ECCouncil Updated 312-50v13 Exam Questions and Answers by demi

The technique described is decoy scanning. In CEH network scanning methodology, decoy scanning is used to make IDS and logging systems attribute scan traffic to multiple apparent sources instead of the attacker’s true IP address. The attacker configures the scanner to generate additional probe packets that appear to originate from several spoofed decoy IP addresses, mixed with the real attacker’s probes. This creates ambiguity for defenders because IDS alerts and firewall logs show many potential “scanners,” complicating attribution and response actions such as blocking a single source.

A key detail in the prompt is that Lily “includes multiple spoofed IP addresses alongside her own” and still “receives accurate results.” That matches how decoy scanning works in tools like Nmap: the attacker’s real IP must remain in the mix so that replies from the target return to the attacker, enabling accurate interpretation of port states. The decoys mainly exist to confuse monitoring and incident response teams by polluting the log trail.

Option C, IP spoofing, is too general and, by itself, typically prevents the attacker from receiving responses because return traffic goes to the spoofed address. Decoy scanning is a specific, structured use of spoofing combined with the real source to preserve results. Option A refers to stealth flag scans, which reduce handshake visibility but do not involve multiple spoofed sources. Option B, source routing, attempts to control packet paths and is not the described behavior. Therefore, the correct answer is Decoy Scanning.

The correct answer is D. Post-Exploitation.

The scenario clearly occurs after initial access has already been obtained. The tester is no longer only discovering assets, identifying vulnerabilities, or exploiting the first weakness. Instead, the tester is modifying logging configurations, creating alternate access keys, maintaining persistence, and mapping privilege relationships inside the cloud tenant.

This aligns with the post-exploitation stage, where the tester evaluates what can be done after compromise, including maintaining access, enumerating privileges, understanding internal trust relationships, and documenting the impact of the compromise.

CEH-aligned methodology separates early activities such as information gathering and vulnerability scanning from later phases such as gaining access and maintaining access. The referenced methodology describes information gathering as collecting details such as IP addressing, protocols, open ports, device types, and vendor information, while later phases include gaining access, privilege escalation, backdoor installation, maintaining access, clearing logs, and covering tracks .

Option A. Exploitation is incorrect because exploitation is the phase where the initial vulnerability is actively used to gain access. In this scenario, the exposed credential has already been used.

Option B. Information Gathering is incorrect because the tester is not merely collecting external or pre-compromise information. The activity is taking place inside the cloud tenant after compromise.

Option C. Vulnerability Assessment is incorrect because vulnerability assessment focuses on identifying and validating weaknesses, not persistence, access key creation, or internal privilege mapping.

Option D. Post-Exploitation is correct because the tester is operating after compromise to maintain access and assess the internal impact.

Therefore, the best answer is D. Post-Exploitation.

The correct answer is C, Bypass filters. In wireless network security, access points may use MAC address filtering to allow only devices whose MAC addresses are listed in the access point’s whitelist. CEH wireless-hacking material explains that MAC spoofing can be used to change a wireless adapter’s MAC address so it matches an allowed MAC address in the access point’s whitelist, thereby bypassing the MAC filter. This does not provide encryption, because encryption protects data confidentiality using cryptographic algorithms. It is also not IDS, because an intrusion detection system monitors and alerts on suspicious activity. Logging records events and activities, which is unrelated to changing a MAC address. MAC spoofing is an impersonation technique: the attacker observes or obtains a valid MAC address and configures their own interface to use it. Therefore, in the context of CEH wireless attacks and access control weaknesses, MAC spoofing is primarily used to bypass MAC-based access filters.

The TCP SYN scan, also known as a Stealth Scan, is emphasized in CEH v13 Network Scanning as the most effective balance between accuracy and stealth. It sends a SYN packet and analyzes the response without completing the TCP handshake.

Because the connection is never fully established, SYN scans are less likely to be logged by applications and are harder for IDS systems to detect compared to TCP Connect scans.

FIN and ACK scans are used for firewall rule mapping and evasion, but they do not reliably enumerate services. TCP Connect scans are noisy and easily detected. Therefore, Stealth (SYN) Scan is the best choice.