EC-COUNCIL 312-50V7 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V7 Online Questions & Answers

• Question 321:

  What is the main advantage that a network-based IDS/IPS system has over a host-based solution?

  A. They do not use host system resources.
  B. They are placed at the boundary, allowing them to inspect all traffic.
  C. They are easier to install and configure.
  D. They will not interfere with user interfaces.
  A. They do not use host system resources.

• Question 322:

  What is the correct command to run Netcat on a server using port 56 that spawns command shell when connected?

  

  A. nc -port 56 -s cmd.exe
  B. nc -p 56 -p -e shell.exe
  C. nc -r 56 -c cmd.exe
  D. nc -L 56 -t -e cmd.exe
  D. nc -L 56 -t -e cmd.exe

• Question 323:

  Which of the following represent weak password? (Select 2 answers)

  A. Passwords that contain letters, special characters, and numbers ExamplE. ap1$%##f@52
  B. Passwords that contain only numbers ExamplE. 23698217
  C. Passwords that contain only special characters ExamplE. and*#@!(%)
  D. Passwords that contain letters and numbers ExamplE. meerdfget123
  E. Passwords that contain only letters ExamplE. QWERTYKLRTY
  F. Passwords that contain only special characters and numbers ExamplE. 123@$45
  G. Passwords that contain only letters and special characters ExamplE. bob@andba
  H. Passwords that contain Uppercase/Lowercase from a dictionary list ExamplE. OrAnGe
  E. Passwords that contain only letters ExamplE. QWERTYKLRTY
  H. Passwords that contain Uppercase/Lowercase from a dictionary list ExamplE. OrAnGe

• Question 324:

  Syslog is a standard for logging program messages. It allows separation of the software that generates messages from the system that stores them and the software that reports and analyzes them. It also provides devices, which would otherwise be unable to communicate a means to notify administrators of problems or performance.

  

  What default port Syslog daemon listens on?

  A. 242
  B. 312
  C. 416
  D. 514
  D. 514

• Question 325:

  NTP allows you to set the clocks on your systems very accurately, to within 100ms and sometimes- even 10ms. Knowing the exact time is extremely important for enterprise security. Various security protocols depend on an accurate source of time information in order to prevent "playback" attacks. These protocols tag their communications with the current time, to prevent attackers from replaying the same communications, e.g., a login/password interaction or even an entire communication, at a later date. One can circumvent this tagging, if the clock can be set back to the time the communication was recorded. An attacker attempts to try corrupting the clocks on devices on your network. You run Wireshark to detect the NTP traffic to see if there are any irregularities on the network. What port number you should enable in Wireshark display filter to view NTP packets?

  A. TCP Port 124
  B. UDP Port 125
  C. UDP Port 123
  D. TCP Port 126
  C. UDP Port 123

• Question 326:

  What is the best defense against privilege escalation vulnerability?

  A. Patch systems regularly and upgrade interactive login privileges at the system administrator level.
  B. Run administrator and applications on least privileges and use a content registry for tracking.
  C. Run services with least privileged accounts and implement multi-factor authentication and authorization.
  D. Review user roles and administrator privileges for maximum utilization of automation services.
  C. Run services with least privileged accounts and implement multi-factor authentication and authorization.

• Question 327:

  When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK. How would an attacker exploit this design by launching TCP SYN attack?

  A. Attacker generates TCP SYN packets with random destination addresses towards a victim host
  B. Attacker floods TCP SYN packets with random source addresses towards a victim host
  C. Attacker generates TCP ACK packets with random source addresses towards a victim host
  D. Attacker generates TCP RST packets with random source addresses towards a victim host
  B. Attacker floods TCP SYN packets with random source addresses towards a victim host

• Question 328:

  In which part of OSI layer, ARP Poisoning occurs?

  

  A. Transport Layer
  B. Datalink Layer
  C. Physical Layer
  D. Application layer
  B. Datalink Layer

• Question 329:

  The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below:

  You are hired to conduct security testing on their network. You successfully brute-force the SNMP community string using a SNMP crack tool. The access-list configured at the router prevents you from establishing a successful connection.

  You want to retrieve the Cisco configuration from the router.

  How would you proceed?

  A. Use the Cisco's TFTP default password to connect and download the configuration file
  B. Run a network sniffer and capture the returned traffic with the configuration file from the router
  C. Run Generic Routing Encapsulation (GRE) tunneling protocol from your computer to the router masking your IP address
  D. Send a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0
  B. Run a network sniffer and capture the returned traffic with the configuration file from the router
  D. Send a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0

• Question 330:

  __________ is found in all versions of NTFS and is described as the ability to fork file data into existing files without affecting their functionality, size, or display to traditional file browsing utilities like dir or Windows Explorer

  A. Alternate Data Streams
  B. Merge Streams
  C. Steganography
  D. NetBIOS vulnerability
  A. Alternate Data Streams