ECCouncil Updated 312-50v13 Exam Questions and Answers by chaim

https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/what-is-fileless-malware.html

Fileless malware can easily evade various security controls, organizations need to focus on monitoring, detecting, and preventing malicious activities instead of using traditional approaches such as scanning for malware through file signatures.Also known as non-malware, infects legitimate software, applications, and other protocols existing in the system to perform various malicious activities.It resides in the system’s RAM. It injects malicious code into the running processes. (P.966/950)

Static Network Address Translation (Static NAT) allows a single private IP address to be mapped to a single public IP address. This one-to-one mapping ensures that the same internal machine is always reachable through the same external IP address, which is crucial for "server publishing" — making internal servers (e.g., web servers, FTP servers) accessible from the internet.

From CEH v13 Courseware:

Module 03: Scanning Networks

Topic: Network Address Translation

Section: Types of NAT

CEH v13 Study Guide states:

“Static NAT provides a fixed translation of a private IP address to a public IP address. It is commonly used when an internal server must always be accessible from the Internet using a consistent IP address — this is known as server publishing.”

Incorrect Options:

A. Overloading PAT: Multiple private IPs share a single public IP using port numbers — not suited for static mappings.

B. Dynamic PAT: Similar to overloading; used for outbound traffic only.

C. Dynamic NAT: Assigns a public IP from a pool; the mapping can change, not suitable for server publishing.

Challenge/response authentication is designed to prevent replay attacks. In this mechanism:

The server sends a random “challenge” string.

The client uses its secret (like a password or private key) to generate a response.

The server verifies that the response matches what it expected for that challenge.

Since the challenge is random and changes each time, an attacker cannot simply capture and replay previous responses to gain unauthorized access.

From CEH v13 Courseware:

Module 11: Session Hijacking

Module 6: Authentication Protocols

CEH v13 Study Guide states:

“Challenge-response authentication prevents replay attacks by using dynamically generated nonces or challenge tokens that change with each session.”

Incorrect Options:

B: Scanning attacks are not related to authentication mechanisms.

C: Session hijacking involves active takeovers, not replaying login attempts.

D: Password cracking targets password hashes, not session tokens.

According to CEH v13 Module 08: Sniffing, the attack described is a classic example of ARP spoofing/poisoning which leads to Man-in-the-Middle (MITM) scenarios. In such attacks, a malicious actor sends forged ARP responses to associate their MAC address with the IP address of a target system, redirecting traffic through their machine.

Tool Used: BetterCAP

BetterCAP is a powerful, modular MITM framework.

It can:

Perform ARP spoofing

Intercept and manipulate HTTP/HTTPS traffic

Modify packets in real-time

Carry out credential harvesting and session hijacking

Miley's actions match the default behavior of BetterCAP during an ARP spoofing attack:

Spoof ARP to redirect traffic.

Intercept and analyze (or manipulate) traffic.

Option Clarification:

A. Gobbler: An older ARP tool, but mostly for ARP scanning, not modern MITM attacks.

B. KDerpNSpoof: Incorrect or misspelled; not a recognized CEH tool.

C. BetterCAP: Correct – used for ARP spoofing and traffic manipulation.

D. Wireshark: Passive sniffer; cannot perform ARP spoofing or MITM.