EC-COUNCIL EC-COUNCIL Certifications 312-50V10 Questions & Answers

• Question 331:

  The network administrator contacts you and tells you that she noticed the temperature on the internal wireless router increases by more than 20% during weekend hours when the office was closed. She asks you to investigate the issue because she is busy dealing with a big conference and she doesn't have time to perform the task.

  What tool can you use to view the network traffic being sent and received by the wireless router?

  A. Wireshark

  B. Nessus

  C. Netcat

  D. Netstat

  Correct Answer: A

  Wireshark is a Free and open source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education.

• Question 332:

  When you are getting information about a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from the server. You can detect all these methods (GET, POST, HEAD, PUT, DELETE, TRACE) using NMAP script engine.

  What nmap script will help you with this task?

  A. http-methods

  B. http enum

  C. http-headers

  D. http-git

  Correct Answer: A

  You can check HTTP method vulnerability using NMAP. Example: #nmap –script=http-methods.nse 192.168.0.25

• Question 333:

  Which of the following describes the characteristics of a Boot Sector Virus?

  A. Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR

  B. Moves the MBR to another location on the RAM and copies itself to the original location of the MBR

  C. Modifies directory table entries so that directory entries point to the virus code instead of the actual program

  D. Overwrites the original MBR and only executes the new virus code

  Correct Answer: A

  A boot sector virus is a computer virus that infects a storage device's master boot record (MBR). The virus moves the boot sector to another location on the hard drive.

  References: https://www.techopedia.com/definition/26655/boot-sector-virus

• Question 334:

  Which regulation defines security and privacy controls for Federal information systems and organizations?

  A. NIST-800-53

  B. PCI-DSS

  C. EU Safe Harbor

  D. HIPAA

  Correct Answer: A

  NIST Special Publication 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," provides a catalog of security controls for all U.S. federal information systems except those related to national security.

  References: https://en.wikipedia.org/wiki/NIST_Special_Publication_800-53

• Question 335:

  Which of the following statements is TRUE?

  A. Sniffers operate on Layer 2 of the OSI model

  B. Sniffers operate on Layer 3 of the OSI model

  C. Sniffers operate on both Layer 2 and Layer 3 of the OSI model.

  D. Sniffers operate on the Layer 1 of the OSI model.

  Correct Answer: A

  The OSI layer 2 is where packet sniffers collect their data.

  References: https://en.wikipedia.org/wiki/Ethernet_frame

• Question 336:

  Which of the following is assured by the use of a hash?

  A. Integrity

  B. Confidentiality

  C. Authentication

  D. Availability

  Correct Answer: A

  An important application of secure hashes is verification of message integrity. Determining whether any

  changes have been made to a message (or a file), for example, can be accomplished by comparing

  message digests calculated before, and after, transmission (or any other event).

  References:

  https://en.wikipedia.org/wiki/Cryptographic_hash_function#Verifying_the_integrity_of_files_ or_messages

• Question 337:

  This phase will increase the odds of success in later phases of the penetration test. It is also the very first step in Information Gathering, and it will tell you what the "landscape" looks like.

  What is the most important phase of ethical hacking in which you need to spend a considerable amount of time?

  A. footprinting

  B. network mapping

  C. gaining access

  D. escalating privileges

  Correct Answer: A

  Footprinting is a first step that a penetration tester used to evaluate the security of any IT infrastructure, footprinting means to gather the maximum information about the computer system or a network and about the devices that are attached to this network.

  References: http://www.ehacking.net/2011/02/footprinting-first-step-of-ethical.html

• Question 338:

  The configuration allows a wired or wireless network interface controller to pass all traffic it receives to the central processing unit (CPU), rather than passing only the frames that the controller is intended to receive.

  Which of the following is being described?

  A. promiscuous mode

  B. port forwarding

  C. multi-cast mode

  D. WEM

  Correct Answer: A

  Promiscuous mode refers to the special mode of Ethernet hardware, in particular network interface cards (NICs), that allows a NIC to receive all traffic on the network, even if it is not addressed to this NIC. By default, a NIC ignores all traffic that is not addressed to it, which is done by comparing the destination address of the Ethernet packet with the hardware address (a.k.a. MAC) of the device. While this makes perfect sense for networking, non- promiscuous mode makes it difficult to use network monitoring and analysis software for diagnosing connectivity issues or traffic accounting.

  References: https://www.tamos.com/htmlhelp/monitoring/

• Question 339:

  This asymmetry cipher is based on factoring the product of two large prime numbers.

  What cipher is described above?

  A. RSA

  B. SHA

  C. RC5

  D. MD5

  Correct Answer: A

  RSA is based on the practical difficulty of factoring the product of two large prime numbers, the factoring problem.

  Note: A user of RSA creates and then publishes a public key based on two large prime numbers, along with an auxiliary value. The prime numbers must be kept secret. Anyone can use the public key to encrypt a message, but with currently published methods, if the public key is large enough, only someone with knowledge of the prime numbers can feasibly decode the message.

  References: https://en.wikipedia.org/wiki/RSA_(cryptosystem)

• Question 340:

  Nation-state threat actors often discover vulnerabilities and hold on to them until they want to launch a sophisticated attack. The Stuxnet attack was an unprecedented style of attack because it used four types of vulnerability.

  What is this style of attack called?

  A. zero-day

  B. zero-hour

  C. zero-sum

  D. no-day

  Correct Answer: A

  Stuxnet is a malicious computer worm believed to be a jointly built American-Israeli cyber weapon. Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software.

  References: https://en.wikipedia.org/wiki/Stuxnet