ECCouncil Updated 312-50v13 Exam Questions and Answers by reina

The CEH Web Application Security module explains that race conditions occur when systems improperly handle simultaneous requests, leading to unexpected behavior. In token-based authentication systems, poor synchronization between token expiration checks and validation logic can allow attackers to exploit timing gaps.

The observed pattern—failed attempts with expired tokens followed by successful access—suggests the attacker exploited a race condition where the application inconsistently validated token state.

Option C is correct.

Option A would not involve expired tokens.

Option B is highly impractical given secure token entropy.

Option D typically succeeds without repeated failures.

CEH highlights race conditions as subtle but dangerous logic flaws.

The correct answer is C because allowing deprecated SSH ciphers creates a cryptographic weakness that can expose the system to downgrade-style attacks. SSH is intended to provide secure remote administration over TCP port 22 and relies on cryptographic protection for confidentiality and secure communication. CEH secure communication topics describe SSH as a secured alternative to Telnet using public-key cryptography for encryption. When obsolete or weak ciphers remain enabled, an attacker positioned in the communication path may try to influence negotiation so that the client and server use a weaker encryption option instead of a stronger one. CEH cryptography attack examples such as FREAK and POODLE show the same principle: attackers abuse fallback or weak algorithm support to force communication toward weaker encryption. This does not directly indicate DoS, XSS, or SQL injection. The primary risk from deprecated SSH ciphers is weakened encrypted communication and possible downgrade attacks.

The correct answer is RSA. CEH cryptography coverage identifies RSA as a public-key cryptosystem widely used for encryption and digital signatures, and it specifically notes that RSA relies on modular arithmetic and large prime numbers. The scenario states that the sender signs with a private key and the recipient verifies with the corresponding public key, which matches standard digital-signature use in RSA-based public-key infrastructure. CEH materials also describe RSA as the de facto asymmetric standard and emphasize its role in authentication, confidentiality, and nonrepudiation. Diffie-Hellman is mainly a key-exchange algorithm and is not the best fit for the signature workflow described here. DSA is a digital-signature algorithm, but the clue about modular exponentiation together with the broad support for encryption and signatures points more directly to RSA in CEH-style exam framing. ElGamal also supports encryption and signatures, but CEH references consistently present RSA as the standard answer when the question combines public/private key signing, directory-based public-key verification, and mainstream digital-signature deployment. Therefore, from a CEH guide perspective, RSA is the most accurate identification for the payment system’s asymmetric algorithm.

DHCP starvation is a network-level attack in which an attacker sends a massive number of DHCPDISCOVER requests, each appearing to originate from a different MAC address. CEH courseware explains that DHCP servers assign IP leases based on unique MAC addresses, and when the lease pool is exhausted, legitimate clients are unable to obtain valid IP configurations. This disrupts network connectivity and can serve as a precursor to deploying a rogue DHCP server, enabling further attacks such as traffic redirection or credential interception. DHCP starvation is different from ARP spoofing, which manipulates MAC–IP mappings, or DNS poisoning, which corrupts domain resolution. Rogue DHCP relay attacks involve forwarding DHCP packets to unauthorized servers, not depleting leases. The scenario described—rapid MAC address spoofing and exhaustion of DHCP leases—matches the precise definition of DHCP starvation as documented in CEH materials.