最新的高品質 312-50v13 考試練習題庫

ECCouncil 312-50v13 考試概覽:

ECCouncil 312-50v13 考試大綱主題:

最新的 CEH v13 312-50v13 免費考試真題：

問題 #1

A penetration tester reviews an API and discovers that changing a numeric object identifier allows access to another user's records without additional authorization checks. Which vulnerability BEST describes this issue?

A. Insecure Direct Object Reference (IDOR)
B. XML Injection
C. HTTP Request Smuggling
D. Clickjacking

問題 #2

During a red team assessment at a retail bank in New York, ethical hacker Aisha launches a flood of TCP connection initiation packets against the bank's online portal. The target accepts each initial handshake packet but never receives the final ACK to complete the three-way handshake, exhausting the server's backlog of half-open connections and preventing legitimate users from establishing new sessions. Which type of DoS attack is Aisha most likely simulating?

A. SYN Flood Attack
B. TCP SACK Panic
C. ACK Flood
D. RST Attack

問題 #3

Following reports of inconsistent IP-to-MAC mappings on an internal access switch at a manufacturing company in Detroit, Michigan, the network security team enabled additional validation controls. Soon afterward, the switch began automatically discarding certain ARP replies that did not match previously recorded IP address assignments. Log entries indicated that packets were being denied due to validation failures tied to existing address-to-port mappings learned earlier from legitimate host configuration traffic. Which switch-level security feature is most likely responsible for enforcing this ARP validation behavior?

A. Configuring BPDU Guard to protect spanning-tree topology
B. Activating Dynamic ARP Inspection to validate ARP packets
C. Displaying the DHCP Snooping binding table for verification
D. Enabling DHCP Snooping to track address assignments

問題 #4

At a biomedical analytics firm in Raleigh, North Carolina, security consultant Marcus Ellison was reviewing exposed services on a legacy Linux host located in a screened subnet. While mapping available services, he observed that the machine was responding to time synchronization queries from multiple internal systems.
Curious whether the service might reveal additional intelligence, Marcus issued targeted queries against the time service and received responses that exposed internal client addresses and system identifiers interacting with it. The information provided unexpected visibility into internal network structure without requiring authentication.
From the available options, what enumeration technique is illustrated in this scenario?

A. NFS Enumeration
B. SNMP Enumeration
C. NetBIOS Enumeration
D. NTP Enumeration

問題 #5

During a red team exercise at a technology consulting firm in San Francisco, analyst Evelyn deploys a malicious payload disguised within a software update installer. When the target runs the installer, the main application functions normally, but behind the scenes, additional malware components are silently placed on the system without the user's knowledge. These hidden components later activate to establish remote access for the red team. Which technique was most likely used to deliver the hidden malware?

A. Downloader
B. Injector
C. Dropper
D. Wrapper

問題與答案：