EC-COUNCIL EC-COUNCIL Certifications 312-50V10 Questions & Answers

• Question 241:

  The company ABC recently discovered that their new product was released by the opposition before their premiere. They contract an investigator who discovered that the maid threw away papers with confidential information about the new product and the opposition found it in the garbage. What is the name of the technique used by the opposition?

  A. Hack attack

  B. Sniffing

  C. Dumpster diving D. Spying

  Correct Answer: C

• Question 242:

  What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?

  A. Residual risk

  B. Inherent risk

  C. Deferred risk

  D. Impact risk

  Correct Answer: A

  The residual risk is the risk or danger of an action or an event, a method or a (technical) process that, although being abreast with science, still conceives these dangers, even if all theoretically possible safety measures would be applied (scientifically conceivable measures); in other words, the amount of risk left over after natural or inherent risks have been reduced by risk controls.

  References: https://en.wikipedia.org/wiki/Residual_risk

• Question 243:

  An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses.

  In which order should he perform these steps?

  A. The sequence does not matter. Both steps have to be performed against all hosts.

  B. First the port scan to identify interesting services and then the ping sweep to find hosts responding to icmp echo requests.

  C. First the ping sweep to identify live hosts and then the port scan on the live hosts. This way he saves time.

  D. The port scan alone is adequate. This way he saves time.

  Correct Answer: C

• Question 244:

  Rebecca commonly sees an error on her Windows system that states that a Data Execution Prevention (DEP) error has taken place. Which of the following is most likely taking place?

  A. A race condition is being exploited, and the operating system is containing the malicious process.

  B. A page fault is occurring, which forces the operating system to write data from the hard drive.

  C. Malware is executing in either ROM or a cache memory area.

  D. Malicious code is attempting to execute instruction in a non-executable memory region.

  Correct Answer: D

• Question 245:

  A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named "nc." The FTP server's access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port.

  What kind of vulnerability must be present to make this remote attack possible?

  A. File system permissions

  B. Privilege escalation

  C. Directory traversal

  D. Brute force login

  Correct Answer: A

  To upload files the user must have proper write file permissions.

  References: http://codex.wordpress.org/Hardening_WordPress

• Question 246:

  A large mobile telephony and data network operator has a data that houses network elements. These are essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS systems. What is the best security policy concerning this setup?

  A. Network elements must be hardened with user ids and strong passwords. Regular security tests and audits should be performed.

  B. As long as the physical access to the network elements is restricted, there is no need for additional measures.

  C. There is no need for specific security measures on the network elements as long as firewalls and IPS systems exist.

  D. The operator knows that attacks and down time are inevitable and should have a backup site.

  Correct Answer: A

• Question 247:

  The "white box testing" methodology enforces what kind of restriction?

  A. The internal operation of a system is completely known to the tester.

  B. Only the external operation of a system is accessible to the tester.

  C. Only the internal operation of a system is known to the tester.

  D. The internal operation of a system is only partly accessible to the tester.

  Correct Answer: A

  White-box testing (also known as clear box testing, glass box testing, transparent box testing, and structural testing) is a method of testing software that tests internal structures or workings of an application, as opposed to its functionality (i.e. black-box testing). In white-box testing an internal perspective of the system, as well as programming skills, are used to design test cases.

  References: https://en.wikipedia.org/wiki/White-box_testing

• Question 248:

  Which of these is capable of searching for and locating rogue access points?

  A. HIDS

  B. WISS

  C. WIPS

  D. NIDS

  Correct Answer: C

• Question 249:

  What does a firewall check to prevent particular ports and applications from getting packets into an organization?

  A. Transport layer port numbers and application layer headers

  B. Presentation layer headers and the session layer port numbers

  C. Network layer headers and the session layer port numbers

  D. Application layer port numbers and the transport layer headers

  Correct Answer: A

  Newer firewalls can filter traffic based on many packet attributes like source IP address, source port,

  destination IP address or transport layer port, destination service like WWW or FTP. They can filter based

  on protocols, TTL values, netblock of originator, of the source, and many other attributes.

  Application layer firewalls are responsible for filtering at 3, 4, 5, 7 layer. Because they analyze the

  application layer headers, most firewall control and filtering is performed actually in the software.

  References:

  https://en.wikipedia.org/wiki/Firewall_(computing)#Network_layer_or_packet_filters http://

  howdoesinternetwork.com/2012/application-layer-firewalls

• Question 250:

  Which of the following statements regarding ethical hacking is incorrect?

  A. Ethical hackers should never use tools or methods that have the potential of exploiting vulnerabilities in an organization's systems.

  B. Testing should be remotely performed offsite.

  C. An organization should use ethical hackers who do not sell vendor hardware/software or other consulting services.

  D. Ethical hacking should not involve writing to or modifying the target systems.

  Correct Answer: A

  Ethical hackers use the same methods and techniques, including those that have the potential of exploiting vulnerabilities, to test and bypass a system's defenses as their less- principled counterparts, but rather than taking advantage of any vulnerabilities found, they document them and provide actionable advice on how to fix them so the organization can improve its overall security.

  References: http://searchsecurity.techtarget.com/definition/ethical-hacker