EC-COUNCIL EC-COUNCIL Certifications 312-50V10 Questions & Answers

• Question 391:

  You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine.

  What wireshark filter will show the connections from the snort machine to kiwi syslog machine?

  A. tcp.dstport==514 andand ip.dst==192.168.0.150

  B. tcp.srcport==514 andand ip.src==192.168.0.99

  C. tcp.dstport==514 andand ip.dst==192.168.0.0/16

  D. tcp.srcport==514 andand ip.src==192.168.150

  Correct Answer: A

  We need to configure destination port at destination ip. The destination ip is 192.168.0.150, where the kiwi syslog is installed.

  References: https://wiki.wireshark.org/DisplayFilters

• Question 392:

  It is an entity or event with the potential to adversely impact a system through unauthorized access, destruction, disclosure, denial of service or modification of data.

  Which of the following terms best matches the definition?

  A. Threat

  B. Attack

  C. Vulnerability

  D. Risk

  Correct Answer: A

  A threat is at any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. Also, the potential for a threat-source to successfully exploit a particular information system vulnerability. References: https://en.wikipedia.org/wiki/Threat_(computer)

• Question 393:

  Which of the following is a design pattern based on distinct pieces of software providing application functionality as services to other applications?

  A. Service Oriented Architecture

  B. Object Oriented Architecture

  C. Lean Coding

  D. Agile Process

  Correct Answer: A

  A service-oriented architecture (SOA) is an architectural pattern in computer software design in which application components provide services to other components via a communications protocol, typically over a network.

  References: https://en.wikipedia.org/wiki/Service-oriented_architecture

• Question 394:

  The purpose of a __________ is to deny network access to local area networks and other information assets by unauthorized wireless devices.

  A. Wireless Intrusion Prevention System

  B. Wireless Access Point

  C. Wireless Access Control List

  D. Wireless Analyzer

  Correct Answer: A

  A wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).

  References: https://en.wikipedia.org/wiki/Wireless_intrusion_prevention_system

• Question 395:

  What is the benefit of performing an unannounced Penetration Testing?

  A. The tester will have an actual security posture visibility of the target network.

  B. Network security would be in a "best state" posture.

  C. It is best to catch critical infrastructure unpatched.

  D. The tester could not provide an honest analysis.

  Correct Answer: A

  Real life attacks will always come without expectation and they will often arrive in ways that are highly creative and very hard to plan for at all. This is, after all, exactly how hackers continue to succeed against network security systems, despite the billions invested in the data protection industry. A possible solution to this danger is to conduct intermittent "unannounced" penentration tests whose scheduling and occurrence is only known to the hired attackers and upper management staff instead of every security employee, as would be the case with "announced" penetration tests that everyone has planned for in advance. The former may be better at detecting realistic weaknesses.

  References: http://www.sitepronews.com/2013/03/20/the-pros-and-cons-of-penetration- testing/

• Question 396:

  An attacker has installed a RAT on a host. The attacker wants to ensure that when a user attempts to go to "www.MyPersonalBank.com", that the user is directed to a phishing site.

  Which file does the attacker need to modify?

  A. Hosts

  B. Sudoers

  C. Boot.ini

  D. Networks

  Correct Answer: A

  The hosts file is a computer file used by an operating system to map hostnames to IP addresses. The hosts file contains lines of text consisting of an IP address in the first text field followed by one or more host names.

  References: https://en.wikipedia.org/wiki/Hosts_(file)

• Question 397:

  A common cryptographical tool is the use of XOR. XOR the following binary values: 10110001 00111010

  A. 10001011

  B. 11011000

  C. 10011101

  D. 10111100

  Correct Answer: A

  The XOR gate is a digital logic gate that implements an exclusive or; that is, a true output (1/HIGH) results if one, and only one, of the inputs to the gate is true. If both inputs are false (0/LOW) or both are true, a false output results. XOR represents the inequality function, i.e., the output is true if the inputs are not alike otherwise the output is false. A way to remember XOR is "one or the other but not both".

  References: https://en.wikipedia.org/wiki/XOR_gate

• Question 398:

  Which mode of IPSec should you use to assure security and confidentiality of data within the same LAN?

  A. ESP transport mode

  B. AH permiscuous

  C. ESP confidential

  D. AH Tunnel mode

  Correct Answer: A

  When transport mode is used, IPSec encrypts only the IP payload. Transport mode provides the protection of an IP payload through an AH or ESP header. Encapsulating Security Payload (ESP) provides confidentiality (in addition to authentication, integrity, and anti-replay protection) for the IP payload.

• Question 399:

  Which tool allows analysts and pen testers to examine links between data using graphs and link analysis?

  A. Maltego

  B. Cain and Abel

  C. Metasploit

  D. Wireshark

  Correct Answer: A

  Maltego is proprietary software used for open-source intelligence and forensics, developed by Paterva. Maltego focuses on providing a library of transforms for discovery of data from open sources, and visualizing that information in a graph format, suitable for link analysis and data mining.

  References: https://en.wikipedia.org/wiki/Maltego

• Question 400:

  How does the Address Resolution Protocol (ARP) work?

  A. It sends a request packet to all the network elements, asking for the MAC address from a specific IP.

  B. It sends a reply packet to all the network elements, asking for the MAC address from a specific IP.

  C. It sends a reply packet for a specific IP, asking for the MAC address.

  D. It sends a request packet to all the network elements, asking for the domain name from a specific IP.

  Correct Answer: A

  When an incoming packet destined for a host machine on a particular local area network arrives at a gateway, the gateway asks the ARP program to find a physical host or MAC address that matches the IP address. The ARP program looks in the ARP cache and, if it finds the address, provides it so that the packet can be converted to the right packet length and format and sent to the machine. If no entry is found for the IP address, ARP broadcasts a request packet in a special format to all the machines on the LAN to see if one machine knows that it has that IP address associated with it. A machine that recognizes the IP address as its own returns a reply so indicating. ARP updates the ARP cache for future reference and then sends the packet to the MAC address that replied.

  References: http://searchnetworking.techtarget.com/definition/Address-Resolution- Protocol-ARP