EC-COUNCIL 312-50V8 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V8 Online Questions & Answers

• Question 231:

  Employees in a company are no longer able to access Internet web sites on their computers. The network administrator is able to successfully ping IP address of web servers on the Internet and is able to open web sites by using an IP address in place of the URL. The administrator runs the nslookup command for www.eccouncil.org and receives an error message stating there is no response from the server.

  What should the administrator do next?

  A. Configure the firewall to allow traffic on TCP ports 53 and UDP port 53.
  B. Configure the firewall to allow traffic on TCP ports 80 and UDP port 443.
  C. Configure the firewall to allow traffic on TCP port 53.
  D. Configure the firewall to allow traffic on TCP port 8080.
  A. Configure the firewall to allow traffic on TCP ports 53 and UDP port 53.

• Question 232:

  When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is

  A. OWASP is for web applications and OSSTMM does not include web applications.
  B. OSSTMM is gray box testing and OWASP is black box testing.
  C. OWASP addresses controls and OSSTMM does not.
  D. OSSTMM addresses controls and OWASP does not.
  D. OSSTMM addresses controls and OWASP does not.

• Question 233:

  You are trying to package a RAT Trojan so that Anti-Virus software will not detect it. Which of the listed technique will NOT be effective in evading Anti-Virus scanner?

  A. Convert the Trojan.exe file extension to Trojan.txt disguising as text file
  B. Break the Trojan into multiple smaller files and zip the individual pieces
  C. Change the content of the Trojan using hex editor and modify the checksum
  D. Encrypt the Trojan using multiple hashing algorithms like MD5 and SHA-1
  A. Convert the Trojan.exe file extension to Trojan.txt disguising as text file

• Question 234:

  You ping a target IP to check if the host is up. You do not get a response. You suspect ICMP is blocked at the firewall. Next you use hping2 tool to ping the target host and you get a response.

  Why does the host respond to hping2 and not ping packet?

  

  A. Ping packets cannot bypass firewalls
  B. You must use ping 10.2.3.4 switch
  C. Hping2 uses stealth TCP packets to connect
  D. Hping2 uses TCP instead of ICMP by default
  D. Hping2 uses TCP instead of ICMP by default

• Question 235:

  A certified ethical hacker (CEH) is approached by a friend who believes her husband is cheating. She offers to pay to break into her husband's email account in order to find proof so she can take him to court. What is the ethical response?

  A. Say no; the friend is not the owner of the account.
  B. Say yes; the friend needs help to gather evidence.
  C. Say yes; do the job for free.
  D. Say no; make sure that the friend knows the risk she's asking the CEH to take.
  A. Say no; the friend is not the owner of the account.

• Question 236:

  Which initial procedure should an ethical hacker perform after being brought into an organization?

  A. Begin security testing.
  B. Turn over deliverables.
  C. Sign a formal contract with non-disclosure.
  D. Assess what the organization is trying to protect.
  C. Sign a formal contract with non-disclosure.

• Question 237:

  In order to show improvement of security over time, what must be developed?

  A. Reports
  B. Testing tools
  C. Metrics
  D. Taxonomy of vulnerabilities
  C. Metrics

• Question 238:

  An attacker has installed a RAT on a host. The attacker wants to ensure that when a user attempts to go to www.MyPersonalBank.com, that the user is directed to a phishing site. Which file does the attacker needto modify?

  A. Hosts
  B. Networks
  C. Boot.ini
  D. Sudoers
  A. Hosts

• Question 239:

  This is an attack that takes advantage of a web site vulnerability in which the site displays content that includes un-sanitized user-provided data. See foobar What is this attack?

  A. Cross-site-scripting attack
  B. SQL Injection
  C. URL Traversal attack
  D. Buffer Overflow attack
  A. Cross-site-scripting attack

• Question 240:

  Which of the following does proper basic configuration of snort as a network intrusion detection system require?

  A. Limit the packets captured to the snort configuration file.
  B. Capture every packet on the network segment.
  C. Limit the packets captured to a single segment.
  D. Limit the packets captured to the /var/log/snort directory.
  A. Limit the packets captured to the snort configuration file.