ECCouncil Updated 312-50v13 Exam Questions and Answers by azlan

In CEH network security concepts, a common way to verify whether a host is running a sniffer is to test for promiscuous-mode behavior using an active stimulus and then observing whether the suspected machine reacts to traffic it should normally discard. The “ping method” is a classic approach: the tester sends ICMP Echo Request traffic crafted so the Ethernet frame uses an incorrect destination MAC address, while the IP layer still targets the suspected host’s IP. Under normal NIC operation, frames with a destination MAC that does not match the interface (and is not broadcast/multicast) are dropped at the data-link layer and never reach the IP stack, so the host will not respond.

If the interface is in promiscuous mode, the NIC passes more frames up to the operating system for processing. In some configurations, this can allow the IP stack to see and respond to the ICMP request even though the frame’s MAC destination was wrong. That unexpected reply is used as an indicator that the host may be capturing traffic promiscuously, consistent with sniffer presence.

The other options are less aligned with the “classic active verification” described. Reverse DNS monitoring is an indirect heuristic and not a reliable confirmation of promiscuous mode. An NSE script is tool-specific rather than the classic foundational technique the question emphasizes. ARP-based methods exist for sniffer detection, but the option presented is less directly tied to the well-known ICMP incorrect-MAC confirmation described in CEH materials.

The described action is classic web server footprinting through banner grabbing. In CEH reconnaissance methodology, banner grabbing is used to identify a target’s service details by eliciting and analyzing standard protocol responses. When Sofia sends a simple HTTP request such as GET / HTTP/1.0, the server often responds with HTTP headers that may include fields like Server and sometimes X-Powered-By, which can reveal the web server product and version, and occasionally information that hints at the underlying operating system or framework. This disclosure is valuable to attackers because it enables targeted exploitation: once the exact server and version are known, an attacker can correlate that information with known vulnerabilities, misconfigurations, and exploit code.

This is not information gathering from robots.txt, which is a web file used to suggest crawler behavior and sometimes reveals hidden paths but does not inherently expose server software versions. It is also not directory brute forcing, which involves systematically guessing directories and files to find hidden endpoints. Vulnerability scanning is broader and typically involves automated checks to detect vulnerabilities; while banner information can be an input to scanning, the technique shown here is specifically identification through response headers.

CEH-aligned mitigation includes disabling or minimizing server signature information, removing unnecessary headers, keeping server software patched, and using secure configurations and reverse proxies to reduce information leakage during reconnaissance.

The correct answer is D. Date and time received by the originator’s email servers.

Email header tracing reveals hop-by-hop routing information, including mail servers, IP addresses, timestamps, and authentication-related details. CEH-aligned email footprinting material states that tracing an email using the header can reveal the destination address, sender’s IP address, sender’s mail server, time and date information, and authentication system information of the sender’s mail server .

The question asks for the exact moment the email was processed by the sender’s system. In an email header, this is best determined by examining the earliest relevant Received header added by the sender’s or originator’s mail infrastructure. That timestamp shows when the originator’s email server received or processed the message before forwarding it onward.

Option A. Sender’s mail server is incorrect because it identifies the system involved but does not by itself provide the processing time.

Option B. Date and time of message sent is less precise because the Date: header may be generated by the mail client and can be inaccurate or user-controlled.

Option C. Authentication system used by sender’s mail server is incorrect because SPF, DKIM, DMARC, or similar authentication details help validate sender authenticity, not the exact processing time.

Option D. Date and time received by the originator’s email servers is correct because it corresponds to the first trusted server-side timestamp in the message path.

Therefore, the best answer is D. Date and time received by the originator’s email servers.

The correct answer is D, Pass-the-hash. In a pass-the-hash attack, the attacker does not need to crack or know the plaintext password. Instead, the attacker reuses a captured or extracted NTLM hash as an authentication credential to access another Windows system or server. CEH system hacking and password attack material describes this concept directly: the attacker steals the hash and sends it instead of cracking the password, allowing Windows authentication to treat the hash as valid credentials. CEH password attack material also describes hash injection, where extracted logon hashes from SAM or memory are used to log on to other servers and exploit more accounts. Brute force attempts many password guesses, Kerberoasting targets Kerberos service tickets, and replay is a broader category but not as precise here. Because the question specifically mentions reused NTLM hashes without cracking passwords, the exact attack is pass-the-hash.