Eccouncil 312-50 Exam Dumps

The correct answer is Use reverse DNS lookups and WHOIS queries to identify the registered IP address blocks associated with the organization's domain.

This technique bridges passive and active reconnaissance effectively. Reverse DNS lookups and WHOIS queries are semi-passive techniques that query publicly available databases maintained by Regional Internet Registries (RIRs) and registrars. They reveal the IP address space registered to the organization without sending direct traffic to the target network, making them much harder to detect than active scanning. This information is legitimately public and provides a proper foundation for subsequent active reconnaissance.

Why the other options are incorrect:

• Zone transfer attack: This is an active attack attempting to pull all DNS records from an authoritative nameserver. Modern DNS configurations rarely allow zone transfers to unauthorized parties, and the attempt would be logged and likely detected.
• SYN scan: While useful for active scanning, performing an aggressive SYN scan immediately skips the logical reconnaissance progression and generates significant network noise and IDS/firewall alerts.
• Packet sniffing: This requires network access the tester does not yet have during external reconnaissance and is passive only if you already have network position.
• ICMP echo sweep: Sending ICMP to random public IPs is unfocused, potentially illegal, and does not target the organization specifically.

The method described---sending TCP packets with no flags set---is a NULL scan. In TCP header terminology, a NULL packet has all control flags cleared (no SYN, ACK, FIN, RST, PSH, URG). The scanner then interprets the target's response behavior to infer port state. Traditionally, for many TCP/IP stacks, a closed port responds with RST, while an open port may respond with no reply (silence) because the packet does not correspond to any valid state in the TCP state machine. This behavior can vary by OS and filtering devices, but the defining characteristic is the ''no flags'' probe.

The scenario also highlights stealth: compared to a TCP connect scan, which completes a full three-way handshake and is easily logged, NULL scans can be less conspicuous because they avoid a normal connection setup. Some intrusion detection systems focus heavily on repeated SYN handshakes or completed connections; unusual flag scans may slip through weak detection, though modern IDS/IPS can still detect them.

Why the other options are incorrect:

TCP Connect Scan (A) uses the operating system's connect() call to establish a full TCP connection; it is not a ''no flags'' technique and is generally noisier.

FIN Scan (B) sends packets with the FIN flag set; it is a different ''stealth'' scan type, but not ''no flags.''

ACK Scan (D) sends packets with the ACK flag set and is typically used to map firewall rules (filtered vs unfiltered), not to determine open vs closed ports in the same way, and again it is not ''no flags.''

Therefore, the scanning method is C. NULL Scan.

The correct answer is D because world-writable cron directories allow unauthorized users or attackers to add or modify scheduled tasks. In Linux, cron is used to run commands or scripts automatically at defined times, and CEH-aligned material identifies crontab as the mechanism for listing scheduled jobs/tasks. If cron directories are writable by everyone, an attacker can place a malicious script or cron entry that repeatedly runs after compromise, after login, or after reboot. This supports the CEH system-hacking phase of maintaining access, also called persistence. The uploaded red-team reference specifically associates Linux ''permanent access'' with cron-based scheduled execution. Linux permissions are based on read, write, and execute rights, and overly permissive settings such as full access for all users create serious control weaknesses. This is not SQL injection or XSS because no web application input is involved. It is not primarily DoS. The best CEH answer is persistence.

The correct answer is D. Sequential Change-Point Detection.

The scenario describes a statistical method that identifies the exact moment when normal traffic behavior changes into anomalous traffic behavior. This directly matches Sequential Change-Point Detection.

CEH-aligned DoS/DDoS detection material explains that Change-Point Detection is used to detect denial-of-service attacks and uses a non-parametric Cumulative Sum, or CUSUM, algorithm to detect traffic-pattern changes. It is also described as having low computational overhead and high accuracy .

Option A. Wavelet-Based Signal Analysis is incorrect because wavelet analysis detects volume-based anomalies through signal analysis, but the question emphasizes identifying the exact statistical transition point.

Option B. Traffic Pattern Analysis is too general and does not specifically describe change-point detection.

Option C. Activity Profiling compares observed activity against average traffic rates or baselines, while the scenario says the system is not relying only on static baselines.

Therefore, the best answer is D. Sequential Change-Point Detection.

The correct answer is HTTP Response Splitting Attack. CEH web server security material explains that HTTP response splitting is an input validation flaw in which attacker-controlled input is used to break a single HTTP response into multiple parts, often by injecting carriage return and line feed delimiters into server-generated headers or related output. The question states that one crafted request is processed as two separate ones and places this weakness in the same broad input-validation family as XSS, CSRF, and SQL injection. That framing strongly matches response splitting, which depends on improper validation of user-supplied data before it is inserted into server communication structures. Password cracking is unrelated to web response formation, directory traversal involves file path abuse, and web cache poisoning focuses on corrupting cached responses served to other users. CEH materials treat HTTP response splitting as a classic web server attack that can lead to malicious redirects, header injection, cache manipulation, or delivery of attacker-controlled content. Because the crafted input causes the server to separate what should be a single communication into multiple response segments, the most accurate classification is HTTP Response Splitting Attack.