EC-COUNCIL 312-50V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V10 Online Questions & Answers

• Question 411:

  Joseph was the Web site administrator for the Mason Insurance in New York, who's main Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to administer the Web site. One night, Joseph received an urgent phone call from his friend, Smith. According to Smith, the main Mason Insurance web site had been vandalized! All of its normal content was removed and replaced with an attacker's message ''Hacker Message: You are dead! Freaks!" From his office, which was directly connected to Mason Insurance's internal network, Joseph surfed to the Web site using his laptop. In his browser, the Web site looked completely intact.

  No changes were apparent. Joseph called a friend of his at his home to help troubleshoot the problem. The Web site appeared defaced when his friend visited using his DSL connection. So, while Smith and his friend could see the defaced page, Joseph saw the intact Mason Insurance web site. To help make sense of this problem, Joseph decided to access the Web site using hisdial-up ISP. He disconnected his laptop from the corporate internal network and used his modem to dial up the same ISP used by Smith. After his modem connected, he quickly typed www.masonins.com in his browser to reveal the following web page:

  

  After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal network, and used Secure Shell (SSH) to log in directly to the Web server. He ran Tripwire against the entire Web site, and determined that every system file and all the Web content on the server were intact. How did the attacker accomplish this hack?

  A. ARP spoofing
  B. SQL injection
  C. DNS poisoning
  D. Routing table injection
  C. DNS poisoning

• Question 412:

  Which of the following does proper basic configuration of snort as a network intrusion detection system require?

  A. Limit the packets captured to the snort configuration file.
  B. Capture every packet on the network segment.
  C. Limit the packets captured to a single segment.
  D. Limit the packets captured to the /var/log/snort directory.
  A. Limit the packets captured to the snort configuration file.

• Question 413:

  You are attempting to man-in-the-middle a session. Which protocol will allow you to guess a sequence number?

  A. TCP
  B. UPD
  C. ICMP
  D. UPX
  A. TCP

• Question 414:

  What technique is used to perform a Connection Stream Parameter Pollution (CSPP) attack?

  A. Injecting parameters into a connection string using semicolons as a separator
  B. Inserting malicious Javascript code into input parameters
  C. Setting a user's session identifier (SID) to an explicit known value
  D. Adding multiple parameters with the same name in HTTP requests
  A. Injecting parameters into a connection string using semicolons as a separator

• Question 415:

  Which of the following is the most important phase of ethical hacking wherein you need to spend considerable amount of time?

  A. Gaining access
  B. Escalating privileges
  C. Network mapping
  D. Footprinting
  D. Footprinting

• Question 416:

  Which specific element of security testing is being assured by using hash?

  A. Authentication
  B. Integrity
  C. Confidentiality
  D. Availability
  B. Integrity

• Question 417:

  You've just been hired to perform a pen test on an organization that has been subjected to a large-scale attack. The CIO is concerned with mitigating threats and vulnerabilities to totally eliminate risk. What is one of the first things you should do when given the job?

  A. Explain to the CIO that you cannot eliminate all risk, but you will be able to reduce risk to acceptable levels.
  B. Interview all employees in the company to rule out possible insider threats.
  C. Establish attribution to suspected attackers.
  D. Start the wireshark application to start sniffing network traffic.
  A. Explain to the CIO that you cannot eliminate all risk, but you will be able to reduce risk to acceptable levels.

• Question 418:

  If an attacker uses the command SELECT*FROM user WHERE name = `x' AND userid IS NULL; --`; which type of SQL injection attack is the attacker performing?

  A. End of Line Comment
  B. UNION SQL Injection
  C. Illegal/Logically Incorrect Query
  D. Tautology
  D. Tautology

• Question 419:

  What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?

  A. tcp.src == 25 and ip.host == 192.168.0.125
  B. host 192.168.0.125:25
  C. port 25 and host 192.168.0.125
  D. tcp.port == 25 and ip.host == 192.168.0.125
  D. tcp.port == 25 and ip.host == 192.168.0.125

• Question 420:

  You have successfully compromised a machine on the network and found a server that is alive on the same network. You tried to ping it but you didn't get any response back. What is happening?

  A. ICMP could be disabled on the target server.
  B. The ARP is disabled on the target server.
  C. TCP/IP doesn't support ICMP.
  D. You need to run the ping command with root privileges.
  A. ICMP could be disabled on the target server.