A penetration tester must enumerate user accounts and network resources in a highly secured Windows environment where SMB null sessions are blocked. Which technique should be used to gather this information discreetly?
Correct Answer: B
CEH v13 explains that when traditional enumeration techniques-such as SMB null sessions-are disabled, attackers often pivot to misconfigured LDAP services that still allow anonymous binding. LDAP anonymous bind, when not properly restricted, exposes directory information such as usernames, organizational units, group memberships, and other metadata. This aligns directly with the scenario, where the tester must avoid triggering alarms while still gathering internal data. LDAP queries generate minimal noise, often blending with normal authentication-related traffic, making them ideal for covert enumeration. Options A and C would require authentication or violate access restrictions, and DNS zone transfers (Option D) rarely succeed because modern DNS servers disable AXFR requests from unauthorized clients. CEH repeatedly stresses the importance of detecting and securing LDAP anonymous bind due to its potential for silent information leakage-making Option B the correct choice.
312-50v13 Exam Question 102
In a vertical privilege escalation scenario, the attacker attempts to gain access to a user account with higher privileges than their current level. Which of the following examples describes vertical privilege escalation?
Correct Answer: D
CEH v13 distinguishes between vertical and horizontal privilege escalation. Vertical escalation occurs when an attacker moves upward in the hierarchy of privileges-such as from a regular user to an administrator or root-by exploiting vulnerabilities, misconfigurations, or insecure privilege boundaries. This allows the attacker to perform tasks that were previously restricted, such as modifying system settings, accessing sensitive data, installing malware, or controlling the entire environment. Horizontal escalation, on the other hand, involves accessing another user's resources at the same privilege level, which the other options describe. Exploiting unquoted service paths or weak access controls may facilitate privilege abuse, but they do not inherently elevate the user to a higher privilege tier unless they specifically lead to administrative execution. The scenario that aligns perfectly with the CEH definition of vertical privilege escalation is the escalation from regular user to administrator.
312-50v13 Exam Question 103
A future-focused security audit discusses risks where attackers collect encrypted data today, anticipating they will be able to decrypt it later using quantum computers. What is this threat commonly known as?
Correct Answer: A
The Certified Ethical Hacker (CEH) Cryptography and Quantum Computing section introduces the concept known as "Harvest Now, Decrypt Later". This threat model describes adversaries capturing encrypted data today, even if they cannot decrypt it immediately, with the expectation that future quantum computers will be able to break currently secure public-key algorithms such as RSA and ECC. Option A accurately reflects this concept. Option B describes a method (Shor's algorithm) but not the threat model itself. Option C is unrelated to cryptographic attacks. Option D refers to quantum communication attacks, not classical encrypted data harvesting. CEH emphasizes post-quantum cryptography as a mitigation strategy.
312-50v13 Exam Question 104
A Nessus scan reveals a critical SSH vulnerability (CVSS 9.0) allowing potential remote code execution on a Linux server. What action should be immediately prioritized?
Correct Answer: D
According to the CEH Vulnerability Assessment and Incident Response modules, vulnerabilities with high CVSS scores and potential RCE must be treated as active threats. CEH best practices recommend: * Immediate containment (network isolation) * Investigation and impact analysis * Patch application * Recovery Option D follows the CEH incident response lifecycle precisely. Option C is incomplete without containment. Options A and B are unsafe. CEH emphasizes containment before remediation.
312-50v13 Exam Question 105
A cybersecurity analyst wants to monitor competitors' web content updates. What key element is missing from the plan?
Correct Answer: B
In CEH v13 Reconnaissance Techniques, passive monitoring of competitors' online presence is a legitimate and effective intelligence-gathering activity. One of the most efficient tools for this purpose is Google Alerts. Google Alerts allow analysts to receive automated notifications when new content containing specific keywords-such as company names, products, or executives-is indexed online. This enables continuous, passive surveillance without repeatedly visiting websites manually. Option B directly addresses the analyst's goal of staying updated efficiently. Option A is illegal and unethical. Option C involves direct interaction, which may reveal the analyst's presence. Option D provides anonymity but does not actively monitor changes. CEH v13 strongly encourages automation in reconnaissance to reduce noise, effort, and detection risk. Therefore, Option B is the correct and CEH-aligned answer.