EC-COUNCIL 312-50V7 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V7 Online Questions & Answers

• Question 501:

  Which initial procedure should an ethical hacker perform after being brought into an organization?

  A. Begin security testing.
  B. Turn over deliverables.
  C. Sign a formal contract with non-disclosure.
  D. Assess what the organization is trying to protect.
  C. Sign a formal contract with non-disclosure.

• Question 502:

  Your company has blocked all the ports via external firewall and only allows port 80/443 to connect to the Internet. You want to use FTP to connect to some remote server on the Internet. How would you accomplish this?

  A. Use HTTP Tunneling
  B. Use Proxy Chaining
  C. Use TOR Network
  D. Use Reverse Chaining
  A. Use HTTP Tunneling

• Question 503:

  You went to great lengths to install all the necessary technologies to prevent hacking attacks, such as expensive firewalls, antivirus software, anti-spam systems and intrusion detection/prevention tools in your company's network. You have configured the most secure policies and tightened every device on your network. You are confident that hackers will never be able to gain access to your network with complex security system in place. Your peer, Peter Smith who works at the same department disagrees with you. He says even the best network security technologies cannot prevent hackers gaining access to the network because of presence of "weakest link" in the security chain. What is Peter Smith talking about?

  A. Untrained staff or ignorant computer users who inadvertently become the weakest link in your security chain
  B. "zero-day" exploits are the weakest link in the security chain since the IDS will not be able to detect these attacks
  C. "Polymorphic viruses" are the weakest link in the security chain since the Anti-Virus scanners will not be able to detect these attacks
  D. Continuous Spam e-mails cannot be blocked by your security system since spammers use different techniques to bypass the filters in your gateway
  A. Untrained staff or ignorant computer users who inadvertently become the weakest link in your security chain

• Question 504:

  What are the three types of compliance that the Open Source Security Testing Methodology Manual (OSSTMM) recognizes?

  A. Legal, performance, audit
  B. Audit, standards based, regulatory
  C. Contractual, regulatory, industry
  D. Legislative, contractual, standards based
  D. Legislative, contractual, standards based

• Question 505:

  This TCP flag instructs the sending system to transmit all buffered data immediately.

  A. SYN
  B. RST
  C. PSH
  D. URG
  E. FIN
  C. PSH

• Question 506:

  A security administrator notices that the log file of the company`s webserver contains suspicious entries:

  

  Based on source code analysis, the analyst concludes that the login.php script is vulnerable to

  A. command injection.
  B. SQL injection.
  C. directory traversal.
  D. LDAP injection.
  B. SQL injection.

• Question 507:

  A computer science student needs to fill some information into a secured Adobe PDF job application that was received from a prospective employer. Instead of requesting a new document that allowed the forms to be completed, the student decides to write a script that pulls passwords from a list of commonly used passwords to try against the secured PDF until the correct password is found or the list is exhausted.

  Which cryptography attack is the student attempting?

  A. Man-in-the-middle attack
  B. Brute-force attack
  C. Dictionary attack
  D. Session hijacking
  C. Dictionary attack

• Question 508:

  SNMP is a connectionless protocol that uses UDP instead of TCP packets (True or False)

  A. true
  B. false
  A. true

• Question 509:

  The fundamental difference between symmetric and asymmetric key cryptographic systems is that symmetric key cryptography uses which of the following?

  A. Multiple keys for non-repudiation of bulk data
  B. Different keys on both ends of the transport medium
  C. Bulk encryption for data transmission over fiber
  D. The same key on each end of the transmission medium
  D. The same key on each end of the transmission medium

• Question 510:

  A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting

  language and it uses MSSQL as a database backend. The analyst locates the application's search form and introduces the following code in the search input fielD.

  IMG SRC=vbscript:msgbox("Vulnerable");> originalAttribute="SRC" originalPath="vbscript:msgbox("Vulnerable");>"

  When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable". Which web applications vulnerability did the analyst discover?

  A. Cross-site request forgery
  B. Command injection
  C. Cross-site scripting
  D. SQL injection
  C. Cross-site scripting