♥♥ 2021 NEW RECOMMEND ♥♥

Free VCE & PDF File for EC-Council 312-50 Real Exam (Full Version!)

★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW 312-50 Exam Dumps (PDF & VCE):
Available on: http://www.surepassexam.com/312-50-exam-dumps.html

Q221. What does the term “Ethical Hacking” mean? 

A. Someone who is hacking for ethical reasons. 

B. Someone who is using his/her skills for ethical reasons. 

C. Someone who is using his/her skills for defensive purposes. 

D. Someone who is using his/her skills for offensive purposes. 

Answer: C

Explanation: Ethical hacking is only about defending your self or your employer against malicious persons by using the same techniques and skills. 


Q222. Which of the following Trojans would be considered 'Botnet Command Control Center'? 

A. YouKill DOOM 

B. Damen Rock 

C. Poison Ivy D. Matten Kit 

Answer: C


Q223. SSL has been seen as the solution to several common security problems. Administrators will often make use of SSL to encrypt communication from point A to point B. Why do you think this could be a bad idea if there is an Intrusion Detection System deployed to monitor the traffic between point A and B? 

A. SSL is redundant if you already have IDS in place. 

B. SSL will trigger rules at regular interval and force the administrator to turn them off. 

C. SSL will slow down the IDS while it is breaking the encryption to see the packet content. 

D. SSL will mask the content of the packet and Intrusion Detection System will be blinded. 

Answer: D

Explanation: Because the traffic is encrypted, an IDS cannot understand it or evaluate the payload. 


Q224. Which of the following ICMP message types are used for destinations unreachables? 

A. 0 

B. 3 

C. 11 

D. 13 

E. 17 

Answer: B

Explanation: Type 3 messages are used for unreachable messages. 0 is Echo Reply, 8 is Echo request, 11 is time exceeded, 13 is timestamp and 17 is subnet mask request. Learning these would be advisable for the test. 


Q225. In the context of Windows Security, what is a 'null' user? 

A. A user that has no skills 

B. An account that has been suspended by the admin 

C. A pseudo account that has no username and password 

D. A pseudo account that was created for security administration purpose 

Answer: C 

Explanation: NULL sessions take advantage of “features” in the SMB (Server Message Block) protocol that exist primarily for trust relationships. You can establish a NULL session with a Windows host by logging on with a NULL user name and password. Using these NULL connections allows you to gather the following information from the host:* List of users and groups 

* List of machines * List of shares * Users and host SID' (Security Identifiers) 

NULL sessions exist in windows networking to allow: * Trusted domains to enumerate resources * 

Computers outside the domain to authenticate and enumerate users * The SYSTEM account to authenticate and enumerate resources 

NetBIOS NULL sessions are enabled by default in Windows NT and 2000. Windows XP and 2003 will allow anonymous enumeration of shares, but not SAM accounts. 


Q226. The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. From the options given below choose the one best interprets the following entry: 

Apr 26 06:43:05 [6282] IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 

(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) 

Interpret the following entry: 

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107.53 

A. An IDS evasion technique 

B. A buffer overflow attempt 

C. A DNS zone transfer 

D. Data being retrieved from 63.226.81.13. 

Answer: B

Explanation: The IDS log file is depicting numerous attacks, however, most of them are from different attackers, in reference to the attack in question, he is trying to mask his activity by trying to act legitimate, during his session on the honeypot, he changes users two times by using the "su" command, but never triess to attempt anything to severe. 


Q227. What do you call a pre-computed hash? 

A. Sun tables 

B. Apple tables 

C. Rainbow tables 

D. Moon tables 

Answer: C


Q228. Which of the following is not an effective countermeasure against replay attacks? 

A. Digital signatures 

B. Time Stamps 

C. System identification 

D. Sequence numbers 

Answer: C

Explanation: A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. Effective countermeasures should be anything that makes it hard to delay or replay the packet (time stamps and sequence numbers) or anything that prove the package is received as it was sent from the original sender (digital signature) 


Q229. This tool is widely used for ARP Poisoning attack. Name the tool. 

A. Cain and Able 

B. Beat Infector 

C. Poison Ivy 

D. Webarp Infector 

Answer: A


Q230. Which of the following keyloggers cannot be detected by anti-virus or anti-spyware products? 

A. Covert keylogger 

B. Stealth keylogger 

C. Software keylogger 

D. Hardware keylogger 

Answer: D

Explanation: As the hardware keylogger never interacts with the Operating System it is undetectable by anti-virus or anti-spyware products.