EC-COUNCIL 312-50V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V10 Online Questions & Answers

• Question 571:

  Websites and web portals that provide web services commonly use the Simple Object Access Protocol SOAP. Which of the following is an incorrect definition or characteristics in the protocol?

  A. Based on XML
  B. Provides a structured model for messaging
  C. Exchanges data between web services
  D. Only compatible with the application protocol HTTP
  D. Only compatible with the application protocol HTTP

• Question 572:

  In an internal security audit, the white hat hacker gains control over a user account and attempts to acquire access to another account's confidential files and information. How can he achieve this?

  A. Port Scanning
  B. Hacking Active Directory
  C. Privilege Escalation
  D. Shoulder-Surfing
  C. Privilege Escalation

• Question 573:

  A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news articles online about the bank, watching what times the bank employees come into work and leave from work, searching the bank's job postings (paying special attention to IT related jobs), and visiting the local dumpster for the bank's corporate office. What phase of the penetration test is the tester currently in?

  A. Information reporting
  B. Vulnerability assessment
  C. Active information gathering
  D. Passive information gathering
  D. Passive information gathering

• Question 574:

  Scenario: 1. Victim opens the attacker's web site.

  2.

  Attacker sets up a web site which contains interesting and attractive content like 'Do you want to make S100 In a day?',

  3.

  Victim clicks to the interesting and attractive content url.

  4- Attacker creates a transparent iframe' in front of the url which victim attempt to click, so victim thinks that he/she clicks to the 'Do you want to make $1000 in a day?' url but actually he/sne clicks to the content or url that exists in the

  transparent iframe' which is setup by the attacker.

  What is the name of the attack which is mentioned in the scenario?

  A. HTTP Parameter Pollution
  B. HTML Injection
  C. Session Fixation
  D. ClickJacking Attack
  D. ClickJacking Attack

• Question 575:

  In many states sending spam is illegal. Thus, the spammers have techniques to try and ensure that no one knows they sent the spam out to thousands of users at a time. Which of the following best describes what spammers use to hide the origin of these types of e- mails?

  A. A blacklist of companies that have their mail server relays configured to allow traffic only to their specific domain name.
  B. Mail relaying, which is a technique of bouncing e-mail from internal to external mails servers continuously.
  C. A blacklist of companies that have their mail server relays configured to be wide open.
  D. Tools that will reconfigure a mail server's relay component to send the e-mail back to the spammers occasionally.
  B. Mail relaying, which is a technique of bouncing e-mail from internal to external mails servers continuously.

• Question 576:

  Which NMAP command combination would let a tester scan every TCP port from a class C network that is blocking ICMP with fingerprinting and service detection?

  A. NMAP -PN -A -O -sS 192.168.2.0/24
  B. NMAP -P0 -A -O -p1-65535 192.168.0/24
  C. NMAP -P0 -A -sT -p0-65535 192.168.0/16
  D. NMAP -PN -O -sS -p 1-1024 192.168.0/8
  B. NMAP -P0 -A -O -p1-65535 192.168.0/24

• Question 577:

  Due to a slowdown of normal network operations, IT department decided to monitor internet traffic for all of the employees. From a legal stand point, what would be troublesome to take this kind of measure?

  A. All of the employees would stop normal work activities
  B. IT department would be telling employees who the boss is
  C. Not informing the employees that they are going to be monitored could be an invasion of privacy.
  D. The network could still experience traffic slow down.
  C. Not informing the employees that they are going to be monitored could be an invasion of privacy.

• Question 578:

  Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a

  secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B.

  How do you prevent DNS spoofing?

  A. Install DNS logger and track vulnerable packets
  B. Disable DNS timeouts
  C. Install DNS Anti-spoofing
  D. Disable DNS Zone Transfer
  C. Install DNS Anti-spoofing

• Question 579:

  An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the following is the most likely reason for lack of management or control packets?

  A. The wireless card was not turned on.
  B. The wrong network card drivers were in use by Wireshark.
  C. On Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
  D. Certain operating systems and adapters do not collect the management or control packets.
  D. Certain operating systems and adapters do not collect the management or control packets.

• Question 580:

  Which of these options is the most secure procedure for storing backup tapes?

  A. In a climate controlled facility offsite
  B. On a different floor in the same building
  C. Inside the data center for faster retrieval in a fireproof safe
  D. In a cool dry environment
  A. In a climate controlled facility offsite