EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 531:

  Bob has a good understanding of cryptography, having worked with it for many years. Cryptography is used to secure data from specific threats but it does not secure the data from the specific threats but it does no secure the application from coding errors. It can provide data privacy; integrity and enable strong authentication but it can't mitigate programming errors. What is a good example of a programming error that Bob can use to explain to the management how encryption will not address all their security concerns?

  A. Bob can explain that using a weak key management technique is a form of programming error
  B. Bob can explain that using passwords to derive cryptographic keys is a form of a programming error
  C. Bob can explain that a buffer overflow is an example of programming error and it is a common mistake associated with poor programming technique
  D. Bob can explain that a random number generation can be used to derive cryptographic keys but it uses a weak seed value and this is a form of a programming error
  C. Bob can explain that a buffer overflow is an example of programming error and it is a common mistake associated with poor programming technique

  ---

  In computer security and programming, a buffer overflow, or buffer overrun, is a programming error which may result in a memory access exception and program termination, or in the event of the user being malicious, a possible breach of system security.

• Question 532:

  Once an intruder has gained access to a remote system with a valid username and password, the attacker will attempt to increase his privileges by escalating the used account to one that has increased privileges. such as that of an administrator. What would be the best countermeasure to protect against escalation of priveges?

  A. Give users tokens
  B. Give user the least amount of privileges
  C. Give users two passwords
  D. Give users a strong policy document
  B. Give user the least amount of privileges

  ---

  With less privileges it is harder to increase the privileges.

• Question 533:

  You have performed the traceroute below and notice that hops 19 and 20 both show the same IP address.

  What can be inferred from this output?

  1 172.16.1.254 (172.16.1.254) 0.724 ms 3.285 ms 0.613 ms 2 ip68-98-176-1.nv.nv.cox.net (68.98.176.1) 12.169 ms 14.958 ms 13.416 ms 3 ip68-98-176- 1.nv.nv.cox.net (68.98.176.1) 13.948 ms ip68-100-0-1.nv.nv.cox.net (68.100.0.1)

  16.743

  ms 16.207 ms 4 ip68-100-0-137.nv.nv.cox.net (68.100.0.137) 17.324 ms 12.933 ms 20.938 ms 5 68.1.1.4 (68.1.1.4) 12.439 ms 220.166 ms 204.170 ms 6 so-6-0-0.gar2.wdc1.Level3.net (67.29.170.1) 16.177 ms 25.943 ms 14.104 ms 7 unknown.Level3.net (209.247.9.173) 14.227 ms 17.553 ms 15.415 ms 8 so-0-1- 0.bbr1.NewYork1.level3.net (64.159.1.41) 17.063 ms 20.960 ms 19.512 ms 9 so-7-0-0-gar1.NewYork1.Level3.net (64.159.1.182) 20.334 ms 19.440 ms

  17.938

  ms 10 so-4-0-0.edge1.NewYork1.Level3.net (209.244.17.74) 27.526 ms 18.317 ms 21.202 ms 11 uunet-level3-oc48.NewYork1.Level3.net (209.244.160.12) 21.411 ms 19.133 ms 18.830 ms 12 0.so-6-0-0.XL1.NYC4.ALTER.NET

  (152.63.21.78)

  21.203 ms 22.670 ms 20.11 ms 13 0.so-2-0-0.TL1.NYC8.ALTER.NET (152.63.0.153) 30.929 ms 24.858 ms 23.108 ms 14 0.so-4-1-0.TL1.ATL5.ALTER.NET (152.63.10.129) 38.894 ms 33.244 33.910 ms 15 0.so-7-00.XL1.MIA4.ALTER.NET (152.63.86.189) 51.165 ms 49.935 ms 49.466 ms 16 0.so-3-0-0.XR1.MIA4.ALTER.NET (152.63.101.41) 50.937 ms 49.005 ms 51.055 ms 17 117.ATM6-0.GW5.MIA1.ALTER.NET (152.63.82.73) 51.897 ms 50.280 ms 53.647 ms 18 example-gwl.customer.alter.net (65.195.239.14) 51.921 ms 51.571 ms 56.855 ms 19 www.ABC.com (65.195.239.22) 52.191 ms 52.571 ms 56.855 ms 20 www.ABC.com (65.195.239.22) 53.561 ms 54.121 ms 58.333 ms

  A. An application proxy firewall
  B. A stateful inspection firewall
  C. A host based IDS
  D. A Honeypot
  B. A stateful inspection firewall

• Question 534:

  WWW wanderers or spiders are programs that traverse many pages in the World Wide Web by recursively retrieving linked pages. Search engines like Google, frequently spider web pages for indexing.

  How will you stop web spiders from crawling certain directories on your website?

  A. Place robots.txt file in the root of your website with listing of directories that you don't want to be crawled
  B. Place authentication on root directories that will prevent crawling from these spiders
  C. Place "HTTP:NO CRAWL" on the html pages that you don't want the crawlers to index
  D. Enable SSL on the restricted directories which will block these spiders from crawling
  A. Place robots.txt file in the root of your website with listing of directories that you don't want to be crawled

  ---

  WWW Robots (also called wanderers or spiders) are programs that traverse many pages in the World Wide Web by recursively retrieving linked pages. The method used to exclude robots from a server is to create a file on the server which

  specifies an access policy for robots.

  This file must be accessible via HTTP on the local URL "/robots.txt".

  http://www.robotstxt.org/orig.html#format

• Question 535:

  When a malicious hacker identifies a target and wants to eventually compromise this target, what would be among the first steps that he would perform? (Choose the best answer)

  A. Cover his tracks by eradicating the log files and audit trails.
  B. Gain access to the remote computer in order to conceal the venue of attacks.
  C. Perform a reconnaissance of the remote target for identical of venue of attacks.
  D. Always begin with a scan in order to quickly identify venue of attacks.
  C. Perform a reconnaissance of the remote target for identical of venue of attacks.

  ---

  A hacker always starts with a preparatory phase (Reconnaissance) where he seeks to gather as much information as possible about the target of evaluation prior to launching an attack. The reconnaissance can be either passive or active (or both).

• Question 536:

  If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?

  A. Birthday
  B. Brute force
  C. Man-in-the-middle
  D. Smurf
  B. Brute force

  ---

  Brute force attacks are performed with tools that cycle through many possible character, number, and symbol combinations to guess a password. Since the token allows offline checking of PIN, the cracker can keep trying PINS until it is cracked.

• Question 537:

  Exhibit

  

  Study the log given in the exhibit,

  Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate?

  A. Disallow UDP 53 in from outside to DNS server
  B. Allow UDP 53 in from DNS server to outside
  C. Disallow TCP 53 in from secondaries or ISP server to DNS server
  D. Block all UDP traffic
  C. Disallow TCP 53 in from secondaries or ISP server to DNS server

  ---

  According to the exhibit, the question is regarding the DNS Zone Transfer. Since Zone Transfers are done with TCP port 53, you should not allow this connect external to you organization.

• Question 538:

  Jack is conducting a port scan of a target network. He knows that his target network has a web server and that a mail server is up and running. Jack has been sweeping the network but has not been able to get any responses from the remote target. Check all of the following that could be a likely cause of the lack of response?

  A. The host might be down
  B. UDP is filtered by a gateway
  C. ICMP is filtered by a gateway
  D. The TCP window Size does not match
  E. The destination network might be down
  F. The packet TTL value is too low and can't reach the target
  A. The host might be down
  C. ICMP is filtered by a gateway
  E. The destination network might be down
  F. The packet TTL value is too low and can't reach the target

  ---

  Wrong answers is B and D as sweeping a network uses ICMP

• Question 539:

  Which one of the following is defined as the process of distributing incorrect Internet Protocol (IP) addresses/names with the intent of diverting traffic?

  A. Network aliasing
  B. Domain Name Server (DNS) poisoning
  C. Reverse Address Resolution Protocol (ARP)
  D. Port scanning
  B. Domain Name Server (DNS) poisoning

  ---

  This reference is close to the one listed DNS poisoning is the correct answer. This is how DNS DOS attack can occur. If the actual DNS records are unattainable to the attacker for him to alter in this fashion, which they should be, the attacker can insert this data into the cache of there server instead of replacing the actual records, which is referred to as cache poisoning.

• Question 540:

  Password cracking programs reverse the hashing process to recover passwords.(True/False.

  A. True
  B. False
  B. False

  ---

  Password cracking programs do not reverse the hashing process. Hashing is a one-way process. What these programs can do is to encrypt words, phrases, and characters using the same encryption process and compare them to the original password. A hashed match reveals the true password.