EC-COUNCIL 312-50V11 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V11 Online Questions & Answers

• Question 111:

  Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/ feed.php?url:externaIsile.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server. What is the type of attack Jason performed In the above scenario?

  A. website defacement
  B. Server-side request forgery (SSRF) attack
  C. Web server misconfiguration
  D. web cache poisoning attack
  B. Server-side request forgery (SSRF) attack

• Question 112:

  While scanning with Nmap, Patin found several hosts which have the IP ID of incremental sequences. He then decided to conduct: nmap -Pn -p- -si kiosk.adobe.com www.riaa.com. kiosk.adobe.com is the host with incremental IP ID sequence. What is the purpose of using "-si" with Nmap?

  A. Conduct stealth scan
  B. Conduct ICMP scan
  C. Conduct IDLE scan
  D. Conduct silent scan
  A. Conduct stealth scan

• Question 113:

  What is the minimum number of network connections in a multi homed firewall?

  A. 3
  B. 5
  C. 4
  D. 2
  A. 3

• Question 114:

  Upon establishing his new startup, Tom hired a cloud service provider (CSP) but was dissatisfied with their service and wanted to move to another CSP. What part of the contract might prevent him from doing so?

  A. Virtualization
  B. Lock-in
  C. Lock-down
  D. Lock-up
  B. Lock-in

• Question 115:

  in an attempt to increase the security of your network, you Implement a solution that will help keep your wireless network undiscoverable and accessible only to those that know It. How do you accomplish this?

  A. Delete the wireless network
  B. Remove all passwords
  C. Lock all users
  D. Disable SSID broadcasting
  D. Disable SSID broadcasting

• Question 116:

  Your company was hired by a small healthcare provider to perform a technical assessment on the network.

  What is the best approach for discovering vulnerabilities on a Windows-based computer?

  A. Use the built-in Windows Update tool
  B. Use a scan tool like Nessus
  C. Check MITRE.org for the latest list of CVE findings
  D. Create a disk image of a clean Windows installation
  B. Use a scan tool like Nessus

• Question 117:

  What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?

  A. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.
  B. Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail.
  C. Symmetric encryption allows the server to security transmit the session keys out-of- band.
  D. Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.
  A. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.

• Question 118:

  How does a denial-of-service attack work?

  A. A hacker prevents a legitimate user (or group of users) from accessing a service
  B. A hacker uses every character, word, or letter he or she can think of to defeat authentication
  C. A hacker tries to decipher a password by using a system, which subsequently crashes the network
  D. A hacker attempts to imitate a legitimate user by confusing a computer or even another person
  A. A hacker prevents a legitimate user (or group of users) from accessing a service

• Question 119:

  The "Gray-box testing" methodology enforces what kind of restriction?

  A. Only the external operation of a system is accessible to the tester.
  B. The internal operation of a system in only partly accessible to the tester.
  C. Only the internal operation of a system is known to the tester.
  D. The internal operation of a system is completely known to the tester.
  B. The internal operation of a system in only partly accessible to the tester.

• Question 120:

  Which of the following is the primary objective of a rootkit?

  A. It opens a port to provide an unauthorized service
  B. It creates a buffer overflow
  C. It replaces legitimate programs
  D. It provides an undocumented opening in a program
  C. It replaces legitimate programs