Eccouncil 312-50 Practice Exam Questions

Eccouncil 312-50 Sample Question Answers

Question # 1

Which tool/utility can help you extract the application layer data from each TCP connectionfrom a log file into separate files?

A. Snort  
B. argus 
C. TCPflow 
D. Tcpdump

Show Answer

Question # 2

Bob wants to prevent attackers from sniffing his passwords on the wired network. Which ofthe following lists the best options?

A. RSA, LSA, POP 
B. SSID, WEP, Kerberos 
C. SMB, SMTP, Smart card 
D. Kerberos, Smart card, Stanford SRP

Show Answer

Question # 3

The follows is an email header. What address is that of the true originator of the message?Return-Path: <[email protected]>Received: from smtp.com (fw.emumail.com [215.52.220.122].by raq-221-181.ev1.net (8.10.2/8.10.2. with ESMTP id h78NIn404807for <[email protected]>; Sat, 9 Aug 2003 18:18:50 -0500Received: (qmail 12685 invoked from network.; 8 Aug 2003 23:25:25 -0000Received: from ([19.25.19.10]. by smtp.com with SMTP Received: from unknown (HELO CHRISLAPTOP. (168.150.84.123.by localhost with SMTP; 8 Aug 2003 23:25:01 -0000From: "Bill Gates" <[email protected]>To: "mikeg" <[email protected]>Subject: We need your help!Date: Fri, 8 Aug 2003 19:12:28 -0400Message-ID: <51.32.123.21@CHRISLAPTOP>MIME-Version: 1.0Content-Type: multipart/mixed;boundary="----=_NextPart_000_0052_01C35DE1.03202950"X-Priority: 3 (Normal.X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook, Build 10.0.2627X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165Importance: Normal

A. 19.25.19.10 
B. 51.32.123.21 
C. 168.150.84.123 
D. 215.52.220.122 
E. 8.10.2/8.10.2 

Show Answer

Question # 4

Ethereal works best on ____________. 

A. Switched networks 
B. Linux platforms 
C. Networks using hubs 
D. Windows platforms 
E. LAN's 

Show Answer

Question # 5

Samantha was hired to perform an internal security test of company. She quickly realizedthat all networks are making use of switches instead of traditional hubs. This greatly limitsher ability to gather information through network sniffing.Which of the following techniques can she use to gather information from the switchednetwork or to disable some of the traffic isolation features of the switch? (Choose two)

A. Ethernet Zapping 
B. MAC Flooding 
C. Sniffing in promiscuous mode 
D. ARP Spoofing 

Show Answer

Question # 6

A POP3 client contacts the POP3 server:

A. To send mail 
B. To receive mail 
C. to send and receive mail 
D. to get the address to send mail to 
E. initiate a UDP SMTP connection to read mail 

Show Answer

Question # 7

A remote user tries to login to a secure network using Telnet, but accidently types in an invaliduser name or password. Which responses would NOT be preferred by an experienced SecurityManager? (multiple answer)

A. Invalid Username 
B. Invalid Password 
C. Authentication Failure 
D. Login Attempt Failed 
E. Access Denied 

Show Answer

Question # 8

ettercap –NCLzs --quietWhat does the command in the exhibit do in “Ettercap”?

A. This command will provide you the entire list of hosts in the LAN 
B. This command will check if someone is poisoning you and will report its IP. 
C. This command will detach from console and log all the collected passwords from the network toa file. 
D. This command broadcasts ping to scan the LAN instead of ARP request of all the subnet IPs. 

Show Answer

Question # 9

You are writing an antivirus bypassing Trojan using C++ code wrapped into chess.c tocreate an executable file chess.exe. This Trojan when executed on the victim machine,scans the entire system (c:\) for data with the following text “Credit Card” and “password”.It then zips all the scanned files and sends an email to a predefined hotmail address.You want to make this Trojan persistent so that it survives computer reboots. Whichregistry entry will you add a key to make it persistent?

A. HKEY_LOCAL_MACHINE\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 
B. HKEY_LOCAL_USER\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 
C. HKEY_LOCAL_SYSTEM\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 
D. HKEY_CURRENT_USER\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 

Show Answer

Question # 10

John wants to try a new hacking tool on his Linux System. As the application comes from asite in his untrusted zone, John wants to ensure that the downloaded tool has not beenTrojaned. Which of the following options would indicate the best course of action for John?

A. Obtain the application via SSL 
B. Obtain the application from a CD-ROM disc 
C. Compare the files’ MD5 signature with the one published on the distribution media 
D. Compare the file’s virus signature with the one published on the distribution media 

Show Answer