EC-COUNCIL 312-50V12 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V12 Online Questions & Answers

• Question 141:

  Lewis, a professional hacker, targeted the loT cameras and devices used by a target venture-capital firm. He used an information-gathering tool to collect information about the loT devices connected to a network, open ports and services, and the attack surface area. Using this tool, he also generated statistical reports on broad usage patterns and trends. This tool helped Lewis continually monitor every reachable server and device on the Internet, further allowing him to exploit these devices in the network. Which of the following tools was employed by Lewis in the above scenario?

  A. Censys
  B. Wapiti
  C. NeuVector
  D. Lacework
  A. Censys

  ---

  Explanation/Reference:

  Censys scans help the scientific community accurately study the Internet. The data is sometimes used to detect security problems and to inform operators of vulnerable systems so that they can fixed

• Question 142:

  Which of the following tools is used to analyze the files produced by several packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

  A. tcptrace
  B. Nessus
  C. OpenVAS
  D. tcptraceroute
  A. tcptrace

• Question 143:

  When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's Computer to update the router configuration. What type of an alert is this?

  A. False negative
  B. True negative
  C. True positive
  D. False positive
  D. False positive

  ---

  Explanation/Reference:

  True Positive IDS referring a behavior as an attack, in real life it is True Negative IDS referring a behavior not an attack and in real life it is not False Positive IDS referring a behavior as an attack, in real life it is not False Negative IDS referring a behavior not an attack, but in real life is an attack.

  False Negative - is the most serious and dangerous state of all !!!!

• Question 144:

  Which of the following algorithms can be used to guarantee the integrity of messages being sent, in transit, or stored?

  A. symmetric algorithms
  B. asymmetric algorithms
  C. hashing algorithms
  D. integrity algorithms
  C. hashing algorithms

• Question 145:

  How can you determine if an LM hash you extracted contains a password that is less than 8 characters long?

  A. There is no way to tell because a hash cannot be reversed
  B. The right most portion of the hash is always the same
  C. The hash always starts with AB923D
  D. The left most portion of the hash is always the same
  E. A portion of the hash will be all 0's
  B. The right most portion of the hash is always the same

• Question 146:

  During a red team engagement, an ethical hacker is tasked with testing the security measures of an organization's wireless network. The hacker needs to select an appropriate tool to carry out a session hijacking attack. Which of the following tools should the hacker use to effectively perform session hijacking and subsequent security analysis, given that the target wireless network has the Wi-Fi Protected Access-preshared key (WPA-PSK) security protocol in place?

  A. FaceNiff
  B. Hetty
  C. Droidsheep
  D. bettercap
  D. bettercap

  ---

  Explanation/Reference:

  bettercap is a tool that can perform session hijacking attacks on wireless networks, among other network security and penetration testing tasks. bettercap can capture and manipulate network traffic, perform man-in-the-middle attacks, spoof and sniff protocols, inject custom payloads, and more. bettercap can perform session hijacking attacks on wireless networks that use the WPA- PSK security protocol by exploiting the four-way handshake process that occurs when a client connects to a wireless access point. The four-way handshake is used to establish a shared encryption key between the client and the access point, based on the pre-shared key (PSK) that is configured on both devices. However, the four-way handshake also exposes some information that can be used to crack the PSK offline, such as the nonce values, the MAC addresses, and the message integrity code (MIC) of the packets2. bettercap can capture the four-way handshake packets using its Wi-Fi module and save them in a file. The file can then be fed to a tool like Hashcat or Aircrack-ng to crack the PSK using brute force or dictionary attacks. Once the PSK is obtained, bettercap can use it to decrypt the wireless traffic and perform session hijacking attacks on the clients connected to the access point3. Therefore, bettercap is an appropriate tool to carry out a session hijacking attack on a wireless network that uses the WPA-PSK security protocol. References: bettercap: the Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks How the WPA2 Enterprise Wireless Security Protocol Works Cracking WPA/WPA2 Passwords with Bettercap and Hashcat

• Question 147:

  Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on your network?

  A. 137 and 139
  B. 137 and 443
  C. 139 and 443
  D. 139 and 445
  D. 139 and 445

• Question 148:

  An attacker decided to crack the passwords used by industrial control systems. In this process, he employed a loop strategy to recover these passwords. He used one character at a time to check whether the first character entered is correct;

  if so, he continued the loop for consecutive characters. If not, he terminated the loop. Furthermore, the attacker checked how much time the device took to finish one complete password authentication process, through which he deduced how

  many characters entered are correct.

  What is the attack technique employed by the attacker to crack the passwords of the industrial control systems?

  A. Side-channel attack
  B. Denial-of-service attack
  C. HMI-based attack
  D. Buffer overflow attack
  C. HMI-based attack

• Question 149:

  SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may Bypass authentication and allow attackers to access and/or modify data attached to a web application. Which of the following SQLI types leverages a database server's ability to make DNS requests to pass data to an attacker?

  A. Union-based SQLI
  B. Out-of-band SQLI
  C. ln-band SQLI
  D. Time-based blind SQLI
  B. Out-of-band SQLI

  ---

  Explanation/Reference:

  Out-of-band SQL injection occurs when an attacker is unable to use an equivalent channel to launch the attack and gather results. ... Out-of-band SQLi techniques would believe the database server's ability to form DNS or HTTP requests to deliver data to an attacker. Out-of-band SQL injection is not very common, mostly because it depends on features being enabled on the database server being used by the web application. Out-of- band SQL injection occurs when an attacker is unable to use the same channel to launch the attack and gather results. Out-of-band techniques, offer an attacker an alternative to inferential time-based techniques, especially if the server responses are not very stable (making an inferential time-based attack unreliable). Out-of-band SQLi techniques would rely on the database server's ability to make DNS or HTTP requests to deliver data to an attacker. Such is the case with Microsoft SQL Server's xp_dirtree command, which can be used to make DNS requests to a server an attacker controls; as well as Oracle Database's UTL_HTTP package, which can be used to send HTTP requests from SQL and PL/SQL to a server an attacker controls.

• Question 150:

  You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any -> 192.168.100.0/24 21 (msg: ""FTP on the network!"";)

  A. A firewall IPTable
  B. FTP Server rule
  C. A Router IPTable
  D. An Intrusion Detection System
  D. An Intrusion Detection System