EC-COUNCIL EC-COUNCIL Certifications 312-50V12 Questions & Answers

• Question 171:

  You need a tool that can do network intrusion prevention and intrusion detection, function as a network sniffer, and record network activity, what tool would you most likely select?

  A. Nmap

  B. Cain and Abel

  C. Nessus

  D. Snort

  Correct Answer: D

• Question 172:

  While scanning with Nmap, Patin found several hosts which have the IP ID of incremental sequences. He then decided to conduct: nmap -Pn -p- -si kiosk.adobe.com www.riaa.com. kiosk.adobe.com is the host with incremental IP ID

  sequence.

  What is the purpose of using "-si" with Nmap?

  A. Conduct stealth scan

  B. Conduct ICMP scan

  C. Conduct IDLE scan

  D. Conduct silent scan

  Correct Answer: C

  Once a suitable zombie has been found, performing a scan is easy. Simply specify the zombie hostname to the -sI option and Nmap does the rest. Example 5.19 shows an example of Ereet scanning the Recording Industry Association of America by bouncing an idle scan off an Adobe machine named Kiosk.

  Example 5.19. An idle scan against the RIAA

  # nmap -Pn -p- -sI kiosk.adobe.com www.riaa.com

  Starting Nmap ( http://nmap.org ) Idlescan using zombie kiosk.adobe.com (192.150.13.111:80); Class: Incremental Nmap scan report for 208.225.90.120 (The 65522 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 25/tcp open smtp 80/tcp open http 111/tcp open sunrpc 135/tcp open loc-srv 443/tcp open https 1027/tcp open IIS 1030/tcp open iad1 2306/tcp open unknown 5631/tcp open pcanywheredata 7937/tcp open unknown 7938/tcp open unknown 36890/tcp open unknown

  Nmap done: 1 IP address (1 host up) scanned in 2594.47 seconds

  https://nmap.org/book/idlescan.html

• Question 173:

  Vlady works in a fishing company where the majority of the employees have very little understanding of IT let alone IT Security. Several information security issues that Vlady often found includes, employees sharing password, writing his/her password on a post it note and stick it to his/her desk, leaving the computer unlocked, didn't log out from emails or other social media accounts, and etc. After discussing with his boss, Vlady decided to make some changes to improve the security environment in his company. The first thing that Vlady wanted to do is to make the employees understand the importance of keeping confidential information, such as password, a secret and they should not share it with other persons. Which of the following steps should be the first thing that Vlady should do to make the employees in his company understand to importance of keeping confidential information a secret?

  A. Warning to those who write password on a post it note and put it on his/her desk

  B. Developing a strict information security policy

  C. Information security awareness training

  D. Conducting a one to one discussion with the other employees about the importance of information security

  Correct Answer: A

• Question 174:

  Nicolas just found a vulnerability on a public-facing system that is considered a zero-day vulnerability. He sent an email to the owner of the public system describing the problem and how the owner can protect themselves from that vulnerability. He also sent an email to Microsoft informing them of the problem that their systems are exposed to. What type of hacker is Nicolas?

  A. Red hat

  B. White hat

  C. Black hat

  D. Gray hat

  Correct Answer: B

  A white hat (or a white hat hacker) is an ethical computer hacker, or a computer security expert, who focuses on penetration testing and in other testing methodologies that ensures the safety of an organization's information systems. Ethical hacking may be a term meant to imply a broader category than simply penetration testing. Contrasted with black hat, a malicious hacker, the name comes from Western films, where heroic and antagonistic cowboys might traditionally wear a white and a black hat respectively. While a white hat hacker hacks under good intentions with permission, and a black hat hacker, most frequently unauthorized, has malicious intent, there's a 3rd kind referred to as a gray hat hacker who hacks with good intentions but sometimes without permission.White hat hackers can also add teams called "sneakers and/or hacker clubs",red teams, or tiger teams.While penetration testing concentrates on attacking software and computer systems from the beginning ?scanning ports, examining known defects in protocols and applications running on the system and patch installations, as an example ?ethical hacking may include other things. A full-blown ethical hack might include emailing staff to invite password details, searching through executive's dustbins and typically breaking and entering, without the knowledge and consent of the targets. Only the owners, CEOs and Board Members (stake holders) who asked for such a censoring of this magnitude are aware. to undertake to duplicate a number of the destructive techniques a true attack might employ, ethical hackers may arrange for cloned test systems, or organize a hack late in the dark while systems are less critical. In most up-to-date cases these hacks perpetuate for the long-term con (days, if not weeks, of long-term human infiltration into an organization). Some examples include leaving USB/flash key drives with hidden auto-start software during a public area as if someone lost the tiny drive and an unsuspecting employee found it and took it.Some other methods of completing these include:?DoS attacks?Social engineering tactics?Reverse engineering? Network security?Disk and memory forensics?Vulnerability research?Security scanners such as:?W3af?Nessus?Burp suite?Frameworks such as:?Metasploit?Training PlatformsThese methods identify and exploit known security vulnerabilities and plan to evade security to realize entry into secured areas. they're ready to do that by hiding software and system `back-doors' which will be used as a link to information or access that a non-ethical hacker, also referred to as `black-hat' or `grey-hat', might want to succeed in .

• Question 175:

  You are logged in as a local admin on a Windows 7 system and you need to launch the Computer Management Console from command line. Which command would you use?

  A. c:\compmgmt.msc

  B. c:\services.msc

  C. c:\ncpa.cp

  D. c:\gpedit

  Correct Answer: A

  To start the Computer Management Console from command line just type compmgmt.msc /computer:computername in your run box or at the command line and it should automatically open the Computer Management console.

  References: http://www.waynezim.com/tag/compmgmtmsc/

• Question 176:

  Which of the following tools performs comprehensive tests against web servers, including dangerous files and CGIs?

  A. Nikto

  B. John the Ripper

  C. Dsniff

  D. Snort

  Correct Answer: A

  https://en.wikipedia.org/wiki/Nikto_(vulnerability_scanner) Nikto is a free software command-line vulnerability scanner that scans web servers for dangerous files/CGIs, outdated server software, and other problems. It performs generic and server types specific checks. It also captures and prints any cookies received. The Nikto code itself is free software, but the data files it uses to drive the program are not.

• Question 177:

  Which Metasploit Framework tool can help penetration tester for evading Anti-virus Systems?

  A. msfpayload

  B. msfcli

  C. msfd

  D. msfencode

  Correct Answer: D

  https://www.offensive-security.com/metasploit-unleashed/msfencode/ One of the best ways to avoid being stopped by antivirus software is to encode our payload with msfencode. Msfencode is a useful tool that alters the code in an executable so that it looks different to antivirus software but will still run the same way. Much as the binary attachment in email is encoded in Base64, msfencode encodes the original executable in a new binary. Then, when the executable is run, msfencode decodes the original code into memory and exe-cutes it.

• Question 178:

  Attacker Rony Installed a rogue access point within an organization's perimeter and attempted to Intrude into its internal network. Johnson, a security auditor, identified some unusual traffic in the internal network that is aimed at cracking the authentication mechanism. He immediately turned off the targeted network and tested for any weak and outdated security mechanisms that are open to attack. What is the type of vulnerability assessment performed by Johnson in the above scenario?

  A. Distributed assessment

  B. Wireless network assessment

  C. Most-based assessment

  D. Application assessment

  Correct Answer: B

  Expanding your network capabilities are often done well using wireless networks, but it also can be a source of harm to your data system . Deficiencies in its implementations or configurations can allow tip to be accessed in an unauthorized manner.This makes it imperative to closely monitor your wireless network while also conducting periodic Wireless Network assessment.It identifies flaws and provides an unadulterated view of exactly how vulnerable your systems are to malicious and unauthorized accesses.Identifying misconfigurations and inconsistencies in wireless implementations and rogue access points can improve your security posture and achieve compliance with regulatory frameworks.

• Question 179:

  A large mobile telephony and data network operator has a data center that houses network elements. These are essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS systems. What is the best security policy concerning this setup?

  A. Network elements must be hardened with user ids and strong passwords. Regular security tests and audits should be performed.

  B. As long as the physical access to the network elements is restricted, there is no need for additional measures.

  C. There is no need for specific security measures on the network elements as long as firewalls and IPS systems exist.

  D. The operator knows that attacks and down time are inevitable and should have a backup site.

  Correct Answer: A

• Question 180:

  Which of the following web vulnerabilities would an attacker be attempting to exploit if they delivered the following input?

  ] >

  A. XXE

  B. SQLi

  C. IDOR

  D. XXS

  Correct Answer: A