Score Higher on Verified 312-50v13 | Certified Ethical Hacker Exam (CEHv13) Exam Questions with Answers

The correct answer is C. Sherlock.

Sherlock is used to search for a username across many social networking and online platforms. Its primary purpose is cross-platform username correlation. It does not natively provide geolocation tracking like Creepy, and it does not provide relationship-graph visualization like Maltego.

CEH-aligned reconnaissance material describes Maltego as a tool that gathers information from different sources and represents relationships through graph-based analysis . Another reference explains that OSINT username-correlation tools can verify whether a username or profile exists across hundreds of platforms . Sherlock matches that username-correlation function.

Option A. Maltego is incorrect because Maltego is used for relationship graphing and visual investigation.

Option B. Creepy is incorrect because Creepy is associated with geolocation intelligence from social media and image metadata.

Option D. Social Searcher is incorrect because it is mainly used for searching and monitoring social media content, not broad username enumeration across hundreds of sites.

Option C. Sherlock is correct because it specializes in checking whether a username exists across many online platforms.

Therefore, the best answer is C. Sherlock.

In CEH’s web application and mobile security modules, improper session management is defined as a failure to enforce session expiration, token invalidation, or secure session lifecycle controls. When an application does not invalidate a session token after logout, attackers can exploit this by performing a replay attack: reusing previously captured session identifiers to impersonate the user and gain unauthorized access. CEH teaches that replaying a live token is the simplest and most direct exploitation method because it does not require guessing or stealing new tokens—the attacker simply reuses a valid one that should have been invalidated. CSRF relies on exploiting a user’s active session and is not required when the attacker already possesses a reusable token. Brute-forcing session tokens is computationally expensive and unnecessary. SQL injection is unrelated to session lifecycle flaws unless token storage is directly exposed. Therefore, a replay attack is the correct exploitation method.

The correct answer is C. MAC Flooding.

The scenario describes a switched network beginning to behave like a hub, with frames appearing across multiple switch ports. This happens when the switch’s CAM table is overwhelmed with many fake MAC address entries. Once the CAM table cannot reliably map destination MAC addresses to ports, the switch floods traffic out multiple ports.

CEH sniffing material explains that MAC flooding sends random MAC addresses mapped with random IP addresses to overflow the CAM table. When the CAM table is full, the switch acts like a hub and broadcasts packets to all ports, helping the attacker sniff packets more easily . Another CEH-aligned exam guide states that MAC flooding sends so many MAC addresses to the CAM table that it cannot keep up, effectively turning the switch into a hub .

Option A. Switch Port Stealing is incorrect because switch port stealing targets a specific victim MAC-to-port mapping through a race condition.

Option B. ARP Poisoning is incorrect because ARP poisoning manipulates ARP caches to redirect traffic through the attacker.

Option D. DNS Poisoning is incorrect because DNS poisoning manipulates name resolution, not switch forwarding behavior.

Therefore, the best answer is C. MAC Flooding.