EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 361:

  Neil is closely monitoring his firewall rules and logs on a regular basis. Some of the users have complained to Neil that there are a few employees who are visiting offensive web site during work hours, without any consideration for others. Neil knows that he has an up-to-date content filtering system and such access should not be authorized. What type of technique might be used by these offenders to access the Internet without restriction?

  A. They are using UDP that is always authorized at the firewall
  B. They are using an older version of Internet Explorer that allow them to bypass the proxy server
  C. They have been able to compromise the firewall, modify the rules, and give themselves proper access
  D. They are using tunneling software that allows them to communicate with protocols in a way it was not intended
  D. They are using tunneling software that allows them to communicate with protocols in a way it was not intended

  ---

  This can be accomplished by, for example, tunneling the http traffic over SSH if you have a SSH server answering to your connection, you enable dynamic forwarding in the ssh client and configure Internet Explorer to use a SOCKS Proxy for network traffic.

• Question 362:

  Which of the following attacks takes best advantage of an existing authenticated connection

  A. Spoofing
  B. Session Hijacking
  C. Password Sniffing
  D. Password Guessing
  B. Session Hijacking

  ---

  Session hijacking is the act of taking control of a user session after successfully obtaining or generating an authentication session ID. Session hijacking involves an attacker using captured, brute forced or reverse-engineered session IDs to seize control of a legitimate user's Web application session while that session is still in progress.

• Question 363:

  If you come across a sheepdip machaine at your client site, what would you infer?

  A. A sheepdip computer is used only for virus checking.
  B. A sheepdip computer is another name for honeypop.
  C. A sheepdip coordinates several honeypots.
  D. A sheepdip computer defers a denial of service attack.
  A. A sheepdip computer is used only for virus checking.

  ---

  Also known as a footbath, a sheepdip is the process of checking physical media, such as floppy disks or CD-ROMs, for viruses before they are used in a computer. Typically, a computer that sheepdips is used only for that process and nothing else and is isolated from the other computers, meaning it is not connected to the network. Most sheepdips use at least two different antivirus programs in order to increase effectiveness.

• Question 364:

  What is the IV key size used in WPA2?

  A. 32
  B. 24
  C. 16
  D. 48
  E. 128
  D. 48

• Question 365:

  Blane is a security analyst for a law firm. One of the lawyers needs to send out an email to a client but he wants to know if the email is forwarded on to any other recipients. The client is explicitly asked not to re-send the email since that would be a violation of the lawyer's and client's agreement for this particular case. What can Blane use to accomplish this?

  A. He can use a split-DNS service to ensure the email is not forwarded on.
  B. A service such as HTTrack would accomplish this.
  C. Blane could use MetaGoofil tracking tool.
  D. Blane can use a service such as ReadNotify tracking tool.
  D. Blane can use a service such as ReadNotify tracking tool.

• Question 366:

  This is an attack that takes advantage of a web site vulnerability in which the site displays content that includes un-sanitized user-provided data.

  See foobar

  What is this attack?

  A. Cross-site-scripting attack
  B. SQL Injection
  C. URL Traversal attack
  D. Buffer Overflow attack
  A. Cross-site-scripting attack

• Question 367:

  You establish a new Web browser connection to Google. Since a 3-way handshake is required for any TCP connection, the following actions will take place.

  

  Which of the following packets represent completion of the 3-way handshake?

  A. 4th packet
  B. 3rdpacket
  C. 6th packet
  D. 5th packet
  D. 5th packet

• Question 368:

  In an attempt to secure his 802.11b wireless network, Bob decides to use strategic antenna positioning. He places the antenna for the access point near the center of the building. For those access points near the outer edge of the building he uses semi-directional antennas that face towards the buildings center. There is a large parking lot and outlying filed surrounding the building that extends out half a mile around the building. Bob figures that with this and his placement of antennas, his wireless network will be safe from attack. Which of he following statements is true?

  A. Bob's network will not be safe until he also enables WEP
  B. With the 300-foot limit of a wireless signal, Bob's network is safe
  C. Bob's network will be sage but only if he doesn't switch to 802.11a
  D. Wireless signals can be detected from miles away; Bob's network is not safe
  D. Wireless signals can be detected from miles away; Bob's network is not safe

  ---

  It's all depending on the capacity of the antenna that a potential hacker will use in order to gain access to the wireless net.

• Question 369:

  In which part of OSI layer, ARP Poisoning occurs?

  

  A. Transport Layer
  B. Datalink Layer
  C. Physical Layer
  D. Application layer
  B. Datalink Layer

• Question 370:

  A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?

  A. The packets were sent by a worm spoofing the IP addresses of 47 infected sites
  B. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
  C. All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
  D. 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0
  B. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system