ECCouncil Updated 312-50v13 Exam Questions and Answers by samson

The correct answer is D because credential dumping tools are specifically designed to collect authentication material such as passwords, password hashes, cached credentials, and Kerberos tickets from a compromised Windows endpoint. In CEH System Hacking concepts, attackers attempt to obtain credentials after gaining access so they can escalate privileges, perform pass-the-hash/pass-the-ticket attacks, or move laterally. Windows stores authentication-related data in locations such as the SAM database and also keeps useful credential material in memory while users are logged in. The CEH-aligned guide notes that Windows stores authentication credentials as password hashes in the SAM file, and that tools can steal hashes from memory or extract passwords/hashes/Kerberos tickets using tools such as Mimikatz. Therefore, the asset being targeted is not the network, logs, or service availability. Logs would be targeted by anti-forensics, availability by DoS, and network by sniffing or scanning. Credential dumping directly targets credentials, making option D the best answer.

The correct answer is C, tcpdump. Passive OS fingerprinting identifies the operating system of a target by observing and analyzing network traffic without actively sending probe packets to the target system. Tools such as tcpdump capture packets traversing a network and allow analysts to inspect characteristics like TCP window size, Time-To-Live (TTL) values, TCP options, and packet behavior that can reveal the operating system in use. Because the target is not directly interrogated, passive fingerprinting is stealthier and less likely to trigger alerts.

Nmap is primarily associated with active OS fingerprinting because it sends specially crafted packets and analyzes the responses to determine the target operating system. Ping is used mainly to verify host availability, while tracert (traceroute) identifies network paths and intermediate hops between systems. Neither ping nor tracert performs OS fingerprinting.

In CEH reconnaissance and enumeration topics, passive information gathering focuses on observing existing communications rather than generating new traffic. Therefore, among the given options, tcpdump is the most appropriate tool for passive OS fingerprinting because it captures and analyzes network traffic without directly probing the target.

The behavior described most closely matches an Eclipse attack. In an eclipse attack, an adversary isolates a victim node by controlling its peer connections so that the node communicates only with attacker-controlled (or attacker-influenced) peers. Once isolated, the attacker can feed the victim a manipulated view of the blockchain—such as withholding blocks, delaying transactions, or presenting an alternative chain history. This can enable downstream impacts like double-spending against merchants who rely on that node’s view for confirmation.

The scenario’s strongest indicators are:

The node “received blocks only from a small, fixed set of peers for several hours,” suggesting abnormal peer diversity and potential isolation.

The attacker “controlled which peers that node communicated with,” which is essentially the definition of eclipsing a node.

The node “accepted a conflicting history” and the attacker supplied “a private chain until they were ready to reveal it,” consistent with feeding the victim a tailored chain view and then releasing/realigning it to profit from reversed payments.

Why the other options are less fitting:

A Finney attack (A) involves a miner pre-mining a block containing a spend, making a payment to a merchant, and then releasing the pre-mined block to invalidate the merchant’s transaction—this doesn’t require isolating a specific node’s peers for hours.

A DeFi sandwich attack (B) is a mempool/MEV tactic on decentralized exchanges involving front-running and back-running, unrelated to isolating node peer connections or feeding a private chain.

A 51% attack (C) involves controlling a majority of network hash power/stake to rewrite history at network scale. The scenario emphasizes isolation of a particular merchant-related node via peer control rather than majority network control.

Therefore, the attack is best identified as D. Eclipse Attack.

The correct answer is D. This message shows classic social engineering and smishing indicators: it arrives by mobile text, claims urgency with a “vital transaction,” impersonates a trusted organization, and asks Bob to contact a free public email address. A legitimate bank or financial institution would normally use an official corporate domain, not a generic @yahoo.com mailbox. Option A is weak because not knowing Scott alone does not prove fraud; the stronger evidence is the suspicious sender identity and unofficial contact channel. Option B is incorrect because the message only claims to represent a respectable organization; attackers often impersonate trusted brands. Option C is unsafe because replying to the provided address validates Bob as a target and may continue the scam. CEH social engineering guidance emphasizes verifying requests through trusted, independent channels and recognizing phishing/smishing attempts that exploit urgency, authority, and user trust. Therefore, the best answer is D.