ECCouncil Updated 312-50v13 Exam Questions and Answers by aylin

The correct answer is D. WSDL Probing Attacks.

The scenario describes retrieving and analyzing service description files to identify web service operations, methods, parameters, and response schemas. That directly matches WSDL probing. WSDL, or Web Services Description Language, describes the functions exposed by a web service, including supported operations and message structures.

CEH-aligned cloud and web service material identifies WSDL, SOAP, and UDDI as web service-related information that attackers may capture or analyze during service hijacking and reconnaissance activities . CEH-aligned web application material also explains that SOAP is used to exchange structured information in web services, and that malicious interaction with SOAP/web service structures can expose backend functionality .

Option A. SOAP Injection is incorrect because the tester is not injecting malicious SOAP payloads.

Option B. Application Logic Attacks is too broad and would involve abusing business logic, not specifically reviewing service descriptions.

Option C. XML Injection is incorrect because the scenario does not involve injecting malicious XML content.

Option D. WSDL Probing Attacks is correct because the tester is probing service description files to understand exposed web service capabilities.

Therefore, the best answer is D. WSDL Probing Attacks.

The correct answer is B. HTTP/2 Stream Memory Not Reclaimed on RST.

The scenario describes an Apache web service using a multiplexed protocol, which points to HTTP/2. The important symptoms are steadily increasing memory consumption, normal client disconnects, repeated stream activity, and memory not returning to baseline. This strongly indicates that HTTP/2 stream-related memory is not being properly reclaimed after stream reset or termination events.

CEH-aligned web server material emphasizes that Apache web servers, like other web servers, can contain bugs and implementation vulnerabilities that require fixes and secure configuration review . The described behavior is not a generic misconfiguration; it is a protocol-specific memory-management issue associated with HTTP/2 stream handling.

Option A. DoS in HTTP/2 with Initial Window Size 0 is incorrect because that issue centers on abusing flow-control window behavior, not unreclaimed memory after stream resets.

Option C. Insecure Default Configuration is incorrect because the issue only appears when HTTP/2 multiplexed mode is enabled and is tied to stream memory behavior.

Option D. mod_macro Buffer Over-read is incorrect because the scenario does not involve mod_macro, buffer over-read behavior, or disclosure from memory.

Therefore, the best answer is B. HTTP/2 Stream Memory Not Reclaimed on RST.

This scenario describes Linear Cryptanalysis, a technique detailed in CEH v13 Cryptography. Linear cryptanalysis involves finding linear approximations that relate plaintext bits, ciphertext bits, and key bits using XOR operations. By analyzing a large number of known plaintext–ciphertext pairs, attackers can identify statistical biases that reveal information about the secret key.

CEH v13 explains that linear cryptanalysis differs from differential cryptanalysis in its approach. While differential cryptanalysis studies how differences in plaintext affect differences in ciphertext, linear cryptanalysis focuses on linear relationships and probability distributions.

The mention of XOR combinations and statistical analysis of plaintext–ciphertext pairs directly aligns with linear cryptanalysis. Brute-force attacks attempt all keys without analysis. Differential cryptanalysis focuses on input differences, not linear equations. Side-channel attacks exploit physical characteristics such as power consumption or timing.

Modern block ciphers like AES are designed to resist linear cryptanalysis by ensuring that linear approximations occur with probabilities close to random. CEH v13 highlights linear cryptanalysis as a foundational attack method used to evaluate cipher strength.

Therefore, Option C is correct.

This scenario precisely matches polymorphic malware, a type of advanced malware described in CEH v13 Malware Threats. Polymorphic malware dynamically alters its code, encryption, or signature each time it propagates, allowing it to evade traditional signature-based antivirus detection.

Additionally, the malware’s ability to remain dormant until triggered indicates logic-based activation, which is common in advanced threats designed to avoid sandbox detection.

CEH v13 emphasizes that polymorphic malware cannot be reliably detected using static signatures. Instead, organizations must rely on behavior-based detection, heuristic analysis, and advanced threat protection systems capable of identifying suspicious runtime behavior.

Options A, C, and D do not match the described behavior. Adware focuses on advertising. Worms self-propagate aggressively. Rootkits focus on stealth and persistence, not code mutation.

Therefore, Option B is the correct answer.