EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 391:

  What is the tool Firewalk used for?

  A. To test the IDS for proper operation
  B. To test a firewall for proper operation
  C. To determine what rules are in place for a firewall
  D. To test the webserver configuration
  E. Firewalk is a firewall auto configuration tool
  C. To determine what rules are in place for a firewall

  ---

  Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device "firewall" will pass. Firewalk works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets and no response will be returned.

• Question 392:

  Bob was frustrated with his competitor, Brownies Inc., and decided to launch an attack that would result in serious financial losses. He planned the attack carefully and carried out the attack at the appropriate moment. Meanwhile, Trent, an administrator at Brownies Inc., realized that their main financial transaction server had been attacked. As a result of the attack, the server crashed and Trent needed to reboot the system, as no one was able to access the resources of the company. This process involves human interaction to fix it. What kind of Denial of Service attack was best illustrated in the scenario above?

  A. DOS attacks which involves flooding a network or system
  B. DOS attacks which involves crashing a network or system
  C. DOS attacks which is done accidentally or deliberately
  D. Simple DDOS attack
  B. DOS attacks which involves crashing a network or system

  ---

  This is not a DDOS, there is only one person involved as attacker

• Question 393:

  What is the essential difference between an `Ethical Hacker' and a `Cracker'?

  A. The ethical hacker does not use the same techniques or skills as a cracker.
  B. The ethical hacker does it strictly for financial motives unlike a cracker.
  C. The ethical hacker has authorization from the owner of the target.
  D. The ethical hacker is just a cracker who is getting paid.
  C. The ethical hacker has authorization from the owner of the target.

  ---

  The ethical hacker uses the same techniques and skills as a cracker and the motive is to find the security breaches before a cracker does. There is nothing that says that a cracker does not get paid for the work he does, a ethical hacker has the owners authorization and will get paid even if he does not succeed to penetrate the target.

• Question 394:

  What framework architecture is shown in this exhibit?

  

  A. Core Impact
  B. Metasploit
  C. Immunity Canvas
  D. Nessus
  B. Metasploit

• Question 395:

  On a backdoored Linux box there is a possibility that legitimate programs are modified or trojaned. How is it possible to list processes and uids associated with them in a more reliable manner?

  A. Use "Is"
  B. Use "lsof"
  C. Use "echo"
  D. Use "netstat"
  B. Use "lsof"

  ---

  lsof is a command used in many Unix-like systems that is used to report a list of all open files and the processes that opened them. It works in and supports several UNIX flavors.

• Question 396:

  

  Which of the following nmap command in Linux procedures the above output?

  A. sudo nmap sP 192.168.0.1/24
  B. root nmap sA 192.168.0.1/24
  C. run nmap TX 192.168.0.1/24
  D. launch nmap PP 192.168.0.1/24
  A. sudo nmap sP 192.168.0.1/24

  ---

  This is an output from a ping scan. The option sP will give you a ping scan of the 192.168.0.1/24 network.

• Question 397:

  While investigating a claim of a user downloading illegal material, the investigator goes through the files on the suspect's workstation. He comes across a file that is called `file.txt' but when he opens it, he find the following: What does this file contain?

  

  A. A picture that has been renamed with a .txt extension.
  B. An encrypted file.
  C. A uuencoded file.
  D. A buffer overflow.
  D. A buffer overflow.

  ---

  This is a buffer overflow exploit with its "payload" in hexadecimal format.

• Question 398:

  To see how some of the hosts on your network react, Winston sends out SYN packets to an IP range. A number of IPs respond with a SYN/ACK response. Before the connection is established he sends RST packets to those hosts to stop the session. Winston has done this to see how his intrusion detection system will log the traffic. What type of scan is Winston attempting here?

  A. Winston is attempting to find live hosts on your company's network by using an XMAS scan.
  B. He is utilizing a SYN scan to find live hosts that are listening on your network.
  C. This type of scan he is using is called a NULL scan.
  D. He is using a half-open scan to find live hosts on your network.
  D. He is using a half-open scan to find live hosts on your network.

• Question 399:

  What type of Trojan is this?

  

  A. RAT Trojan
  B. E-Mail Trojan
  C. Defacement Trojan
  D. Destructing Trojan
  E. Denial of Service Trojan
  C. Defacement Trojan

• Question 400:

  Bob has set up three web servers on Windows Server 2008 IIS 7.0. Bob has followed all the recommendations for securing the operating system and IIS. These servers are going to run numerous e-commerce websites that are projected to bring in thousands of dollars a day. Bob is still concerned about the security of these servers because of the potential for financial loss. Bob has asked his company's firewall administrator to set the firewall to inspect all incoming traffic on ports 80 and 443 to ensure that no malicious data is getting into the network.

  Why will this not be possible?

  A. Firewalls cannot inspect traffic coming through port 443
  B. Firewalls can only inspect outbound traffic
  C. Firewalls cannot inspect traffic at all, they can only block or allow certain ports
  D. Firewalls cannot inspect traffic coming through port 80
  C. Firewalls cannot inspect traffic at all, they can only block or allow certain ports