EC-COUNCIL EC-COUNCIL Certifications 312-50V10 Questions & Answers

• Question 61:

  Which of the following is the primary objective of a rootkit?

  A. It opens a port to provide an unauthorized service

  B. It creates a buffer overflow

  C. It replaces legitimate programs

  D. It provides an undocumented opening in a program

  Correct Answer: C

• Question 62:

  Bob is going to perform an active session hijack against Brownies Inc. He has found a target that allows session oriented connections (Telnet) and performs the sequence prediction on the target operating system. He manages to find an active session due to the high level of traffic on the network. What is Bob supposed to do next?

  A. Take over the session

  B. Reverse sequence prediction

  C. Guess the sequence numbers

  D. Take one of the parties offline

  Correct Answer: C

• Question 63:

  Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches.

  If these switches' ARP cache is successfully flooded, what will be the result?

  A. The switches will drop into hub mode if the ARP cache is successfully flooded.

  B. If the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to attacks.

  C. Depending on the switch manufacturer, the device will either delete every entry in its ARP cache or reroute packets to the nearest switch.

  D. The switches will route all traffic to the broadcast address created collisions.

  Correct Answer: A

• Question 64:

  When discussing passwords, what is considered a brute force attack?

  A. You attempt every single possibility until you exhaust all possible combinations or discover the password

  B. You threaten to use the rubber hose on someone unless they reveal their password

  C. You load a dictionary of words into your cracking program

  D. You create hashes of a large number of words and compare it with the encrypted passwords

  E. You wait until the password expires

  Correct Answer: A

• Question 65:

  This is an attack that takes advantage of a web site vulnerability in which the site displays content that includes un-sanitized user-provided data.

  

  What is this attack?

  A. Cross-site-scripting attack

  B. SQL Injection

  C. URL Traversal attack

  D. Buffer Overflow attack

  Correct Answer: A

• Question 66:

  What tool can crack Windows SMB passwords simply by listening to network traffic?

  A. This is not possible

  B. Netbus

  C. NTFSDOS

  D. L0phtcrack

  Correct Answer: D

• Question 67:

  Which utility will tell you in real time which ports are listening or in another state?

  A. Netstat

  B. TCPView

  C. Nmap

  D. Loki

  Correct Answer: B

• Question 68:

  OpenSSL on Linux servers includes a command line tool for testing TLS. What is the name of the tool and the correct syntax to connect to a web server?

  A. openssl s_client -site www.website.com:443

  B. openssl_client -site www.website.com:443

  C. openssl s_client -connect www.website.com:443

  D. openssl_client -connect www.website.com:443

  Correct Answer: C

• Question 69:

  When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK.

  How would an attacker exploit this design by launching TCP SYN attack?

  A. Attacker generates TCP SYN packets with random destination addresses towards a victim host

  B. Attacker floods TCP SYN packets with random source addresses towards a victim host

  C. Attacker generates TCP ACK packets with random source addresses towards a victim host

  D. Attacker generates TCP RST packets with random source addresses towards a victim host

  Correct Answer: B

• Question 70:

  What hacking attack is challenge/response authentication used to prevent?

  A. Replay attacks

  B. Scanning attacks

  C. Session hijacking attacks

  D. Password cracking attacks

  Correct Answer: A