EC-Council EC-Council exam is one of the many demanded exams to examination whether a person master the crucial topics of the EC-Council exam. It really is never the easy career to pass the particular EC-Council EC-Council certification exam by your self. However, Exambibles EC-Council 312-50 practice questions along with answers will help you to pass around the first try out. EC-Council 312-50 simulated tests are compiled under the particular supervision of experienced and seasoned IT professionals. EC-Council EC-Council exam preps which give you the most realistic along with comprehensive studying materials are generally award-winning of the same occupation. Get access for the free EC-Council 312-50 exam braindumps upon Exambible website appropriate now.

2021 Oct 312-50 exam engine

Q381. TCP/IP Session Hijacking is carried out in which OSI layer? 

A. Transport layer 

B. Datalink layer 

C. Physical Layer 

D. Network Layer 

Answer: A


Q382. This is an example of whois record. 


Sometimes a company shares a little too much information on their organization through public domain records. Based on the above whois record, what can an attacker do? (Select 2 answers) 

A. Search engines like Google, Bing will expose information listed on the WHOIS record 

B. An attacker can attempt phishing and social engineering on targeted individuals using the information from WHOIS record 

C. Spammers can send unsolicited e-mails to addresses listed in the WHOIS record 

D. IRS Agents will use this information to track individuals using the WHOIS record information 

Answer: BC


Q383. This method is used to determine the Operating system and version running on a remote target system. What is it called? 

A. Service Degradation 

B. OS Fingerprinting 

C. Manual Target System 

D. Identification Scanning 

Answer: B


Q384. What techniques would you use to evade IDS during a Port Scan? (Select 4 answers) 

A. Use fragmented IP packets 

B. Spoof your IP address when launching attacks and sniff responses from the server 

C. Overload the IDS with Junk traffic to mask your scan 

D. Use source routing (if possible) 

E. Connect to proxy servers or compromised Trojaned machines to launch attacks 

Answer: ABDE


Q385. What does black box testing mean? 

A. You have full knowledge of the environment 

B. You have no knowledge of the environment 

C. You have partial knowledge of the environment 

Answer: B

Explanation: Black box testing is conducted when you have no knowledge of the environment. It is more time consuming and expensive. 


Down to date 312-50 test questions:

Q386. Bob is conducting a password assessment for one of his clients. Bob suspects that password policies are not in place and weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weakness and key loggers. What are the means that Bob can use to get password from his client hosts and servers? 

A. Hardware, Software and Sniffing 

B. Hardware and Software Keyloggers 

C. Software only, they are the most effective 

D. Passwords are always best obtained using Hardware key loggers 

Answer: A 

Explanation: All loggers will work as long as he has physical access to the computers. 


Topic 8, Denial of Service 

275. The evil hacker, is purposely sending fragmented ICMP packets to a remote target. The total size of this ICMP packet once reconstructed is over 65,536 bytes. From the information given, what type of attack is attempting to perform? 

A. Syn flood 

B. Smurf 

C. Ping of death 

D. Fraggle 

Answer: C 

Reference: http://insecure.org/sploits/ping-o-death.html 


Q387. Network Administrator Patricia is doing an audit of the network. Below are some of her findings concerning DNS. Which of these would be a cause for alarm? 

Select the best answer. 

A. There are two external DNS Servers for Internet domains. Both are AD integrated. 

B. All external DNS is done by an ISP. 

C. Internal AD Integrated DNS servers are using private DNS names that are 

D. unregistered. 

E. Private IP addresses are used on the internal network and are registered with the internal AD integrated DNS server. 

Answer: A 

Explanations: 

A. There are two external DNS Servers for Internet domains. Both are AD integrated. This is the correct answer. Having an AD integrated DNS external server is a serious cause for alarm. There is no need for this and it causes vulnerability on the network. 

B. All external DNS is done by an ISP. 

This is not the correct answer. This would not be a cause for alarm. This would actually reduce the company's network risk as it is offloaded onto the ISP. 

C. Internal AD Integrated DNS servers are using private DNS names that are unregistered. This is not the correct answer. This would not be a cause for alarm. This would actually reduce the company's network risk. 

D. Private IP addresses are used on the internal network and are registered with the internal AD integrated DNS server. 

This is not the correct answer. This would not be a cause for alarm. This would actually reduce the company's network risk. 


Q388. The Slammer Worm exploits a stack-based overflow that occurs in a DLL implementing the Resolution Service. 

Which of the following Database Server was targeted by the slammer worm? 

A. Oracle 

B. MSSQL 

C. MySQL 

D. Sybase 

E. DB2 

Answer: B

Explanation: W32.Slammer is a memory resident worm that propagates via UDP Port 1434 and exploits a vulnerability in SQL Server 2000 systems and systems with MSDE 2000 that have not applied the patch released by Microsoft Security Bulletin MS02-039. 


Q389. Which tool/utility can help you extract the application layer data from each TCP connection from a log file into separate files? 

A. Snort 

B. argus 

C. TCPflow 

D. Tcpdump 

Answer: C

Explanation: Tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. 


Q390. Lauren is performing a network audit for her entire company. The entire network is comprised of around 500 computers. Lauren starts an ICMP ping sweep by sending one IP packet to the broadcast address of the network, but only receives responses from around five hosts. Why did this ping sweep only produce a few responses? 

A. Only Windows systems will reply to this scan. 

B. A switched network will not respond to packets sent to the broadcast address. 

C. Only Linux and Unix-like (Non-Windows) systems will reply to this scan. 

D. Only servers will reply to this scan. 

Answer: C