EC-COUNCIL 312-50V8 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V8 Online Questions & Answers

• Question 831:

  Clive is conducting a pen-test and has just port scanned a system on the network. He has identified the operating system as Linux and been able to elicit responses from ports 23, 25 and 53. He infers port 23 as running Telnet service, port 25 as running SMTP service and port 53 as running DNS service. The client confirms these findings and attests to the current availability of the services. When he tries to telnet to port 23 or 25, he gets a blank screen in response. On typing other commands, he sees only blank spaces or underscores symbols on the screen.

  What are you most likely to infer from this?

  A. The services are protected by TCP wrappers
  B. There is a honeypot running on the scanned machine
  C. An attacker has replaced the services with trojaned ones
  D. This indicates that the telnet and SMTP server have crashed
  A. The services are protected by TCP wrappers

• Question 832:

  The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:

  Time:Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP

  Time:Mar 13 17:30:17 Port:21 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:19 Port:22 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP

  Time:Mar 13 17:30:21 Port:23 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP

  Time:Mar 13 17:30:22 Port:25 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP

  Time:Mar 13 17:30:23 Port:80 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP Time:Mar 13 17:30:30 Port:443 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP

  What type of activity has been logged?

  A. Port scan targeting 192.168.1.103
  B. Teardrop attack targeting 192.168.1.106
  C. Denial of service attack targeting 192.168.1.103
  D. Port scan targeting 192.168.1.106
  D. Port scan targeting 192.168.1.106

• Question 833:

  Syslog is a standard for logging program messages. It allows separation of the software that generates messages from the system that stores them and the software that reports and analyzes them. It also provides devices, which would otherwise be unable to communicate a means to notify administrators of problems or performance.

  

  What default port Syslog daemon listens on?

  A. 242
  B. 312
  C. 416
  D. 514
  D. 514

• Question 834:

  Advanced encryption standard is an algorithm used for which of the following?

  A. Data integrity
  B. Key discovery
  C. Bulk data encryption
  D. Key recovery
  C. Bulk data encryption

• Question 835:

  While performing a ping sweep of a subnet you receive an ICMP reply of Code 3/Type 13 for all the pings sent out. What is the most likely cause behind this response?

  A. The firewall is dropping the packets.
  B. An in-line IDS is dropping the packets.
  C. A router is blocking ICMP.
  D. The host does not respond to ICMP packets.
  C. A router is blocking ICMP.

• Question 836:

  Which of the following is the BEST way to defend against network sniffing?

  A. Using encryption protocols to secure network communications
  B. Restrict Physical Access to Server Rooms hosting Critical Servers
  C. Use Static IP Address
  D. Register all machines MAC Address in a centralized Database
  A. Using encryption protocols to secure network communications

• Question 837:

  Windows LAN Manager (LM) hashes are known to be weak.

  Which of the following are known weaknesses of LM? (Choose three)

  A. Converts passwords to uppercase.
  B. Hashes are sent in clear text over the network.
  C. Makes use of only 32 bit encryption.
  D. Effective length is 7 characters.
  A. Converts passwords to uppercase.
  B. Hashes are sent in clear text over the network.
  D. Effective length is 7 characters.

• Question 838:

  What is a sniffing performed on a switched network called?

  A. Spoofed sniffing
  B. Passive sniffing
  C. Direct sniffing
  D. Active sniffing
  D. Active sniffing

• Question 839:

  When working with Windows systems, what is the RID of the true administrator account?

  A. 500
  B. 501
  C. 512
  D. 1001
  E. 1024
  F. 1000
  A. 500

• Question 840:

  When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's computer to update the router configuration. What type of an alert is this?

  A. False positive
  B. False negative
  C. True positve
  D. True negative
  A. False positive