ECCouncil Updated 312-50v13 Exam Questions and Answers by alara

This scenario describes Platform as a Service (PaaS) because the provider delivers a managed platform where developers can deploy and run custom applications while the provider manages the underlying infrastructure components—servers, operating systems, storage, and often middleware/runtime components. The customer is responsible for application code and logic (and usually data and application configuration), but not for provisioning or maintaining the base compute and OS layers.

The key phrasing is: “developers can deploy and test custom applications without managing the underlying servers, operating systems, or storage,” and “the firm controls the application logic but not the runtime infrastructure.” That is the hallmark responsibility split of PaaS: the provider handles infrastructure and platform operations, enabling rapid development and deployment through managed runtimes, build/deploy pipelines, and scalable services.

Why the other models don’t fit:

IaaS (A) would require the customer to manage the OS and many platform components (patching, runtime configuration, middleware), even though the provider supplies the virtualized infrastructure. The scenario explicitly says they do not manage OS or servers.

SaaS (C) provides a complete finished application that the customer uses; customers typically cannot deploy their own custom application logic onto it in the way described.

XaaS (D) is a broad umbrella term, not the specific NIST-style service model classification being asked.

Therefore, the correct answer is B. Platform as a Service (PaaS).

The CEH IDS/IPS Evasion module describes packet fragmentation as a common evasion technique used to bypass signature-based detection.

Option B is correct.

Other options represent different attack categories.

CEH highlights reassembly normalization as a countermeasure.

The correct answer is C, Parameter tampering. In web application hacking, hidden fields are HTML form fields used to pass values back to the server, but they are only hidden from normal browser display, not from the user or attacker. CEH web application material explains that hidden fields are embedded in HTML forms to maintain values sent back to the server, and attacks challenge the assumption that hidden fields cannot be viewed or modified by examining the HTML source and changing the request before it reaches the server. This directly matches parameter tampering because the attacker modifies client-side parameters such as form fields, cookies, query strings, or URL parameters to alter application behavior. CEH material also describes parameter/form tampering as manipulating parameters during client-server communication, including URL values and web page form fields. SQL injection targets database queries, XSS injects script into pages, and CSRF tricks authenticated users into submitting unwanted requests. Hidden-field manipulation is therefore a form of parameter tampering.

The correct answer is D because PowerShell script block logs provide the most direct visibility into PowerShell-based attacker activity. In CEH-style security operations and incident response, defenders must review logs that are closest to the suspicious activity being investigated. PowerShell is widely used for Windows automation, administration, and post-compromise actions; the CEH-related material notes that PowerShell can automate tasks on Microsoft Windows systems and can be used after compromising a Windows target. Script block logging records the actual PowerShell code blocks executed, including suspicious commands, encoded commands, download cradles, privilege escalation scripts, and in-memory execution attempts. DNS logs may show domain lookups, and firewall logs may show network connections, but neither reveals the PowerShell commands themselves. Syslog is generic and more common in Unix/Linux or centralized logging contexts. Since the attacker is abusing PowerShell heavily, PowerShell script block logs give investigators the strongest evidence of command content, execution behavior, and malicious intent. Therefore, option D is the best answer.