rocess identity and its network activity, which is exactly what the scenario requires.","domainId":"646be576-c9ff-4844-a6c7-f02547067f85","difficulty":"hard","questionType":"multi_select","pbqConfig":null,"exhibitText":null,"options":[{"id":"27e8e5c6-77fb-4fac-ab56-9fa015733435","label":null,"text":"volatility -f memory.dmp netscan","isCorrect":true},{"id":"2fd31ecb-a4ec-443c-b8ce-cd3c22f9f252","label":null,"text":"volatility -f memory.dmp pslist","isCorrect":true},{"id":"7363c853-0e25-42e8-8dfb-e00aabc88218","label":null,"text":"volatility -f memory.dmp procdump","isCorrect":false},{"id":"2d2668ab-21c3-43be-994f-620ffc43587b","label":null,"text":"volatility -f memory.dmp svcscan","isCorrect":false},{"id":"f219108e-65b3-41a2-be02-9dc0f863c095","label":null,"text":"volatility -f memory.dmp malfind","isCorrect":false}],"domainName":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware"},{"id":"19694aae-69fb-4777-b756-e8a8756c1ec4","slug":"which-of-the-following-tools-is-specifically-designed-for-ar-e8nzd","questionText":"Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?","explanation":"Ettercap is specifically designed for ARP poisoning and man-in-the-middle (MITM) attacks on a local network. It exploits the Address Resolution Protocol (ARP) by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host, thereby intercepting traffic between two hosts on the same subnet.","domainId":"94578746-6587-4984-bb49-46dd43017140","difficulty":"easy","questionType":"multiple_choice","pbqConfig":null,"exhibitText":null,"options":[{"id":"22e08005-9c6b-4b45-aa74-1bd4832606ed","label":null,"text":"Nmap","isCorrect":false},{"id":"5fd53c13-0ae8-48a8-a9f9-f1f2e64ec565","label":null,"text":"Wireshark","isCorrect":false},{"id":"5a4a48b5-4373-42c9-96cd-1b10705bb064","label":null,"text":"Metasploit","isCorrect":false},{"id":"9cbea045-ef0e-4a22-9b9e-40981945a539","label":null,"text":"Ettercap","isCorrect":true}],"domainName":"Malware, Social Engineering and Network Attacks","domainSlug":"ceh-malware-social-network"},{"id":"33521746-4bf1-49ea-9891-cf5208f10613","slug":"refer-to-the-exhibit-a-penetration-tester-sends-a-soap-requ-ex-ku2u","questionText":"Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?","explanation":"The SOAP service returns multiple user records in response to a crafted request, indicating that the input is being interpolated into a database query without proper sanitization. This is classic SQL injection (SQLi) in a SOAP XML context, where an attacker can embed SQL payloads within XML elements (e.g., admin' OR '1'='1) to manipulate the backend SQL query and retrieve all records.","domainId":"69a1e04b-10ae-4ef6-8328-781216e49629","difficulty":"hard","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"\n\n \n \n 1 OR 1=1\n \n \n\n\nResponse:\n\n \n \n \n 1\n admin\n admin@test.com\n \n \n 2\n user\n user@test.com\n \n \n \n","options":[{"id":"0a3f4a0a-38fc-4003-b0ae-0af2417a7a7d","label":null,"text":"SQL injection in SOAP service","isCorrect":true},{"id":"c75dc241-b9cb-4a14-a9df-2f02fa1f527b","label":null,"text":"XML External Entity (XXE) injection","isCorrect":false},{"id":"47239ba4-7a7c-4c5e-b27f-20779e7a548b","label":null,"text":"Cross-site scripting (XSS)","isCorrect":false},{"id":"44f44293-27f2-4c69-bdff-6829ac61f626","label":null,"text":"Command injection","isCorrect":false}],"domainNa