312-50v13 Exam Preparation Material | Certified Ethical Hacker Exam (CEHv13)

Explanation:
The correct answer is A. Measured service because the scenario describes a core cloud characteristic where resource usage is metered, monitored, controlled, and reported, enabling pay-as-you-go billing and supporting accountability and auditability. In CEH cloud computing coverage (aligned with standard cloud definitions), measured service refers to the cloud provider’s ability to automatically track and quantify consumption of resources such as CPU/compute time, storage capacity, memory, and network bandwidth. This metering is fundamental to cloud economics: customers pay based on actual usage rather than fixed, up-front infrastructure costs.
In the Black Friday context, demand is bursty and unpredictable. Measured service allows the organization to scale resources up during peak shopping hours and scale down afterward, while billing remains tied to what was truly consumed. This is especially important for cost control in e-commerce environments where overprovisioning for peak loads on-premises would be expensive and inefficient. Additionally, because the provider records usage in detail, the organization can perform chargeback/showback internally, validate invoices, and maintain evidence for audits and compliance reviews―all of which depend on accurate, granular measurement.
Why the other options are not the best fit: Broad network access describes availability over networks and access via standard mechanisms (not usage tracking). On-demand self-service refers to users provisioning resources automatically without human interaction from the provider (not billing metering). Resource pooling refers to multi-tenant pooling of provider resources dynamically assigned and reassigned according to demand (again, not the billing/audit measurement function).
Therefore, the feature of detailed tracking of compute hours, storage usage, and bandwidth consumption that supports pay-per-use and auditing is best explained by measured service.

Explanation:
The correct answer is D. PCB-4510 Jammer.
The scenario describes a portable high-power multi-band jammer capable of disrupting several wireless technologies, including Wi-Fi and cellular communication, across an approximate 120-meter range for slightly over one hour. Among the listed options, PCB-4510 Jammer best matches those operational characteristics.
CEH wireless security material describes wireless jamming as a denial-of-service condition in which an attacker uses a jamming device to block wireless communications within the affected area. Wireless devices are susceptible to jamming or interference when enough competing RF energy is introduced into the airwaves. Another wireless reference explains that Wi-Fi signal jamming blocks communications using special hardware and prevents users from connecting to wireless networks within the jammer’s vicinity.
Option A. PCB-1016 Jammer is incorrect because it does not best match the described higher coverage radius and multi-band impact.
Option B. CPB-2612H-5G Jammer is incorrect because the scenario’s range and operating duration align more closely with PCB-4510.
Option C. CPB-2920 Jammer is incorrect because the described 120-meter campus disruption more strongly matches PCB-4510 characteristics.
Option D. PCB-4510 Jammer is correct because it best fits the high-power, multi-band, approximately 120-meter jamming behavior described.
Therefore, the best answer is D. PCB-4510 Jammer.

Explanation:
The issue described is verbose error messages, where an application reveals excessive technical details when handling invalid input. The scenario states that the platform returns “detailed system information, including database query strings and directory paths” instead of a generic error. Exposing internal paths and query strings is a common symptom of verbose error handling: stack traces, SQL statements, file system locations, framework versions, and configuration hints can appear in responses when exception handling is misconfigured or when debug settings are enabled in production.
These details are valuable to attackers because they reduce guesswork. Directory paths can reveal the operating system, deployment layout, and sensitive file locations; database query strings can reveal table/column names and query structure, enabling more effective
SQL injection payloads or targeted data extraction. Verbose errors can also leak usernames, internal hostnames, API endpoints, and even secrets if mishandled. Even if the initial invalid request does not compromise the system, the leaked information can significantly improve the attacker’s ability to craft subsequent attacks with higher precision.
Why the other options are less accurate:
Improper error handling (A) is a broader category and could include verbose errors, but the question’s best match is the specific symptom: detailed internal information disclosure. Directory traversal (B) involves manipulating path input to access unauthorized files; here, the application is revealing paths due to errors, not being coerced into reading arbitrary files.
CORS misconfiguration (D) relates to cross-origin browser access controls and is unrelated to leaking stack traces or database queries.
Therefore, the correct answer is C. Verbose Error Messages.

Explanation:
The correct answer is D. Detect.
The activity described is the continuous review of enterprise operational data to identify irregular patterns that may indicate malicious activity. This is a detection function. CEH-aligned IDS material explains that intrusion detection systems monitor packets and attempt to discover whether an attacker is trying to break into a system or cause a denial-of-service condition. It also describes anomaly detection as measuring a baseline of activity, such as CPU utilization, disk activity, user logins, and file activity, so that abnormal behavior can be identified.
Option A. Predict is incorrect because prediction focuses on anticipating risks and likely threats before they occur.
Option B. Protect is incorrect because protection focuses on safeguards and controls that reduce the likelihood or impact of attacks.
Option C. Respond is incorrect because response occurs after an event or incident is detected.
Option D. Detect is correct because the team is monitoring data to identify suspicious or abnormal behavior.
Therefore, the best answer is D. Detect.

Explanation:
The described technique is HTTP tunneling because Ethan is encapsulating his traffic inside standard web requests on port 80 to blend with normal browsing activity and bypass perimeter defenses that only perform basic port/protocol filtering. HTTP tunneling leverages the fact that many organizations allow outbound (and sometimes inbound) HTTP/HTTPS traffic through firewalls for business needs. If a firewall is not doing deep inspection (such as application-layer proxying, WAF inspection, or strict egress controls), encapsulated traffic can traverse allowed ports while carrying non-HTTP payloads inside the HTTP structure.
The scenario’s core clues are: (1) “encapsulates his traffic inside standard web requests,”
(2) uses port 80, and (3) success depends on the firewall “not performing deep application inspection.” These are exactly the conditions where HTTP tunneling is effective: the traffic appears as ordinary HTTP sessions, so the firewall treats it as permitted web traffic even though the content is being used as a carrier for another protocol or command channel.
Why the other options don’t fit:
DNS tunneling (D) also encapsulates traffic, but it uses DNS queries/responses (typically UDP/TCP 53), not HTTP requests on port 80.
Tiny fragments (C) is an evasion method that breaks packets into very small fragments to confuse filtering/IDS reassembly; the scenario is about encapsulation in web requests, not fragmentation.
Source routing (B) attempts to influence packet path using IP options; it is not described here and is commonly blocked/ignored in modern networks.
Therefore, the firewall evasion technique is A. HTTP Tunneling.