. It also notes that tools such as Mimikatz can extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Red-team material similarly links LSASS process dumping and Mimikatz analysis with extracting information from memory. Therefore, unknown processes accessing LSASS memory strongly indicate credential dumping. SQLi and XSS are web application attacks, and DoS targets availability, not authentication secrets.

Insecure Deserialization is the best match because the scenario explicitly describes user-supplied data being processed during object reconstruction. In CEH-aligned web application security concepts, deserialization is the process of taking serialized data, such as JSON, XML, YAML, or binary objects, and converting it back into in-memory objects the application can use. When an application accepts serialized objects from an untrusted source and reconstructs them without strong validation, integrity checks, and safe type constraints, an attacker can tamper with the serialized content to alter object fields, inject unexpected object types, or trigger unsafe behaviors during reconstruction.

The key clue is that Sophia uploads a crafted template file and gains administrative access and access to restricted dashboards. That outcome commonly occurs when a deserialized object contains role, permission, or account attributes that the server trusts, or when deserialization triggers privileged logic through gadget chains or unsafe callbacks. The prompt also rules out database queries, client-side code execution, and session manipulation, which eliminates common alternatives like SQL injection, XSS, and session hijacking. Local file inclusion would involve forcing the server to include local files using path manipulation, which is not described here. Verbose error messages can leak information but do not directly grant admin access.

Mitigations emphasized in ethical hacking guidance include never deserializing untrusted data when avoidable, enforcing strict allowlists of types, applying cryptographic signing or HMAC integrity validation to serialized data, using safer data formats with explicit schemas, regenerating authorization decisions server-side rather than trusting client-provided object attributes, and logging and blocking anomalous deserialization attempts.

The correct answer is D. This message shows classic social engineering and smishing indicators: it arrives by mobile text, claims urgency with a “vital transaction,” impersonates a trusted organization, and asks Bob to contact a free public email address. A legitimate bank or financial institution would normally use an official corporate domain, not a generic @yahoo.com mailbox. Option A is weak because not knowing Scott alone does not prove fraud; the stronger evidence is the suspicious sender identity and unofficial contact channel. Option B is incorrect because the message only claims to represent a respectable organization; attackers often impersonate trusted brands. Option C is unsafe because replying to the provided address validates Bob as a target and may continue the scam. CEH social engineering guidance emphasizes verifying requests through trusted, independent channels and recognizing phishing/smishing attempts that exploit urgency, authority, and user trust. Therefore, the best answer is D.

Operational Technology and ICS environments often suffer from misconfigurations such as unchanged factory-default passwords. CEH identifies exploiting default credentials as a direct and effective method because ICS devices frequently lack strong authentication controls. Using these built-in credentials grants immediate unauthorized access to supervisory controls, enabling adversaries to manipulate configurations, disrupt processes, or escalate attacks across critical systems.