ECCouncil Updated 312-50v13 Exam Questions and Answers by evie-mae

The activity described is passive wireless packet capture in monitor mode—specifically collecting management frames (such as beacon frames and probe responses) and observing client/AP interactions (including authentication-related frames) while not injecting or transmitting anything. In the Aircrack-ng suite, the tool designed for exactly this reconnaissance-and-capture purpose is Airodump-ng.

Airodump-ng is the component that listens on the air interface once the card is placed into monitor mode, then captures 802.11 frames and displays useful reconnaissance data such as BSSID, channel, encryption type, signal strength, and associated clients (stations). Critically, it can write captured traffic to files (e.g., .cap) for offline analysis—which matches the scenario’s “record into a capture file for later offline analysis.” This is a common CEH workflow: reconnaissance → capture → analyze, keeping the initial step non-intrusive.

By contrast:

Aireplay-ng (A) is primarily used for active attacks / packet injection (e.g., deauthentication, replay) and would typically involve transmitting frames.

Aircrack-ng (B) is used mainly for key cracking (WEP/WPA/WPA2 handshakes) after capture, not for passive collection itself.

Airbase-ng (C) focuses on creating a rogue AP / MITM-style setups, which is also an active transmission role.

So, for silent monitoring + capturing beacons/probes/auth frames to a file, the best match is D. Airodump-ng.

CEH v13 identifies automated patch management as the most secure and scalable approach. Automated tools ensure timely deployment, validation, rollback capability, and compliance reporting.

Manual patching increases human error. Applying patches from unknown sources introduces malware risk. Limiting patches contradicts best practices.

Therefore, Option B is correct.

The correct answer is C because Unicode encoding is commonly associated with bypassing weak input filters, IDS signatures, and web application filtering controls. In CEH-style web and perimeter evasion topics, attackers may encode dangerous characters so that the security filter does not recognize the payload, while the target application or server later decodes and processes it. CEH material specifically describes Unicode characters as effective against web and IDS filters because they can replace human-readable characters and confuse signature-based detection. It also explains that Unicode allows multiple representations for characters and can be maliciously used to bypass filters that only check limited or short Unicode forms. ROT13 is only a simple substitution cipher, Base64 is general-purpose encoding, and Hex is a representation format. While these can support obfuscation, the CEH exam context most strongly links filter bypass with Unicode encoding, especially in directory traversal, canonicalization, and IDS/WAF evasion scenarios.

According to CEH v13 Security Operations and Incident Response, zero-day vulnerabilities pose one of the highest operational risks because exploits exist before official remediation is available. When active exploitation is observed and no vendor patch exists, immediate compensating controls must be deployed.

The first and most effective action is implementing virtual patching, typically through a Web Application Firewall (WAF) or Intrusion Prevention System (IPS). CEH v13 defines virtual patching as a security measure that blocks exploitation attempts at the network or application layer without modifying the vulnerable software. This approach allows organizations to maintain service availability while reducing exposure.

Shutting down the server (Option A) may prevent exploitation but introduces unacceptable business disruption and is not recommended as a first response. Backups and incident response planning (Option C) are critical but do not actively prevent exploitation. Passive monitoring (Option D) allows attackers to continue exploiting the vulnerability unchecked.

CEH v13 emphasizes that virtual patching is the preferred first response for zero-day threats, especially when systems are mission-critical. It provides immediate risk reduction while allowing time for vendor patch development and controlled deployment.