ECCouncil Updated 312-50v13 Exam Questions and Answers by alisha

This scenario is a textbook example of a Whaling Attack, a highly targeted phishing technique described in the CEH v13 Social Engineering module. Whaling specifically targets senior executives or high-ranking individuals, exploiting their authority, access privileges, and decision-making roles.

In the given case, the attacker crafts a personalized email, impersonates the CEO, and uses legitimate corporate branding to build trust. The malicious PDF attachment delivers a backdoor, aligning with CEH v13 descriptions of advanced spear-phishing techniques used against executives.

CEH v13 differentiates whaling from other phishing types:

Broad phishing targets large groups indiscriminately.

Pharming redirects users via DNS manipulation.

Email clone attacks copy legitimate emails but typically target peers, not executives.

Whaling attacks are particularly dangerous because executives often bypass security scrutiny and possess elevated system access. CEH v13 emphasizes executive awareness training as a key mitigation strategy.

Therefore, the correct answer is Whaling attack aimed at high-ranking personnel.

The correct answer is D. ldapsearch -h < host > -x -s base namingContexts.

The goal is to query the directory server’s root DSE for exposed naming contexts. The -x option performs simple authentication, -s base limits the search scope to the base object, and namingContexts requests the attribute that lists available naming contexts, such as domain and configuration partitions.

CEH-aligned LDAP enumeration material explains that LDAP directory services provide information about users, systems, networks, services, and organizational structure, and that LDAP enumeration can reveal domain and directory details useful for later targeting .

Option A is incorrect because it assumes a known base DN before discovering the naming contexts.

Option B is incomplete because it does not request the naming context attribute.

Option C also assumes the base DN is already known.

Option D is correct because it retrieves base-level naming context information before deeper LDAP searches.

Therefore, the best answer is D. ldapsearch -h < host > -x -s base namingContexts.

CEH materials explain that modern web applications deploy multiple layers of security—HTTPS, secure cookies, HttpOnly flags, and strict session regeneration—to defend against standard hijacking methods such as token theft through XSS or fixation. When these protections are properly implemented, attackers must compromise the underlying trust relationship between the client and server to successfully intercept or manipulate session tokens. One of the most advanced techniques described in CEH is compromising a trusted certificate authority or injecting a forged certificate into the victim’s trust store. This enables the attacker to perform a transparent MITM attack despite HTTPS protections. Because the victim’s browser trusts the forged certificate, encrypted traffic—including session tokens—is exposed to the attacker without generating browser warnings or IDS alerts. Timing side-channel attacks are not considered session hijacking methods; XSS is mitigated by secure flags; and session fixation is ineffective when session regeneration occurs. Therefore, compromising a trusted certificate authority to enable an undetectable MITM attack is the most viable method.

The correct answer is B. In CEH ethical hacking and penetration-testing guidance, testers must operate strictly within the authorized scope, agreement, and reporting procedures. When sensitive data such as credit card numbers and PII is unexpectedly discovered, the tester should not copy, move, examine further, or continue testing as though it were a normal finding. CEH-aligned guidance specifically warns that when illegal or highly sensitive material is encountered, it should not be copied to the tester’s own device, and the tester must follow team guidance and remain within the engagement agreement. Continuing the test could increase exposure, disturb evidence, or violate PCI-DSS and privacy handling requirements. Making a local copy is especially wrong because it creates another unauthorized location for regulated data. Contacting the employee directly is also improper because escalation should go through the approved client point of contact or management. Therefore, the best course of action is to stop the test immediately and contact management.