312-50v13認定資格 & 312-50v13テスト対策書Xhs1991は最高な品質で最速なスピードでECCouncilの312-50v13認定試験の資料を更新するサイトでございます。もしかすると君はほかのサイトもECCouncilの312-50v13認証試験に関する資料があるのを見つけた、比較したらXhs1991が提供したのがいちばん全面的で品質が最高なことがわかりました。 ECCouncil Certified Ethical Hacker Exam (CEHv13) 認定 312-50v13 試験問題 (Q109-Q114):質問 # 109
Your company performs penetration tests and security assessments for small and medium-sized businesses in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.
What should you do?
A. Copy the data to removable media and keep it in case you need it.
B. Ignore the data and continue the assessment until completed as agreed.
C. Confront the client in a respectful manner and ask her about the data.
D. Immediately stop work and contact the proper legal authorities.
正解：D
解説：
Per CEH v13 Official Courseware - Module 01: Introduction to Ethical Hacking, ethical hackers and penetration testers are bound by legal and professional standards. When illegal activities such as human trafficking are discovered:
The ethical response is to cease operations and report the findings to the appropriate legal authorities.
Continuing work, ignoring the findings, or confronting the client personally is both unprofessional and may potentially expose the tester to legal liability.
Reference: CEH v13 eCourseware - Module 01: Introduction to Ethical Hacking # "Legal Implications and Reporting Requirements" CEH v13 Code of Conduct for Certified Ethical Hackers
========
質問 # 110
Which of the following statements about a zone transfer is correct? (Choose three.)
A. A zone transfer can be prevented by blocking all inbound TCP port 53 connections
B. A zone transfer passes all zone information that a DNS server maintains
C. A zone transfer is accomplished with the DNS
D. A zone transfer passes all zone information that a nslookup server maintains
E. A zone transfer is accomplished with the nslookup service
F. Zone transfers cannot occur on the Internet
正解：A、B、C
質問 # 111
When you are getting information about a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from the server. You can detect all these methods (GET, POST, HEAD, DELETE, PUT, TRACE) using NMAP script engine. What Nmap script will help you with this task?
A. http-headers
B. http-git
C. http-methods
D. http enum
正解：C
質問 # 112
The company ABC recently contracts a new accountant. The accountant will be working with the financial statements. Those financial statements need to be approved by the CFO and then they will be sent to the accountant but the CFO is worried because he wants to be sure that the information sent to the accountant was not modified once he approved it. Which of the following options can be useful to ensure the integrity of the data?
A. The CFO can use an excel file with a password
B. The document can be sent to the accountant using an exclusive USB for that document
C. The financial statements can be sent twice, one by email and the other delivered in USB and the accountant can compare both to be sure is the same document
D. The CFO can use a hash algorithm in the document once he approved the financial statements
正解：D
解説：
Hashing algorithms (such as SHA-256 or MD5) are used to generate a unique digital fingerprint of a file or message. Once the CFO approves the financial statement, generating a hash value for the document ensures that if any modification occurs (even a single bit), the hash value will change, indicating a breach in data integrity.
This solution directly addresses integrity - one of the three components of the CIA triad (Confidentiality, Integrity, Availability). Password protection or transferring via USB does not ensure integrity; they offer access control and delivery security.
Reference:
CEH v13 eCourseware - Module 20: Cryptography # "Hash Functions"
CEH v13 Study Guide - Chapter: Cryptographic Controls # Data Integrity with Hashes
質問 # 113
During a physical penetration test simulating a social engineering attack, a threat actor walks into the lobby of a target organization dressed as a field technician from a known external vendor. Carrying a fake ID badge and referencing a known company name, the attacker confidently claims they've been dispatched to perform a routine server room upgrade. Using internal-sounding terminology and referencing real employee names gathered via OSINT, the individual conveys urgency. The receptionist, recognizing the vendor name and the convincing language, allows access without verifying the credentials.
A. Leaked credentials on public networks and forums
B. Misconfigured network segmentation allowing unauthorized access
C. Perceived authority and reliance on third-party familiarity
D. Trust in physical security logs used by security teams
正解：C
解説：
CEH's social engineering principles highlight psychological manipulation techniques such as authority, urgency, trust exploitation, and impersonation. In this scenario, the attacker leverages "perceived authority," a powerful influence tactic where the social engineer poses as someone with legitimate power or sanctioned access-such as a technician, auditor, or vendor representative. CEH emphasizes that referencing real employee names, using technical terminology, and impersonating trusted third-party partners increases believability and reduces verification resistance. The receptionist's acceptance of the attacker's presence without verifying credentials matches classical authority-based exploitation. Leaked credentials, physical security logs, and network segmentation issues do not relate to human-layer social engineering. The situation clearly reflects the manipulation of trust and authority as described in CEH's psychological attack vectors.