EC-COUNCIL EC-COUNCIL Certifications 312-50V12 Questions & Answers

• Question 241:

  Which of the following protocols can be used to secure an LDAP service against anonymous queries?

  A. SSO

  B. RADIUS

  C. WPA

  D. NTLM

  Correct Answer: D

  In a Windows network, nongovernmental organization (New Technology) local area network Manager (NTLM) could be a suite of Microsoft security protocols supposed to produce authentication, integrity, and confidentiality to users.NTLM is that the successor to the authentication protocol in Microsoft local area network Manager (LANMAN), Associate in Nursing older Microsoft product. The NTLM protocol suite is enforced in an exceedingly Security Support supplier, which mixes the local area network Manager authentication protocol, NTLMv1, NTLMv2 and NTLM2 Session protocols in an exceedingly single package. whether or not these protocols area unit used or will be used on a system is ruled by cluster Policy settings, that totally different|completely different} versions of Windows have different default settings. NTLM passwords area unit thought-about weak as a result of they will be brute-forced very simply with fashionable hardware. NTLM could be a challenge-response authentication protocol that uses 3 messages to authenticate a consumer in an exceedingly affiliation orientating setting (connectionless is similar), and a fourth extra message if integrity is desired. First, the consumer establishes a network path to the server and sends a NEGOTIATE_MESSAGE advertising its capabilities. Next, the server responds with CHALLENGE_MESSAGE that is employed to determine the identity of the consumer. Finally, the consumer responds to the challenge with Associate in Nursing AUTHENTICATE_MESSAGE. The NTLM protocol uses one or each of 2 hashed word values, each of that are keep on the server (or domain controller), and that through a scarcity of seasoning area unit word equivalent, that means that if you grab the hash price from the server, you'll evidence while not knowing the particular word. the 2 area unit the lm Hash (a DES-based operate applied to the primary fourteen chars of the word born-again to the standard eight bit laptop charset for the language), and also the nt Hash (MD4 of the insufficient endian UTF-16 Unicode password). each hash values area unit sixteen bytes (128 bits) every. The NTLM protocol additionally uses one among 2 a method functions, looking on the NTLM version. National Trust LanMan and NTLM version one use the DES primarily based LanMan a method operate (LMOWF), whereas National TrustLMv2 uses the NT MD4 primarily based a method operate (NTOWF).

• Question 242:

  ping-* 6 192.168.0.101

  Output:

  Pinging 192.168.0.101 with 32 bytes of data:

  Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

  Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

  Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

  Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

  Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

  Reply from 192.168.0.101:

  Ping statistics for 192.168.0101

  Packets: Sent = 6, Received = 6, Lost = 0 (0% loss).

  Approximate round trip times in milli-seconds:

  Minimum = 0ms, Maximum = 0ms, Average = 0ms

  What does the option * indicate?

  A. t

  B. s

  C. a

  D. n

  Correct Answer: D

• Question 243:

  What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?

  A. Residual risk

  B. Impact risk

  C. Deferred risk

  D. Inherent risk

  Correct Answer: A

  https://en.wikipedia.org/wiki/Residual_risk

  The residual risk is the risk or danger of an action or an event, a method or a (technical) process that, although being abreast with science, still conceives these dangers, even if all theoretically possible safety measures would be applied

  (scientifically conceivable measures); in other words, the amount of risk left over after natural or inherent risks have been reduced by risk controls.

  Residual risk = (Inherent risk) - (impact of risk controls)

• Question 244:

  Jude, a pen tester, examined a network from a hacker's perspective to identify exploits and vulnerabilities accessible to the outside world by using devices such as firewalls, routers, and servers. In this process, he also estimated the threat of

  network security attacks and determined the level of security of the corporate network.

  What is the type of vulnerability assessment that Jude performed on the organization?

  A. External assessment

  B. Passive assessment

  C. Host-based assessment

  D. Application assessment

  Correct Answer: A

• Question 245:

  CompanyXYZ has asked you to assess the security of their perimeter email gateway. From your office in New York, you craft a specially formatted email message and send it across the Internet to an employee of CompanyXYZ. The

  employee of CompanyXYZ is aware of your test. Your email message looks like this:

  From: [email protected]

  To: [email protected] Subject: Test message

  Date: 4/3/2017 14:37

  The employee of CompanyXYZ receives your email message.

  This proves that CompanyXYZ's email gateway doesn't prevent what?

  A. Email Masquerading

  B. Email Harvesting

  C. Email Phishing

  D. Email Spoofing

  Correct Answer: D

  Email spoofing is the fabrication of an email header in the hopes of duping the recipient into thinking the email originated from someone or somewhere other than the intended source. Because core email protocols do not have a built-in method of authentication, it is common for spam and phishing emails to use said spoofing to trick the recipient into trusting the origin of the message. The ultimate goal of email spoofing is to get recipients to open, and possibly even respond to, a solicitation. Although the spoofed messages are usually just a nuisance requiring little action besides removal, the more malicious varieties can cause significant problems and sometimes pose a real security threat.

• Question 246:

  Bob, a system administrator at TPNQM SA, concluded one day that a DMZ is not needed if he properly configures the firewall to allow access just to servers/ports, which can have direct internet access, and block the access to workstations.

  Bob also concluded that DMZ makes sense just when a stateful firewall is available, which is not the case of TPNQM SA.

  In this context, what can you say?

  A. Bob can be right since DMZ does not make sense when combined with stateless firewalls

  B. Bob is partially right. He does not need to separate networks if he can create rules by destination IPs, one by one

  C. Bob is totally wrong. DMZ is always relevant when the company has internet servers and workstations

  D. Bob is partially right. DMZ does not make sense when a stateless firewall is available

  Correct Answer: C

• Question 247:

  Bill is a network administrator. He wants to eliminate unencrypted traffic inside his company's network. He decides to setup a SPAN port and capture all traffic to the datacenter. He immediately discovers unencrypted traffic in port UDP 161. What protocol is this port using and how can he secure that traffic?

  A. it is not necessary to perform any actions, as SNMP is not carrying important information.

  B. SNMP and he should change it to SNMP V3

  C. RPC and the best practice is to disable RPC completely

  D. SNMP and he should change it to SNMP v2, which is encrypted

  Correct Answer: B

  We have various articles already in our documentation for setting up SNMPv2 trap handling in Opsview, but SNMPv3 traps are a whole new ballgame. They can be quite confusing and complicated to set up the first time you go through the process, but when you understand what is going on, everything should make more sense. SNMP has gone through several revisions to improve performance and security (version 1, 2c and 3). By default, it is a UDP port based protocol where communication is based on a `fire and forget' methodology in which network packets are sent to another device, but there is no check for receipt of that packet (versus TCP port when a network packet must be acknowledged by the other end of the communication link). There are two modes of operation with SNMP ?get requests (or polling) where one device requests information from an SNMP enabled device on a regular basis (normally using UDP port 161), and traps where the SNMP enabled device sends a message to another device when an event occurs (normally using UDP port 162). The latter includes instances such as someone logging on, the device powering up or down, or a wide variety of other problems that would need this type of investigation. This blog covers SNMPv3 traps, as polling and version 2c traps are covered elsewhere in our documentation. SNMP trapsSince SNMP is primarily a UDP port based system, traps may be `lost' when sending between devices; the sending device does not wait to see if the receiver got the trap. This means if the configuration on the sending device is wrong (using the wrong receiver IP address or port) or the receiver isn't listening for traps or rejecting them out of hand due to misconfiguration, the sender will never know. The SNMP v2c specification introduced the idea of splitting traps into two types; the original `hope it gets there' trap and the newer `INFORM' traps. Upon receipt of an INFORM, the receiver must send an acknowledgement back. If the sender doesn't get the acknowledgement back, then it knows there is an existing problem and can log it for sysadmins to find when they interrogate the device.

• Question 248:

  John is investigating web-application firewall logs and observers that someone is attempting to inject the following:

  char buff[10]; buff[>o] - 'a':

  What type of attack is this?

  A. CSRF

  B. XSS

  C. Buffer overflow

  D. SQL injection

  Correct Answer: C

  Buffer overflow this attack is an anomaly that happens when software writing data to a buffer overflows the buffer's capacity, leading to adjacent memory locations being overwritten. In other words, an excessive amount of information is being passed into a container that doesn't have enough space, which information finishes up replacing data in adjacent containers.Buffer overflows are often exploited by attackers with a goal of modifying a computer's memory so as to undermine or take hold of program execution.

  

  What's a buffer?A buffer, or data buffer, is a neighborhood of physical memory storage wont to temporarily store data while it's being moved from one place to a different . These buffers typically sleep in RAM memory. Computers frequently use buffers to assist improve performance; latest hard drives cash in of buffering to efficiently access data, and lots of online services also use buffers. for instance , buffers are frequently utilized in online video streaming to stop interruption. When a video is streamed, the video player downloads and stores perhaps 20% of the video at a time during a buffer then streams from that buffer. This way, minor drops in connection speed or quick service disruptions won't affect the video stream performance.Buffers are designed to contain specific amounts of knowledge . Unless the program utilizing the buffer has built-in instructions to discard data when an excessive amount of is shipped to the buffer, the program will overwrite data in memory adjacent to the buffer.Buffer overflows are often exploited by attackers to corrupt software. Despite being well-understood, buffer overflow attacks are still a serious security problem that torment cyber-security teams. In 2014 a threat referred to as `heartbleed' exposed many many users to attack due to a buffer overflow vulnerability in SSL software. How do attackers exploit buffer overflows?An attacker can deliberately feed a carefully crafted input into a program which will cause the program to undertake and store that input during a buffer that isn't large enough, overwriting portions of memory connected to the buffer space. If the memory layout of the program is well-defined, the attacker can deliberately overwrite areas known to contain executable code. The attacker can then replace this code together with his own executable code, which may drastically change how the program is meant to figure .For example if the overwritten part in memory contains a pointer (an object that points to a different place in memory) the attacker's code could replace that code with another pointer that points to an exploit payload. this will transfer control of the entire program over to theattacker's code.

• Question 249:

  Elliot is in the process of exploiting a web application that uses SQL as a back-end database. He's determined that the application is vulnerable to SQL injection, and has introduced conditional timing delays into injected queries to determine

  whether they are successful.

  What type of SQL injection is Elliot most likely performing?

  A. Error-based SQL injection

  B. Blind SQL injection

  C. Union-based SQL injection

  D. NoSQL injection

  Correct Answer: B

• Question 250:

  Alice, a professional hacker, targeted an organization's cloud services. She infiltrated the targets MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization. Which of the following cloud attacks did Alice perform in the above scenario?

  A. Cloud hopper attack

  B. Cloud cryptojacking

  C. Cloudborne attack

  D. Man-in-the-cloud (MITC) attack

  Correct Answer: A

  Operation Cloud Hopper was an in depth attack and theft of data in 2017 directed at MSP within the uk (U.K.), us (U.S.), Japan, Canada, Brazil, France, Switzerland, Norway, Finland, Sweden, South Africa , India, Thailand, South Korea and Australia. The group used MSP as intermediaries to accumulate assets and trade secrets from MSP client engineering, MSP industrial manufacturing, retail, energy, pharmaceuticals, telecommunications, and government agencies.Operation Cloud Hopper used over 70 variants of backdoors, malware and trojans. These were delivered through spear-phishing emails. The attacks scheduled tasks or leveraged services/utilities to continue Microsoft Windows systems albeit the pc system was rebooted. It installed malware and hacking tools to access systems and steal data.