ECCouncil Updated 312-50v13 Exam Questions and Answers by tom

CEH v13 defines a Trojan as malware that appears as a legitimate, trusted software application while secretly executing malicious actions behind the scenes. Trojans rely on deception rather than replication, often masquerading as tools, utilities, updates, or installers. Once executed, they may install backdoors, steal credentials, exfiltrate data, or modify system settings. The defining characteristic emphasized in CEH is the legitimate-looking façade combined with hidden malicious intent, which matches the scenario perfectly. Spyware (Option B) focuses on monitoring and data collection but does not necessarily disguise itself as legitimate software. Worms (Option C) self-replicate across networks, which is not described here. Rootkits (Option D) hide system compromise but do not necessarily pose as legitimate software. Therefore, the malware described is a Trojan.

To perform a thorough password assessment, Bob can use:

Hardware Keyloggers: Installed between the keyboard and computer; captures keystrokes.

Software Keyloggers: Installed on the OS; logs keystrokes and system activity.

Network Sniffing: Captures plaintext passwords from unencrypted protocols (e.g., FTP, Telnet).

From CEH v13 Official Courseware:

Module 4: Enumeration

Module 6: Malware Threats

Module 8: Sniffing

CEH v13 Study Guide states:

“A comprehensive password audit can involve passive sniffing of credentials on the wire, software keyloggers for direct input capture, and hardware keyloggers for stealthy physical surveillance.”

Incorrect Options:

B, C, D: Limiting to just one method misses out on broader techniques.

A brute-force attack is the most exhaustive password-cracking method. It tries every possible combination of characters (letters, numbers, and symbols) until the correct password is found.

From CEH v13 Courseware:

Module 6: Password Cracking Techniques

CEH v13 Study Guide states:

“Brute-force attacks try every possible combination until the correct password is discovered. It’s resource-intensive but guarantees success if enough time and processing power is available.”

Incorrect Options:

B: Refers to social engineering or coercion.

C: Describes a dictionary attack.

D: Refers to a rainbow table attack.

E: Not a cracking method.

A DHCP starvation assault is a pernicious computerized assault that objectives DHCP workers. During a DHCP assault, an unfriendly entertainer floods a DHCP worker with false DISCOVER bundles until the DHCP worker debilitates its stock of IP addresses. When that occurs, the aggressor can deny genuine organization clients administration, or even stock an other DHCP association that prompts a Man-in-the-Middle (MITM) assault.

In a DHCP Starvation assault, a threatening entertainer sends a huge load of false DISCOVER parcels until the DHCP worker thinks they’ve used their accessible pool. Customers searching for IP tends to find that there are no IP addresses for them, and they’re refused assistance. Furthermore, they may search for an alternate DHCP worker, one which the unfriendly entertainer may give. What’s more, utilizing a threatening or sham IP address, that unfriendly entertainer would now be able to peruse all the traffic that customer sends and gets.

In an unfriendly climate, where we have a malevolent machine running some sort of an instrument like Yersinia, there could be a machine that sends DHCP DISCOVER bundles. This malevolent customer doesn’t send a modest bunch – it sends a great many vindictive DISCOVER bundles utilizing sham, made-up MAC addresses as the source MAC address for each solicitation.

In the event that the DHCP worker reacts to every one of these false DHCP DISCOVER parcels, the whole IP address pool could be exhausted, and that DHCP worker could trust it has no more IP delivers to bring to the table to legitimate DHCP demands.

When a DHCP worker has no more IP delivers to bring to the table, ordinarily the following thing to happen would be for the aggressor to get their own DHCP worker. This maverick DHCP worker at that point starts giving out IP addresses.

The advantage of that to the assailant is that if a false DHCP worker is distributing IP addresses, including default DNS and door data, customers who utilize those IP delivers and begin to utilize that default passage would now be able to be directed through the aggressor’s machine. That is all that an unfriendly entertainer requires to play out a man-in-the-center (MITM) assault.