312-50v13 ECCouncil Certified Ethical Hacker Exam (CEHv13) Free Practice Exam Questions (2026 Updated)

The CEH Web Application Attacks module explains tautology-based SQL injection as an attack where input alters a conditional statement to always evaluate as TRUE (e.g., ' OR ' 1 ' = ' 1 ' ).

Submitting a single quote often breaks query logic and allows attackers to manipulate authentication conditions.

Option D is correct.

Option A extracts data.

Option B relies on error messages.

Option C uses timing delays.

CEH identifies tautology attacks as one of the earliest and most common SQL injection techniques.

The evidence points to a User Account Control bypass. In CEH coverage of Windows privilege escalation, UAC is a protection mechanism intended to prevent silent elevation of privileges, typically prompting the user when an action requires administrative rights. However, certain Windows binaries are “auto-elevate” (often trusted, signed Microsoft executables) and can run with elevated privileges under specific conditions without showing a UAC prompt. Attackers abuse this behavior by manipulating user-writable registry locations—commonly under the current user hive—to influence how these trusted binaries launch other components.

The scenario describes exactly that pattern: a non-elevated process starts an auto-elevate executable such as fodhelper.exe, eventvwr.exe, or sdclt.exe, and the system executes unauthorized code with no prompt. The key forensic clue is “manipulation of shell-related keys under the current user hive,” which is a hallmark of UAC bypass techniques that hijack file association or shell open commands so the trusted binary invokes an attacker-controlled payload instead of the intended system action. Because the modification occurs in HKCU, it can often be performed without administrator privileges, making it attractive for stealthy elevation.

The other options do not match as well. Kernel exploitation involves abusing OS kernel vulnerabilities and would not hinge on shell registry hijacks. Scheduled tasks typically leave task artifacts and are a persistence/execution method rather than this specific auto-elevate redirection behavior. DLL hijacking focuses on search-order abuse for loading malicious DLLs, not shell key redirection tied to UAC auto-elevation.

Tautology-based SQL injection tests, such as using ' OR ' 1 ' = ' 1, are safe and effective methods to verify whether SQL queries are being manipulated by user input. CEH emphasizes avoiding destructive queries and using logical expressions that return all rows if injection is successful.

The correct choice is OS command injection in nginxWebUI because the question describes untrusted input being passed into backend processing in a way that affects system-level operations. CEH web application material classifies command injection as an injection flaw that occurs when a vulnerable application allows attacker-controlled input to be interpreted by the operating system or shell environment. The key clue is that the tester manipulates parameters associated with uploaded content, and those altered values influence commands executed in the server-side web service context. That is the hallmark of command injection rather than SSRF, which would involve the server making unintended outbound requests, or certificate validation issues, which relate to TLS trust decisions. The mention of no direct shell access is also consistent with command injection, because the attacker does not need an interactive shell if malicious input can still alter system commands behind the application. CEH guidance repeatedly stresses that unvalidated input in web applications can lead to injection attacks, including command injection, when user-controlled values reach backend interpreters without strict sanitization, parameter control, or allow-list validation.

This scenario represents a Tautology-Based SQL Injection, a fundamental SQL injection technique covered under the Web Application Hacking module in the CEH v13 curriculum. The defining characteristic of this attack is the injection of a condition that always evaluates to TRUE, thereby bypassing authentication or authorization controls.

In the given example, the injected input 1 OR ' T ' = ' T ' ; -- manipulates the logical condition of the SQL query. A typical vulnerable login query may resemble:

SELECT * FROM users WHERE user_id = 1 AND password = ' input ' ;

When the attacker submits the injected payload, the resulting SQL statement becomes:

SELECT * FROM users WHERE user_id = 1 OR ' T ' = ' T ' ; -- ' ;

The expression ' T ' = ' T ' is a tautology, meaning it always evaluates to TRUE regardless of context. As a result, the database returns records without properly validating the user’s credentials, granting unauthorized access.

According to EC-Council CEH v13, tautology-based SQL injection is classified as a Boolean-based injection technique where attackers exploit improper input validation to alter the logical flow of SQL queries. This attack does not depend on database error messages (as in Error-Based SQL Injection), does not extract data using UNION statements (Union-Based SQL Injection), and does not rely on response delays (Time-Based Blind SQL Injection).

CEH v13 emphasizes that such attacks are especially effective against login forms and authentication mechanisms when developers fail to implement input sanitization, parameterized queries, or prepared statements. This attack is one of the most common and exam-tested SQL injection types because it clearly demonstrates how flawed logic can compromise application security without advanced techniques.

Understanding tautology-based SQL injection is critical for ethical hackers, as it forms the foundation for identifying and mitigating more complex SQL injection variants.

CEH v13 details that fragmentation attacks are a common IDS evasion strategy. Signature-based IDS systems depend on reassembling packets to detect malicious patterns. When attackers fragment TCP headers into smaller segments, the IDS may be unable to reconstruct the original packet sequence, especially if the fragments are intentionally crafted to confuse reassembly buffers. Meanwhile, the target host typically recombines the fragments correctly, allowing the scan or payload to pass undetected. This technique is specifically discussed under IDS evasion methods, where fragmentation prevents complete packet inspection. Options A and B describe unrelated evasion mechanisms such as IP spoofing and MAC spoofing, and Option C does not fundamentally affect IDS reconstruction. The tester is clearly using packet fragmentation to evade detection while still mapping open ports successfully.

The correct answer is D because world-writable cron directories allow unauthorized users or attackers to add or modify scheduled tasks. In Linux, cron is used to run commands or scripts automatically at defined times, and CEH-aligned material identifies crontab as the mechanism for listing scheduled jobs/tasks. If cron directories are writable by everyone, an attacker can place a malicious script or cron entry that repeatedly runs after compromise, after login, or after reboot. This supports the CEH system-hacking phase of maintaining access, also called persistence. The uploaded red-team reference specifically associates Linux “permanent access” with cron-based scheduled execution. Linux permissions are based on read, write, and execute rights, and overly permissive settings such as full access for all users create serious control weaknesses. This is not SQL injection or XSS because no web application input is involved. It is not primarily DoS. The best CEH answer is persistence.

CEH v13 details the standard penetration testing workflow, where confirmed critical vulnerabilities—especially those affecting core systems like database servers—should be prioritized for exploitation only after verification and when explicitly permitted by the rules of engagement. Exploiting a known vulnerability using vetted tools (e.g., Metasploit, CVE-specific exploits) provides evidence of real-world risk and validates the severity rating. Brute-forcing logins (Option B) is inefficient and often outside scope. Ignoring a critical vulnerability (Option C) violates CEH’s prioritization guidelines. A DoS attack (Option D) is never appropriate unless the engagement explicitly authorizes destructive testing, which is rare. CEH stresses that high-impact vulnerabilities should be exploited to demonstrate business risk, privilege escalation potential, data exposure, or lateral movement possibilities—making Option A fully aligned with CEH methodology.

The correct answer is B. Use a scan tool like Nessus. In CEH vulnerability assessment and reconnaissance concepts, vulnerability scanners are used to discover security weaknesses on systems, applications, services, and network devices. Nessus is a widely known vulnerability assessment tool that can scan Windows-based systems for missing patches, weak configurations, open ports, insecure services, outdated software, and known vulnerabilities.

Option A is not the best answer because MITRE CVE provides vulnerability information, but it does not directly assess whether a specific Windows computer is vulnerable. Option C is related to system imaging or forensic preparation, not vulnerability discovery. Option D, Windows Update, helps install patches, but it does not perform a complete vulnerability assessment or detect misconfigurations and exposed services.

For a healthcare provider, vulnerability scanning is especially important because systems may process sensitive patient or business data. A scanner such as Nessus gives structured results that can be prioritized and remediated.

Therefore, the best approach is to use a scan tool like Nessus.

The correct answer is B, Clickjacking Attack. Clickjacking is a web application attack in which an attacker tricks a victim into clicking on a hidden or disguised element different from what the victim perceives on the screen. The most common technique involves placing a transparent or invisible iframe over legitimate-looking content. When the victim clicks the visible button, image, or link, the click is actually directed to the hidden iframe controlled by the attacker.

In CEH web application hacking topics, clickjacking is considered a user-interface redress attack because it manipulates the user’s perception of the web page. Attackers use this technique to force users to perform unintended actions such as changing account settings, authorizing transactions, enabling webcams, downloading malware, or granting permissions on trusted websites while remaining unaware of the action being performed.

HTTP Parameter Pollution involves manipulating application parameters, HTML Injection inserts malicious HTML into a web page, and Session Fixation forces a user to use a predefined session identifier. Since the scenario specifically describes a transparent iframe tricking the victim into clicking hidden content, the attack is Clickjacking.

Answer: B QUESTION NO: 25 [Malware Threats]

What kind of detection technique is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it ' s made on the provider ' s environment?

A. Heuristics based

B. Honeypot based

C. Behavioral based

D. Cloud based

Answer: D

The correct answer is D. Cloud based because the question describes an antivirus architecture where suspicious files, metadata, reputation information, and threat intelligence are collected from multiple protected endpoints and analyzed within the vendor’s cloud infrastructure rather than exclusively on the local machine. In CEH malware defense concepts, cloud-based detection leverages centralized analysis engines, reputation services, machine learning models, and global threat intelligence gathered from many endpoints. This approach enables rapid identification of emerging malware and zero-day threats because intelligence learned from one protected system can immediately benefit all other protected systems.

Heuristic-based detection focuses on identifying suspicious code characteristics and malware-like patterns. Behavioral-based detection monitors how a program behaves on a system, such as unauthorized registry changes, process injection, or unusual network activity. Honeypot-based solutions use decoy systems to attract and study attackers. None of these specifically describe offloading analysis to the antivirus provider’s environment. The key phrase in the question is that malware analysis is performed in the provider’s environment using information collected from many protected systems, which is the defining characteristic of cloud-based malware detection. Therefore, option D is the most accurate CEH-aligned answer.

The correct answer is B. Impersonation because Rachel’s primary technique is pretending to be a specific, legitimate employee (“Mark Stevens, a senior finance manager”) to induce the HR staffer to disclose or transmit sensitive information. In CEH-aligned social engineering concepts, impersonation is the act of assuming another person’s identity or role—often someone with authority or a believable business need—to gain trust and persuade the target to perform an action they otherwise should not (such as sharing confidential documents, resetting credentials, or bypassing verification steps).

The scenario includes multiple social engineering influence factors commonly emphasized in CEH: authority (claiming to be a senior finance manager and referencing the CFO), urgency (“upcoming presentation” and “urgently needs”), and pressure to reduce the likelihood the staffer follows standard validation procedures. These elements strengthen the impersonation by making the request feel both legitimate and time-sensitive, increasing compliance. The target’s reaction—feeling compelled due to Rachel’s authoritative tone—matches the expected psychological effect of impersonation attacks.

Why the other options are less correct: Vishing (voice phishing) is a delivery channel—social engineering conducted via phone calls. While this interaction occurs over the phone, the question asks for the technique being demonstrated. The defining technique here is the identity deception (impersonation) rather than merely the medium. Quid pro quo involves offering something in exchange (e.g., “I’ll fix your issue if you give me your password”), which is not present. Reverse social engineering involves the attacker creating a problem and positioning themselves as the helper so the victim contacts them; that is not described because Rachel initiates the call and directly requests the document.

Therefore, the most accurate classification of Rachel’s method is Impersonation.

The finding most directly demonstrates insecure data transfer and storage. The scenario includes two explicit problems: (1) sensitive business records are transmitted “across the network without encryption,” and (2) the same records are “stored in a retrievable format” in the cloud platform. Those two conditions map exactly to data-in-transit and data-at-rest weaknesses. When IoT devices transmit sensitive data without encryption (e.g., plain HTTP, unprotected MQTT, insecure proprietary protocols), attackers who gain network visibility can intercept, read, and potentially modify that data. Similarly, when cloud-stored data is kept in an easily retrievable or improperly protected form (e.g., weak access controls, lack of encryption at rest, overly permissive storage buckets, exposed APIs), attackers can access business records long after transmission.

In IoT ecosystems, data typically flows from sensors to gateways, then to cloud dashboards and analytics services. If encryption and strong access control are not consistently applied across these hops, confidentiality and integrity are at risk. This can lead to competitive harm (exposed inventory/business records), privacy impact (if customer data is included), and operational disruption (tampered records leading to wrong decisions). The scenario is not about the IoT device exposing services like Telnet/FTP (network services), nor about default passwords; it is specifically about how data is transported and stored.

Why the other options are less accurate:

Insecure ecosystem interfaces (A) focuses on APIs, web/mobile apps, and cloud interfaces; while cloud storage access might involve interfaces, the core weakness described is lack of encryption and retrievable storage, which is more directly the data transfer/storage category.

Insecure network services (C) refers to exposed services/ports on IoT devices, not data confidentiality across the pipeline.

Insecure default settings (D) relates to factory defaults (passwords, open ports, insecure configs), not specifically unencrypted transport and weak storage protection.

Therefore, the correct answer is B. Insecure data transfer and storage.

RST hijacking is a TCP session hijacking technique emphasized in CEH materials under network attacks against established communications. In TCP, a Reset flag packet is used to abruptly tear down a connection. If an attacker can observe the session and determine the correct parameters such as IP addresses, ports, and an in-window sequence number, they can forge a TCP RST packet that appears to come from one endpoint. This can force the victim side to drop the session, making the legitimate client suddenly lose responsiveness.

The key clue in the scenario is that Rachel “observes a client-server communication” and then injects crafted packets that disrupt the client while the server continues to communicate with Rachel’s system. That behavior matches the practical use of RST hijacking in demonstrations: terminate or desynchronize the victim endpoint while keeping the server-side session usable long enough for the attacker to inject traffic with valid sequence and acknowledgment values. In a switched LAN, this is often paired with sniffing or traffic visibility to reliably craft the reset packet and subsequent injected packets.

Blind hijacking is different because the attacker cannot see the traffic and must guess sequence numbers, which contradicts the “observes communication” detail. UDP hijacking is not applicable because UDP is connectionless and does not use session state or RST flags. “TCP/IP hijacking” is a broad category, but the question asks for the specific technique used to disrupt the client via crafted packets, which is best identified as RST hijacking.

The Certified Ethical Hacker (CEH) Network and Perimeter Hacking module describes MAC flooding as an attack targeting switch CAM (Content Addressable Memory) tables. The attacker overwhelms the switch by sending frames with spoofed MAC addresses, forcing the switch to broadcast traffic like a hub.

Option D is the correct indicator because MAC flooding results in many different MAC addresses being learned on a single switch port, which is abnormal behavior. CEH documentation identifies this as the primary forensic sign of a MAC flooding attack.

Option A relates more closely to ARP poisoning rather than MAC flooding.

Option B can occur in network misconfigurations but is not a primary MAC flooding indicator.

Option C is common in NAT environments and is not malicious by itself.

CEH emphasizes monitoring CAM table behavior and port security violations to detect MAC flooding attacks effectively.

CEH v13 explains that when traditional enumeration techniques—such as SMB null sessions—are disabled, attackers often pivot to misconfigured LDAP services that still allow anonymous binding. LDAP anonymous bind, when not properly restricted, exposes directory information such as usernames, organizational units, group memberships, and other metadata. This aligns directly with the scenario, where the tester must avoid triggering alarms while still gathering internal data. LDAP queries generate minimal noise, often blending with normal authentication-related traffic, making them ideal for covert enumeration. Options A and C would require authentication or violate access restrictions, and DNS zone transfers (Option D) rarely succeed because modern DNS servers disable AXFR requests from unauthorized clients. CEH repeatedly stresses the importance of detecting and securing LDAP anonymous bind due to its potential for silent information leakage—making Option B the correct choice.

The correct answer is A. Golden SAML Attack.

A Golden SAML Attack occurs when an attacker obtains the private signing material used by an identity provider and then forges valid SAML authentication assertions. Because the forged assertions are signed with trusted material, cloud service providers may treat them as legitimate authentication responses.

The scenario clearly states that the consultant extracted signing material used in trust relationships between the internal identity provider and cloud services, then generated authentication responses that granted cloud application access without passwords or MFA. This is the defining behavior of a Golden SAML attack.

CEH-aligned cloud security material identifies cloud account hijacking and insecure cloud authentication paths as major concerns, especially where cloud services depend on authentication, authorization, and API trust relationships . The Golden SAML technique specifically abuses federated authentication trust rather than stealing a normal user password.

Option B. Living off the Cloud (LotC) Attack is incorrect because LotC involves abusing legitimate cloud-native services and tools to perform attacker operations while blending into normal cloud activity. It does not specifically describe forging SAML authentication assertions.

Option C. Cloud Hopper Attack is incorrect because Cloud Hopper refers to attacks that target managed service providers or cloud service providers to reach downstream customers.

Option D. Man-in-the-Cloud (MITC) Attack is incorrect because MITC typically abuses synchronization tokens or cloud sync mechanisms, not identity-provider signing keys.

Therefore, the best answer is A. Golden SAML Attack.

This scenario describes fileless malware using covert command-and-control (C2) channels over commonly allowed protocols such as HTTP and DNS, a technique heavily emphasized in CEH v13 Malware Threats. Such malware avoids writing files to disk and instead leverages memory, legitimate system tools, and trusted protocols to evade traditional defenses.

Signature-based antivirus updates (Option A) are ineffective against fileless malware because there are no static artifacts to match. Blocking known malware ports (Option C) is also ineffective, as the malware intentionally uses ports 80 and 53, which must remain open for normal business operations. Restricting plain HTTP (Option B) may reduce visibility but does not stop DNS tunneling or encrypted malicious traffic.

CEH v13 identifies behavioral analytics as the most effective countermeasure against advanced malware. Behavioral solutions establish a baseline of normal system and network activity, then detect anomalies such as:

Unusual outbound DNS query patterns

Abnormal HTTP beaconing intervals

Legitimate applications behaving suspiciously

PowerShell or system tools generating network traffic unexpectedly

By monitoring how systems behave rather than what files exist, behavioral analytics can identify stealthy C2 communications and disrupt them early. Therefore, Option D is the most effective and CEH-aligned response.

The correct answer is B. Testing String because the scenario describes a classic SQL injection detection approach where the tester submits special characters and malformed input strings—most notably single quotes ( ' )—to observe how the application processes them and whether it produces database error feedback. In SQL injection discovery, inserting a single quote (or multiple quotes) into a parameter commonly breaks the intended SQL syntax if the input is concatenated into a query without proper validation/escaping or parameterization. When this happens, the backend database often returns error messages that may disclose critical information such as the DBMS type (e.g., MySQL, Microsoft SQL Server, Oracle), query fragments, and sometimes references to table/column names. That is exactly what you observed: “system feedback that unexpectedly reveals the database type and internal query structure.”

This method is specifically called “testing strings” in CEH-style SQL injection identification: using quote characters, delimiters, comment markers, and other metacharacters to see whether the application is vulnerable and whether errors or abnormal behavior occur. The goal is not to fully exploit the injection immediately, but to confirm whether input is being interpreted as part of an SQL statement and to collect clues that help the tester model the backend query and proceed with safe, authorized validation steps.

Why the other options are less accurate: Function testing is a broader web-testing concept and is not the specific SQLi detection tactic shown. Dynamic testing generally refers to testing an application while it is running to observe behavior, but it does not name this specific SQLi discovery technique. Fuzz testing involves sending large volumes of random or semi-random unexpected inputs to trigger crashes or errors; while multiple quotes could be part of fuzzing, the described method is the targeted, well-known SQLi testing string approach used to elicit informative SQL errors.

Therefore, the method being employed is Testing String.

CEH v13 classifies application-layer DoS attacks as the most difficult to detect and mitigate. A distributed SQL injection-based DoS exploits database query processing by overwhelming backend systems with malicious but syntactically valid requests.

Unlike volumetric attacks, this method generates low-bandwidth, high-impact traffic that appears legitimate. Traditional DDoS protections often fail to identify such traffic, especially when it targets authenticated services like online banking.

UDP floods, Smurf attacks, and ICMP-based attacks are well-known and more easily mitigated with rate limiting and filtering. Zero-day exploits cause service disruption but are not primarily DoS techniques.

CEH v13 highlights that application-layer DoS attacks blend seamlessly with normal traffic patterns, making them exceptionally challenging. Thus, option A is correct.

The correct answer is C. Web Cache Poisoning Attack.

The key indicators are:

The altered content is served to other users.

The origin server still returns the legitimate response.

The issue disappears after cache expiration or replacement.

The crafted request uses headers and parameters that influence cached output.

CEH-aligned web server material explains that Web Cache Poisoning occurs when an attacker sends a crafted request into the cache and stores fake entries, causing users to be redirected or served malicious content . Another CEH-aligned reference explains that a web cache stores copies of responses to speed up future requests, and if an attacker forces malicious or manipulated content into the cache, later visitors can receive that poisoned response .

Option A. DNS Server Hijacking is incorrect because DNS records or DNS server settings are not being modified.

Option B. DNS Rebinding Attack is incorrect because the scenario concerns cached web content, not browser access to private-network resources through DNS rebinding.

Option D. SQL Injection Vulnerability is incorrect because the behavior is tied to delivery-layer caching, not database query manipulation.

Therefore, the best answer is C. Web Cache Poisoning Attack.

The correct answer is D because, in DNS, a zone is the administrative portion of the DNS namespace that contains DNS resource records for that portion of the domain tree. These records define how names are resolved and how services are located. Examples include A records for host-to-IP mapping, MX records for mail servers, NS records for name servers, CNAME records for aliases, PTR records for reverse lookups, and SOA records that identify the authoritative DNS server for the zone. In CEH reconnaissance and footprinting topics, DNS information is important because a DNS zone can reveal valuable network details such as hostnames, mail servers, name servers, and other infrastructure information. Option A is too broad because a zone is not merely a collection of domains. Option B is vague and does not define the zone itself. Option C is too narrow because alias records are only CNAME records, one type of DNS resource record. Therefore, a DNS zone is best defined as a collection of resource records.

This question focuses on API Security, Webhooks abuse, and Webshell mitigation, all of which are addressed in the CEH v13 Web Application Hacking and Security Operations modules. The most appropriate corrective action is Option D, as it directly addresses the root causes and persistence mechanisms of the compromise.

According to CEH v13, attackers frequently exploit improper input validation in APIs and insecure webhook implementations to inject malicious payloads or gain remote command execution. Webhooks, when not properly validated, can accept malicious requests that trigger backend processes, making them a common vector for API abuse.

Input validation on all API endpoints is critical to prevent injection attacks, including command injection and SQL injection. CEH v13 explicitly emphasizes validating request parameters, headers, and payload structures to prevent malicious manipulation.

Reviewing webhook payloads ensures that only trusted sources can trigger automated actions, preventing attackers from abusing webhook functionality. This includes validating signatures, enforcing authentication, and restricting allowed payload formats.

Finally, regular scanning for webshells is essential because webshells provide persistent backdoor access. CEH v13 identifies webshell detection as a key defensive measure during incident response and post-exploitation containment.

Other options are incomplete:

A WAF alone cannot detect all webshells.

IP blocking is ineffective against spoofed or cloud-based attacks.

MFA and server hardening are valuable but do not directly address webhook abuse or existing webshells.

Therefore, Option D provides the most comprehensive, CEH v13–aligned mitigation strategy.

The correct answer is A. Design Flaws because the weaknesses originate from fundamental development-time decisions in how the application was architected—specifically (1) selecting or creating a weak custom encryption algorithm and (2) implementing session validation in a way that allows requests to bypass access controls. In CEH-aligned vulnerability classification, design flaws are problems embedded in the application’s design and logic, not merely bugs from implementation mistakes, misconfiguration of a server setting, or missing vendor patches. They are often systemic: even if the code is “working as intended,” the intent itself is insecure.

The prompt explicitly states the issues are “traced back to flawed system logic and poor encryption design decisions made during the development phase.” That description maps directly to design flaws: using “homegrown crypto” instead of vetted cryptographic primitives and protocols is a classic design error because it typically lacks proper peer review, threat modeling, and proven resistance to cryptanalysis. Likewise, session validation that permits bypassing access controls indicates the application’s authorization/session model was designed incorrectly (for example, trusting client-side state, failing to enforce server-side checks consistently, or allowing unauthenticated endpoints to access privileged operations).

Why the other options are less accurate: Application flaws is a broad label that can include coding bugs, but the question is asking for the best category given that the root cause is architectural decisions rather than a narrow coding mistake. Misconfigurations/weak configurations usually refer to insecure settings in deployment (default credentials, permissive headers, weak TLS configuration), not a custom crypto algorithm and flawed session logic baked into the app. Poor patch management concerns failing to update known vulnerable components; here, the weakness is custom logic, not an unpatched third-party vulnerability.

Therefore, the most accurate category for these development-phase encryption and session/authorization weaknesses is Design Flaws.

The best match is VeraCrypt because the scenario explicitly requires three capabilities commonly associated with it in CEH cryptography and data protection coverage: encrypted containers, strong modern ciphers such as AES with 256-bit keys, and the ability to hide a protected volume inside another volume to reduce detectability. VeraCrypt is a successor to TrueCrypt and is widely referenced in ethical hacking curricula as a practical disk encryption utility that can create encrypted file containers and encrypt entire partitions or drives. It supports multiple algorithms and combinations, including AES-256, and can mount encrypted containers as virtual drives so applications can access data normally while it remains encrypted at rest.

The key distinguishing requirement is concealment of secure storage using hidden volumes. VeraCrypt supports plausible deniability by allowing a hidden volume to exist inside an outer encrypted volume. If compelled to reveal a password, a user can disclose the outer volume password while the hidden volume remains undetectable without its separate credentials. The prompt’s phrase “conceal secure volumes within standard ones” maps directly to this VeraCrypt feature and is not a standard capability of BitLocker or FileVault.

BitLocker and FileVault provide strong full-disk encryption, but they do not provide hidden volumes for plausible deniability. Rohos can create encrypted containers, but hidden-volume style plausible deniability is most strongly and commonly associated with VeraCrypt in CEH-oriented discussions. Therefore, VeraCrypt is the most appropriate tool for Noah’s stated objectives.

The correct answer is C. MAC Flooding.

The scenario describes a switched network beginning to behave like a hub, with frames appearing across multiple switch ports. This happens when the switch’s CAM table is overwhelmed with many fake MAC address entries. Once the CAM table cannot reliably map destination MAC addresses to ports, the switch floods traffic out multiple ports.

CEH sniffing material explains that MAC flooding sends random MAC addresses mapped with random IP addresses to overflow the CAM table. When the CAM table is full, the switch acts like a hub and broadcasts packets to all ports, helping the attacker sniff packets more easily . Another CEH-aligned exam guide states that MAC flooding sends so many MAC addresses to the CAM table that it cannot keep up, effectively turning the switch into a hub .

Option A. Switch Port Stealing is incorrect because switch port stealing targets a specific victim MAC-to-port mapping through a race condition.

Option B. ARP Poisoning is incorrect because ARP poisoning manipulates ARP caches to redirect traffic through the attacker.

Option D. DNS Poisoning is incorrect because DNS poisoning manipulates name resolution, not switch forwarding behavior.

Therefore, the best answer is C. MAC Flooding.

This scenario is a textbook example of a Whaling Attack, a highly targeted phishing technique described in the CEH v13 Social Engineering module. Whaling specifically targets senior executives or high-ranking individuals, exploiting their authority, access privileges, and decision-making roles.

In the given case, the attacker crafts a personalized email, impersonates the CEO, and uses legitimate corporate branding to build trust. The malicious PDF attachment delivers a backdoor, aligning with CEH v13 descriptions of advanced spear-phishing techniques used against executives.

CEH v13 differentiates whaling from other phishing types:

Broad phishing targets large groups indiscriminately.

Pharming redirects users via DNS manipulation.

Email clone attacks copy legitimate emails but typically target peers, not executives.

Whaling attacks are particularly dangerous because executives often bypass security scrutiny and possess elevated system access. CEH v13 emphasizes executive awareness training as a key mitigation strategy.

Therefore, the correct answer is Whaling attack aimed at high-ranking personnel.

CEH v13 outlines insertion attacks as IDS evasion methods in which attackers send packets deliberately crafted so that the IDS processes them differently from the target host. In an insertion attack, malformed packets appear legitimate to the IDS—allowing malicious traffic to blend with benign inspection results—while the end host rejects or modifies the packets due to incorrect checksums, invalid flags, or protocol inconsistencies. As a result, the IDS sees one set of reconstructed data, while the actual host processes a different version or nothing at all. CEH emphasizes that intrusion detection systems may not follow full TCP/IP stack validation, making them susceptible to deception by malformed or borderline-conformant packets. Polymorphic shellcode (Option B) changes payload signatures, not packet structure. Session splicing (Option C) splits payload across packets to evade pattern matching but does not rely on checksum manipulation. Fragmentation attacks (Option D) divide traffic into smaller fragments, not alter validity fields. The described behavior fits insertion attacks precisely.

The correct answer is Clone Phishing. CEH social engineering material explains that clone phishing occurs when an attacker takes a legitimate message previously received by the victim, duplicates its appearance and content, and modifies a malicious element such as a link or attachment. That matches this scenario exactly: the attacker reused genuine branding, the original format, sender display style, and subject line, then changed the embedded hyperlink so users would reauthenticate on a fake portal. Consent phishing is a different cloud-focused technique involving malicious OAuth authorization requests. Search engine phishing relies on manipulating search results so victims voluntarily navigate to a fake site. Tabnabbing involves changing the content of an inactive browser tab to a phishing page. None of those fit as closely as clone phishing. CEH guidance stresses that clone phishing is highly convincing because the message is based on a real prior communication that the victim may remember and trust. Since the attacker preserved almost everything from a legitimate message and altered only the actionable malicious link, the scenario is a textbook example of Clone Phishing.