EC-COUNCIL 312-50V12 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V12 Online Questions & Answers

• Question 461:

  What kind of detection techniques is being used in antivirus softwares that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it's made on the premiers environment?

  A. VCloud based
  B. Honypot based
  C. Behaviour based
  D. Heuristics based
  A. VCloud based

• Question 462:

  A hacker has successfully infected an internet-facing server which he will then use to send junk mail, take part in coordinated attacks, or host junk email content. Which sort of trojan infects this server?

  A. Botnet Trojan
  B. Banking Trojans
  C. Turtle Trojans
  D. Ransomware Trojans
  A. Botnet Trojan

• Question 463:

  While using your bank's online servicing you notice the following string in the URL bar:

  "http: // www. MyPersonalBank.com/account?id=368940911028389andDamount=10980andCamount=21"

  You observe that if you modify the Damount and Camount values and submit the request, that data on the web page reflects the changes.

  Which type of vulnerability is present on this site?

  A. Cookie Tampering
  B. SQL Injection
  C. Web Parameter Tampering
  D. XSS Reflection
  C. Web Parameter Tampering

• Question 464:

  Your company performs penetration tests and security assessments for small and medium- sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human

  trafficking.

  What should you do?

  A. Confront the client in a respectful manner and ask her about the data.
  B. Copy the data to removable media and keep it in case you need it.
  C. Ignore the data and continue the assessment until completed as agreed.
  D. Immediately stop work and contact the proper legal authorities.
  D. Immediately stop work and contact the proper legal authorities.

• Question 465:

  Johnson, an attacker, performed online research for the contact details of reputed cybersecurity firms. He found the contact number of sibertech.org and dialed the number, claiming himself to represent a technical support team from a

  vendor. He warned that a specific server is about to be compromised and requested sibertech.org to follow the provided instructions. Consequently, he prompted the victim to execute unusual commands and install malicious files, which were

  then used to collect and pass critical Information to Johnson's machine.

  What is the social engineering technique Steve employed in the above scenario?

  A. Quid pro quo
  B. Diversion theft
  C. Elicitation
  D. Phishing
  A. Quid pro quo

  ---

  Explanation/Reference:

  https://www.eccouncil.org/what-is-social-engineering/ This Social Engineering scam involves an exchange of information that can benefit both the victim and the trickster. Scammers would make the prey believe that a fair exchange will be present between both sides, but in reality, only the fraudster stands to benefit, leaving the victim hanging on to nothing. An example of a Quid Pro Quo is a scammer pretending to be an IT support technician. The con artist asks for the login credentials of the company's computer saying that the company is going to receive technical support in return. Once the victim has provided the credentials, the scammer now has control over the company's computer and may possibly load malware or steal personal information that can be a motive to commit identity theft.

  "A quid pro quo attack (aka something for something" attack) is a variant of baiting. Instead of baiting a target with the promise of a good, a quid pro quo attack promises a service or a benefit based on the execution of a specific action." https://resources.infosecinstitute.com/topic/common-social-engineering- attacks/#:~:text=A%20quid%20pro%20quo%20attack,execution%20of%20a%20specific%2 0action.

• Question 466:

  Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a

  benign user Ned.

  Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?

  A. "GET /restricted/goldtransfer?to=Robandfrom=1 or 1=1' HTTP/1.1Host: westbank.com"
  B. "GET /restricted/\r\n\%00account%00Ned%00access HTTP/1.1 Host: westbank.com"
  C. "GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com"
  D. "GET /restricted/ HTTP/1.1 Host: westbank.com
  C. "GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com"

  ---

  Explanation/Reference:

  This question shows a classic example of an IDOR vulnerability. Rob substitutes Ned's name in the "name" parameter and if the developer has not fixed this vulnerability, then Rob will gain access to Ned's account. Below you will find more detailed information about IDOR vulnerability.

  Insecure direct object references (IDOR) are a cybersecurity issue that occurs when a web application developer uses an identifier for direct access to an internal implementation object but provides no additional access control and/or authorization checks. For example, an IDOR vulnerability would happen if the URL of a transaction could be changed through client-side user input to show unauthorized data of another transaction. Most web applications use simple IDs to reference objects. For example, a user in a database will usually be referred to via the user ID. The same user ID is the primary key to the database column containing user information and is generated automatically. The database key generation algorithm is very simple: it usually uses the next available integer. The same database ID generation mechanisms are used for all other types of database records. The approach described above is legitimate but not recommended because it could enable the attacker to enumerate all users. If it's necessary to maintain this approach, the developer must at least make absolutely sure that more than just a reference is needed to access resources. For example, let's say that the web application displays transaction details using the following URL: https://www.example.com/transaction.php?id=74656 A malicious hacker could try to substitute the id parameter value 74656 with other similar values, for example: https://www.example.com/transaction.php?id=74657 The 74657 transaction could be a valid transaction belonging to another user. The malicious hacker should not be authorized to see it. However, if the developer made an error, the attacker would see this transaction and hence we would have an insecure direct object reference vulnerability.

• Question 467:

  Which Metasploit Framework tool can help penetration tester for evading Anti-virus Systems?

  A. msfpayload
  B. msfcli
  C. msfd
  D. msfencode
  D. msfencode

  ---

  Explanation/Reference:

  https://www.offensive-security.com/metasploit-unleashed/msfencode/ One of the best ways to avoid being stopped by antivirus software is to encode our payload with msfencode. Msfencode is a useful tool that alters the code in an executable so that it looks different to antivirus software but will still run the same way. Much as the binary attachment in email is encoded in Base64, msfencode encodes the original executable in a new binary. Then, when the executable is run, msfencode decodes the original code into memory and exe-cutes it.

• Question 468:

  Josh has finished scanning a network and has discovered multiple vulnerable services. He knows that several of these usually have protections against external sources but are frequently susceptible to internal users. He decides to draft an email, spoof the sender as the internal IT team, and attach a malicious file disguised as a financial spreadsheet. Before Josh sends the email, he decides to investigate other methods of getting the file onto the system. For this particular attempt, what was the last stage of the cyber kill chain that Josh performed?

  A. Exploitation
  B. Weaponization
  C. Delivery
  D. Reconnaissance
  B. Weaponization

• Question 469:

  Which of the following information security controls creates an appealing isolated environment for hackers to prevent them from compromising critical targets while simultaneously gathering information about the hacker?

  A. intrusion detection system
  B. Honeypot
  C. Botnet
  D. Firewall
  B. Honeypot

  ---

  Explanation/Reference:

  A honeypot may be a trap that an IT pro lays for a malicious hacker, hoping that they will interact with it during a way that gives useful intelligence. It's one among the oldest security measures in IT, but beware: luring hackers onto your network, even on an isolated system, are often a dangerous game.honeypot may be a good starting place: "A honeypot may be a computer or computing system intended to mimic likely targets of cyberattacks." Often a honeypot are going to be deliberately configured with known vulnerabilities in situation to form a more tempting or obvious target for attackers. A honeypot won't contain production data or participate in legitimate traffic on your network -- that's how you'll tell anything happening within it's a results of an attack. If someone's stopping by, they're up to no good.That definition covers a various array of systems, from bare-bones virtual machines that only offer a couple of vulnerable systems to ornately constructed fake networks spanning multiple servers. and therefore the goals of these who build honeypots can vary widely also , starting from defense thorough to academic research. additionally , there's now an entire marketing category of deception technology that, while not meeting the strict definition of a honeypot, is certainly within the same family. But we'll get thereto during a moment.honeypots aim to permit close analysis of how hackers do their dirty work. The team controlling the honeypot can watch the techniques hackers use to infiltrate systems, escalate privileges, and otherwise run amok through target networks. These sorts of honeypots are found out by security companies, academics, and government agencies looking to look at the threat landscape. Their creators could also be curious about learning what kind of attacks are out there, getting details on how specific sorts of attacks work, or maybe trying to lure a specific hackers within the hopes of tracing the attack back to its source. These systems are often inbuilt fully isolated lab environments, which ensures that any breaches don't end in non-honeypot machines falling prey to attacks.Production honeypots, on the opposite hand, are usually deployed in proximity to some organization's production infrastructure, though measures are taken to isolate it the maximum amount as possible. These honeypots often serve both as bait to distract hackers who could also be trying to interrupt into that organization's network, keeping them faraway from valuable data or services; they will also function a canary within the coalpit , indicating that attacks are underway and are a minimum of partially succeeding.

• Question 470:

  Which address translation scheme would allow a single public IP address to always correspond to a single machine on an internal network, allowing "server publishing"?

  A. Overloading Port Address Translation
  B. Dynamic Port Address Translation
  C. Dynamic Network Address Translation
  D. Static Network Address Translation
  D. Static Network Address Translation