EC-COUNCIL EC-COUNCIL Certifications 312-50V8 Questions & Answers

• Question 381:

  John runs a Web server, IDS and firewall on his network. Recently his Web server has been under constant hacking attacks. He looks up the IDS log files and sees no intrusion attempts but the Web server constantly locks up and needs rebooting due to various brute force and buffer overflow attacks but still the IDS alerts no intrusion whatsoever. John becomes suspicious and views the Firewall logs and he notices huge SSL connections constantly hitting his Web server. Hackers have been using the encrypted HTTPS protocol to send exploits to the Web server and that was the reason the IDS did not detect the intrusions.

  How would John protect his network from these types of attacks?

  A. Install a proxy server and terminate SSL at the proxy

  B. Enable the IDS to filter encrypted HTTPS traffic

  C. Install a hardware SSL "accelerator" and terminate SSL at this layer

  D. Enable the Firewall to filter encrypted HTTPS traffic

  Correct Answer: AC

• Question 382:

  To see how some of the hosts on your network react, Winston sends out SYN packets to an IP range. A number of IPs respond with a SYN/ACK response. Before the connection is established he sends RST packets to those hosts to stop the session. Winston has done this to see how his intrusion detection system will log the traffic.

  What type of scan is Winston attempting here?

  A. Winston is attempting to find live hosts on your company's network by using an XMAS scan.

  B. He is utilizing a SYN scan to find live hosts that are listening on your network.

  C. This type of scan he is using is called a NULL scan.

  D. He is using a half-open scan to find live hosts on your network.

  Correct Answer: D

• Question 383:

  In keeping with the best practices of layered security, where are the best places to place intrusion detection/intrusion prevention systems? (Choose two.)

  A. HID/HIP (Host-based Intrusion Detection/Host-based Intrusion Prevention)

  B. NID/NIP (Node-based Intrusion Detection/Node-based Intrusion Prevention)

  C. NID/NIP (Network-based Intrusion Detection/Network-based Intrusion Prevention)

  D. CID/CIP (Computer-based Intrusion Detection/Computer-based Intrusion Prevention)

  Correct Answer: AC

• Question 384:

  If the final set of security controls does not eliminate all risk in a system, what could be done next?

  A. Continue to apply controls until there is zero risk.

  B. Ignore any remaining risk.

  C. If the residual risk is low enough,it can be accepted.

  D. Remove current controls since they are not completely effective.

  Correct Answer: C

• Question 385:

  A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters.

  What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?

  A. if (billingAddress = 50) {update field} else exit

  B. if (billingAddress != 50) {update field} else exit

  C. if (billingAddress >= 50) {update field} else exit

  D. if (billingAddress <= 50) {update field} else exit

  Correct Answer: D

• Question 386:

  How can rainbow tables be defeated?

  A. Password salting

  B. Use of non-dictionary words

  C. All uppercase character passwords

  D. Lockout accounts under brute force password cracking attempts

  Correct Answer: A

• Question 387:

  Which of the following is an advantage of utilizing security testing methodologies to conduct a security audit?

  A. They provide a repeatable framework.

  B. Anyone can run the command line scripts.

  C. They are available at low cost.

  D. They are subject to government regulation.

  Correct Answer: A

• Question 388:

  If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP.

  Which other option could the tester use to get a response from a host using TCP?

  A. Hping

  B. Traceroute

  C. TCP ping

  D. Broadcast ping

  Correct Answer: A

• Question 389:

  Which type of security document is written with specific step-by-step details?

  A. Process

  B. Procedure

  C. Policy

  D. Paradigm

  Correct Answer: B

• Question 390:

  A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying.

  What actions should the CEH take?

  A. Threaten to publish the penetration test results if not paid.

  B. Follow proper legal procedures against the company to request payment.

  C. Tell other customers of the financial problems with payments from this company.

  D. Exploit some of the vulnerabilities found on the company webserver to deface it.

  Correct Answer: B