ECCouncil Certified Ethical Hacker Exam (CEH v13 AI) : 312-50v13

During an internal security review at a multinational consulting firm in Berlin, Germany, cybersecurity analyst Jonas Weber was evaluating the risks associated with employees using personal mobile devices to access corporate resources. Several incidents had been reported where unauthorized applications accessed sensitive business data, and sessions remained active even after prolonged inactivity. In some cases, devices with modified operating systems were still able to connect to internal services.
Further investigation revealed that the organization had not clearly defined ownership boundaries between personal and corporate applications, lacked restrictions, and did not enforce consistent access controls or session management policies. Additionally, employees were unaware of acceptable usage practices, increasing the likelihood of unintentional data exposure.
Which administrative control would best address these issues as part of a secure device strategy?

• A. Secure organization's data centers with multi-layered protection systems
• B. Do not allow jailbroken and rooted devices
• C. Apply session authentication and timeout policy on access gateways
• D. Control access based on need-to-know

During a security assessment, an attacker identifies a flaw in a multi-user file system. The system first verifies access rights to a temporary file created by a user. However, immediately after this verification, and before the file is processed, the attacker manages to swap the original file with a malicious version. This manipulation happens in the brief interval between the system ' s access verification and the moment it handles the file, resulting in the malicious file being treated as legitimate. Which vulnerability is the attacker exploiting?

• A. Improper certificate validation in trusted communication channels.
• B. Time-of-validation/time-of-execution issue in resource management logic.
• C. Null pointer dereference leading to unexpected application behavior.
• D. Integer overflow during arithmetic computations with limited memory bounds.

You are an ethical hacker at Northpoint Assessments, engaged to map the wireless footprint around Harborview Plaza in San Francisco, California. To enumerate nearby networks and prompt devices to reveal SSIDs and capabilities, you actively send crafted management frames from your laptop and log each AP ' s immediate responses (including probe responses and capability information), rather than only listening for broadcasts. Based on the described activity, which Wi-Fi discovery technique are you performing?

• A. Active Footprinting
• B. Network Discovery Software
• C. Wash Command
• D. Passive Footprinting

Following a suspected data breach at a pharmaceutical research lab in Cambridge, Massachusetts, forensic examiners identified several research documents that had been removed from normal directory listings on a compromised server.
When analysts examined the physical storage sectors previously associated with those files, they found that the sector contents no longer matched the historical allocation records, and no recognizable fragments of the original material could be reconstructed. The disk structure itself remained intact, and the storage medium showed no signs of hardware-level destruction.
Which anti-forensics technique best explains the attacker's actions in this scenario?

• A. Overwriting Data/Metadata
• B. Artifact Wiping
• C. Data/File Deletion
• D. Data Hiding in File System Structures

A CEH has mirrored a website, identified session hijacking risk, and wants to minimize detection. What is the most appropriate next step?

• A. Perform automated vulnerability scanning
• B. Attempt SQL Injection
• C. Hijack a session and modify server configuration
• D. Launch brute-force attacks