EC-COUNCIL EC-COUNCIL Certifications 312-50V10 Questions & Answers

• Question 561:

  Passive reconnaissance involves collecting information through which of the following?

  A. Social engineering

  B. Network traffic sniffing

  C. Man in the middle attacks

  D. Publicly accessible sources

  Correct Answer: D

• Question 562:

  What is the main advantage that a network-based IDS/IPS system has over a host-based solution?

  A. They do not use host system resources.

  B. They are placed at the boundary, allowing them to inspect all traffic.

  C. They are easier to install and configure.

  D. They will not interfere with user interfaces.

  Correct Answer: A

• Question 563:

  When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's computer to update the router configuration. What type of an alert is this?

  A. False positive

  B. False negative

  C. True positve

  D. True negative

  Correct Answer: A

• Question 564:

  When an alert rule is matched in a network-based IDS like snort, the IDS does which of the following?

  A. Drops the packet and moves on to the next one

  B. Continues to evaluate the packet until all rules are checked

  C. Stops checking rules, sends an alert, and lets the packet continue

  D. Blocks the connection with the source IP address in the packet

  Correct Answer: B

• Question 565:

  A newly discovered flaw in a software application would be considered which kind of security vulnerability?

  A. Input validation flaw

  B. HTTP header injection vulnerability

  C. 0-day vulnerability D. Time-to-check to time-to-use flaw

  Correct Answer: C

• Question 566:

  The use of technologies like IPSec can help guarantee the following: authenticity, integrity, confidentiality and:

  A. non-repudiation.

  B. operability.

  C. security.

  D. usability.

  Correct Answer: A

• Question 567:

  How can a rootkit bypass Windows 7 operating system's kernel mode, code signing policy?

  A. Defeating the scanner from detecting any code change at the kernel

  B. Replacing patch system calls with its own version that hides the rootkit (attacker's) actions

  C. Performing common services for the application process and replacing real applications with fake ones

  D. Attaching itself to the master boot record in a hard drive and changing the machine's boot sequence/ options

  Correct Answer: D

• Question 568:

  Which of the following is an application that requires a host application for replication?

  A. Micro

  B. Worm

  C. Trojan

  D. Virus

  Correct Answer: D

  Computer viruses infect a variety of different subsystems on their hosts. A computer virus is a malware that, when executed, replicates by reproducing itself or infecting other programs by modifying them. Infecting computer programs can include as well, data files, or the boot sector of the hard drive. When this replication succeeds, the affected areas are then said to be "infected".

  References: https://en.wikipedia.org/wiki/Computer_virus

• Question 569:

  An attacker uses a communication channel within an operating system that is neither designed nor intended to transfer information. What is the name of the communications channel?

  A. Classified

  B. Overt

  C. Encrypted

  D. Covert

  Correct Answer: D

• Question 570:

  Which command line switch would be used in NMAP to perform operating system detection?

  A. -OS

  B. -sO

  C. -sP

  D. -O

  Correct Answer: D