EC-COUNCIL 312-50V12 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V12 Online Questions & Answers

• Question 321:

  A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named "nc." The FTP server's access logs show that the

  anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The "ps" command shows that the "nc" file is running as

  process, and the netstat command shows the "nc" process is listening on a network port.

  What kind of vulnerability must be present to make this remote attack possible?

  A. File system permissions
  B. Privilege escalation
  C. Directory traversal
  D. Brute force login
  A. File system permissions

  ---

  Explanation/Reference:

  File system permissions

  Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set,

  then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also

  execute under higher-level permissions, which could include SYSTEM.

  Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.

• Question 322:

  A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers.

  A. Use port security on his switches.
  B. Use a tool like ARPwatch to monitor for strange ARP activity.
  C. Use a firewall between all LAN segments.
  D. If you have a small network, use static ARP entries.
  E. Use only static IP addresses on all PC's.
  A. Use port security on his switches.
  B. Use a tool like ARPwatch to monitor for strange ARP activity.
  D. If you have a small network, use static ARP entries.

• Question 323:

  Which method of password cracking takes the most time and effort?

  A. Dictionary attack
  B. Shoulder surfing
  C. Rainbow tables
  D. Brute force
  D. Brute force

  ---

  Explanation/Reference:

  Brute-force attack when an attacker uses a set of predefined values to attack a target and analyze the response until he succeeds. Success depends on the set of predefined values. It will take more time if it is larger, but there is a better probability of success. In a traditional brute-force attack, the passcode or password is incrementally increased by one letter/number each time until the right passcode/password is found.

• Question 324:

  This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from the server. By observing the response, an attacker can extract sensitive information. What type of attack is this?

  A. Time-based SQL injection
  B. Union SQL injection
  C. Error-based SQL injection
  D. Blind SQL injection
  D. Blind SQL injection

• Question 325:

  The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1(100%). What is the closest approximate cost of this replacement and recovery operation per year?

  A. $1320
  B. $440
  C. $100
  D. $146
  D. $146

  ---

  Explanation/Reference:

  1.

  AV (Asset value) = $300 + (14 * $10) = $440 - the cost of a hard drive plus the work of a recovery person, i.e.how much would it take to replace 1 asset? 10 hours for resorting the OS and soft + 4 hours for DB restore multiplies by hourly rate of the recovery person.

  2.

  SLE (Single Loss Expectancy) = AV * EF (Exposure Factor) = $440 * 1 = $440

  3.

  ARO (Annual rate of occurrence) = 1/3 (every three years, meaning the probability of occurring during 1 years is 1/3)

  4.

  ALE (Annual Loss Expectancy) = SLE * ARO = 0.33 * $440 = $145.2

• Question 326:

  Rebecca, a security professional, wants to authenticate employees who use web services for safe and secure communication. In this process, she employs a component of the Web Service Architecture, which is an extension of SOAP, and it

  can maintain the integrity and confidentiality of SOAP messages.

  Which of the following components of the Web Service Architecture is used by Rebecca for securing the communication?

  A. WSDL
  B. WS Work Processes
  C. WS-Policy
  D. WS-Security
  D. WS-Security

• Question 327:

  Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a

  secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B.

  How do you prevent DNS spoofing?

  A. Install DNS logger and track vulnerable packets
  B. Disable DNS timeouts
  C. Install DNS Anti-spoofing
  D. Disable DNS Zone Transfer
  C. Install DNS Anti-spoofing

• Question 328:

  As a security analyst for Sky Secure Inc., you are working with a client that uses a multi- cloud strategy, utilizing services from several cloud providers. The client wants to implement a system that will provide unified security management across all their cloud platforms. They need a solution that allows them to consistently enforce security policies, identify and respond to threats, and maintain visibility of all their cloud resources. Which of the following should you recommend as the best solution?

  A. Use a hardware-based firewall to secure all cloud resources.
  B. implement separate security management tools for each cloud platform.
  C. Use a Cloud Access Security Broker (CASB).
  D. Rely on the built-in security features of each cloud platform.
  C. Use a Cloud Access Security Broker (CASB).

  ---

  Explanation/Reference:

  A Cloud Access Security Broker (CASB) is a security policy enforcement point, either on-premises or in the cloud, that administers an organization's enterprise security policies when users attempt to access its cloud-based resources. A CASB can provide unified security management across multiple cloud platforms, as it can monitor cloud activity, enforce security policies, identify and respond to threats, and maintain visibility of all cloud resources. A CASB can also integrate with other security tools, such as data loss prevention (DLP), encryption, malware detection, and identity and access management (IAM), to enhance the security posture of the organization. The other options are not as effective or feasible as using a CASB. Using a hardware- based firewall to secure all cloud resources may not be compatible with the dynamic and scalable nature of the cloud, as it may introduce latency, complexity, and cost. Implementing separate security management tools for each cloud platform may create inconsistency, inefficiency, and confusion, as each tool may have different features, interfaces, and configurations. Relying on the built-in security features of each cloud platform may not be sufficient or comprehensive, as each platform may have different levels of security, compliance, and functionality. References: What Is a Cloud Access Security Broker (CASB)? | Microsoft What Is a CASB? - Cloud Access Security Broker - Cisco What is a Cloud Access Security Broker (CASB)?

• Question 329:

  Peter, a Network Administrator, has come to you looking for advice on a tool that would help him perform SNMP queries over the network. Which of these tools would perform the SNMP enumeration he is looking for?

  A. SNMPUtil
  B. SNScan
  C. SNMPScan
  D. Solarwinds IP Network Browser
  E. NMap
  A. SNMPUtil
  B. SNScan
  D. Solarwinds IP Network Browser

• Question 330:

  In the context of password security, a simple dictionary attack involves loading a dictionary file (a text file full of dictionary words) into a cracking application such as L0phtCrack or John the Ripper, and running it against user accounts located by the application. The larger the word and word fragment selection, the more effective the dictionary attack is. The brute force method is the most inclusive, although slow. It usually tries every possible letter and number combination in its automated exploration. If you would use both brute force and dictionary methods combined together to have variation of words, what would you call such an attack?

  A. Full Blown
  B. Thorough
  C. Hybrid
  D. BruteDics
  C. Hybrid