EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 501:

  Perimeter testing means determining exactly what your firewall blocks and what it allows. To conduct a good test, you can spoof source IP addresses and source ports. Which of the following command results in packets that will appear to originate from the system at 10.8.8.8? Such a packet is useful for determining whether the firewall is allowing random packets in or out of your network.

  A. hping3 -T 10.8.8.8 -S netbios -c 2 -p 80
  B. hping3 -Y 10.8.8.8 -S windows -c 2 -p 80
  C. hping3 -O 10.8.8.8 -S server -c 2 -p 80
  D. hping3 -a 10.8.8.8 -S springfield -c 2 -p 80
  D. hping3 -a 10.8.8.8 -S springfield -c 2 -p 80

• Question 502:

  Exhibit

  

  You receive an e-mail with the message displayed in the exhibit. From this e-mail you suspect that this message was sent by some hacker since you have using their e- mail services for the last 2 years and they never sent out an e-mail as

  this. You also observe the URL in the message and confirm your suspicion about 340590649. You immediately enter the following at the Windows 2000 command prompt.

  ping 340590649

  You get a response with a valid IP address. What is the obstructed IP address in the e-mail URL?

  A. 192.34.5.9
  B. 10.0.3.4
  C. 203.2.4.5
  D. 199.23.43.4
  C. 203.2.4.5

  ---

  Convert the number in binary, then start from last 8 bits and convert them to decimal to get the last octet (in this case .5)

• Question 503:

  SSL has been as the solution to a lot of common security problems. Administrator will often time make use of SSL to encrypt communications from points A to Point B. Why do you think this could be a bad idea if there is an Intrusion Detection System deployed to monitor the traffic between Point A to Point B?

  A. SSL is redundant if you already have IDS's in place
  B. SSL will trigger rules at regular interval and force the administrator to turn them off
  C. SSL will make the content of the packet and Intrusion Detection System are blinded
  D. SSL will slow down the IDS while it is breaking the encryption to see the packet content
  C. SSL will make the content of the packet and Intrusion Detection System are blinded

  ---

  An IDS will not be able to evaluate the content in the packets if it is encrypted.

• Question 504:

  Syslog is a standard for logging program messages. It allows separation of the software that generates messages from the system that stores them and the software that reports and analyzes them. It also provides devices, which would otherwise be unable to communicate a means to notify administrators of problems or performance.

  

  What default port Syslog daemon listens on?

  A. 242
  B. 312
  C. 416
  D. 514
  D. 514

• Question 505:

  Within the context of Computer Security, which of the following statements best describe Social Engineering?

  A. Social Engineering is the act of publicly disclosing information.
  B. Social Engineering is the act of getting needed information from a person rather than breaking into a system.
  C. Social Engineering is the means put in place by human resource to perform time accounting.
  D. Social Engineering is a training program within sociology studies.
  B. Social Engineering is the act of getting needed information from a person rather than breaking into a system.

  ---

  Social engineering is a collection of techniques used to manipulate people into performing actions or divulging confidential information.

• Question 506:

  You want to capture Facebook website traffic in Wireshark. What display filter should you use that shows all TCP packets that contain the word 'facebook'?

  A. display==facebook
  B. traffic.content==facebook
  C. tcp contains facebook
  D. list.display.facebook
  C. tcp contains facebook

• Question 507:

  TCP packets transmitted in either direction after the initial three-way handshake will have which of the following bit set?

  A. SYN flag
  B. ACK flag
  C. FIN flag
  D. XMAS flag
  B. ACK flag

• Question 508:

  Which of the following tools can be used to perform a zone transfer?

  A. NSLookup
  B. Finger
  C. Dig
  D. Sam Spade
  E. Host
  F. Netcat
  G. Neotrace
  A. NSLookup
  C. Dig
  D. Sam Spade
  E. Host

  ---

  There are a number of tools that can be used to perform a zone transfer. Some of these include: NSLookup, Host, Dig, and Sam Spade.

• Question 509:

  On wireless networks, SSID is used to identify the network. Why are SSID not considered to be a good security mechanism to protect a wireless networks?

  A. The SSID is only 32 bits in length.
  B. The SSID is transmitted in clear text.
  C. The SSID is the same as the MAC address for all vendors.
  D. The SSID is to identify a station, not a network.
  B. The SSID is transmitted in clear text.

  ---

  The SSID IS constructed to identify a network, it IS NOT the same as the MAC address and SSID's consists of a maximum of 32 alphanumeric characters.

• Question 510:

  Vulnerability scanners are automated tools that are used to identify vulnerabilities and misconfigurations of hosts. They also provide information regarding mitigating discovered vulnerabilities.

  

  Which of the following statements is incorrect?

  A. Vulnerability scanners attempt to identify vulnerabilities in the hosts scanned.
  B. Vulnerability scanners can help identify out-of-date software versions, missing patches, or system upgrades
  C. They can validate compliance with or deviations from the organization's security policy
  D. Vulnerability scanners can identify weakness and automatically fix and patch the vulnerabilities without user intervention
  D. Vulnerability scanners can identify weakness and automatically fix and patch the vulnerabilities without user intervention