EC-COUNCIL EC-COUNCIL Certifications 312-50V12 Questions & Answers

• Question 411:

  A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers.

  A. Use port security on his switches.

  B. Use a tool like ARPwatch to monitor for strange ARP activity.

  C. Use a firewall between all LAN segments.

  D. If you have a small network, use static ARP entries.

  E. Use only static IP addresses on all PC's.

  Correct Answer: ABD

• Question 412:

  Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?

  A. The switches will drop into hub mode if the ARP cache is successfully flooded.

  B. If the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to attacks.

  C. Depending on the switch manufacturer, the device will either delete every entry in its ARP cache or reroute packets to the nearest switch.

  D. The switches will route all traffic to the broadcast address created collisions.

  Correct Answer: A

• Question 413:

  What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?

  A. Copy the system files from a known good system

  B. Perform a trap and trace

  C. Delete the files and try to determine the source

  D. Reload from a previous backup

  E. Reload from known good media

  Correct Answer: E

• Question 414:

  Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered. John decided to perform a TCP SYN ping scan on the target network. Which of the following Nmap commands must John use to perform the TCP SVN ping scan?

  A. nmap -sn -pp < target ip address >

  B. nmap -sn -PO < target IP address >

  C. Anmap -sn -PS < target IP address >

  D. nmap -sn -PA < target IP address >

  Correct Answer: C

  https://hub.packtpub.com/discovering-network-hosts-with-tcp-syn-and-tcp-ack-ping-scans-in-nmaptutorial/

• Question 415:

  To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1

  using https.

  Which of the following firewall rules meets this requirement?

  A. If (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 443) then permit

  B. If (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 80 or 443) then permit

  C. If (source matches 10.20.20.1 and destination matches 10.10.10.0/24 and port matches 443) then permit

  D. If (source matches 10.10.10.0 and destination matches 10.20.20.1 and port matches 443) then permit

  Correct Answer: A

• Question 416:

  What is the purpose of DNS AAAA record?

  A. Authorization, Authentication and Auditing record

  B. Address prefix record

  C. Address database record

  D. IPv6 address resolution record

  Correct Answer: D

• Question 417:

  Which definition among those given below best describes a covert channel?

  A. A server program using a port that is not well known.

  B. Making use of a protocol in a way it is not intended to be used.

  C. It is the multiplexing taking place on a communication link.

  D. It is one of the weak channels used by WEP which makes it insecure

  Correct Answer: B

• Question 418:

  What is the proper response for a NULL scan if the port is open?

  A. SYN

  B. ACK

  C. FIN

  D. PSH

  E. RST

  F. No response

  Correct Answer: F

• Question 419:

  Which of the following is the primary objective of a rootkit?

  A. It opens a port to provide an unauthorized service

  B. It creates a buffer overflow

  C. It replaces legitimate programs

  D. It provides an undocumented opening in a program

  Correct Answer: C

• Question 420:

  Which of the following antennas is commonly used in communications for a frequency band of 10 MHz to VHF and UHF?

  A. Yagi antenna

  B. Dipole antenna

  C. Parabolic grid antenna

  D. Omnidirectional antenna

  Correct Answer: A