EC-COUNCIL 312-50V8 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V8 Online Questions & Answers

• Question 411:

  Most cases of insider abuse can be traced to individuals who are introverted, incapable of dealing with stress or conflict, and frustrated with their job, office politics, and lack of respect or promotion. Disgruntled employees may pass company

  secrets and intellectual property to competitors for monitory benefits.

  Here are some of the symptoms of a disgruntled employee:

  a.

  Frequently leaves work early, arrive late or call in sick

  b.

  Spends time surfing the Internet or on the phone

  c.

  Responds in a confrontational, angry, or overly aggressive way to simple requests or comments

  d.

  Always negative; finds fault with everything

  These disgruntled employees are the biggest threat to enterprise security.

  How do you deal with these threats? (Select 2 answers)

  A. Limit access to the applications they can run on their desktop computers and enforce strict work hour rules
  B. By implementing Virtualization technology from the desktop to the data centre,organizations can isolate different environments with varying levels of access and security to various employees
  C. Organizations must ensure that their corporate data is centrally managed and delivered to users just and when needed
  D. Limit Internet access,e-mail communications,access to social networking sites and job hunting portals
  B. By implementing Virtualization technology from the desktop to the data centre,organizations can isolate different environments with varying levels of access and security to various employees
  C. Organizations must ensure that their corporate data is centrally managed and delivered to users just and when needed

• Question 412:

  You are the security administrator for a large network. You want to prevent attackers from running any sort of traceroute into your DMZ and discover the internal structure of publicly accessible areas of the network. How can you achieve this?

  A. Block ICMP at the firewall.
  B. Block UDP at the firewall.
  C. Both A and B.
  D. There is no way to completely block doing a trace route into this area.
  D. There is no way to completely block doing a trace route into this area.

• Question 413:

  User which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?

  A. 18 U.S.C 1029 Possession of Access Devices
  B. 18 U.S.C 1030 Fraud and related activity in connection with computers
  C. 18 U.S.C 1343 Fraud by wire,radio or television
  D. 18 U.S.C 1361 Injury to Government Property
  E. 18 U.S.C 1362 Government communication systems
  F. 18 U.S.C 1831 Economic Espionage Act
  G. 18 U.S.C 1832 Trade Secrets Act
  B. 18 U.S.C 1030 Fraud and related activity in connection with computers

• Question 414:

  When you are getting informationabout a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from the server. You can detect all these methods (GET, POST, HEAD, PUT, DELETE, TRACE) using NMAP script engine.

  What nmap script will help you with this task?

  A. http enum
  B. http-git
  C. http-headers
  D. http-methods
  B. http-git

• Question 415:

  A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniff the SMB exchanges which carry user logons. The user is plugged into a hub with 23 other systems. However, he is unable to capture any logons though he knows that other users are logging in.

  What do you think is the most likely reason behind this?

  A. There is a NIDS present on that segment.
  B. Kerberos is preventing it.
  C. Windows logons cannot be sniffed.
  D. L0phtcrack only sniffs logons to web servers.
  B. Kerberos is preventing it.

• Question 416:

  Which of the following is component of a risk assessment?

  A. Logical interface
  B. DMZ
  C. Administrative safeguards
  D. Physical security
  C. Administrative safeguards

• Question 417:

  In which location, SAM hash passwords are stored in Windows 7?

  A. c:\windows\system32\config\SAM
  B. c:\winnt\system32\machine\SAM
  C. c:\windows\etc\drivers\SAM
  D. c:\windows\config\etc\SAM
  A. c:\windows\system32\config\SAM

• Question 418:

  TCP SYN Flood attack uses the three-way handshake mechanism.

  1.

  An attacker at system A sends a SYN packet to victim at system B.

  2.

  System B sends a SYN/ACK packet to victim A.

  3.

  As a normal three-way handshake mechanism system A should send an ACK packet to system B, however, system A does not send an ACK packet to system B. In this case client B is waiting for an ACK packet from client A. This status of client B is called _________________

  A. "half-closed"
  B. "half open"
  C. "full-open"
  D. "xmas-open"
  B. "half open"

• Question 419:

  PGP, SSL, and IKE are all examples of which type of cryptography?

  A. Hash Algorithm
  B. Secret Key
  C. Public Key
  D. Digest
  C. Public Key

• Question 420:

  What statement is true regarding LM hashes?

  A. LM hashes consist in 48 hexadecimal characters.
  B. LM hashes are based on AES128 cryptographic standard.
  C. Uppercase characters in the password are converted to lowercase.
  D. LM hashes are not generated when the password length exceeds 15 characters.
  D. LM hashes are not generated when the password length exceeds 15 characters.