EC-COUNCIL EC-COUNCIL Certifications 312-50V11 Questions & Answers

• Question 161:

  Ethical hacker jane Smith is attempting to perform an SQL injection attach. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs. which two SQL Injection types would give her the results she is looking for?

  A. Out of band and boolean-based

  B. Time-based and union-based

  C. union-based and error-based

  D. Time-based and boolean-based

  Correct Answer: C

  Union based SQL injection allows an attacker to extract information from the database by extending the results returned by the first query. The Union operator can only be used if the original/new queries have an equivalent structure Error- based SQL injection is an In-band injection technique where the error output from the SQL database is employed to control the info inside the database. In In-band injection, the attacker uses an equivalent channel for both attacks and collect data from the database.

• Question 162:

  SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may Bypass authentication and allow attackers to access and/or modify data attached to a web application.

  Which of the following SQLI types leverages a database server's ability to make DNS requests to pass data to an attacker?

  A. Union-based SQLI

  B. Out-of-band SQLI

  C. ln-band SQLI

  D. Time-based blind SQLI

  Correct Answer: B

  Out-of-band SQL injection occurs when an attacker is unable to use an equivalent channel to launch the attack and gather results. ... Out-of-band SQLi techniques would believe the database server's ability to form DNS or HTTP requests to deliver data to an attacker. Out-of-band SQL injection is not very common, mostly because it depends on features being enabled on the database server being used by the web application. Out-of- band SQL injection occurs when an attacker is unable to use the same channel to launch the attack and gather results. Out-of-band techniques, offer an attacker an alternative to inferential time-based techniques, especially if the server responses are not very stable (making an inferential time-based attack unreliable). Out-of-band SQLi techniques would rely on the database server's ability to make DNS or HTTP requests to deliver data to an attacker. Such is the case with Microsoft SQL Server's xp_dirtree command, which can be used to make DNS requests to a server an attacker controls; as well as Oracle Database's UTL_HTTP package, which can be used to send HTTP requests from SQL and PL/SQL to a server an attacker controls.

• Question 163:

  Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

  A. To determine who is the holder of the root account

  B. To perform a DoS

  C. To create needless SPAM

  D. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail

  E. To test for virus protection

  Correct Answer: D

• Question 164:

  Stella, a professional hacker, performs an attack on web services by exploiting a vulnerability that provides additional routing information in the SOAP header to support asynchronous communication. This further allows the transmission of web-service requests and response messages using different TCP connections. Which of the following attack techniques is used by Stella to compromise the web services?

  A. XML injection

  B. WS-Address spoofing

  C. SOAPAction spoofing

  D. Web services parsing attacks

  Correct Answer: C

• Question 165:

  Your company performs penetration tests and security assessments for small and medium- sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.

  What should you do?

  A. Confront the client in a respectful manner and ask her about the data.

  B. Copy the data to removable media and keep it in case you need it.

  C. Ignore the data and continue the assessment until completed as agreed.

  D. Immediately stop work and contact the proper legal authorities.

  Correct Answer: D

• Question 166:

  A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a user from the IT department had a dial-out modem installed.

  Which security policy must the security analyst check to see if dial-out modems are allowed?

  A. Firewall-management policy

  B. Acceptable-use policy

  C. Permissive policy

  D. Remote-access policy

  Correct Answer: D

• Question 167:

  Fred is the network administrator for his company. Fred is testing an internal switch.

  From an external IP address, Fred wants to try and trick this switch into thinking it already has established a session with his computer. How can Fred accomplish this?

  A. Fred can accomplish this by sending an IP packet with the RST/SIN bit and the source address of his computer.

  B. He can send an IP packet with the SYN bit and the source address of his computer.

  C. Fred can send an IP packet with the ACK bit set to zero and the source address of the switch.

  D. Fred can send an IP packet to the switch with the ACK bit and the source address of his machine.

  Correct Answer: D

• Question 168:

  You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist's email, and you send her an email changing the source email to her boss's email (boss@company). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your malicious links (these links contain malware) and send back the modified pdf, saying that the links don't work. She reads your email, opens the links, and her machine gets infected. You now have access to the company network. What testing method did you use?

  A. Social engineering

  B. Piggybacking

  C. Tailgating

  D. Eavesdropping

  Correct Answer: A

• Question 169:

  An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

  A. He will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.

  B. He will activate OSPF on the spoofed root bridge.

  C. He will repeat this action so that it escalates to a DoS attack.

  D. He will repeat the same attack against all L2 switches of the network.

  Correct Answer: A

• Question 170:

  When you are testing a web application, it is very useful to employ a proxy tool to save every request and response. You can manually test every request and analyze the response to find vulnerabilities. You can test parameter and headers manually to get more precise results than if using web vulnerability scanners.

  What proxy tool will help you find web vulnerabilities?

  A. Maskgen

  B. Dimitry

  C. Burpsuite

  D. Proxychains

  Correct Answer: C