EC-COUNCIL 312-50V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V10 Online Questions & Answers

• Question 231:

  To maintain compliance with regulatory requirements, a security audit of the systems on a network must be performed to determine their compliance with security policies. Which one of the following tools would most likely be used in such an audit?

  A. Vulnerability scanner
  B. Protocol analyzer
  C. Port scanner
  D. Intrusion Detection System
  A. Vulnerability scanner

• Question 232:

  Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp's lobby. He checks his current SID, which is S-1-5-21-1223352397- 1872883824-861252104-501. What needs to happen before Matthew has full administrator access?

  A. He must perform privilege escalation.
  B. He needs to disable antivirus protection.
  C. He needs to gain physical access.
  D. He already has admin privileges, as shown by the "501" at the end of the SID.
  A. He must perform privilege escalation.

• Question 233:

  A hacker has successfully infected an internet-facing server which he will then use to send junk mail, take part in coordinated attacks, or host junk email content. Which sort of trojan infects this server?

  A. Botnet Trojan
  B. Turtle Trojans
  C. Banking Trojans
  D. Ransomware Trojans
  A. Botnet Trojan

• Question 234:

  An IT employee got a call from one of our best customers. The caller wanted to know about the company's network infrastructure, systems, and team. New opportunities of integration are in sight for both company and customer. What should this employee do?

  A. Since the company's policy is all about Customer Service, he/she will provide information.
  B. Disregarding the call, the employee should hang up.
  C. The employee should not provide any information without previous management authorization.
  D. The employees can not provide any information; but, anyway, he/she will provide the name of the person in charge.
  C. The employee should not provide any information without previous management authorization.

• Question 235:

  Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?

  A. Produces less false positives
  B. Can identify unknown attacks
  C. Requires vendor updates for a new threat
  D. Cannot deal with encrypted network traffic
  B. Can identify unknown attacks

• Question 236:

  You have compromised a server and successfully gained a root access. You want to pivot and pass traffic undetected over the network and evade any possible Intrusion Detection System. What is the best approach?

  A. Install Cryptcat and encrypt outgoing packets from this server.
  B. Install and use Telnet to encrypt all outgoing traffic from this server.
  C. Use Alternate Data Streams to hide the outgoing packets from this server.
  D. Use HTTP so that all traffic can be routed via a browser, thus evading the internal Intrusion Detection Systems.
  A. Install Cryptcat and encrypt outgoing packets from this server.

• Question 237:

  Which type of Nmap scan is the most reliable, but also the most visible, and likely to be picked up by and IDS?

  A. SYN scan
  B. ACK scan
  C. RST scan
  D. Connect scan
  E. FIN scan
  D. Connect scan

• Question 238:

  It is a widely used standard for message logging. It permits separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. This protocol is specifically designed for

  transporting event messages.

  Which of the following is being described?

  A. SNMP
  B. ICMP
  C. SYSLOG
  D. SMS
  C. SYSLOG

• Question 239:

  During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?

  A. The tester must capture the WPA2 authentication handshake and then crack it.
  B. The tester must use the tool inSSIDer to crack it using the ESSID of the network.
  C. The tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
  D. The tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key.
  A. The tester must capture the WPA2 authentication handshake and then crack it.

• Question 240:

  A company is using Windows Server 2003 for its Active Directory (AD). What is the most efficient way to crack the passwords for the AD users?

  A. Perform a dictionary attack.
  B. Perform a brute force attack.
  C. Perform an attack with a rainbow table.
  D. Perform a hybrid attack.
  C. Perform an attack with a rainbow table.