ECCouncil Updated 312-50v13 Exam Questions and Answers by tom

The correct answer is D because the scenario describes Business Email Compromise, commonly called BEC. In BEC, attackers compromise or misuse a trusted business email account and send believable internal messages to employees, finance teams, executives, or partners. The key clues are “compromise a legitimate email account,” “convincing internal messages,” and “urgent actions.” CEH social engineering concepts explain that computer-based social engineering includes phishing and crafted emails that appear legitimate, while spear phishing targets an individual or small group within an organization. However, this question is more specific than ordinary phishing or spear phishing because the attacker is using a legitimate compromised account rather than only a fake or spoofed email. CEH email-hijacking content also describes compromised email accounts sending messages to people the victim knows and email messages containing requests such as money transfers. Therefore, spoofing, phishing, and spear phishing are related, but Business Email Compromise is the most precise answer.

The correct answer is B because the question directly describes a web application deserializing untrusted data, which is the classic condition for insecure deserialization. Deserialization is the process of converting serialized data back into an object or usable program structure. When an application accepts serialized data from an untrusted source and processes it without proper validation, integrity checking, or type restrictions, an attacker may manipulate the serialized object and influence application logic. In serious cases, this can result in remote code execution, privilege escalation, authentication bypass, or application takeover. The CEH web application security material maps this issue to OWASP web risks, where insecure deserialization is identified as a flaw that can lead to remote code execution attacks, which are among the most severe application impacts. SSTI involves server-side template injection, SQLi targets database queries, and XSS executes script in a user’s browser. Since the question specifically mentions untrusted deserialized data causing RCE, the precise flaw is insecure deserialization.

CEH v13 clarifies that nbtstat is used only for NetBIOS name table enumeration, not for listing shared resources. Tags such as < 20 > indicate file server services, but share enumeration requires tools like net view or SMB enumeration utilities.

Thus, the inability to list shares is due to tool limitation, not service configuration. Option C is correct.

The correct answer is C. Analyze Firmware.

The firmware image has already been obtained. The tester is now inspecting the binary to understand its format, architecture, readable strings, and low-level structure. This is part of the Analyze Firmware stage.

The referenced firmware analysis material lists commands such as file < bin > , strings, strings -n5 < bin > , strings -tx < bin > , binwalk < bin > , and hexdump -C < bin > as firmware analysis activities used to inspect firmware content and structure .

Option A. Extract the Filesystem is incorrect because filesystem extraction would involve extracting embedded filesystems from the firmware image, commonly with tools such as binwalk -e.

Option B. Obtain Firmware is incorrect because the question states that the tester already received the firmware image.

Option D. Emulate Firmware is incorrect because emulation involves running or simulating the firmware environment, which has not yet occurred.

Therefore, the best answer is C. Analyze Firmware.