EC-COUNCIL EC-COUNCIL Certifications 312-50V12 Questions & Answers

• Question 451:

  Which of the following is a low-tech way of gaining unauthorized access to systems?

  A. Social Engineering

  B. Eavesdropping

  C. Scanning

  D. Sniffing

  Correct Answer: A

• Question 452:

  Which of the following tactics uses malicious code to redirect users' web traffic?

  A. Spimming

  B. Pharming

  C. Phishing

  D. Spear-phishing

  Correct Answer: B

• Question 453:

  Bobby, an attacker, targeted a user and decided to hijack and intercept all their wireless communications. He installed a fake communication tower between two authentic endpoints to mislead the victim. Bobby used this virtual tower to interrupt the data transmission between the user and real tower, attempting to hijack an active session, upon receiving the users request. Bobby manipulated the traffic with the virtual tower and redirected the victim to a malicious website. What is the attack performed by Bobby in the above scenario?

  A. Wardriving

  B. KRACK attack

  C. jamming signal attack

  D. aLTEr attack

  Correct Answer: D

  aLTEr attacks are usually performed on LTE devices Attacker installs a virtual (fake) communication tower between two authentic endpoints intending to mislead the victim This virtual tower is used to interrupt the data transmission between

  the user and real tower attempting to hijack the active session.

  https://alter-attack.net/media/breaking_lte_on_layer_two.pdf The new aLTEr attack can be used against nearly all LTE connected endpoints by intercepting traffic and redirecting it to malicious websites together with a particular approach for

  Apple iOS devices.

  This attack works by taking advantage of a style flaw among the LTE network -- the information link layer (aka: layer-2) of the LTE network is encrypted with AES-CTR however it's not integrity-protected, that is why an offender will modify the

  payload. As a result, the offender is acting a classic man-in-the-middle wherever they're movement as a cell tower to the victim.

  

• Question 454:

  Steven connected his iPhone to a public computer that had been infected by Clark, an attacker. After establishing the connection with the public computer, Steven enabled iTunes WI-FI sync on the computer so that the device could continue

  communication with that computer even after being physically disconnected. Now, Clark gains access to Steven's iPhone through the infected computer and is able to monitor and read all of Steven's activity on the iPhone, even after the

  device is out of the communication zone.

  Which of the following attacks is performed by Clark in above scenario?

  A. IOS trustjacking

  B. lOS Jailbreaking

  C. Exploiting SS7 vulnerability

  D. Man-in-the-disk attack

  Correct Answer: A

  An iPhone client's most noticeably terrible bad dream is to have somebody oversee his/her gadget, including the capacity to record and control all action without waiting be in a similar room. In this blog entry, we present another weakness called "Trustjacking", which permits an aggressor to do precisely that. This weakness misuses an iOS highlight called iTunes Wi-Fi sync, which permits a client to deal with their iOS gadget without genuinely interfacing it to their PC. A solitary tap by the iOS gadget proprietor when the two are associated with a similar organization permits an assailant to oversee the gadget. Furthermore, we will stroll through past related weaknesses and show the progressions that iPhone has made to alleviate them, and why these are adequately not to forestall comparative assaults. After interfacing an iOS gadget to another PC, the clients are being found out if they trust the associated PC or not. Deciding to believe the PC permits it to speak with the iOS gadget by means of the standard iTunes APIs. This permits the PC to get to the photographs on the gadget, perform reinforcement, introduce applications and considerably more, without requiring another affirmation from the client and with no recognizable sign. Besides, this permits enacting the "iTunes Wi-Fi sync" highlight, which makes it conceivable to proceed with this sort of correspondence with the gadget even after it has been detached from the PC, as long as the PC and the iOS gadget are associated with a similar organization. It is intriguing to take note of that empowering "iTunes Wi-Fi sync" doesn't need the casualty's endorsement and can be directed simply from the PC side. Getting a live stream of the gadget's screen should be possible effectively by consistently requesting screen captures and showing or recording them distantly. It is imperative to take note of that other than the underlying single purpose of disappointment, approving the vindictive PC, there is no other component that forestalls this proceeded with access. Likewise, there isn't anything that informs the clients that by approving the PC they permit admittance to their gadget even in the wake of detaching the USB link.

• Question 455:

  What is the following command used for? net use \targetipc$ "" /u:""

  A. Grabbing the etc/passwd file

  B. Grabbing the SAM

  C. Connecting to a Linux computer through Samba.

  D. This command is used to connect as a null session

  E. Enumeration of Cisco routers

  Correct Answer: D

• Question 456:

  Within the context of Computer Security, which of the following statements describes Social Engineering best?

  A. Social Engineering is the act of publicly disclosing information

  B. Social Engineering is the means put in place by human resource to perform time accounting

  C. Social Engineering is the act of getting needed information from a person rather than breaking into a system

  D. Social Engineering is a training program within sociology studies

  Correct Answer: C

• Question 457:

  What is the minimum number of network connections in a multi homed firewall?

  A. 3

  B. 5

  C. 4

  D. 2

  Correct Answer: A

• Question 458:

  Tess King is using the nslookup command to craft queries to list all DNS information (such as Name Servers, host names, MX records, CNAME records, glue records (delegation for child Domains), zone serial number, TimeToLive (TTL)

  records, etc) for a Domain.

  What do you think Tess King is trying to accomplish? Select the best answer.

  A. A zone harvesting

  B. A zone transfer

  C. A zone update

  D. A zone estimate

  Correct Answer: B

• Question 459:

  A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer's software and hardware without the owner's permission. Their intention can either be to simply gain knowledge or to illegally make

  changes.

  Which of the following class of hacker refers to an individual who works both offensively and defensively at various times?

  A. White Hat

  B. Suicide Hacker

  C. Gray Hat

  D. Black Hat

  Correct Answer: C

• Question 460:

  On performing a risk assessment, you need to determine the potential impacts when some of the critical business processes of the company interrupt its service. What is the name of the process by which you can determine those critical businesses?

  A. Emergency Plan Response (EPR)

  B. Business Impact Analysis (BIA)

  C. Risk Mitigation

  D. Disaster Recovery Planning (DRP)

  Correct Answer: B