Want to know Testking 312-50 Exam practice test features? Want to lear more about EC-Council Ethical Hacking and Countermeasures (CEHv6) certification experience? Study Top Quality EC-Council 312-50 answers to Improve 312-50 questions at Testking. Gat a success with an absolute guarantee to pass EC-Council 312-50 (Ethical Hacking and Countermeasures (CEHv6)) test on your first attempt.


♥♥ 2021 NEW RECOMMEND ♥♥

Free VCE & PDF File for EC-Council 312-50 Real Exam (Full Version!)

★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW 312-50 Exam Dumps (PDF & VCE):
Available on: http://www.surepassexam.com/312-50-exam-dumps.html

Q201. Exhibit: 

Given the following extract from the snort log on a honeypot, what do you infer from the attack? 

A. A new port was opened 

B. A new user id was created 

C. The exploit was successful 

D. The exploit was not successful 

Answer: D

Explanation: The attacker submits a PASS to the honeypot and receives a login incorrect before disconnecting. 


Q202. Your company trainee Sandra asks you which are the four existing Regional Internet Registry (RIR's)? 

A. APNIC, PICNIC, ARIN, LACNIC 

B. RIPE NCC, LACNIC, ARIN, APNIC 

C. RIPE NCC, NANIC, ARIN, APNIC 

D. RIPE NCC, ARIN, APNIC, LATNIC 

Answer: B

Explanation: All other answers include non existing organizations (PICNIC, NANIC, LATNIC). See http://www.arin.net/library/internet_info/ripe.html 


Q203. If you send a SYN to an open port, what is the correct response?(Choose all correct answers. 

A. SYN 

B. ACK 

C. FIN 

D. PSH 

Answer: AB

Explanation: The proper response is a SYN / ACK. This technique is also known as half-open scanning. 


Q204. You are scanning into the target network for the first time. You find very few conventional ports open. When you attempt to perform traditional service identification by connecting to the open ports, it yields either unreliable or no results. You are unsure of which protocols are being used. You need to discover as many different protocols as possible. 

Which kind of scan would you use to achieve this? (Choose the best answer) 

A. Nessus scan with TCP based pings. 

B. Nmap scan with the –sP (Ping scan) switch. 

C. Netcat scan with the –u –e switches. 

D. Nmap with the –sO (Raw IP packets) switch. 

Answer: D

Explanation: Running Nmap with the –sO switch will do a IP Protocol Scan. The IP protocol scan is a bit different than the other nmap scans. The IP protocol scan is searching for additional IP protocols in use by the remote station, such as ICMP, TCP, and UDP. If a router is scanned, additional IP protocols such as EGP or IGP may be identified. 


Q205. How do you defend against DHCP Starvation attack? 

A. Enable ARP-Block on the switch 

B. Enable DHCP snooping on the switch 

C. Configure DHCP-BLOCK to 1 on the switch 

D. Install DHCP filters on the switch to block this attack 

Answer: B


Q206. TCP/IP Session Hijacking is carried out in which OSI layer? 

A. Transport layer 

B. Datalink layer 

C. Physical Layer 

D. Network Layer 

Answer: A


Q207. Which of the following activities will not be considered passive footprinting? 

A. Go through the rubbish to find out any information that might have been discarded 

B. Search on financial site such as Yahoo Financial to identify assets 

C. Scan the range of IP address found in the target DNS database 

D. Perform multiples queries using a search engine 

Answer: C 

Explanation: Scanning is not considered to be passive footprinting. 


Q208. Giles is the network administrator for his company, a graphics design company based in Dallas. Most of the network is comprised of Windows servers and workstations, except for some designers that prefer to use MACs. These MAC users are running on the MAC OS X operating system. These MAC users also utilize iChat to talk between each other. Tommy, one of these MAC users, calls Giles and says that his computer is running very slow. Giles then gets more calls from the other MAC users saying they are receiving instant messages from Tommy even when he says he is not on his computer. Giles immediately unplugs Tommy's computer from the network to take a closer look. He opens iChat on Tommy's computer and it says that it sent a file called latestpics.tgz to all the other MAC users. Tommy says he never sent those files. Giles also sees that many of the computer's applications appear to be altered. The path where the files should be has an altered file and the original application is stored in the file's resource fork. 

What has Giles discovered on Tommy's computer? 

A. He has discovered OSX/Chat-burner virus on Tommy's computer 

B. Giles has found the OSX/Leap-A virus on Tommy's computer 

C. This behavior is indicative of the OSX/Inqtana.A virus 

D. On Tommy's computer, Giles has discovered an apparent infection of the OSX/Transmitter.B virus 

Answer: B

Explanation: OSX.Leap.A is a worm that targets installs of Macintosh OS X and spreads via iChat Instant Messenger program. http://www.symantec.com/security_response/writeup.jsp?docid=2006-021614-4006-99 


Q209. Stephanie works as senior security analyst for a manufacturing company in Detroit. Stephanie manages network security throughout the organization. Her colleague Jason told her in confidence that he was able to see confidential corporate information posted on the external website http://www.jeansclothesman.com. He tries random URLs on the company's website and finds confidential information leaked over the web. Jason says this happened about a month ago. Stephanie visits the said URLs, but she finds nothing. She is very concerned about this, since someone should be held accountable if there was sensitive information posted on the website. 

Where can Stephanie go to see past versions and pages of a website? 

A. She should go to the web page Samspade.org to see web pages that might no longer be on the website 

B. If Stephanie navigates to Search.com; she will see old versions of the company website 

C. Stephanie can go to Archive.org to see past versions of the company website 

D. AddressPast.com would have any web pages that are no longer hosted on the company's website 

Answer: C


Q210. You are the CIO for Avantes Finance International, a global finance company based in Geneva. You are responsible for network functions and logical security throughout the entire corporation. Your company has over 250 servers running Windows Server, 5000 workstations running Windows Vista, and 200 mobile users working from laptops on Windows 7. 

Last week, 10 of your company's laptops were stolen from salesmen while at a conference in Amsterdam. These laptops contained proprietary company information. While doing damage assessment on the possible public relations nightmare this may become, a news story leaks about the stolen laptops and also that sensitive information from those computers was posted to a blog online. 

What built-in Windows feature could you have implemented to protect the sensitive information on these laptops? 

A. You should have used 3DES which is built into Windows 

B. If you would have implemented Pretty Good Privacy (PGP) which is built into Windows, the sensitive information on the laptops would not have leaked out 

C. You should have utilized the built-in feature of Distributed File System (DFS) to protect the sensitive information on the laptops 

D. You could have implemented Encrypted File System (EFS) to encrypt the sensitive files on the laptops 

Answer: D