EC-COUNCIL EC-COUNCIL Certifications 312-50V11 Questions & Answers

• Question 341:

  Based on the following extract from the log of a compromised machine, what is the hacker really trying to steal?

  A. har.txt

  B. SAM file

  C. wwwroot

  D. Repair file

  Correct Answer: B

• Question 342:

  A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers.

  A. Use port security on his switches.

  B. Use a tool like ARPwatch to monitor for strange ARP activity.

  C. Use a firewall between all LAN segments.

  D. If you have a small network, use static ARP entries.

  E. Use only static IP addresses on all PC's.

  Correct Answer: ABD

• Question 343:

  Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches.

  If these switches' ARP cache is successfully flooded, what will be the result?

  A. The switches will drop into hub mode if the ARP cache is successfully flooded.

  B. If the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to attacks.

  C. Depending on the switch manufacturer, the device will either delete every entry in its ARP cache or reroute packets to the nearest switch.

  D. The switches will route all traffic to the broadcast address created collisions.

  Correct Answer: A

• Question 344:

  One of your team members has asked you to analyze the following SOA record. What is the version?

  Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.) (Choose

  four.)

  A. 200303028

  B. 3600

  C. 604800

  D. 2400

  E. 60

  F. 4800

  Correct Answer: A

• Question 345:

  A zone file consists of which of the following Resource Records (RRs)?

  A. DNS, NS, AXFR, and MX records

  B. DNS, NS, PTR, and MX records

  C. SOA, NS, AXFR, and MX records

  D. SOA, NS, A, and MX records

  Correct Answer: D

• Question 346:

  A "Server-Side Includes" attack refers to the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary code remotely.

  Which web-page file type, if it exists on the web server, is a strong indication that the server is vulnerable to this kind of attack?

  A. .stm

  B. .html

  C. .rss

  D. .cms

  Correct Answer: A

• Question 347:

  Roma is a member of a security team. She was tasked with protecting the internal network of an organization from imminent threats. To accomplish this task, Roma fed threat intelligence into the security devices in a digital format to block and identify inbound and outbound malicious traffic entering the organization's network.

  Which type of threat intelligence is used by Roma to secure the internal network?

  A. Technical threat intelligence

  B. Operational threat intelligence

  C. Tactical threat intelligence

  D. Strategic threat intelligence

  Correct Answer: A

• Question 348:

  Attacker Steve targeted an organization's network with the aim of redirecting the company's web traffic to another malicious website. To achieve this goal, Steve performed DNS cache poisoning by exploiting the vulnerabilities In the DNS server software and modified the original IP address of the target website to that of a fake website. What is the technique employed by Steve to gather information for identity theft?

  A. Pretexting

  B. Pharming

  C. Wardriving

  D. Skimming

  Correct Answer: B

  A pharming attacker tries to send a web site's traffic to a faux website controlled by the offender, typically for the aim of collection sensitive data from victims or putting in malware on their machines. Attacker tend to specialize in making look- alike ecommerce and digital banking websites to reap credentials and payment card data. Though they share similar goals, pharming uses a special technique from phishing. "Pharming attacker are targeted on manipulating a system, instead of tricking people into reaching to a dangerous web site," explains David Emm, principal security man of science at Kaspersky. "When either a phishing or pharming attacker is completed by a criminal, they need a similar driving issue to induce victims onto a corrupt location, however the mechanisms during which this is often undertaken are completely different."

• Question 349:

  Tremp is an IT Security Manager, and he is planning to deploy an IDS in his small company. He is looking for an IDS with the following characteristics: - Verifies success or failure of an attack - Monitors system activities Detects attacks that a network-based IDS fails to detect - Near real-time detection and response Does not require additional hardware - Lower entry cost Which type of IDS is best suited for Tremp's requirements?

  A. Gateway-based IDS

  B. Network-based IDS

  C. Host-based IDS

  D. Open source-based

  Correct Answer: C

• Question 350:

  Which of the following antennas is commonly used in communications for a frequency band of 10 MHz to VHF and UHF?

  A. Yagi antenna

  B. Dipole antenna

  C. Parabolic grid antenna

  D. Omnidirectional antenna

  Correct Answer: A