Jul 20, 2026 Reliable Study Materials for 312-50v13 Exam Success For Sure [Q354-Q379]

Jul 20, 2026 Reliable Study Materials for 312-50v13 Exam Success For Sure

100% Latest Most updated 312-50v13 Questions and Answers

NEW QUESTION # 354
During a security assessment, an attacker identifies a flaw in a multi-user file system. The system first verifies access rights to a temporary file created by a user. However, immediately after this verification, and before the file is processed, the attacker manages to swap the original file with a malicious version. This manipulation happens in the brief interval between the system's access verification and the moment it handles the file, resulting in the malicious file being treated as legitimate. Which vulnerability is the attacker exploiting?

• A. Improper certificate validation in trusted communication channels.
• B. Null pointer dereference leading to unexpected application behavior.
• C. Time-of-validation/time-of-execution issue in resource management logic.
• D. Integer overflow during arithmetic computations with limited memory bounds.

Answer: C

Explanation:
The attacker exploits the gap between when the system checks access permissions and when it actually uses the file. This timing window allows the file to be swapped, which is a classic time-of- check to time-of-use vulnerability.

NEW QUESTION # 355
After the completion of the pen test, you have provided the client with a list of controls to implement to reduce the identified risk. What term best describes the risk that remains after the controls have been implemented?

• A. Inherent risk
• B. Gap analysis
• C. Total risk
• D. Residual risk

Answer: D

Explanation:
Residual risk is the amount of risk that remains after security controls and mitigation measures have been implemented. It represents the remaining exposure that cannot be completely eliminated.

NEW QUESTION # 356
The establishment of a TCP connection involves a negotiation called three-way handshake. What type of message does the client send to the server in order to begin this negotiation?

• A. SYN
• B. SYN-ACK
• C. ACK
• D. RST

Answer: A

NEW QUESTION # 357
Morris, a professional hacker, performed a vulnerability scan on a target organization by sniffing the traffic on the network to identify the active systems, network services, applications, and vulnerabilities. He also obtained the list of the users who are currently accessing the network.
What is the type of vulnerability assessment that Morris performed on the target organization?

• A. Credentialed assessment
• B. External assessment
• C. Passive assessment
• D. Internal assessment

Answer: C

NEW QUESTION # 358
During an external assessment, a security analyst configures Nmap so that the hardware address recorded in firewall logs differs from the original interface address of the scanning system. Repeated executions of the scan show that the recorded hardware address changes automatically each time.
What Nmap option enables this behavior?

• A. --spoof-mac 0
• B. --spoof-mac 00:01:02:25:56:AE
• C. --spoof-mac Dell 10.10.1.11
• D. --spoof-mac Dell

Answer: A

Explanation:
The correct answer is A. --spoof-mac 0.
Nmap supports MAC address spoofing as a firewall-evasion and scan-obfuscation option. The available reference material lists Nmap firewall evasion options and identifies --spoof-mac mac as the option used to spoof the MAC address .
The value 0 tells Nmap to generate a random MAC address. Because the question states that the recorded hardware address changes automatically each time, the random MAC option is the correct match.
Option B. --spoof-mac Dell is incorrect because this selects a MAC address associated with a specific vendor prefix, not the fully random behavior described.
Option C. --spoof-mac 00:01:02:25:56:AE is incorrect because it uses a fixed MAC address. Repeated scans would show the same spoofed address, not a new one each time.
Option D. --spoof-mac Dell 10.10.1.11 is incorrect because it is not the correct Nmap option format for this behavior.
Therefore, the best answer is A. --spoof-mac 0.

NEW QUESTION # 359
A penetration tester reviews an API and discovers that changing a numeric object identifier allows access to another user's records without additional authorization checks. Which vulnerability BEST describes this issue?

• A. Clickjacking
• B. Insecure Direct Object Reference (IDOR)
• C. XML Injection
• D. HTTP Request Smuggling

Answer: B

Explanation:
IDOR vulnerabilities occur when applications expose internal object identifiers without enforcing authorization for each request. Attackers can modify predictable identifiers to access unauthorized resources. Proper server-side access control should verify that every authenticated user is permitted to access the requested object.

NEW QUESTION # 360
Robin, an attacker, is attempting to bypass the firewalls of an organization through the DNS tunneling method in order to exfiltrate data. He is using the NSTX tool for bypassing the firewalls. On which of the following ports should Robin run the NSTX tool?

• A. Port 80
• B. Port 23
• C. Port 50
• D. Port 53

Answer: D

Explanation:
DNS uses Ports 53 which is almost always open on systems, firewalls, and clients to transmit DNS queries.
instead of the more familiar Transmission Control Protocol (TCP) these queries use User Datagram Protocol (UDP) due to its low-latency, bandwidth and resource usage compared TCP-equivalent queries. UDP has no error or flow-control capabilities, nor does it have any integrity checking to make sure the info arrived intact.
How is internet use (browsing, apps, chat etc) so reliable then? If the UDP DNS query fails (it's a best-effort protocol after all) within the first instance, most systems will retry variety of times and only after multiple failures, potentially switch to TCP before trying again; TCP is additionally used if the DNS query exceeds the restrictions of the UDP datagram size - typically 512 bytes for DNS but can depend upon system settings.
Figure 1 below illustrates the essential process of how DNS operates: the client sends a question string (for example, mail.google[.]com during this case) with a particular type - typically A for a number address. I've skipped the part whereby intermediate DNS systems may need to establish where '.com' exists, before checking out where 'google[.]com' are often found, and so on.

Many worms and scanners are created to seek out and exploit systems running telnet. Given these facts, it's really no surprise that telnet is usually seen on the highest Ten Target Ports list. Several of the vulnerabilities of telnet are fixed. They require only an upgrade to the foremost current version of the telnet Daemon or OS upgrade. As is usually the case, this upgrade has not been performed on variety of devices. this might flow from to the very fact that a lot of systems administrators and users don't fully understand the risks involved using telnet. Unfortunately, the sole solution for a few of telnets vulnerabilities is to completely discontinue its use. the well-liked method of mitigating all of telnets vulnerabilities is replacing it with alternate protocols like ssh. Ssh is capable of providing many of an equivalent functions as telnet and a number of other additional services typical handled by other protocols like FTP and Xwindows. Ssh does still have several drawbacks to beat before it can completely replace telnet. it's typically only supported on newer equipment. It requires processor and memory resources to perform the info encryption and decryption. It also requires greater bandwidth than telnet thanks to the encryption of the info . This paper was written to assist clarify how dangerous the utilization of telnet are often and to supply solutions to alleviate the main known threats so as to enhance the general security of the web Once a reputation is resolved to an IP caching also helps: the resolved name-to-IP is usually cached on the local system (and possibly on intermediate DNS servers) for a period of your time . Subsequent queries for an equivalent name from an equivalent client then don't leave the local system until said cache expires. Of course, once the IP address of the remote service is understood , applications can use that information to enable other TCP-based protocols, like HTTP, to try to to their actual work, for instance ensuring internet cat GIFs are often reliably shared together with your colleagues.
So, beat all, a couple of dozen extra UDP DNS queries from an organization's network would be fairly inconspicuous and will leave a malicious payload to beacon bent an adversary; commands could even be received to the requesting application for processing with little difficulty.

NEW QUESTION # 361
In the bustling financial hub of Charlotte, North Carolina, ethical hacker Raj Patel is contracted by TrustBank, a regional US bank, to evaluate their online loan application portal. On April 22, 2025, Raj tests a feature allowing customers to upload structured financial documents for loan processing. By submitting a specially crafted document, he triggers a response that exposes internal server file paths and sensitive configuration data, including database connection strings. The issue arises from the portal's handling of external references in document parsing, not from response manipulation, authentication weaknesses, or undetected attack attempts. Raj compiles a detailed report to assist TrustBank's security team in mitigating the vulnerability.
Which type of vulnerability is Raj most likely exploiting in TrustBank's online loan application portal?

• A. Security Logging and Monitoring Failures
• B. XML External Entity (XXE) Injection
• C. HTTP Response Splitting
• D. Identification and Authentication Failures

Answer: B

Explanation:
The vulnerability described is characteristic of XML External Entity (XXE) Injection. In CEH web application security coverage, XXE occurs when an application parses XML input without properly disabling external entity resolution. If the XML parser is configured insecurely, an attacker can define a malicious external entity that references local files or internal system resources. When the parser processes the XML document, it resolves the external entity and may return the contents of sensitive files in the server's response.
The scenario clearly states that the issue arises from "handling of external references in document parsing" and results in exposure of internal file paths and database connection strings. This aligns directly with XXE behavior, where attackers leverage external entity declarations to retrieve local files such as configuration files, environment settings, or system credentials. In some cases, XXE can also enable server-side request forgery by forcing the server to make internal network requests.
The other options do not match the described behavior. Identification and authentication failures relate to improper access controls, not document parsing. HTTP response splitting involves manipulating headers to inject malicious responses. Security logging and monitoring failures refer to detection gaps, not data exposure through parsing. CEH-recommended mitigation strategies include disabling DTD processing, turning off external entity resolution in XML parsers, validating input formats, implementing least privilege on file access, and using secure parsing libraries that prevent XXE exploitation.

NEW QUESTION # 362
A regional investment firm in Denver, Colorado, recently migrated to a fully switched Ethernet infrastructure. During an authorized security evaluation, a consultant connected a test device to an access-layer switch and initiated a scripted network interaction.
Within minutes, administrators observed irregular switching behavior. Frames that were normally delivered directly between specific workstations began appearing across multiple switch ports.
Users reported brief connectivity instability, but no configuration changes were made to the switch. After the activity subsided, forwarding operations gradually stabilized.
Based on the observed behavior, which sniffing technique was most likely performed?

• A. Switch Port Stealing
• B. MAC Flooding
• C. ARP Poisoning
• D. DNS Poisoning

Answer: B

Explanation:
The behavior describes a switched network being overwhelmed so that frames are no longer properly confined to specific MAC address tables and instead appear across multiple ports. This is characteristic of MAC flooding, where excessive MAC entries force a switch into a fail-open or hub-like state, allowing traffic to be observed across ports.

NEW QUESTION # 363
During a security assessment, an attacker identifies a flaw in a multi-user file system. The system first verifies access rights to a temporary file created by a user. However, immediately after this verification, and before the file is processed, the attacker manages to swap the original file with a malicious version. This manipulation happens in the brief interval between the system's access verification and the moment it handles the file, resulting in the malicious file being treated as legitimate. Which vulnerability is the attacker exploiting?

• A. Improper certificate validation in trusted communication channels.
• B. Null pointer dereference leading to unexpected application behavior.
• C. Time-of-validation/time-of-execution issue in resource management logic.
• D. Integer overflow during arithmetic computations with limited memory bounds.

Answer: C

Explanation:
Comprehensive Explanation from CEH v13 Courseware:
CEH v13 explains that TOCTOU (Time-of-Check Time-of-Use) vulnerabilities arise when a system checks a condition (such as file permissions) and then later uses the resource based on that assumption. If there is even a tiny gap between the validation and the actual use, attackers can exploit this race condition by replacing or modifying the resource after validation but before execution. This is common in file-handling operations involving temporary files, symbolic links, or shared directories. CEH emphasizes that TOCTOU attacks often lead to privilege escalation, unauthorized execution, or tampering with data because the system trusts the earlier validation step. The attacker swaps the file at precisely the right moment, taking advantage of a race window. The other options-certificate validation, integer overflow, and null pointer dereference-do not involve timing-based race conditions. The scenario exactly matches CEH's description of TOCTOU exploitation, where attackers manipulate file access in the interval between validation and execution.

NEW QUESTION # 364
Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to implant malicious backdoors in its firmware. He also identified that an installed backdoor can persist even if the server is reallocated to new clients or businesses that use it as an IaaS. What is the type of cloud attack that can be performed by exploiting the vulnerability discussed in the above scenario?

• A. Cloud cryptojacking
• B. Cloudborne attack
• C. Metadata spoofing attack
• D. Man-in-the-cloud (MITC) attack

Answer: B

NEW QUESTION # 365
FILL BLANK
Scenario
Instructions
You have been hired as a part of the Red Team at CEHORG, an IT and ITES organization that deals with advanced research and development in the field of information security. It has offices all over the country connected in real-time by its network infrastructure.
Your organization is worried about rising cybersecurity incidents and has entrusted you with a comprehensive security audit of the complete infrastructure.
CEHORG's internal network consists of several subnets housing various organizational units like any large organization. The front office is connected to a separate subnet that connects to the company's public-facing computers. The company has installed multiple kiosks to help customers understand their products and services. The front office also has Wi-Fi connectivity to cater to the users who carry their smartphones and laptops.
The CEHORG's internal network is made up of Militarized and Demilitarized zones. As a security precaution and by design, all the internal resource zones are configured with different subnet IPs.
The militarized zone houses the application servers that provide application frameworks for various departments. The Demilitarized Zone contains public-facing systems of the organization, such as web and mail servers. The headquarters' network topology and protocols are replicated worldwide in all its satellite offices for efficient communication with the headquarters.
Description
CEH Practical exam presents you with 20 challenges built on the ethical hacking domains covered in the C|EH program. The exam hosts multiple hidden machines, each containing a set of vulnerable applications and services. You must apply your knowledge and skills in various ethical hacking domains and solve the challenges. The exam duration is 6 hours. Each challenge in CEH Practical weighs 10 points, and you are required to solve a minimum of 14 challenges out of 20, which would sum up to 140 points, to become a CEH (Practical) Credential Holder.
On the cyber range, you will have access to Ethical Hacker Workstations, EH Workstation - 1 and EH Workstation - 2. EH Workstation - 1 is a Parrot Security machine and EH Workstation
- 2 is a Windows 11 machine. You can switch to these machines from the Resources tab.
Please note that there are a maximum of 3 attempts for each challenge.
Available target networks:
10.10.55.0/24
192.168.44.0/24
192.168.200.0/24
Exclusions:
10.10.55.1, 10.10.55.2
192.168.44.1, 192.168.44.2
192.168.200.1, 192.168.200.2
The credentials to access EH Workstation - 1 (Parrot Security) machine are as below:
Username: attacker Password: toor
The credentials to access EH Workstation - 2 (Windows 11) are as below:
Username: Admin Password: Pa$$w0rd
The credentials to access OpenVAS on EH Workstation - 1 (Parrot Security) machine are as below:
Username: admin Password: password
To open OpenVAS tool, click Applications at the top of the Desktop window and navigate to Pentesting → Vulnerability Analysis → Openvas - Greenbone → Start Greenbone Vulnerability Manager Service to launch OpenVAS tool.
Note: You can use username.txt and password.txt available on the Desktop of the EH Workstation - 1 (Parrot Security) machine for any credentials/password cracking attempt.
Flags
Challenge:
A former employee of the organization has stolen a critical account credential and stored it in a file named pixelpioneer.txt prior to quitting the company. The credential is a nine-character alphanumeric string. Access the pixelpioneer.txt file, located in the Downloads folder of the "EH Workstation - 2," where it was identified as an email attachment. Note: You have learned that
"password" is the key to extracting data from the pixelpioneer.txt file. (Format: ANaa*aANaNa)

Answer:

Explanation:
T3ch!eT1g3r

NEW QUESTION # 366
A financial services firm is experiencing a sophisticated DoS attack on their DNS servers with DNS amplification and their web servers with HTTP floods. Traditional firewall rules and IDS are failing to mitigate the attack effectively. To protect their infrastructure without impacting legitimate users, which advanced mitigation strategy should the firm implement?

• A. Block all incoming traffic from suspicious IP ranges using access control lists
• B. Utilize a cloud-based DDoS protection service with traffic scrubbing capabilities
• C. Deploy a Web Application Firewall (WAF) to filter HTTP traffic
• D. Increase server capacity and implement simple rate limiting

Answer: B

Explanation:
A cloud-based DDoS protection service with traffic scrubbing can absorb and filter large-scale DNS amplification and HTTP flood traffic across multiple layers, distinguishing malicious traffic from legitimate requests and maintaining service availability without disrupting valid users.

NEW QUESTION # 367
As part of an annual security awareness program at BrightPath Consulting in Denver, Colorado, the cybersecurity team conducts an ethical hacking experiment to test employee vigilance against physical social engineering threats. During a simulated attack, ethical hacker Liam Carter strategically places a USB drive labeled "Confidential 2025 Budget Plans" in the company's parking lot, designed to look like it was accidentally dropped. The USB is programmed to install a harmless tracking script when plugged into a workstation, alerting the security team. Sarah, a project coordinator, finds the USB and considers plugging it into her office laptop to identify its owner.
What social engineering technique is being tested in this experiment?

• A. Baiting
• B. Hoax
• C. Phishing
• D. Pretexting

Answer: A

Explanation:
The scenario clearly describes baiting, a physical social engineering technique covered in CEH under human- based attacks. Baiting involves enticing a victim with something appealing or intriguing, such as free software, confidential documents, or valuable information, in order to trick them into compromising security.
In this case, the USB drive is deliberately labeled "Confidential 2025 Budget Plans," which is designed to trigger curiosity and urgency. The attacker relies on human psychology, specifically curiosity and perceived importance, to motivate the target to plug the device into a company system.
Unlike phishing, which typically occurs through email or electronic communication, baiting often involves physical media such as USB drives left in public areas like parking lots or lobbies. CEH materials highlight that attackers may preload such devices with malware that executes automatically when inserted, granting access to the internal network. Even though this experiment uses a harmless tracking script, the methodology mirrors real-world attacks where malicious payloads could establish backdoors, exfiltrate data, or deploy ransomware.
Hoaxes spread false warnings to create panic but do not necessarily require interaction with physical devices.
Pretexting involves fabricating a scenario or identity to elicit information directly from a target through conversation or interaction. The use of a strategically placed USB labeled with enticing information fits the definition of baiting precisely. This test reinforces the importance of policies prohibiting unknown removable media usage and promoting employee awareness training.

NEW QUESTION # 368
#!/usr/bin/python
import socket
buffer=["A"]
counter=50
while len(buffer)<=100:
buffer.append("A"*counter)
counter=counter+50
commands=["HELP","STATS","RTIME","LTIME","SRUN","TRUN","GMON","GDOG","KSTET"," GTER","HTER","LTER","KSTAN"] for command in commands:
for buffstring in buffer:
print "Exploiting " + command + ": " + str(len(buffstring))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.1', 9999))
s.recv(50)
s.send(command + buffstring)
s.close()
What is the code written for?

• A. Denial-of-service (DOS)
• B. Bruteforce
• C. Encryption
• D. Buffer Overflow

Answer: D

Explanation:
In CEH v13 Module 05: System Hacking, and in lab-based exploitation exercises, this is a classic fuzzer for buffer overflow testing.
The script creates increasingly larger strings of "A" (50, 100, 150...).
These are passed as arguments to different vulnerable commands on the target service (127.0.0.1:9999).
The goal is to trigger a crash, typically when input exceeds buffer limits (i.e., buffer overflow).
This is part of exploit development to identify the offset and locate the instruction pointer overwrite (EIP overwrite).
Reference:
CEH v13 Module 05 - Buffer Overflow Concepts
CEH iLabs: Exploitation with Custom Fuzzers in Python
EC-Council Exploit Development Lab Manual

NEW QUESTION # 369
What indicates advanced persistent threat behavior?

• A. Malware spam
• B. One-time exploit
• C. Brute force
• D. Long dwell time

Answer: D

Explanation:
Advanced persistent threats are characterized by attackers maintaining unauthorized access to a target environment for an extended period. Long dwell time indicates stealthy, ongoing activity focused on persistence, surveillance, and long-term objectives.

NEW QUESTION # 370
Which individuals believe that hacking and defacing websites can promote social change?

• A. Black hat hackers
• B. Gray hat hackers
• C. Hacktivists
• D. Ethical hackers

Answer: C

Explanation:
Hacktivists use hacking activities, such as website defacement and cyberattacks, to promote political, ideological, or social causes. Their actions are intended to influence public opinion or drive social change.

NEW QUESTION # 371
A vulnerability has a score of 9.8. What does this rating help explain?

• A. It classifies attacks qualitatively
• B. It measures authentication errors
• C. It generates exploit payloads
• D. It quantifies impact and exploitability to prioritize remediation

Answer: D

Explanation:
This refers to the CVSS (Common Vulnerability Scoring System), which CEH v13 identifies as the industry standard for vulnerability prioritization. A score of 9.8 indicates critical severity, combining metrics such as exploitability, impact, privileges required, and scope.
CVSS helps organizations prioritize remediation objectively, focusing resources on vulnerabilities with the highest business risk. It also allows consistent communication between technical and management teams.
Options B, C, and D misrepresent CVSS functionality. Therefore, Option A is correct.

NEW QUESTION # 372
Your company, Encryptor Corp, is developing a new application that will handle highly sensitive user information. As a cybersecurity specialist, you want to ensure this data is securely stored.
The development team proposes a method where data is hashed and then encrypted before storage. However, you want an added layer of security to verify the integrity of the data upon retrieval. Which of the following cryptographic concepts should you propose to the team?

• A. Apply a digital signature mechanism.
• B. Suggest using salt with hashing.
• C. Implement a block cipher mode of operation.
• D. Switch to elliptic curve cryptography.

Answer: A

NEW QUESTION # 373
Which of the following is one primary difference between a malicious hacker and an ethical hacker?

• A. Malicious hackers use different tools and techniques than ethical hackers use.
• B. Malicious hackers are more advanced than ethical hackers because they can use any technique to attack a system or network.
• C. Ethical hackers obtain permission before bringing down servers or stealing credit card databases.
• D. Ethical hackers use the same methods but strive to do no harm.

Answer: D

Explanation:
Ethical hackers use many of the same tools, techniques, and methods as malicious hackers, but they operate with authorization and with the goal of identifying and fixing security weaknesses without causing harm to the organization.

NEW QUESTION # 374
During a targeted intrusion against a cloud infrastructure company in Salt Lake City, Utah, an attacker distributes a modified installation package of a legitimate network diagnostic utility widely used by employees. Before distributing the package, the attacker binds a malicious remote- access payload with the original executable so that both components are installed together.
When users launch the diagnostic tool, it performs its normal troubleshooting functions, while the hidden payload simultaneously executes in the background and establishes communication with a remote command server. From a malware deployment perspective, what technique best describes this approach?

• A. Dropper
• B. Downloader
• C. Wrapper
• D. Packer

Answer: C

Explanation:
The scenario describes a malicious payload being combined with a legitimate application so that both are installed and executed together, while the legitimate program continues to function normally. This is characteristic of a wrapper, where malware is bound to a trusted executable to disguise its presence and ensure execution alongside the original application.

NEW QUESTION # 375
A security analyst uses Zenmap to perform an ICMP timestamp ping scan to acquire information related to the current time from the target host machine.
Which of the following Zenmap options must the analyst use to perform the ICMP timestamp ping scan?

• A. -Pn
• B. -PP
• C. -PY
• D. -PU

Answer: B

Explanation:
In CEH v13 Module 03: Scanning Networks, ICMP scan types are covered under host discovery techniques in Nmap/Zenmap.
The -PP option in Nmap is used to perform an ICMP timestamp request scan.
This method sends an ICMP timestamp request and listens for a timestamp reply from the target.
It helps analysts determine the system uptime and verify whether the host is alive (for stealthy discovery).
Option Clarification:
A: -PY: SCTP INIT Ping (used for SCTP-based hosts).
B: -PU: UDP Ping (sends UDP packets).
C: -PP: ICMP Timestamp Ping - correct answer.
D: -Pn: Skips host discovery (treats all hosts as alive), not a ping type.
Reference:
Module 03 - Host Discovery Techniques
CEH Labs: Zenmap and Nmap Scanning with ICMP Ping Options
Nmap Docs: https://nmap.org/book/man-host-discovery.html

NEW QUESTION # 376
Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks.
What is the type of threat intelligence collected by Arnold in the above scenario?

• A. Technical threat intelligence
• B. Tactical threat intelligence
• C. Operational threat intelligence
• D. Strategic threat intelligence

Answer: C

NEW QUESTION # 377
During a red team exercise at a financial institution in New York, penetration tester Bob investigates irregularities in time synchronization across critical servers. While probing one server, he decides to use a diagnostic command that allows him to directly interact with the NTP daemon and query its internal state. This command enables him to perform monitoring and retrieve statistics, but it is primarily focused on controlling and checking the operation of the NTP service rather than listing peers with delay, offset, and jitter values. Which command should Bob use to accomplish this?

• A. ntptrace [-n] [-m maxhosts] [servername/IP_address]
• B. ntpq [-inp] [-c command] [host] [...]
• C. ntpq -p [host]
• D. ntpdc [-ilnps] [-c command] [host] [...]

Answer: D

Explanation:
The ntpdc command allows direct interaction with the NTP daemon to query and control its internal state, perform monitoring, and retrieve operational statistics, which aligns with Bob's diagnostic objective.

NEW QUESTION # 378
Bob, a seasoned security analyst at XYZ Aerospace, was investigating a series of misaligned transaction timestamps coming from one of the data archival systems. Suspecting that the server might be syncing with an unstable time source, Bob decided to extract a detailed list of all peer servers associated with the target machine, including metrics such as delay, offset, and jitter, to determine whether the issue stemmed from time synchronization drift.
Which of the following commands should Bob use to retrieve this information?

• A. ntptrace [-n] [-m maxhosts] [servername/IP_address]
• B. ntpq [-n] [-l] [-c command] [host] [...]
• C. ntpq -p [host]
• D. ntpdc [-n] [-s] [-c command] [host] [...]

Answer: C

Explanation:
The command that best matches Bob's goal is ntpq -p. In CEH-aligned coverage of network services and operational troubleshooting, NTP is highlighted as a critical dependency because inaccurate time can break authentication, distort logs, and cause incorrect transaction ordering. When investigating suspected time drift, the most useful first step is to view the active NTP associations and their quality metrics. The ntpq utility queries an NTP daemon and reports peer status and performance data. Specifically, ntpq -p displays a peer table that includes each configured or discovered time source along with fields such as delay, offset, and jitter.
These values help determine whether the server is locked to a stable source or being influenced by a poor or rogue time server. Offset indicates how far the local clock differs from the peer, delay reflects network latency to the peer, and jitter shows the variability in timing measurements, all of which are directly mentioned in the question.
Option A, ntptrace, is used to trace the chain of NTP servers back to a reference clock and is useful for understanding hierarchy, but it does not provide the detailed delay, offset, and jitter peer metrics in the same way. Option C, ntpdc, is an older monitoring tool that can query NTP, but CEH references more commonly emphasize ntpq for peer statistics and associations. Option D is a generic ntpq invocation with interactive command support, but the -p option is the explicit mode that outputs the peer list with the required metrics.

NEW QUESTION # 379
......

New ECCouncil 312-50v13 Dumps & Questions: https://torrentlabs.itexamsimulator.com/312-50v13-brain-dumps.html