EC-COUNCIL EC-COUNCIL Certifications 312-50V12 Questions & Answers

• Question 121:

  In the context of Windows Security, what is a 'null' user?

  A. A user that has no skills

  B. An account that has been suspended by the admin

  C. A pseudo account that has no username and password

  D. A pseudo account that was created for security administration purpose

  Correct Answer: C

• Question 122:

  Study the snort rule given below:

  

  From the options below, choose the exploit against which this rule applies.

  A. WebDav

  B. SQL Slammer

  C. MS Blaster

  D. MyDoom

  Correct Answer: C

• Question 123:

  What type of a vulnerability/attack is it when the malicious person forces the user's browser to send an authenticated request to a server?

  A. Session hijacking

  B. Server side request forgery

  C. Cross-site request forgery

  D. Cross-site scripting

  Correct Answer: C

• Question 124:

  The security team of Debry Inc. decided to upgrade Wi-Fi security to thwart attacks such as dictionary attacks and key recovery attacks. For this purpose, the security team started implementing cutting-edge technology that uses a modern key establishment protocol called the simultaneous authentication of equals (SAE), also known as dragonfly key exchange, which replaces the PSK concept. What is the Wi-Fi encryption technology implemented by Debry Inc.?

  A. WEP

  B. WPA

  C. WPA2

  D. WPA3

  Correct Answer: C

• Question 125:

  Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?

  A. Produces less false positives

  B. Can identify unknown attacks

  C. Requires vendor updates for a new threat

  D. Cannot deal with encrypted network traffic

  Correct Answer: B

  An anomaly-based intrusion detection system is an intrusion detection system for detecting both network and computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on heuristics or rules, rather than patterns or signatures, and attempts to detect any type of misuse that falls out of normal system operation. This is as opposed to signature-based systems, which can only detect attacks for which a signature has previously been created. In order to positively identify attack traffic, the system must be taught to recognize normal system activity. The two phases of a majority of anomaly detection systems consist of the training phase (where a profile of normal behaviors is built) and the testing phase (where current traffic is compared with the profile created in the training phase). Anomalies are detected in several ways, most often with artificial intelligence type techniques. Systems using artificial neural networks have been used to great effect. Another method is to define what normal usage of the system comprises using a strict mathematical model, and flag any deviation from this as an attack. This is known as strict anomaly detection.[3] Other techniques used to detect anomalies include data mining methods, grammar-based methods, and the Artificial Immune System. Network-based anomalous intrusion detection systems often provide a second line of defense to detect anomalous traffic at the physical and network layers after it has passed through a firewall or other security appliance on the border of a network. Host-based anomalous intrusion detection systems are one of the last layers of defense and reside on computer endpoints. They allow for fine-tuned, granular protection of endpoints at the application level. Anomaly-based Intrusion Detection at both the network and host levels have a few shortcomings; namely a high false-positive rate and the ability to be fooled by a correctly delivered attack. Attempts have been made to address these issues through techniques used by PAYL and MCPAD.

• Question 126:

  By performing a penetration test, you gained access under a user account. During the test, you established a connection with your own machine via the SMB service and occasionally entered your login and password in plaintext. Which file do you have to clean to clear the password?

  A. .X session-log

  B. .bashrc

  C. .profile

  D. .bash_history

  Correct Answer: D

  File created by Bash, a Unix-based shell program commonly used on Mac OS X and Linux operating systems; stores a history of user commands entered at the command prompt; used for viewing old commands that are

  executed.BASH_HISTORY files are hidden files with no filename prefix. They always use the filename .bash_history.NOTE:

  Bash is that the shell program employed by Apple Terminal.Our goal is to assist you understand what a file with a *.bash_history suffix is and the way to open it.The Bash History file type, file format description, and Mac and Linux programs

  listed on this page are individually researched and verified by the FileInfo team. we attempt for 100% accuracy and only publish information about file formats that we've tested and validated.

• Question 127:

  What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?

  A. Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail.

  B. Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.

  C. Symmetric encryption allows the server to securely transmit the session keys out-of- band.

  D. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.

  Correct Answer: D

• Question 128:

  Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with

  password weaknesses and key loggers.

  Which of the following options best represents the means that Bob can adopt to retrieve passwords from his clients hosts and servers?

  A. Hardware, Software, and Sniffing.

  B. Hardware and Software Keyloggers.

  C. Passwords are always best obtained using Hardware key loggers.

  D. Software only, they are the most effective.

  Correct Answer: A

• Question 129:

  The "Gray-box testing" methodology enforces what kind of restriction?

  A. Only the external operation of a system is accessible to the tester.

  B. The internal operation of a system in only partly accessible to the tester.

  C. Only the internal operation of a system is known to the tester.

  D. The internal operation of a system is completely known to the tester.

  Correct Answer: D

  White-box testing (also known as clear box testing, glass box testing, transparent box testing, and structural testing) is a method of software testing that tests internal structures or workings of an application, as opposed to its functionality (i.e. black-box testing). In white-box testing, an internal perspective of the system, as well as programming skills, are used to design test cases. The tester chooses inputs to exercise paths through the code and determine the expected outputs. This is analogous to testing nodes in a circuit, e.g. in- circuit testing (ICT). White-box testing can be applied at the unit, integration and system levels of the software testing process. Although traditional testers tended to think of white- box testing as being done at the unit level, it is used for integration and system testing more frequently today. It can test paths within a unit, paths between units during integration, and between subsystems during a system-level test. Though this method of test design can uncover many errors or problems, it has the potential to miss unimplemented parts of the specification or missing requirements. Where white-box testing is design-driven,[1] that is, driven exclusively by agreed specifications of how each component of the software is required to behave (as in DO-178C and ISO 26262 processes) then white-box test techniques can accomplish assessment for unimplemented or missing requirements.

  White-box test design techniques include the following code coverage criteria:

  1.

  Control flow testing

  2.

  Data flow testing

  3.

  Branch testing

  4.

  Statement coverage

  5.

  Decision coverage

  6.

  Modified condition/decision coverage

  7.

  Prime path testing

  8.

  Path testing

• Question 130:

  Elante company has recently hired James as a penetration tester. He was tasked with performing enumeration on an organization's network. In the process of enumeration, James discovered a service that is accessible to external sources. This service runs directly on port 21. What is the service enumerated byjames in the above scenario?

  A. Border Gateway Protocol (BGP)

  B. File Transfer Protocol (FTP)

  C. Network File System (NFS)

  D. Remote procedure call (RPC)

  Correct Answer: B