EC-COUNCIL 312-50V7 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V7 Online Questions & Answers

• Question 101:

  Bret is a web application administrator and has just read that there are a number of surprisingly common web application vulnerabilities that can be exploited by unsophisticated attackers with easily available tools on the Internet. He has also read that when an organization deploys a web application, they invite the world to send HTTP requests. Attacks buried in these requests sail past firewalls, filters, platform hardening, SSL, and IDS without notice because they are inside legal HTTP requests. Bret is determined to weed out vulnerabilities.

  What are some of the common vulnerabilities in web applications that he should be concerned about?

  A. Non-validated parameters, broken access control, broken account and session management, cross- site scripting and buffer overflows are just a few common vulnerabilities
  B. Visible clear text passwords, anonymous user account set as default, missing latest security patch, no firewall filters set and no SSL configured are just a few common vulnerabilities
  C. No SSL configured, anonymous user account set as default, missing latest security patch, no firewall filters set and an inattentive system administrator are just a few common vulnerabilities
  D. No IDS configured, anonymous user account set as default, missing latest security patch, no firewall filters set and visible clear text passwords are just a few common vulnerabilities
  A. Non-validated parameters, broken access control, broken account and session management, cross- site scripting and buffer overflows are just a few common vulnerabilities

• Question 102:

  One of the most common and the best way of cracking RSA encryption is to begin to derive the two prime numbers, which are used in the RSA PKI mathematical process. If the two numbers p and q are discovered through a _____________ process, then the private key can be derived.

  A. Factorization
  B. Prime Detection
  C. Hashing
  D. Brute-forcing
  A. Factorization

• Question 103:

  A hacker is attempting to see which ports have been left open on a network. Which NMAP switch would the hacker use?

  A. -sO
  B. -sP
  C. -sS
  D. -sU
  A. -sO

• Question 104:

  Which of the following is a symmetric cryptographic standard?

  A. DSA
  B. PKI
  C. RSA
  D. 3DES
  D. 3DES

• Question 105:

  A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news articles online about the bank, watching what times the bank employees come into work and leave from work, searching the bank's job postings (paying special attention to IT related jobs), and visiting the local dumpster for the bank's corporate office. What phase of the penetration test is the tester currently in?

  A. Information reporting
  B. Vulnerability assessment
  C. Active information gathering
  D. Passive information gathering
  D. Passive information gathering

• Question 106:

  When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?

  A. Network tap
  B. Layer 3 switch
  C. Network bridge
  D. Application firewall
  A. Network tap

• Question 107:

  What results will the following command yielD. 'NMAP -sS -O -p 123-153 192.168.100.3'?

  A. A stealth scan, opening port 123 and 153
  B. A stealth scan, checking open ports 123 to 153
  C. A stealth scan, checking all open ports excluding ports 123 to 153
  D. A stealth scan, determine operating system, and scanning ports 123 to 153
  D. A stealth scan, determine operating system, and scanning ports 123 to 153

• Question 108:

  Bluetooth uses which digital modulation technique to exchange information between paired devices?

  A. PSK (phase-shift keying)
  B. FSK (frequency-shift keying)
  C. ASK (amplitude-shift keying)
  D. QAM (quadrature amplitude modulation)
  A. PSK (phase-shift keying)

• Question 109:

  Which of the following descriptions is true about a static NAT?

  A. A static NAT uses a many-to-many mapping.
  B. A static NAT uses a one-to-many mapping.
  C. A static NAT uses a many-to-one mapping.
  D. A static NAT uses a one-to-one mapping.
  D. A static NAT uses a one-to-one mapping.

• Question 110:

  Attacking well-known system defaults is one of the most common hacker attacks. Most software is shipped with a default configuration that makes it easy to install and setup the application. You should change the default settings to secure the system.

  Which of the following is NOT an example of default installation?

  A. Many systems come with default user accounts with well-known passwords that administrators forget to change
  B. Often, the default location of installation files can be exploited which allows a hacker to retrieve a file from the system
  C. Many software packages come with "samples" that can be exploited, such as the sample programs on IIS web services
  D. Enabling firewall and anti-virus software on the local system
  D. Enabling firewall and anti-virus software on the local system