EC-COUNCIL EC-COUNCIL Certifications 312-50V8 Questions & Answers

• Question 781:

  What is the proper response for a NULL scan if the port is open?

  A. SYN

  B. ACK

  C. FIN

  D. PSH

  E. RST

  F. No response

  Correct Answer: F

• Question 782:

  What is a NULL scan?

  A. A scan in which all flags are turned off

  B. A scan in which certain flags are off

  C. A scan in which all flags are on

  D. A scan in which the packet size is set to zero

  E. A scan with a illegal packet size

  Correct Answer: A

• Question 783:

  What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?(Choose all that apply.

  A. 110

  B. 135

  C. 139

  D. 161

  E. 445

  F. 1024

  Correct Answer: BCE

• Question 784:

  When an alert rule is matched in a network-based IDS like snort, the IDS does which of the following?

  A. Drops the packet and moves on to the next one

  B. Continues to evaluate the packet until all rules are checked

  C. Stops checking rules,sends an alert,and lets the packet continue

  D. Blocks the connection with the source IP address in the packet

  Correct Answer: B

• Question 785:

  You are the security administrator for a large network. You want to prevent attackers from running any sort of traceroute into your DMZ and discovering the internal structure of publicly accessible areas of the network.

  How can you achieve this?

  A. There is no way to completely block tracerouting into this area

  B. Block UDP at the firewall

  C. Block TCP at the firewall

  D. Block ICMP at the firewall

  Correct Answer: A

• Question 786:

  In Buffer Overflow exploit, which of the following registers gets overwritten with return address of the exploit code?

  A. EEP

  B. ESP

  C. EAP

  D. EIP

  Correct Answer: D

• Question 787:

  What does FIN in TCP flag define?

  A. Used to abort a TCP connection abruptly

  B. Used to close a TCP connection

  C. Used to acknowledge receipt of a previous packet or transmission

  D. Used to indicate the beginning of a TCP connection

  Correct Answer: B

• Question 788:

  Joel and her team have been going through tons of garbage, recycled paper, and other rubbish in order to find some information about the target they are attempting to penetrate.

  How would you call this type of activity?

  A. Dumpster Diving

  B. Scanning

  C. CI Gathering

  D. Garbage Scooping

  Correct Answer: A

• Question 789:

  Vulnerability mapping occurs after which phase of a penetration test?

  A. Host scanning

  B. Passive information gathering

  C. Analysis of host scanning

  D. Network level discovery

  Correct Answer: C

• Question 790:

  In which of the following should be performed first in any penetration test?

  A. System identification

  B. Intrusion Detection System testing

  C. Passive information gathering

  D. Firewall testing

  Correct Answer: C