EC-Council 312-50 Free Practice Questions

Q1. Neil is a network administrator working in Istanbul. Neil wants to setup a protocol analyzer on his network that will receive a copy of every packet that passes through the main office switch. What type of port will Neil need to setup in order to accomplish this? 

A. Neil will have to configure a Bridged port that will copy all packets to the protocol analyzer. 

B. Neil will need to setup SPAN port that will copy all network traffic to the protocol analyzer. 

C. He will have to setup an Ether channel port to get a copy of all network traffic to the analyzer. 

D. He should setup a MODS port which will copy all network traffic. 

View Answer

Q2. The terrorist organizations are increasingly blocking all traffic from North America or from Internet Protocol addresses that point to users who rely on the English Language. 

Hackers sometimes set a number of criteria for accessing their website. This information is shared among the co-hackers. For example if you are using a machine with the Linux Operating System and the Netscape browser then you will have access to their website in a convert way. When federal investigators using PCs running windows and using Internet Explorer visited the hacker’s shared site, the hacker’s system immediately mounted a distributed denial-of-service attack against the federal system. 

Companies today are engaging in tracking competitor’s through reverse IP address lookup sites like whois.com, which provide an IP address’s domain. When the competitor visits the companies website they are directed to a products page without discount and prices are marked higher for their product. When normal users visit the website they are directed to a page with full-blown product details along with attractive discounts. This is based on IP-based blocking, where certain addresses are barred from accessing a site. 

What is this masking technique called? 

A. Website Cloaking 

B. Website Filtering 

C. IP Access Blockade 

D. Mirrored WebSite 

View Answer

Q3. What does ICMP (type 11, code 0) denote? 

A. Unknown Type 

B. Time Exceeded 

C. Source Quench 

D. Destination Unreachable 

View Answer

Q4. What are the four steps is used by nmap scanning? 

A. DNS Lookup 

B. ICMP Message 

C. Ping 

D. Reverse DNS lookup 

E. TCP three way handshake 

F. The Actual nmap scan 

View Answer

Q5. You are the IT Manager of a large legal firm in California. Your firm represents many important clients whose names always must remain anonymous to the public. Your boss, Mr. Smith is always concerned about client information being leaked or revealed to the pres or public. You have just finished a complete security overhaul of your information system including an updated IPS, new firewall, email encryption and employee security awareness training. Unfortunately, many of your firm’s clients do not trust technology to completely secure their information, so couriers routinely have to travel back and forth to and from the office with sensitive information. 

Your boss has charged you with figuring out how to secure the information the couriers must transport. You propose that the data be transferred using burned CD’s or USB flash drives. You initially think of encrypting the files, but decide against that method for fear the encryption keys could eventually be broken. 

What software application could you use to hide the data on the CD’s and USB flash drives? 

A. Snow 

B. File Snuff 

C. File Sneaker 

D. EFS 

View Answer

Q6. Darren is the network administrator for Greyson & Associates, a large law firm in Houston. Darren is responsible for all network functions as well as any digital forensics work that is needed. Darren is examining the firewall logs one morning and notices some unusual activity. He traces the activity target to one of the firm's internal file servers and finds that many documents on that server were destroyed. After performing some calculations, Darren finds the damage to be around $75,000 worth of lost data. Darren decides that this incident should be handled and resolved within the same day of its discovery. 

What incident level would this situation be classified as? 

A. This situation would be classified as a mid-level incident 

B. Since there was over $50,000 worth of loss, this would be considered a high-level incident 

C. Because Darren has determined that this issue needs to be addressed in the same day it was discovered, this would be considered a low-level incident 

D. This specific incident would be labeled as an immediate-level incident 

View Answer

Q7. Pandora is used to attack __________ network operating systems. 

A. Windows 

B. UNIX 

C. Linux 

D. Netware 

E. MAC OS 

View Answer

Q8. You have successfully brute forced basic authentication configured on a Web Server using Brutus hacking tool. The username/password is “Admin” and “Bettlemani@”. You logon to the system using the brute forced password and plant backdoors and rootkits. 

After downloading various sensitive documents from the compromised machine, you proceed to clear the log files to hide your trace.. 

Which event log located at C:\Windows\system32\config contains the trace of your brute force attempts? 

A. AppEvent.Evt 

B. SecEvent.Evt 

C. SysEvent.Evt 

D. WinEvent.Evt 

View Answer

Q9. nn would like to perform a reliable scan against a remote target. She is not concerned about being stealth at this point. 

Which of the following type of scans would be the most accurate and reliable option? 

A. A half-scan 

B. A UDP scan 

C. A TCP Connect scan 

D. A FIN scan 

View Answer

Q10. Bob has set up three web servers on Windows Server 2008 IIS 7.0. Bob has followed all the recommendations for securing the operating system and IIS. These servers are going to run numerous e-commerce websites that are projected to bring in thousands of dollars a day. Bob is still concerned about the security of these servers because of the potential for financial loss. Bob has asked his company's firewall administrator to set the firewall to inspect all incoming traffic on ports 80 and 443 to ensure that no malicious data is getting into the network. 

Why will this not be possible? 

A. Firewalls cannot inspect traffic coming through port 443 

B. Firewalls can only inspect outbound traffic 

C. Firewalls cannot inspect traffic at all, they can only block or allow certain ports 

D. Firewalls cannot inspect traffic coming through port 80 

View Answer

Q11. Which of the following best describes Vulnerability? 

A. The loss potential of a threat 

B. An action or event that might prejudice security 

C. An agent that could take advantage of a weakness 

D. A weakness or error that can lead to compromise 

View Answer

Q12. John Beetlesman, the hacker has successfully compromised the Linux System of Agent Telecommunications, Inc’s WebServer running Apache. He has downloaded sensitive documents and database files off the machine. 

Upon performing various tasks, Beetlesman finally runs the following command on the Linux box before disconnecting. 

for ((i=0;i<1;i++));do 

?dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda 

done 

What exactly is John trying to do? 

A. He is making a bit stream copy of the entire hard disk for later download 

B. He is deleting log files to remove his trace 

C. He is wiping the contents of the hard disk with zeros 

D. He is infecting the hard disk with random virus strings 

View Answer

Q13. ou have hidden a Trojan file virus.exe inside another file readme.txt using NTFS streaming. 

Which command would you execute to extract the Trojan to a standalone file? 

A. c:\> type readme.txt:virus.exe > virus.exe 

B. c:\> more readme.txt | virus.exe > virus.exe 

C. c:\> cat readme.txt:virus.exe > virus.exe 

D. c:\> list redme.txt$virus.exe > virus.exe 

View Answer

Q14. Choose one of the following pseudo codes to describe this statement: 

If we have written 200 characters to the buffer variable, the stack should stop because it cannot hold any more data. 

A. If (I > 200) then exit (1) 

B. If (I < 200) then exit (1) 

C. If (I <= 200) then exit (1) 

D. If (I >= 200) then exit (1) 

View Answer

Q15. You have been using the msadc.pl attack script to execute arbitrary commands on an NT4 web server. While it is effective, you find it tedious to perform extended functions. On further research you come across a perl script that runs the following msadc functions: 

What kind of exploit is indicated by this script? 

A. A buffer overflow exploit. 

B. A SUID exploit. 

C. A SQL injection exploit. 

D. A chained exploit. 

E. A buffer under run exploit. 

View Answer