EC-COUNCIL EC-COUNCIL Certifications 312-50V12 Questions & Answers

• Question 391:

  Widespread fraud ac Enron. WorldCom, and Tyco led to the creation of a law that was designed to improve the accuracy and accountability of corporate disclosures. It covers accounting firms and third parties that provide financial services to some organizations and came into effect in 2002. This law is known by what acronym?

  A. Fed RAMP

  B. PCIDSS

  C. SOX

  D. HIPAA

  Correct Answer: C

  The Sarbanes-Oxley Act of 2002 could be a law the U.S. Congress passed on July thirty of that year to assist defend investors from fallacious money coverage by companies.Also called the SOX Act of 2002 and also the company Responsibility Act of 2002, it mandated strict reforms to existing securities rules and obligatory powerful new penalties on law breakers. The Sarbanes-Oxley law Act of 2002 came in response to money scandals within the early 2000s involving in public listed corporations like Enron Corporation, Tyco International plc, and WorldCom. The high-profile frauds cask capitalist confidence within the trustiness of company money statements Associate in Nursingd light-emitting diode several to demand an overhaul of decades-old restrictive standards.

• Question 392:

  Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:

  Username: attack' or 1=1 Password: 123456

  Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

  A. select * from Users where UserName = `attack' ' or 1=1 -- and UserPassword = `123456'

  B. select * from Users where UserName = `attack' or 1=1 -- and UserPassword = `123456'

  C. select * from Users where UserName = `attack or 1=1 -- and UserPassword = `123456'

  D. select * from Users where UserName = `attack' or 1=1 --' and UserPassword = `123456'

  Correct Answer: A

• Question 393:

  You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address was blacklisted just before the alert. You are starting an investigation to roughly analyze the severity of the situation. Which of the following is appropriate to analyze?

  A. IDS log

  B. Event logs on domain controller

  C. Internet Firewall/Proxy log.

  D. Event logs on the PC

  Correct Answer: C

• Question 394:

  When a security analyst prepares for the formal security assessment - what of the following should be done in order to determine inconsistencies in the secure assets database and verify that system is compliant to the minimum security baseline?

  A. Data items and vulnerability scanning

  B. Interviewing employees and network engineers

  C. Reviewing the firewalls configuration

  D. Source code review

  Correct Answer: A

• Question 395:

  A Security Engineer at a medium-sized accounting firm has been tasked with discovering how much information can be obtained from the firm's public facing web servers. The engineer decides to start by using netcat to port 80.

  The engineer receives this output:

  HTTP/1.1 200 OK Server: Microsoft-IIS/6 Expires: Tue, 17 Jan 2011 01:41:33 GMT Date: Mon, 16 Jan 2011 01:41:33 GMT Content-Type: text/html Accept-Ranges: bytes Last Modified: Wed, 28 Dec 2010 15:32:21 GMT ETag:"b0aac0542e25c31:89d" Content-Length: 7369

  Which of the following is an example of what the engineer performed?

  A. Banner grabbing

  B. SQL injection

  C. Whois database query

  D. Cross-site scripting

  Correct Answer: A

• Question 396:

  Samuel, a professional hacker, monitored and Intercepted already established traffic between Bob and a host machine to predict Bob's ISN. Using this ISN, Samuel sent spoofed packets with Bob's IP address to the host machine. The host machine responded with <| packet having an Incremented ISN. Consequently, Bob's connection got hung, and Samuel was able to communicate with the host machine on behalf of Bob. What is the type of attack performed by Samuel in the above scenario?

  A. UDP hijacking

  B. Blind hijacking

  C. TCP/IP hacking

  D. Forbidden attack

  Correct Answer: C

  A TCP/IP hijack is an attack that spoofs a server into thinking it's talking with a sound client, once actually it's communication with an assaulter that has condemned (or hijacked) the tcp session. Assume that the client has administrator-level privileges, which the attacker needs to steal that authority so as to form a brand new account with root-level access of the server to be used afterward. A tcp Hijacking is sort of a two-phased man-in- the-middle attack. The man-in-the-middle assaulter lurks within the circuit between a shopper and a server so as to work out what port and sequence numbers are being employed for the conversation. First, the attacker knocks out the client with an attack, like Ping of Death, or ties it up with some reasonably ICMP storm. This renders the client unable to transmit any packets to the server. Then, with the client crashed, the attacker assumes the client's identity so as to talk with the server. By this suggests, the attacker gains administrator-level access to the server. One of the most effective means of preventing a hijack attack is to want a secret, that's a shared secret between the shopper and also the server. looking on the strength of security desired, the key may be used for random exchanges. this is often once a client and server periodically challenge each other, or it will occur with each exchange, like Kerberos.

• Question 397:

  The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below:

  You are hired to conduct security testing on their network.

  You successfully brute-force the SNMP community string using a SNMP crack tool.

  The access-list configured at the router prevents you from establishing a successful connection. You want to retrieve the Cisco configuration from the router. How would you proceed?

  A. Use the Cisco's TFTP default password to connect and download the configuration file

  B. Run a network sniffer and capture the returned traffic with the configuration file from the router

  C. Run Generic Routing Encapsulation (GRE) tunneling protocol from your computer to the router masking your IP address

  D. Send a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0

  Correct Answer: BD

• Question 398:

  Which wireless security protocol replaces the personal pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) and is therefore resistant to offline dictionary attacks?

  A. WPA3-Personal

  B. WPA2-Enterprise

  C. Bluetooth

  D. ZigBee

  Correct Answer: A

• Question 399:

  If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?

  A. Birthday

  B. Brute force

  C. Man-in-the-middle

  D. Smurf

  Correct Answer: B

• Question 400:

  What would be the purpose of running "wget 192.168.0.15 -q -S" against a web server?

  A. Performing content enumeration on the web server to discover hidden folders

  B. Using wget to perform banner grabbing on the webserver

  C. Flooding the web server with requests to perform a DoS attack

  D. Downloading all the contents of the web page locally for further examination

  Correct Answer: B

  -q, --quiet quiet (no output) -S, --server-response print server response