Acquiring EC-Council EC-Council certification is often a hard job by oneself. The EC-Council 312-50 exam real exam will get some changes, and the EC-Council 312-50 practice questions and answers will make some modifications accordingly. The actual EC-Council 312-50 test will be an important a part of EC-Council EC-Council certification exam. Examcollection offers wealthy resources to suit your needs to put together the EC-Council 312-50 exam. The actual EC-Council 312-50 certificate is a threshold on the IT industry.


♥♥ 2021 NEW RECOMMEND ♥♥

Free VCE & PDF File for EC-Council 312-50 Real Exam (Full Version!)

★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW 312-50 Exam Dumps (PDF & VCE):
Available on: http://www.surepassexam.com/312-50-exam-dumps.html

2021 Apr 312-50 free draindumps

Q411. Eric notices repeated probes to port 1080. He learns that the protocol being used is designed to allow a host outside of a firewall to connect transparently and securely through the firewall. He wonders if his firewall has been breached. What would be your inference? 

A. Eric network has been penetrated by a firewall breach 

B. The attacker is using the ICMP protocol to have a covert channel 

C. Eric has a Wingate package providing FTP redirection on his network 

D. Somebody is using SOCKS on the network to communicate through the firewall 

Answer: D

Explanation: Port Description: SOCKS. SOCKS port, used to support outbound tcp services (FTP, HTTP, etc). Vulnerable similar to FTP Bounce, in that attacker can connect to this port and bounce out to another internal host. Done to either reach a protected internal host or mask true source of attack. Listen for connection attempts to this port -- good sign of port scans, SOCKS-probes, or bounce attacks. Also a means to access restricted resources. Example: Bouncing off a MILNET gateway SOCKS port allows attacker to access web sites, etc. that were restricted only to.mil domain hosts. 


Q412. Bob has been hired to do a web application security test. Bob notices that the site is dynamic and infers that they mist be making use of a database at the application back end. Bob wants to validate whether SQL Injection would be possible. 

What is the first character that Bob should use to attempt breaking valid SQL requests? 

A. Semi Column 

B. Double Quote 

C. Single Quote 

D. Exclamation Mark 

Answer: C

Explanation: In SQL single quotes are used around values in queries, by entering another single quote Bob tests if the application will submit a null value and probably returning an error. 


Q413. Which of the following best describes session key creation in SSL? 

A. It is created by the server after verifying theuser's identity 

B. It is created by the server upon connection by the client 

C. It is created by the client from the server's public key 

D. It is created by the client after verifying the server's identity 

Answer: D

Explanation: An SSL session always begins with an exchange of messages called the SSL handshake. The handshake allows the server to authenticate itself to the client using public-key techniques, then allows the client and the server to cooperate in the creation of symmetric keys used for rapid encryption, decryption, and tamper detection during the session that follows. Optionally, the handshake also allows the client to authenticate itself to the server. 


Q414. Which of the following activities would not be considered passive footprinting? 

A. Search on financial site such as Yahoo Financial 

B. Perform multiple queries through a search engine 

C. Scan the range of IP address found in their DNS database 

D. Go through the rubbish to find out any information that might have been discarded 

Answer: C

Explanation: Passive footprinting is a method in which the attacker never makes contact with the target. Scanning the targets IP addresses can be logged at the target and therefore contact has been made. 


Q415. Melissa is a virus that attacks Microsoft Windows platforms. 

To which category does this virus belong? 

A. Polymorphic 

B. Boot Sector infector 

C. System 

D. Macro 

Answer: D

Explanation: The Melissa macro virus propagates in the form of an email message containing an infected Word document as an attachment. 


Rebirth 312-50 free exam:

Q416. Jim was having no luck performing a penetration test on his company’s network. He was running the test from home and had downloaded every security scanner he could lay his hands on. Despite knowing the IP range of all of the systems and the exact network configuration, Jim was unable to get any useful results. Why is Jim having these problems? 

A. Security scanners can’t perform vulnerability linkage 

B. Security Scanners are not designed to do testing through a firewall 

C. Security Scanners are only as smart as their database and can’t find unpublished vulnerabilities 

D. All of the above 

Answer: D

Explanation: Security scanners are designed to find vulnerabilities but not to use them, also they will only find well known vulnerabilities that and no zero day exploits. Therefore you can’t use a security scanner for penetration testing but need a more powerful program. 


Q417. You establish a new Web browser connection to Google. Since a 3-way handshake is required for any TCP connection, the following actions will take place. 

-DNS query is sent to the DNS server to resolve www.google.com 

-DNS server replies with the IP address for Google? 

-SYN packet is sent to Google. 

-Google sends back a SYN/ACK packet 

-Your computer completes the handshake by sending an ACK 

-The connection is established and the transfer of data commences 

Which of the following packets represent completion of the 3-way handshake? 

A. 4th packet 

B. 3rdpacket 

C. 6th packet 

D. 5th packet 

Answer: D


Q418. ou are attempting to crack LM Manager hashed from Windows 2000 SAM file. You will be using LM Brute force hacking tool for decryption. 

What encryption algorithm will you be decrypting? 

A. MD4 

B. DES 

C. SHA 

D. SSL 

Answer: B

Explanation: The LM hash is computed as follows.1. The user’s password as an OEM string is converted to uppercase. 2. This password is either null-padded or truncated to 14 bytes. 3. The “fixed-length” password is split into two 7-byte halves. 4. These values are used to create two DES keys, one from each 7-byte half. 5. Each of these keys is used to DES-encrypt the constant ASCII string “KGS!@#$%”, resulting in two 8-byte ciphertext values. 6. These two ciphertext values are concatenated to form a 16-byte value, which is the LM hash. 


Q419. Which of the following represents the initial two commands that an IRC client sends to join an IRC network? 

A. USER, NICK 

B. LOGIN, NICK 

C. USER, PASS 

D. LOGIN, USER 

Answer: A 

Explanation: A "PASS" command is not required for either client or server connection to be registered, but it must precede the server message or the latter of the NICK/USER combination. (RFC 1459) 


Q420. What port number is used by Kerberos protocol? 

A. 44 

B. 88 

C. 419 

D. 487 

Answer: B 

Explanation: Kerberos traffic uses UDP/TCP protocol source and destination port 88.