ECCouncil Updated 312-50v13 Exam Questions and Answers by rehmat

Ping of Death is a classic Denial-of-Service technique in which an attacker sends oversized or malformed IP packets that exceed the maximum allowed size when reassembled. In IP networks, the maximum packet size is 65,535 bytes. Historically, attackers exploited fragmentation by sending a series of IP fragments that, when reassembled by the target, resulted in a packet larger than the permitted limit or produced an invalid buffer condition. Vulnerable systems could crash, reboot, or become unstable because the network stack mishandled the reassembly process or failed to properly validate packet length and structure.

The scenario matches this behavior precisely: Sofia transmits “oversized, malformed packets” and the server “crashes intermittently due to processing failures.” That symptom is more consistent with a malformed-packet handling flaw than with pure traffic volume. An ICMP flood and an ACK flood are volumetric or resource-exhaustion attacks that overwhelm bandwidth or connection-handling capacity, typically degrading performance rather than directly causing crashes from malformed packet parsing. A Smurf attack is an amplification-based ICMP attack using broadcast addresses to multiply traffic toward a victim; again, it is about volume, not crafted malformed packets that trigger parsing failures.

CEH guidance highlights that PoD-style attacks exploit improper packet validation and reassembly logic. Modern systems are generally patched, but poorly maintained devices, legacy OS stacks, and some embedded implementations can still exhibit instability when exposed to malformed fragmentation and reassembly edge cases.

Local File Inclusion vulnerabilities arise when a web application incorporates user-supplied input into file-handling functions without proper sanitization. CEH courseware emphasizes that attackers can leverage directory traversal sequences (such as ../../) to escape the intended directory structure and access sensitive local files. An LFI payload commonly targets system files like /etc/passwd on Linux to extract user information or escalate the attack further.

The correct answer is D. A hash algorithm is used to verify data integrity, which means confirming that information has not been changed after approval or transmission. Once the CFO approves the financial statements, a hash value can be generated for the document using algorithms such as SHA-256. Later, the accountant can calculate the hash again and compare it with the original hash. If both hash values match, the document has not been modified. If even one character, number, or byte changes, the resulting hash will be different.

Option A only controls the delivery medium and does not prove the file was unchanged. Option B provides password protection, which relates more to access control or confidentiality, not strong integrity verification. Option C gives redundancy, but both copies could still be altered or mishandled.

In CEH cryptography concepts, hashing is specifically associated with integrity verification, while encryption protects confidentiality and digital signatures provide integrity, authentication, and non-repudiation. Therefore, using a hash algorithm is the most suitable answer.

The correct answer is C. HTTP/S Tunneling.

The scenario describes persistent outbound command-and-control traffic that resembles legitimate service requests and is designed to pass through normal egress controls. HTTP and HTTPS traffic are commonly allowed through perimeter firewalls, making HTTP/S tunneling a strong match.

CEH firewall-evasion material describes HTTP tunneling as a method of bypassing firewall restrictions by encapsulating attacker data inside HTTP traffic, allowing activity to pass through permitted web ports such as port 80 . CEH material also describes a reverse WWW shell in which an internal host makes what appears to be a legitimate HTTP request to an attacker-controlled web server, while the returned response actually contains commands for the compromised host to execute .

Option A. ICMP Tunneling is incorrect because ICMP tunneling uses ICMP echo request/reply traffic, not web-like service requests.

Option B. TCP Sequence Tunneling is incorrect because the scenario does not describe hiding data in TCP sequence fields.

Option D. DNS Tunneling is incorrect because DNS tunneling usually appears as unusual DNS queries and encoded subdomains, not web-service-like request/response behavior.

Therefore, the best answer is C. HTTP/S Tunneling.