Free 312-50V13 Practice Test Questions and Answers (2026)

The primary conceptual advantage of an anomaly-based Intrusion Detection System (IDS) is its ability to identify unknown or "zero-day" attacks. Unlike signature-based systems that rely on a database of known attack patterns, an anomaly-based IDS first establishes a baseline of normal network or system behavior. It then monitors activity and flags any significant deviation from this baseline as a potential threat. This methodology allows it to detect novel attacks for which no signature exists, as the attack's behavior will likely differ from the established normal profile.

A. Produces less false positives: This is incorrect. Anomaly-based systems are known for producing a higher rate of false positives because benign, yet unusual, activities can be flagged as malicious deviations from the norm.

C. Requires vendor updates for a new threat: This is a characteristic of signature-based IDS. They depend on vendors to research new threats and distribute updated signature files to be able to detect them.

D. Cannot deal with encrypted network traffic: This is a challenge for most network-based IDS, regardless of whether they are anomaly-based or signature-based. Encrypted payloads obscure the data needed for analysis by both methods.

1. National Institute of Standards and Technology (NIST) Special Publication 800-94

Guide to Intrusion Detection and Prevention Systems (IDPS).

Section 2.2.2

Anomaly-Based Detection: "The primary benefit of anomaly-based detection is that it can be effective against previously unknown threats... A major drawback of anomaly-based detection approaches is the high false positive rate." This directly supports option B as correct and option A as incorrect.

Section 2.2.1

Signature-Based Detection: "The main drawback to signature-based approaches is that they can only detect attacks for which a signature has been developed." This supports the reasoning for why option C describes signature-based systems.

2. Garcia-Teodoro

P.

Diaz-Verdejo

J.

Maciá-Fernández

G.

& Vázquez

E. (2009). Anomaly-based network intrusion detection: Techniques

systems and challenges. Computers & Security

28(1-2)

18–28.

Section 1

Introduction (p. 19): "The main advantage of these systems [anomaly-based] is their ability to detect novel attacks against computer systems and networks... However

their main drawback is the high rate of false alarms they usually suffer." This publication corroborates that detecting unknown attacks is the key characteristic and that high false positives are a known issue. (DOI: https://doi.org/10.1016/j.cose.2008.08.003)

3. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017. Lecture 15: Intrusion Detection.

The course materials frequently contrast the two methods

noting that signature-based systems are "Bad for zero-day exploits

" while anomaly-based systems "Can detect zero-day exploits." This aligns with the selection of option B. The materials also highlight that a disadvantage of anomaly detection is "High false alarm rate."

The Payment Card Industry Data Security Standard (PCI DSS) objective "Implement Strong Access Control Measures" focuses on ensuring that access to system components and cardholder data is restricted to authorized individuals. Requirement 8 of the PCI DSS, "Identify and authenticate access to system components," explicitly mandates assigning a unique ID to each person with computer access. This fundamental control ensures that every action on the network can be traced back to a specific, known user, which is a cornerstone of secure access management and accountability.

A. Regularly test security systems and processes.

This requirement falls under the PCI DSS objective "Regularly Monitor and Test Networks," which focuses on vulnerability scanning, penetration testing, and intrusion detection/prevention.

B. Encrypt transmission of cardholder data across open, public networks.

This is a requirement under the objective "Protect Cardholder Data," which deals with safeguarding data both at rest (storage) and in transit using strong cryptography.

D. Use and regularly update anti-virus software on all systems commonly affected by malware.

This requirement is part of the objective "Maintain a Vulnerability Management Program," which includes protecting systems against malware and ensuring security patches are applied.

1. PCI Security Standards Council. (2022). Payment Card Industry (PCI) Data Security Standard: Requirements and Security Assessment Procedures

Version 4.0. Page 11

"PCI DSS Goals and Requirements" table.

Goal: Implement Strong Access Control Measures: This goal encompasses Requirement 8

"Identify Users and Authenticate Access to System Components." Requirement 8.2.1 specifically states

"Assign all users a unique ID before allowing them to access system components or cardholder data

" directly supporting option C.

The same table maps the other options to their respective goals: Requirement 11 ("Test Security of Systems and Networks Regularly") to "Regularly Monitor and Test Networks" (Option A); Requirement 4 to "Protect Cardholder Data" (Option B); and Requirement 5 ("Protect All Systems and Networks from Malicious Software") to "Maintain a Vulnerability Management Program" (Option D).

2. Cornell University. (n.d.). IT@Cornell Policy Office: PCI DSS Requirements. Cornell University. Retrieved from https://it.cornell.edu/policy/pci-dss-requirements

This university resource outlines the 12 PCI DSS requirements grouped by the six control objectives. It explicitly lists "Assign a unique ID to each person with computer access" under Goal 4: "Implement Strong Access Control Measures."

The command enum -U -d -u administrator -p 192.168.1.105 is being executed against a machine with an active SMB port (445). The flags indicate a specific attack vector. The -u administrator flag explicitly targets the "administrator" user account. The -p flag is conventionally used to specify a password or a password file/list, and the -d flag likely signifies a "dictionary" attack mode. Therefore, Eve is attempting to use a dictionary of common passwords to guess the administrator account's password. This process is a form of password cracking aimed at gaining unauthorized access.

A. Eve is trying to connect as a user with Administrator privileges:

The enum tool is primarily for enumeration and testing, not for establishing a persistent connection or interactive shell, which tools like psexec or smbclient are used for.

B. Eve is trying to enumerate all users with Administrative privileges:

The command targets a single, specific user (-u administrator), not a group. Enumerating a group's members would require different syntax, typically targeting the "Administrators" group.

D. Eve is trying to escalate privilege of the null user to that of Administrator:

This is an initial access attempt on a known account. It is not an attempt to elevate the privileges of an unauthenticated null session, which is a different technique.

1. Ric Messier

CEH v11 Certified Ethical Hacker Study Guide

Wiley

2021. Chapter 5

"Enumeration

" discusses how

after enumerating usernames via SMB

an attacker's next step is often to attempt to crack passwords for those discovered accounts. The command shown is a stylized representation of this password attack phase.

2. Dakota State University

CSC 443/543: Ethical Hacking & Countermeasures

Lab 07 - Enumeration. This lab exercise outlines the standard penetration testing methodology where enum4linux is first used to enumerate users

and then a tool like Hydra is used to perform a dictionary attack against discovered accounts (e.g.

hydra -L users.txt -P pass.txt smb). The question's scenario directly mirrors this process.

3. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 8.2

"Password Cracking

" the text describes dictionary attacks as a common method where an attacker uses a list of likely passwords to guess a user's credentials against a network service.

The AndroidManifest.xml file is a mandatory component of every Android application. It resides in the root directory of the application package (APK). The Android operating system and build tools rely on this file to understand the application's structure and requirements before any code is executed. It declares the fundamental components of the application, such as its activities, services, broadcast receivers, and content providers. Additionally, it specifies the permissions the application requires and the hardware or software features it needs, making it the central configuration file.

B. APK.info: This is not a standard or recognized file within the Android application package structure; it is a fabricated name.

C. resources.asrc: This file contains the application's precompiled resources (e.g., strings, layouts, styles) in a binary format, not the declaration of its core components.

D. classes.dex: This file contains the application's source code compiled into the Dalvik Executable (DEX) format, which is executed by the Android Runtime (ART).

1. Official Vendor Documentation: Google. (n.d.). App manifest overview. Android Developers. Retrieved from https://developer.android.com/guide/topics/manifest/app-manifest.

Reference Specifics: The first paragraph explicitly states

"Every app project must have an AndroidManifest.xml file... The manifest file describes essential information about your app to the Android build tools

the Android operating system

and Google Play." The section "App components" further details that the manifest is used to declare activities

services

broadcast receivers

and content providers.

2. University Courseware: Zeldovich

N. (2014). Lecture 15: Mobile (Android) Security. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Reference Specifics: Slide 10

"Android application structure

" identifies AndroidManifest.xml as the file that "Declares components

permissions

etc." for the application.

3. Peer-reviewed Academic Publication: Zhou

Y.

& Jiang

X. (2012). Dissecting Android Malware: Characterization and Evolution. 2012 IEEE Symposium on Security and Privacy

95-109. https://doi.org/10.1109/SP.2012.16

Reference Specifics: Section II-A

"Android Application Structure

" states: "Each Android application must have a manifest file

named AndroidManifest.xml

to declare its components (i.e.

activities

services

content providers and broadcast receivers)

permissions

and other facilities..."

This command sequence outlines a logical, albeit syntactically imperfect, method for web page link extraction using standard Linux tools. The process begins with wget to retrieve the HTML source code of the target website's main page. The output is then piped to grep, which first filters the HTML to isolate lines containing anchor tags (<a href=...) that define hyperlinks. A second grep command further refines this output to display only those links that contain the target domain name ("site.com"), effectively grabbing the relevant links as requested. Among the given options, this pipe represents the most conceptually correct workflow for the task.

A. dirb is a web content scanner used to discover hidden files and directories through brute-force, not for parsing the content of a known page.

B. This command contains multiple syntactical errors and uses a nonsensical delimiter ("V") with the cut command, which would fail to correctly parse and extract URLs.

D. This option is completely non-functional due to multiple syntax errors, such as the missing space after wget and the malformed cut command.

---

1. GNU Wget 1.21.2 Manual

Section 3.3 "Logging and Input File Options": The manual specifies the use of -O - or --output-document=- to direct the downloaded content to standard output

which is necessary for piping to other commands like grep. This confirms wget is a tool for downloading content

which is the first step in the correct option's logic.

Reference: https://www.gnu.org/software/wget/manual/wget.html#Logging-and-Input-File-Options

2. GNU Grep 3.7 Manual

Section 1.1 "What is Grep?": The grep manual describes its function as searching for lines that match a given pattern. This supports its use in the correct answer for filtering the HTML output from wget to find lines containing tags.

Reference: https://www.gnu.org/software/grep/manual/grep.html#What-is-Grep003f

3. MIT Missing Semester of Your CS Education

Lecture 2 "Shell Tools and Scripting": This university courseware details the use of core utilities and piping (|) to chain commands. It explains how tools like curl or wget can be used to fetch web data

and grep can be used to process that data

validating the fundamental structure of the command pipeline presented in the correct answer.

Reference: https://missing.csail.mit.edu/2020/shell-tools/ (See section on curl

grep

and pipes).

The nslookup utility in Windows can be used to perform a DNS zone transfer by using the ls subcommand. The command ls -d sends a request to the configured DNS server for a full zone transfer (AXFR), which lists all DNS records for the specified domain. In this scenario, after setting the server to 192.168.10.2 (using the server 192.168.10.2 command), the command ls -d abccorp.local would be used. Option B contains a common typo (is instead of ls), but it represents the correct command structure for this task.

A. list server=192.168.10.2 type=all is syntactically incorrect. The nslookup utility does not use keyword arguments like server= or type=.

C. Iserver 192.168.10.2-t all is syntactically incorrect. lserver (assuming Iserver is a typo) sets a server, but the -t option is used with the ls command, not lserver.

D. List domain=Abccorp.local type=zone is syntactically incorrect. nslookup does not accept parameters in the key=value format for the ls command.

1. Microsoft Corporation

"nslookup ls" documentation. This official vendor documentation details the ls subcommand for nslookup. It specifies the syntax ls [option] and describes the -d option as "Lists all records for the domain

" which is the function that initiates a zone transfer request.

Source: Microsoft Learn

nslookup ls command documentation. (Specific page: The official documentation page for the nslookup ls subcommand on the Microsoft Learn website).

2. University of Washington

CSE 484: Computer Security

Lab 1. This university courseware provides practical exercises on network reconnaissance. The lab instructions for DNS enumeration explicitly guide students to use nslookup

set the server

and then use the ls -d command to attempt a zone transfer and list all hostnames.

Source: University of Washington

Paul G. Allen School of Computer Science & Engineering

CSE 484

Lab 1: "Network Reconnaissance & Security Auditing

" DNS Enumeration section.

3. Purdue University

CS 42600: Computer Security

Lecture Notes. Course materials on network security often cover DNS vulnerabilities. Lecture notes describe DNS zone transfers as a method for reconnaissance and identify nslookup with the ls -d command as a primary tool for attempting this on Windows systems.

Source: Purdue University

Department of Computer Science

CS 42600

Lecture notes on "Network Security

" DNS Security section.

The statement is incorrect. In the Domain Name System (DNS), the priority for a Mail Exchanger (MX) record is determined by a preference number, where a lower numerical value indicates a higher priority. When a mail transfer agent (MTA) looks up the MX records for a domain to deliver an email, it will attempt to connect to the mail server with the lowest preference number first. If that server is unavailable, it will then try the server with the next-lowest preference number, and so on.

The statement "MX record priority increases as the number increases" is the direct opposite of how the protocol is defined and implemented. A higher preference number signifies a lower priority and is typically assigned to backup or secondary mail servers that should only be used if the primary servers (with lower numbers) are unreachable.

1. Internet Engineering Task Force (IETF) RFC 5321

"Simple Mail Transfer Protocol"

Section 5.1: This document

which obsoletes the earlier RFC 2821

defines the standard for SMTP. It states

"The MX mechanism provides a way to rank mail servers... A mail server with a lower preference number is said to be 'more preferred' or 'of higher priority'."

2. Internet Engineering Task Force (IETF) RFC 1035

"Domain Names - Implementation and Specification"

Section 3.3.9: This is the foundational document for DNS. In defining the MX record data format

it specifies a 16-bit integer for preference and states: "A 16 bit integer which specifies the preference given to this RR [Resource Record] among others at the same owner. Lower values are preferred."

3. University of California

Berkeley

EECS Courseware

"CS 168

Introduction to the Internet: Architecture and Protocols"

Lecture 16: Naming (DNS): Course materials for foundational networking classes at reputable universities consistently describe this behavior. Lecture notes explain that the MX record includes a preference field

and mailers must try the server with the lowest preference value first. This is a standard and fundamental concept of DNS operation for mail routing.

IoTSeeker is an open-source tool specifically designed to perform network scans to discover various types of Internet of Things (IoT) devices. Its primary function is to test whether these discovered devices are still using their default, factory-set credentials. This aligns perfectly with the scenario where John, the hacker, is using an automated tool to find IoT devices on the CyberSol Inc. network that are vulnerable due to default credentials. The tool's purpose is explicitly for security auditing and penetration testing of IoT devices.

B. IoT Inspector: This is a tool primarily for end-users to monitor their own network, analyzing traffic from their IoT devices to identify potential privacy and security risks, not for offensive scanning of external networks.

C. AT&T IoT Platform: This is a commercial, cloud-based service offered by AT&T for businesses to manage, connect, and scale their own IoT deployments. It is a management platform, not a hacking tool.

D. Azure IoT Central: This is a Microsoft cloud service (aPaaS) that enables users to build, manage, and maintain commercial-grade IoT solutions. It is a development and management platform, not a security scanning tool.

1. Bamakan

S. M. H.

Moghaddam

M.

& Niyato

D. (2020). Scanning the Scanners: A Survey of Tools for Discovering Vulnerable IoT Devices. IEEE Communications Surveys & Tutorials

22(1)

536-563. In Table IV on page 545

IoTSeeker is listed with the description: "Detects specific IoT devices and checks for default credentials." DOI: https://doi.org/10.1109/COMST.2019.2945518

2. Sharma

S.

& Gupta

M. (2020). A Review on IoT Security Tools. 2020 4th International Conference on Intelligent Computing and Control Systems (ICICCS)

1118-1123. The paper describes IoTSeeker as a tool that "scans a network for specific types of IoT devices to detect if they are using the default

factory-set credentials." DOI: https://doi.org/10.1109/ICICCS48265.2020.9121049

3. Hassan

W. H. (2019). Current research on Internet of Things (IoT) security: A survey. Computer Networks

148

283-294. This survey discusses vulnerabilities in IoT

including default credentials

and mentions tools used to discover such weaknesses

categorizing tools like IoTSeeker as scanners for identifying misconfigurations. DOI: https://doi.org/10.1016/j.comnet.2018.11.025

The network address is 10.1.4.0 with a /23 CIDR notation, which corresponds to a subnet mask of 255.255.254.0. This subnet includes all IP addresses from 10.1.4.0 to 10.1.5.255. The range of usable host addresses is 10.1.4.1 to 10.1.5.254.

The DHCP server is configured to lease the last 100 usable IP addresses. To find this range, we start from the last usable address (10.1.5.254) and count back 100 addresses. This defines the DHCP lease pool as 10.1.5.155 to 10.1.5.254. From the options provided, only 10.1.5.200 falls within this specific range.

A. 210.1.55.200: This is a public IP address and is not part of the specified 10.0.0.0/8 private network range.

B. 10.1.4.254: This address is valid within the subnet but is not part of the configured DHCP scope for the last 100 usable IPs.

D. 10.1.4.156: This address is valid within the subnet but is not part of the configured DHCP scope for the last 100 usable IPs.

1. Postel

J.

& Mogul

J. (1985). RFC 950: Internet Standard Subnetting Procedure. IETF. Section 2.1 details the interpretation of IP addresses with subnet masks to determine network and host portions.

2. Rekhter

Y.

Moskowitz

B.

Karrenberg

D.

de Groot

G. J.

& Lear

E. (1996). RFC 1918: Address Allocation for Private Internets. IETF. Section 3 specifies the 10.0.0.0/8 private address block.

3. Droms

R. (1997). RFC 2131: Dynamic Host Configuration Protocol. IETF. Section 2.2 discusses the allocation mechanism where a server selects an address from a pool of available addresses for a client.

4. Dordal

P. L. (2019). An Introduction to Computer Networks. Loyola University Chicago

Department of Computer Science. Chapter 9.3

"IP Subnets

" pp. 325-330. This university text explains the calculation of subnet ranges

network addresses

and broadcast addresses.

This technique is known as a fragmented packet scan. It deliberately splits the TCP header of a probe packet (e.g., a SYN or FIN packet) across multiple, smaller IP fragments. The objective is to evade detection by simple packet-filtering firewalls or older Intrusion Detection Systems (IDS). These security devices may only inspect the first fragment of a packet stream for rule matching. Since the TCP flags and port numbers are in subsequent fragments, the device fails to identify the scan's nature and may allow the packets to pass. The target host reassembles the fragments and processes the complete TCP packet, sending a response that reveals the port's state to the attacker.

A. ACK flag probe scanning: This scan sends TCP packets with only the ACK flag set to map firewall rules; it does not inherently rely on fragmentation for evasion.

B. ICMP Echo scanning: This is a "ping scan" that uses the ICMP protocol, not TCP. It does not involve splitting TCP headers.

D. IPID scanning: This is an advanced idle scan that uses a third-party "zombie" host to infer port states by observing IPID sequence changes, not by fragmenting packets.

1. Official Vendor Documentation (Nmap): The Nmap Reference Guide

a tool central to ethical hacking

explicitly describes this technique with its -f option. It states

"The -f option causes the requested scan...to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters

intrusion detection systems

and other annoyances to detect what you are doing."

Source: Nmap Reference Guide

Section: "Firewall/IDS Evasion and Spoofing".

2. Academic Publication: The foundational paper on IDS evasion techniques discusses fragmentation as a primary method for bypassing network security controls. The authors explain how attackers can exploit the reassembly policies of end hosts versus the IDS.

Source: Ptacek

T. H.

& Newsham

T. N. (1998). Insertion

Evasion

and Denial of Service: Eluding Network Intrusion Detection. Secure Networks

Inc. Section 3.2

"Fragmentation."

3. University Courseware: Reputable computer science programs cover fragmentation as a classic network security evasion technique. Lecture materials explain how splitting headers across fragments can bypass stateless firewalls that do not perform full packet reassembly.

Source: University of California

Berkeley. CS 161: Computer Security. Lecture 14

"Network Security

" slide on "Evasion."

Cloud-based detection is an antivirus technique where threat analysis is offloaded from the end-user's system to the provider's cloud infrastructure. This model involves a lightweight agent on the protected system that collects data (e.g., file hashes, metadata, suspicious behaviors) and sends it to the cloud. The provider's environment then analyzes this data, often correlating information from millions of other protected systems to identify and respond to new threats rapidly. This perfectly matches the question's description of collecting data from multiple systems and performing analysis in the provider's environment rather than locally.

A. Behavioral based: This technique focuses on the actions and behavior of a program to determine if it is malicious, not on the location where the analysis is performed.

B. Heuristics based: This method uses algorithms and rules to detect potential malware based on suspicious characteristics. Its defining feature is the analytical approach, not the environment.

C. Honeypot based: This is a security mechanism that uses a decoy system to lure and study attackers. It is a threat intelligence tool, not a detection technique used on production endpoints.

1. Vinod

P. S.

Jaidhar

C. D.

& Latha

B. (2019). A Survey on Malware Detection Methods. In Proceedings of the 3rd International Conference on Computing and Communications Technologies (ICCCT). IEEE. (DOI: https://doi.org/10.1109/ICCCT2.2019.8824938). On page 2

Section III-D

the paper states

"Cloud-based scanners move malware detection from the user’s computer to the cloud... The client on the user’s computer gathers data about the files and sends it to the cloud for analysis."

2. Ussath

M.

Jaeger

D.

& F. Cheng. (2016). A Survey of Malware-Detection Methods. Hasso-Plattner-Institut

University of Potsdam

Technical Reports in Computer Science

No. 106. On page 10

Section 2.4

it describes cloud-based detection: "Instead of performing the analysis on the client

a small agent collects information about executable files and sends it to the cloud provider... The provider analyzes the data and returns a result."

3. Al-Ameen

M. A.

& Maarof

M. A. (2014). A Survey on Cloud Based Antivirus Systems. International Journal of Computer Applications

99(17)

1-6. The abstract and introduction state

"The main idea of cloud based antivirus is to move the heavy tasks of the antivirus from the client side to the server side (cloud)... It depends on collecting information from protected computers."

The scenario describes a short-range (10-100 m), low-power, low-data-rate wireless communication protocol used for infrequent data transfer in industrial systems. The most critical detail is that the protocol is based on the IEEE 802.15.4 standard. Zigbee is a high-level communication protocol suite whose physical (PHY) and media access control (MAC) layers are defined by the IEEE 802.15.4 standard. It is specifically designed for wireless personal area networks (WPANs) and is widely used in IoT and industrial control systems, fitting all the characteristics mentioned in the question.

A. MQTT: This is an application-layer (OSI Layer 7) messaging protocol that runs over TCP/IP; it is not a wireless communication standard based on IEEE 802.15.4.

B. LPWAN: This is a broad category of long-range technologies (e.g., LoRaWAN), not a specific protocol. Its typical range is kilometers, far exceeding the 10-100 m specified.

D. NB-IoT: This is a cellular-based Low-Power Wide-Area Network (LPWAN) technology standardized by 3GPP. It is not based on IEEE 802.15.4 and is designed for long-range communication.

1. National Institute of Standards and Technology (NIST). (2019). NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks. U.S. Department of Commerce. In Section 3.2.1

"Short-Range Wireless

" the document states

"Zigbee is a specification for a suite of high-level communication protocols using small

low-power digital radios based on the IEEE 802.15.4 standard for wireless personal area networks (WPANs)." (Page 13).

2. Gungor

V. C.

& Hancke

G. P. (2009). Industrial Wireless Sensor Networks: Challenges

Design Principles

and Technical Approaches. IEEE Transactions on Industrial Electronics

56(10)

4258–4265. https://doi.org/10.1109/TIE.2009.2015754. This paper discusses communication standards for industrial environments

stating

"The IEEE 802.15.4 standard is the basis for several WSN protocol stacks

such as ZigBee... It is designed for low-cost and low-power WSNs with a typical transmission range of 10–100 m." (Section III.A

Page 4260).

3. Farahani

S. (2008). ZigBee Wireless Networks and Transceivers. Newnes. The book's introduction clarifies

"ZigBee is a standard for a suite of high level communication protocols using small

low-power digital radios based on the IEEE 802.15.4 standard for Low-Rate Wireless Personal Area Networks (LR-WPANs)." (Chapter 1

Page 1).

Wired Equivalent Privacy (WEP) is a deprecated security protocol with well-documented cryptographic vulnerabilities, including a flawed implementation of the RC4 stream cipher and the use of a short, static initialization vector (IV). These weaknesses allow attackers to recover the secret key and decrypt traffic with relative ease. The recommended and industry-standard replacement is Wi-Fi Protected Access 2 (WPA2) utilizing the Advanced Encryption Standard (AES) with Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP). WPA2-AES provides robust data confidentiality, integrity, and authentication, effectively mitigating the risks associated with WEP and securing the wireless network against modern threats.

A. MAC address filtering is an access control mechanism, not an encryption protocol, and is easily bypassed by attackers spoofing a permitted MAC address.

C. Open System authentication provides no authentication, allowing any device to connect. This is a significant security downgrade, not an enhancement.

D. SSID broadcast disabling is a weak security-by-obscurity measure that only hides the network name from casual scans; it does not encrypt data.

1. National Institute of Standards and Technology (NIST). (2012). Guidelines for Securing Wireless Local Area Networks (WLANs) (Special Publication 800-153). Section 3.1

"WLAN Security Protocols

" states

"WEP is a deprecated IEEE 802.11 security protocol... WEP has been found to be vulnerable to several attacks that can be executed with publicly available tools. Therefore

WEP should not be used." Section 4.2.1 recommends using WPA2.

2. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 18

"Wireless Network Security

" details the vulnerabilities of WEP and describes WPA2 with AES-CCMP as the robust and recommended security solution for IEEE 802.11 networks. (This is a standard university textbook).

3. He

C.

& Mitchell

J. C. (2004). Security Analysis and Improvements for IEEE 802.11i. Stanford University Technical Report. This report

foundational to the development of WPA2

analyzes the weaknesses of prior protocols like WEP and details the security properties of the CCMP protocol (used with AES in WPA2) as the secure replacement. Available via Stanford's digital repository.

The provided string alert tcp any any -> 192.168.100.0/24 21 (msg: ““FTP on the network!””;) is a classic example of a rule for a Network Intrusion Detection System (NIDS), specifically in the format used by Snort and Suricata. The rule's components are standard for an IDS: an action (alert), protocol (tcp), source and destination IP/port, a direction operator (->), and rule options that include a descriptive message (msg). The purpose of this rule is to detect TCP traffic destined for the FTP port (21) on a specific subnet and generate an alert, which is the primary function of an IDS.

A. A firewall IPTable: iptables rules use a different syntax, employing flags like -A (append), -p (protocol), and -j (jump) with targets such as ACCEPT or DROP.

B. FTP Server rule: FTP server configuration files define server behavior, user access, and directory permissions, not network traffic inspection rules in this format.

C. A Router IPTable: Router configurations, such as Cisco Access Control Lists (ACLs) or iptables on Linux-based routers, use a distinct and different syntax to permit or deny traffic.

1. Snort 3 Users Manual: The official documentation for Snort

a widely-used IDS

specifies the rule syntax. The "Rule Headers" section details the structure: Action Protocol SrcIP SrcPort Direction DstIP DstPort (Options). The question's rule perfectly matches this documented format. (Source: Snort.org

Snort 3 Users Manual

Chapter 4: Rules

Section 4.1: Rule Headers).

2. University of Virginia

CS 4457: Computer Networks Courseware: Lecture slides on "Network Security" explicitly show examples of Snort rules. Slide 23 presents the "Anatomy of a Snort Rule

" which is identical to the structure in the question

contrasting it with firewall rules. (Source: University of Virginia

School of Engineering and Applied Science

CS 4457

Lecture 23: Network Security

Slide 23).

3. Linux iptables Man Page: The official manual page for iptables provides the authoritative syntax for its rules. The format is iptables [-t table] {-A|-C|-D} chain rule-specification

which is structurally different from the rule provided in the question. (Source: iptables(8) — Linux manual page).

The Presentation Layer (Layer 6) of the OSI model is responsible for the formatting, translation, and syntax of data for the application layer. Its primary functions include character code translation, data compression, and, most relevant to this question, data encryption and decryption. When User A uses PKI to encrypt an email message, the encryption process transforms the application data (the email content) into a secure format. This transformation is a classic Presentation Layer service, ensuring the data is protected before being passed down the stack for transmission and can be correctly decrypted and presented to User B's application.

A. Application: The application layer (e.g., the email client) generates the message content but delegates the task of data formatting and encryption to the Presentation Layer.

B. Transport: This layer secures the entire communication channel (e.g., using TLS) but does not perform encryption on the specific message data itself, as described in the scenario.

C. Session: This layer is responsible for establishing, managing, and terminating communication sessions between applications, not for handling the syntax or encryption of the data.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 1

Section 1.5.1

"The OSI Model

" the text states

"The presentation layer is to provide services that allow communicating applications to interpret the meaning of the data exchanged. These services include data compression and data encryption."

2. Stallings

W. (2017). Data and Computer Communications (10th ed.). Pearson. In Chapter 2

Section 2.2

"The OSI Model

" the Presentation Layer is defined as being responsible for formatting and code conversion

with encryption being a key service provided at this layer.

3. ISO/IEC 7498-1:1994

"Information technology -- Open Systems Interconnection -- Basic Reference Model: The Basic Model". Section 7.2.1

"Purpose

" describes the Presentation Layer's role in managing the representation of information

which includes applying transformations like encryption to the data syntax used by applications.

4. Comer

D. E. (2018). Computer Networks and Internets (6th ed.). Pearson. In Chapter 11

"Network Layering Principles And The Osi 7-layer Model

" the text specifies that the Presentation Layer handles data representation issues

explicitly listing encryption as one of its functions.

The Security Identifier (SID) S-1-5-21-1223352397-1872883824-861252104-501 ends with the Relative Identifier (RID) 501. According to Microsoft's official documentation, the RID 501 corresponds to the built-in Guest account, which has severely restricted privileges. To gain "full administrator access," which is typically associated with the Administrator account (RID 500) or membership in the Administrators group, Matthew must elevate his current low-level permissions. This process of transitioning from a low-privilege account to a high-privilege account is known as privilege escalation.

B. He needs to disable antivirus protection.

Disabling antivirus is a common post-exploitation step to maintain access and avoid detection, but it does not grant administrative privileges itself.

C. He needs to gain physical access.

Physical access is one vector for privilege escalation but is not a strict requirement. Many privilege escalation techniques can be performed remotely via software vulnerabilities.

D. He already has admin privileges, as shown by the “501” at the end of the SID.

This is factually incorrect. The RID for the built-in Administrator account is 500. The RID 501 identifies the built-in Guest account.

---

1. Microsoft Corporation. (2023). Well-known SIDs. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/well-known-security-identifiers-in-windows-operating-systems.

Reference Specifics: In the section "Well-known RIDs

" the document explicitly lists DOMAINUSERRIDGUEST with a relative ID of 501 ("A user account for guests of the domain") and DOMAINUSERRIDADMIN with a relative ID of 500 ("The administrative user account in a domain"). This directly confirms that the SID in the question belongs to a Guest account

not an Administrator.

2. MITRE. (2023). ATT&CK Tactic TA0004: Privilege Escalation. The MITRE Corporation. Retrieved from https://attack.mitre.org/tactics/TA0004/.

Reference Specifics: The MITRE ATT&CK framework

a globally recognized knowledge base of adversary tactics

defines Privilege Escalation as "the result of actions that allow an adversary to obtain a higher level of permissions on a system or network." This definition directly applies to Matthew's situation

where he must move from a low-privilege Guest account to an administrative one.

3. Pfleeger

C. P.

& Pfleeger

S. L. (2003). Security in Computing (3rd ed.). Prentice Hall.

Reference Specifics: Chapter 4

"Programs and Programming

" section on "Gaining Privileges

" discusses how malicious code often seeks to "obtain privileges to which it is not entitled." The text explains that a program running with the privileges of a normal user (or in this case

a guest) must exploit a system flaw to gain the privileges of a more powerful user

such as an administrator. This academic text establishes the fundamental concept of privilege escalation.

Social engineering is fundamentally a low-tech attack method because it exploits human psychology, trust, and gullibility rather than complex technical vulnerabilities. The primary attack vector is the human element. Attackers manipulate individuals into divulging sensitive information or performing actions that compromise security. Classic examples, such as impersonation over the phone, pretexting, or tailgating to enter a secure facility, require minimal to no advanced technology, making it a quintessential low-tech way to gain unauthorized access.

B. Eavesdropping: While simple shoulder surfing is a low-tech form, eavesdropping in a modern cybersecurity context often implies technical interception of electronic or network communications, which is not low-tech.

C. Scanning: This is an inherently technical reconnaissance method that requires specific software tools (e.g., Nmap) to actively probe networks and systems for open ports, services, and vulnerabilities.

D. Sniffing: This is a technical method requiring specialized software (e.g., Wireshark) and hardware to passively capture, decode, and analyze data packets traversing a network.

1. Bishop

M. (2003). Computer Security: Art and Science. Addison-Wesley Professional. In Chapter 1

Section 1.2.3

"Methods of Attack

" the text distinguishes between attacks that exploit hardware or software and those that exploit human practices. Social engineering is presented as a primary example of the latter

non-technical category.

2. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 1

Section 1.3

"Methods of Defense

" discusses threats and categorizes social engineering as a non-computer-based attack that involves tricking or persuading an authorized user.

3. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. Chapter 17

"Human Factors

" is dedicated to non-technical attacks

with Section 17.1

"Social Engineering

" defining it as a technique to trick people

contrasting it with purely technical hacking methods.

4. University of California

Berkeley. (2020). CS 161: Computer Security

Lecture 1: Introduction and Threat Models. The lecture notes differentiate between technical attacks on systems and attacks that target the human component

identifying social engineering as the key example of exploiting human fallibility. (Specific lecture materials available via course websites).

A false positive occurs when an Intrusion Detection System (IDS) incorrectly flags legitimate, benign network traffic or user activity as malicious. In this scenario, the system administrator was performing an authorized and routine task: updating the router's configuration. The IDS, however, misidentified this legitimate administrative action as a potential threat and generated an alert. Since the activity was not an actual attack, but the system generated an alert, it is classified as a false positive. This type of event is common in IDS/IPS tuning, where rules must be refined to distinguish between normal administrative behavior and genuine attacks.

A. False negative: This is the failure of an IDS to detect a real attack. The described event was a legitimate action, not an attack.

B. True negative: This occurs when an IDS correctly identifies benign traffic and does not generate an alert. Here, an alert was generated.

C. True positive: This is the correct identification of a genuine attack. The administrator's action was authorized and not an attack.

1. National Institute of Standards and Technology (NIST) Special Publication 800-94

Guide to Intrusion Detection and Prevention Systems (IDPS)

Revision 1

February 2012.

Section 2.2.2

"IDPS Accuracy

" Page 2-4: Defines a false positive as "Alerts that indicate malicious activity is occurring

but are not caused by actual malicious activity." This directly corresponds to the scenario where a legitimate administrative action triggered an alert.

2. Khraisat

A.

Gondal

I.

Vamplew

P.

& Kamruzzaman

J. (2019). A Survey of Intrusion Detection Systems: Techniques

Datasets and Challenges. Cybersecurity

2(1)

20.

Section "Performance Metrics

" Paragraph 2: The paper defines a False Positive (FP) as "a normal or irrelevant activity that is incorrectly classified as an attack." This aligns with the IDS misclassifying the administrator's legitimate router update.

DOI: https://doi.org/10.1186/s42400-019-0038-7

3. Saltzer

J. H.

& Kaashoek

M. F. (2009). Principles of Computer System Design: An Introduction. MIT OpenCourseWare

Massachusetts Institute of Technology.

Chapter 10

"Security and Protection

" Section 10.5.2

"Intrusion Detection": University courseware on system security design consistently defines these four outcomes (TP

FP

TN

FN) as the fundamental metrics for evaluating any detection system. A false positive is universally described as a "false alarm

" where the system signals an intrusion that has not actually occurred

matching the question's scenario.

A Wireless Intrusion Prevention System (WIPS) is a network security device that specifically monitors the radio spectrum for the presence of unauthorized or rogue access points (APs) and other wireless threats. WIPS solutions actively scan all Wi-Fi channels to detect devices that are not authorized to be on the network. Upon detection, they can use techniques like RF triangulation and signal strength analysis to help administrators physically locate the rogue device. They can also take automated preventative measures, such as sending de-authentication packets to clients connected to the rogue AP, effectively containing the threat.

A. HIDS: A Host-based Intrusion Detection System operates on an individual computer or device, not on the network, and cannot scan the wireless spectrum for rogue APs.

B. WISS: Wireless Intrusion Sniffing System (WISS) is not a standard industry-recognized acronym for a type of security system; it is a distractor.

D. NIDS: A Network Intrusion Detection System monitors traffic on the wired network. While it might detect suspicious traffic originating from a rogue AP, it cannot actively scan radio frequencies to discover or locate it.

1. Sargolzaei

S.

et al. (2013). "Wireless Intrusion Detection Systems: A Survey." International Journal of Computer Networks & Communications (IJCNC)

Vol. 5

No. 6. This paper discusses WIDS/WIPS capabilities

stating

"A WIDS can detect rogue access points... WIPSs have the ability to prevent the threat from happening." (Section 3

p. 157).

2. Pescitelli

F.

et al. (2022). "A Survey on Wireless Security: Technical Challenges

Recent Advances

and Future Trends." IEEE Access

Vol. 10

pp. 37316-37347. The survey explains that WIPS are designed to "detect and prevent intrusions in wireless networks

such as rogue APs

evil twins

and DoS attacks." (Section IV-A

p. 37323). DOI: https://doi.org/10.1109/ACCESS.2022.3161352

3. Kim

K.

et al. (2007). "A Rogue Access Point Detection Scheme using a Hierarchical Architecture." In Information Security and Cryptology - ICISC 2006. Lecture Notes in Computer Science

vol 4296. Springer

Berlin

Heidelberg. The paper explicitly contrasts different systems

noting that while NIDS and HIDS are essential

"they are not suitable for detecting rogue APs

" establishing the need for specialized wireless monitoring systems like WIPS. (Introduction

p. 174). DOI: https://doi.org/10.1007/978-3-540-68912-713

A service-based solution, typically offered by a third-party auditing firm or a Managed Security Service Provider (MSSP), is the most suitable choice. This model inherently provides an external perspective ("imitates the outside view of attackers") by scanning the organization's assets from the internet. These providers use enterprise-grade scanning tools that are continuously updated with the latest vulnerability information and employ advanced techniques like inference-based testing. They are designed to manage scans across multiple, geographically dispersed networks, fulfilling all the requirements stated by the e-commerce organization. The third party manages the entire assessment infrastructure, process, and reporting.

A. Inference-based assessment solution: This describes a specific testing technique used by scanning tools to deduce information, not a comprehensive solution type.

C. Tree-based assessment approach: This is a manual methodology for systematically testing network paths and components, not an automated, database-driven solution.

D. Product-based solution installed on a private network: This type of solution provides an internal perspective by default and would not accurately imitate an external attacker's view.

---

1. EC-Council. (2023). Certified Ethical Hacker (CEH) Version 13 Courseware

Module 06

"Vulnerability Analysis."

The official CEH v13 curriculum distinguishes between vulnerability assessment solutions. It describes service-based solutions as being performed by a third party from a remote location

providing an independent

outside-in perspective of the network. It explicitly contrasts this with product-based solutions

which are installed internally and provide an inside-out view. The text also identifies tree-based assessment as a manual methodology and inference-based testing as a feature of scanning logic.

2. Kim

D.

& Solomon

M. G. (2021). Fundamentals of Information Systems Security (4th ed.). Jones & Bartlett Learning.

Chapter 10

"Vulnerability Assessment and Penetration Testing

" discusses the different models for conducting assessments. It explains that engaging external security consultants (a service-based model) is a common practice for obtaining an objective

external view of an organization's security posture

which is critical for internet-facing entities like e-commerce companies.

3. Scarfone

K.

& Mell

P. (2008). Technical Guide to Information Security Testing and Assessment (NIST SP 800-115). National Institute of Standards and Technology.

Section 4.3

"Assessment Methods

" outlines various approaches. While not using the exact CEH terminology

it differentiates between assessments performed by internal staff using on-premises tools versus those conducted by external

independent parties. It notes that external assessments are crucial for understanding the exposure of publicly accessible systems

aligning with the requirements for a service-based solution.