ECCouncil Updated 312-50v13 Exam Questions and Answers by chaim

The correct answer is C. Botnet Trojan.

The scenario describes systems infected through a phishing attachment, silently connecting to a centralized command-and-control server, waiting for instructions, and executing distributed traffic bursts. This is characteristic of a botnet.

CEH-aligned material explains that a botnet is commonly established by installing a bot on a victim system using a Trojan horse. Once executed, the victim system becomes infected and waits for instructions from a command-and-control handler. The handler then sends instructions to infected systems, or bots, to perform attacks such as distributed denial-of-service activity . Another reference also defines botnet Trojans as Trojans used to infect many systems and then use the compromised systems together to attack a victim system, commonly for distributed denial-of-service attacks .

Option A. E-banking Trojan is incorrect because e-banking Trojans focus on stealing banking credentials or manipulating financial transactions.

Option B. Rootkit Trojan is incorrect because a rootkit Trojan focuses on hiding malicious activity or maintaining stealth at a low system level.

Option D. Backdoor Trojan is incorrect because a backdoor Trojan provides unauthorized remote access, but the coordinated command-and-control behavior across multiple infected systems best matches a botnet Trojan.

Therefore, the best answer is C. Botnet Trojan.

The most critical benefit in this scenario is scalability. CEH-aligned guidance on modern ethical hacking emphasizes that large, distributed enterprise environments create a fundamental operational challenge: the number of assets, configurations, cloud services, and remote endpoints is too large for purely manual assessment methods to maintain consistent coverage within acceptable timelines. The question highlights exactly this constraint by stating “highly complex and distributed” infrastructure and the “sheer scale of the environment.” An AI-driven platform that “automatically scans the entire network” and continuously flags anomalies is primarily valuable because it can expand assessment coverage across many systems simultaneously, helping the red team evaluate more of the attack surface efficiently.

While predictive analysis is a real AI capability, the scenario’s success requirement is not forecasting future attacks; it is executing assessment activities at enterprise scale and keeping pace as conditions change. Simulation and testing is what red teams do regardless of AI, but AI’s differentiator here is the ability to perform continuous, large-scale discovery and prioritization across cloud, servers, and endpoints without proportional increases in human effort. Enhanced reporting helps communicate results, but it is not the primary operational limiter described.

Additionally, the prompt mentions adapting detection models as new behaviors appear. That supports continuous operation, but the deciding factor is still the ability to operate across a massive environment and maintain broad visibility. Therefore, scalability is the key benefit most critical to success in this scenario.

This scenario describes steganographic sniffing, a highly sophisticated technique covered in CEH v13 Network Sniffing and Steganography. By embedding sensitive data inside legitimate image files—such as CT scans—attackers can intercept or exfiltrate patient information while avoiding detection.

Option D represents a steganography-based covert channel, which is extremely difficult to identify because:

The file appears legitimate

Standard encryption and IDS tools do not flag it

Medical images naturally contain large data volumes

Options A and B involve malware, which is more detectable. Option C involves text-based covert channels, which are easier to analyze than binary image embedding.

CEH v13 identifies steganography as one of the hardest data-hiding techniques to detect, making Option D correct.