312-50v13 Practice Test practice questions, page 32 of 42, with answer review and explanations.
Question 156
At a biomedical analytics firm in Raleigh, North Carolina, security consultant Marcus Ellison was reviewing exposed services on a legacy Linux host located in a screened subnet. While mapping available services, he observed that the machine was responding to time synchronization queries from multiple internal systems. Curious whether the service might reveal additional intelligence, Marcus issued targeted queries against the time service and received responses that exposed internal client addresses and system identifiers interacting with it. The information provided unexpected visibility into internal network structure without requiring authentication. From the available options, what enumeration technique is illustrated in this scenario?
NFS Enumeration
NetBIOS Enumeration
SNMP Enumeration
NTP Enumeration
Question 157
During an internal security review at a transportation authority in Columbus, Ohio, a red team analyst positioned himself on the same local network segment as several domain-joined administrative workstations. Over several hours, he recorded authentication exchanges as legitimate users performed their routine logon activities across the network. He later analyzed the captured traffic to recover valid credentials associated with privileged accounts. Based on the attacker's actions, how should this password attack be classified?
Passive Online Attack
Non-Electronic Attack
Active Online Attack
Offline Attack
Question 158
During an authorized engagement at IronClad Financial Services in Charlotte, the red team successfully exploits a weakness and obtains administrative access to a critical server. After achieving this objective, the team installs a backdoor mechanism to ensure continued access even if the original vulnerability is remediated. The team documents this activity as part of demonstrating long-term adversary behavior within the approved scope. Within the CEH ethical hacking framework, which phase does this activity represent?
Reconnaissance
Vulnerability Scanning
Maintaining Access
Clearing Tracks
Question 159
MidWest BioAnalytics, a pharmaceutical research firm in Columbus, Ohio, authorizes a controlled adversarial simulation to assess the resilience of its internal web-based inventory management platform. During the exercise, administrators observe that several active client connections briefly lose synchronization, and unexpected command patterns appear within system transaction logs. The irregularities are subtle and become apparent only after reviewing stored network captures. Executive leadership requests a solution that can maintain ongoing visibility into network exchanges and highlight activity that diverges from typical communication behavior across the organization's infrastructure. Which approach best satisfies this requirement?
Perform manual packet inspection using a protocol analyzer
Monitor for abnormal surges of repeated ACK responses
Use an Intrusion Detection System (IDS)
Evaluate authentication token generation patterns
Question 160
During a red team engagement at a biotechnology firm in San Diego, California, the security team observed that a compromised internal workstation was generating an unusually high number of outbound name resolution requests to external servers. Upon deeper inspection, analysts discovered that the query strings contained encoded data segments rather than typical lookup patterns. Further analysis revealed that these outbound requests were being used to transfer sensitive information to an attacker-controlled system outside the corporate network. Which technique was most likely used to covertly transfer the data in this scenario?