EC-COUNCIL EC-COUNCIL Certifications 312-50V7 Questions & Answers

• Question 121:

  A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The

  customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying.

  What actions should the CEH take?

  A. Threaten to publish the penetration test results if not paid.

  B. Follow proper legal procedures against the company to request payment.

  C. Tell other customers of the financial problems with payments from this company.

  D. Exploit some of the vulnerabilities found on the company webserver to deface it.

  Correct Answer: B

• Question 122:

  Which type of security document is written with specific step-by-step details?

  A. Process

  B. Procedure

  C. Policy

  D. Paradigm

  Correct Answer: B

• Question 123:

  Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. Which of the following is the correct bit size of the Diffie-Hellman (DH) group 5?

  A. 768 bit key

  B. 1025 bit key

  C. 1536 bit key

  D. 2048 bit key

  Correct Answer: C

• Question 124:

  Which results will be returned with the following Google search query? site:target.com -site:Marketing.target.com accounting

  A. Results matching all words in the query

  B. Results matching "accounting" in domain target.com but not on the site Marketing.target.com

  C. Results from matches on the site marketing.target.com that are in the domain target.com but do not include the word accounting

  D. Results for matches on target.com and Marketing.target.com that include the word "accounting"

  Correct Answer: B

• Question 125:

  One advantage of an application-level firewall is the ability to

  A. filter packets at the network level.

  B. filter specific commands, such as http:post.

  C. retain state information for each packet.

  D. monitor tcp handshaking.

  Correct Answer: B

• Question 126:

  Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them?

  A. Detective

  B. Passive

  C. Intuitive

  D. Reactive

  Correct Answer: B

• Question 127:

  Which of the following settings enables Nessus to detect when it is sending too many packets and the network pipe is approaching capacity?

  A. Netstat WMI Scan

  B. Silent Dependencies

  C. Consider unscanned ports as closed

  D. Reduce parallel connections on congestion

  Correct Answer: D

• Question 128:

  Which solution can be used to emulate computer services, such as mail and ftp, and to capture information related to logins or actions?

  A. Firewall

  B. Honeypot

  C. Core server

  D. Layer 4 switch

  Correct Answer: B

• Question 129:

  A network administrator received an administrative alert at 3:00 a.m. from the intrusion detection system. The alert was generated because a large number of packets were coming into the network over ports 20 and 21. During analysis, there were no signs of attack on the FTP servers. How should the administrator classify this situation?

  A. True negatives

  B. False negatives

  C. True positives

  D. False positives

  Correct Answer: D

• Question 130:

  The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:

  Time:Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:17 Port:21 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:19 Port:22 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:21 Port:23 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:22 Port:25 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:23 Port:80 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:30 Port:443 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP

  What type of activity has been logged?

  A. Port scan targeting 192.168.1.103

  B. Teardrop attack targeting 192.168.1.106

  C. Denial of service attack targeting 192.168.1.103

  D. Port scan targeting 192.168.1.106

  Correct Answer: D