312-50v13 Exam Dumps : Certified Ethical Hacker Exam (CEHv13)

In OT hacking methodology, once exposed industrial assets have been identified, the next logical step—before attempting exploitation—is to actively assess those assets for weaknesses. The scenario states the tester is “actively probing controllers, services, and interfaces to identify exploitable weaknesses” and explicitly confirms that no exploitation attempts or persistence mechanisms have occurred. That combination maps most closely to the Vulnerability Scanning phase.

Vulnerability scanning in OT contexts includes carefully enumerating and assessing industrial components such as PLCs, HMIs, historians, engineering workstations, and industrial gateways. The goal is to discover issues like outdated firmware, insecure services, weak authentication, exposed management interfaces, misconfigurations, and known CVEs affecting industrial protocols or device web consoles. “Actively probing” is an important clue: information gathering can be passive (asset inventories, diagrams, OSINT, passive network visibility), but scanning moves into active interaction with hosts and services to identify vulnerabilities—still short of exploitation.

The other answer choices do not align with the described boundaries. Gain Remote Access implies initial compromise or establishing access paths (e.g., leveraging credentials, remote services, or exploits) and is a later step once weaknesses are identified and selected. Launch Attacks is even further along, where exploitation or disruption actions occur. Information Gathering would fit earlier when the tester is identifying assets and collecting details with minimal interaction; however, the scenario says that stage is already past (“has already identified exposed industrial assets”) and that the tester is now probing for exploitable weaknesses.

Therefore, the current phase is D. Vulnerability Scanning.

The firewall described is doing more than simple header checks: it is validating session state and also performing some application-level analysis. That combination is characteristic of a Stateful Multilayer Inspection Firewall. This firewall type expands beyond traditional packet filtering by tracking the state of network connections (e.g., TCP handshake progression, established sessions, expected flags and sequence behavior) and applying inspection across multiple OSI layers. Because it understands whether traffic belongs to a legitimate, established session, it can block many spoofed or out-of-context packets that might pass a stateless filter.

The mention of being harder to bypass with fragmentation or tunneling attacks further supports this. Stateless packet-filtering firewalls mainly rely on source/destination IP, port, and protocol fields. Attackers may attempt fragmentation to split payloads across packets and evade simplistic inspection, or use tunneling to encapsulate traffic to hide prohibited content. A stateful multilayer firewall, by maintaining connection tables and reassembling or correlating traffic with session context, is better equipped to detect anomalies that do not align with valid session behavior and to apply deeper inspection policies.

Why the other choices are less fitting:

A Packet Filtering Firewall (A) focuses on basic header fields and is typically stateless, matching the opposite of what Mia observed.

An Application-Level Firewall (C) (proxy firewall) can do deep application inspection, but the scenario emphasizes a multilayer approach combining state tracking with application-level checks—more aligned with stateful multilayer inspection than a pure application proxy model.

A Circuit-Level Gateway Firewall (D) validates session establishment (e.g., TCP handshakes) and creates virtual circuits, but it generally does not perform meaningful application-level analysis of the content.

Therefore, the best match is B. Stateful Multilayer Inspection Firewall.

CEH’s SQL Injection coverage distinguishes between classic (error-based), union-based, boolean-based blind, and time-based blind SQL injection. Time-based blind SQL injection is used when the application does not return database errors or query results to the attacker (no visible output), but the attacker can infer execution behavior by measuring response delays.

A time-based payload intentionally triggers a database delay function (for example, SLEEP(), WAITFOR DELAY, pg_sleep() depending on DBMS). If the injection is successful, the page response time increases predictably, confirming that attacker-controlled SQL is being executed.

Option C is the correct time-based blind probe because it uses conditional logic (IF(1=1, SLEEP(5), 0)) to cause a measurable delay only when the injected condition evaluates true. CEH teaches that this technique is particularly effective against hardened applications that suppress errors and sanitize outputs, because timing becomes the side-channel for confirmation.

Option A and Option D are UNION-based payload patterns intended to extract data via returned result sets, which time-based blind scenarios typically do not provide. Option B is a classic authentication-bypass/boolean test; it can indicate injection but does not specifically validate time-based blind behavior when output is not observable.

CEH mitigation guidance includes parameterized queries, strict input validation, least-privilege DB accounts, WAF tuning, and centralized logging to detect anomalous query timing patterns.