Excellent 312-50v11 Updated 2021 Dumps With 100% Exam Passing Guarantee
Best way to practice test for EC-COUNCIL 312-50v11
NEW QUESTION 60
Attacker Steve targeted an organization's network with the aim of redirecting the company's web traffic to another malicious website. To achieve this goal, Steve performed DNS cache poisoning by exploiting the vulnerabilities In the DNS server software and modified the original IP address of the target website to that of a fake website. What is the technique employed by Steve to gather information for identity theft?
- A. Pharming
- B. Wardriving
- C. Skimming
- D. Pretexting
Answer: A
Explanation:
A pharming attacker tries to send a web site's traffic to a faux website controlled by the offender, typically for the aim of collection sensitive data from victims or putting in malware on their machines. Attacker tend to specialize in making look-alike ecommerce and digital banking websites to reap credentials and payment card data.
Though they share similar goals, pharming uses a special technique from phishing. "Pharming attacker are targeted on manipulating a system, instead of tricking people into reaching to a dangerous web site," explains David Emm, principal security man of science at Kaspersky. "When either a phishing or pharming attacker is completed by a criminal, they need a similar driving issue to induce victims onto a corrupt location, however the mechanisms during which this is often undertaken are completely different."
NEW QUESTION 61
An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security.
When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events do not match up.
What is the most likely cause?
- A. The network devices are not all synchronized.
- B. The security breach was a false positive.
- C. The attacker altered or erased events from the logs.
- D. Proper chain of custody was not observed while collecting the logs.
Answer: A
NEW QUESTION 62
Attacker Rony installed a rogue access point within an organization's perimeter and attempted to intrude into its internal network. Johnson, a security auditor, identified some unusual traffic in the internal network that is aimed at cracking the authentication mechanism. He immediately turned off the targeted network and tested for any weak and outdated security mechanisms that are open to attack. What is the type of vulnerability assessment performed by johnson in the above scenario?
- A. Distributed assessment
- B. Wireless network assessment
- C. Application assessment
- D. Host-based assessment
Answer: B
NEW QUESTION 63
An attacker is trying to redirect the traffic of a small office. That office is using their own mail server, DNS server and NTP server because of the importance of their job. The attacker gain access to the DNS server and redirect the direction www.google.com to his own IP address. Now when the employees of the office want to go to Google they are being redirected to the attacker machine. What is the name of this kind of attack?
- A. MAC Flooding
- B. ARP Poisoning
- C. DNS spoofing
- D. Smurf Attack
Answer: C
NEW QUESTION 64
Steven connected his iPhone to a public computer that had been infected by Clark, an attacker. After establishing the connection with the public computer, Steven enabled iTunes Wi-Fi sync on the computer so that the device could continue communication with that computer even after being physically disconnected.
Now, Clark gains access to Steven's iPhone through the infected computer and is able to monitor and read all of Steven's activity on the iPhone, even after the device is out of the communication zone.
Which of the following attacks is performed by Clark in the above scenario?
- A. iOS trustjacking
- B. Man-in-the-disk attack
- C. iOS jailbreaking
- D. Exploiting SS7 vulnerability
Answer: A
NEW QUESTION 65
Jack, a professional hacker, targets an organization and performs vulnerability scanning on the target web server to identify any possible weaknesses, vulnerabilities, and misconfigurations. In this process, Jack uses an automated tool that eases his work and performs vulnerability scanning to find hosts, services, and other vulnerabilities in the target server. Which of the following tools is used by Jack to perform vulnerability scanning?
- A. NCollector Studio
- B. WebCopier Pro
- C. Netsparker
- D. Infoga
Answer: C
NEW QUESTION 66
Alice needs to send a confidential document to her coworker. Bryan. Their company has public key infrastructure set up. Therefore. Alice both encrypts the message and digitally signs it. Alice uses_______to encrypt the message, and Bryan uses__________to confirm the digital signature.
- A. Bryan's public key; Alice's public key
- B. Bryan's public key; Bryan's public key
- C. Bryan's private key; Alice's public key
- D. Alice's public key; Alice's public key
Answer: D
NEW QUESTION 67
what is the port to block first in case you are suspicious that an loT device has been compromised?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Explanation
TCP port 48101 uses the Transmission management Protocol. transmission control protocol is one in all the most protocols in TCP/IP networks. transmission control protocol could be a connection-oriented protocol, it needs acknowledgement to line up end-to-end communications. only a association is about up user's knowledge may be sent bi-directionally over the association.
Attention! transmission control protocol guarantees delivery of knowledge packets on port 48101 within the same order during which they were sent. bonded communication over transmission control protocol port
48101 is that the main distinction between transmission control protocol and UDP. UDP port 48101 wouldn't have bonded communication as transmission control protocol.
UDP on port 48101 provides Associate in Nursing unreliable service and datagrams might arrive duplicated, out of order, or missing unexpectedly. UDP on port 48101 thinks that error checking and correction isn't necessary or performed within the application, avoiding the overhead of such process at the network interface level.
UDP (User Datagram Protocol) could be a borderline message-oriented Transport Layer protocol (protocol is documented in IETF RFC 768).
Application examples that always use UDP: vocalisation IP (VoIP), streaming media and period multiplayer games. several internet applications use UDP, e.g. the name System (DNS), the Routing info Protocol (RIP), the Dynamic Host Configuration Protocol (DHCP), the straightforward Network Management Protocol (SNMP).
NEW QUESTION 68
Your company performs penetration tests and security assessments for small and medium-sized business in the local are a. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.
What should you do?
- A. Immediately stop work and contact the proper legal authorities.
- B. Confront the client in a respectful manner and ask her about the data.
- C. Ignore the data and continue the assessment until completed as agreed.
- D. Copy the data to removable media and keep it in case you need it.
Answer: A
NEW QUESTION 69
Which rootkit is characterized by its function of adding code and/or replacing some of the operating-system kernel code to obscure a backdoor on a system?
- A. Kernel-level rootkit
- B. User-mode rootkit
- C. Library-level rootkit
- D. Hypervisor-level rootkit
Answer: A
NEW QUESTION 70
which of the following protocols can be used to secure an LDAP service against anonymous queries?
- A. SSO
- B. NTLM
- C. RADIUS
- D. WPA
Answer: C
Explanation:
Remote Authentication Dial-In User Service (RADIUS) could be a networking protocols, in operation on ports 1812 and 1813, that gives centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service. RADIUS was developed by American Revolutionary leader Enterprises, Inc. in 1991 as an access server authentication and accounting protocol and later brought into the net Engineering Task Force (IETF) standards.
RADIUS could be a client/server protocol that runs within the application layer, and might use either protocol or UDP as transport. Network access servers, the gateways that management access to a network, sometimes contain a RADIUS consumer element that communicates with the RADIUS server . RADIUS is commonly the back-end of alternative for 802.1X authentication moreover.
The RADIUS server is sometimes a background method running on a UNIX system or Microsoft Windows server.
NEW QUESTION 71
What tool can crack Windows SMB passwords simply by listening to network traffic?
- A. This is not possible
- B. Netbus
- C. L0phtcrack
- D. NTFSDOS
Answer: C
NEW QUESTION 72
When discussing passwords, what is considered a brute force attack?
- A. You attempt every single possibility until you exhaust all possible combinations or discover the password
- B. You create hashes of a large number of words and compare it with the encrypted passwords
- C. You threaten to use the rubber hose on someone unless they reveal their password
- D. You load a dictionary of words into your cracking program
- E. You wait until the password expires
Answer: A
NEW QUESTION 73
Which of the following steps for risk assessment methodology refers to vulnerability identification?
- A. Determines risk probability that vulnerability will be exploited (High. Medium, Low)
- B. Determines if any flaws exist in systems, policies, or procedures
- C. Identifies sources of harm to an IT system. (Natural, Human. Environmental)
- D. Assigns values to risk probabilities; Impact values.
Answer: A
NEW QUESTION 74
You went to great lengths to install all the necessary technologies to prevent hacking attacks, such as expensive firewalls, antivirus software, anti-spam systems and intrusion detection/prevention tools in your company's network. You have configured the most secure policies and tightened every device on your network. You are confident that hackers will never be able to gain access to your network with complex security system in place.
Your peer, Peter Smith who works at the same department disagrees with you.
He says even the best network security technologies cannot prevent hackers gaining access to the network because of presence of "weakest link" in the security chain.
What is Peter Smith talking about?
- A. "zero-day" exploits are the weakest link in the security chain since the IDS will not be able to detect these attacks
- B. Continuous Spam e-mails cannot be blocked by your security system since spammers use different techniques to bypass the filters in your gateway
- C. "Polymorphic viruses" are the weakest link in the security chain since the Anti-Virus scanners will not be able to detect these attacks
- D. Untrained staff or ignorant computer users who inadvertently become the weakest link in your security chain
Answer: D
NEW QUESTION 75
You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic. If you did not have a VPN, how would you identify whether someone is performing an ARP spoofing attack on your laptop?
- A. You should use netstat to check for any suspicious connections with another IP address within the LAN.
- B. You cannot identify such an attack and must use a VPN to protect your traffic, r
- C. You should scan the network using Nmap to check the MAC addresses of all the hosts and look for duplicates.
- D. You should check your ARP table and see if there is one IP address with two different MAC addresses.
Answer: B
NEW QUESTION 76
A newly joined employee. Janet, has been allocated an existing system used by a previous employee. Before issuing the system to Janet, it was assessed by Martin, the administrator. Martin found that there were possibilities of compromise through user directories, registries, and other system parameters. He also Identified vulnerabilities such as native configuration tables, incorrect registry or file permissions, and software configuration errors. What is the type of vulnerability assessment performed by Martin?
- A. Credentialed assessment
- B. Distributed assessment
- C. Host-based assessment
- D. Database assessment
Answer: C
Explanation:
Explanation
The host-based vulnerability assessment (VA) resolution arose from the auditors' got to periodically review systems. Arising before the net becoming common, these tools typically take an "administrator's eye" read of the setting by evaluating all of the knowledge that an administrator has at his or her disposal.
UsesHost VA tools verify system configuration, user directories, file systems, registry settings, and all forms of other info on a number to gain information about it. Then, it evaluates the chance of compromise. it should also live compliance to a predefined company policy so as to satisfy an annual audit. With administrator access, the scans area unit less possible to disrupt traditional operations since the computer code has the access it has to see into the complete configuration of the system.
What it Measures Host
VA tools will examine the native configuration tables and registries to spot not solely apparent vulnerabilities, however additionally "dormant" vulnerabilities - those weak or misconfigured systems and settings which will be exploited when an initial entry into the setting. Host VA solutions will assess the safety settings of a user account table; the access management lists related to sensitive files or data; and specific levels of trust applied to other systems. The host VA resolution will a lot of accurately verify the extent of the danger by determinant however way any specific exploit could also be ready to get.
NEW QUESTION 77
Richard, an attacker, targets an MNC. In this process, he uses a footprinting technique to gather as much information as possible. Using this technique, he gathers domain information such as the target domain name, contact details of its owner, expiry date, and creation date. With this information, he creates a map of the organization's network and misleads domain owners with social engineering to obtain internal details of its network.
What type of footprinting technique is employed by Richard?
- A. Whois footprinting
- B. VPN footprinting
- C. VoIP footprinting
- D. Email footprinting
Answer: A
NEW QUESTION 78
The network users are complaining because their system are slowing down. Further, every time they attempt to go a website, they receive a series of pop-ups with advertisements. What types of malware have the system been infected with?
- A. Trojan
- B. Spyware
- C. Adware
- D. Virus
Answer: C
Explanation:
Adware, or advertising supported computer code, is computer code that displays unwanted advertisements on your pc. Adware programs can tend to serve you pop-up ads, will modification your browser's homepage, add spyware and simply bombard your device with advertisements. Adware may be a additional summary name for doubtless unwanted programs. It's roughly a virulent disease and it's going to not be as clearly malicious as a great deal of different problematic code floating around on the net. create no mistake concerning it, though, that adware has to return off of no matter machine it's on. Not solely will adware be extremely annoying whenever you utilize your machine, it might additionally cause semipermanent problems for your device.
Adware a network users the browser to gather your internet browsing history so as to 'target' advertisements that appear tailored to your interests. At their most innocuous, adware infections square measure simply annoying. as an example, adware barrages you with pop-up ads that may create your net expertise markedly slower and additional labor intensive.
NEW QUESTION 79
A security analyst uses Zenmap to perform an ICMP timestamp ping scan to acquire information related to the current time from the target host machine.
Which of the following Zenmap options must the analyst use to perform the ICMP timestamp ping scan?
- A. -PP
- B. -PY
- C. -PU
- D. -Pn
Answer: A
NEW QUESTION 80
what is the correct way of using MSFvenom to generate a reverse TCP shellcode for windows?
- A. msfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f exe > shell.exe
- B. msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f exe > shell.exe
- C. msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f c
- D. msfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f c
Answer: B
NEW QUESTION 81
At what stage of the cyber kill chain theory model does data exfiltration occur?
- A. Actions on objectives
- B. Weaponization
- C. Command and control
- D. installation
Answer: A
Explanation:
The longer an adversary has this level of access, the greater the impact. Defenders must detect this stage as quickly as possible and deploy tools which can enable them to gather forensic evidence. One example would come with network packet captures, for damage assessment. Only now, after progressing through the primary six phases, can intruders take actions to realize their original objectives. Typically, the target of knowledge exfiltration involves collecting, encrypting and extracting information from the victim(s) environment; violations of knowledge integrity or availability are potential objectives also . Alternatively, and most ordinarily , the intruder may only desire access to the initial victim box to be used as a hop point to compromise additional systems and move laterally inside the network. Once this stage is identified within an environment, the implementation of prepared reaction plans must be initiated. At a minimum, the plan should include a comprehensive communication plan, detailed evidence must be elevated to the very best ranking official or board , the deployment of end-point security tools to dam data loss and preparation for briefing a CIRT Team. Having these resources well established beforehand may be a "MUST" in today's quickly evolving landscape of cybersecurity threats
NEW QUESTION 82
At what stage of the cyber kill chain theory model does data exfiltration occur?
- A. Actions on objectives
- B. Installation
- C. Weaponization
- D. Command and control
Answer: A
NEW QUESTION 83
_________ is a type of phishing that targets high-profile executives such as CEOs, CFOs, politicians, and celebrities who have access to confidential and highly valuable information.
- A. Vishing
- B. Spear phishing
- C. Phishing
- D. Whaling
Answer: D
NEW QUESTION 84
Bill is a network administrator. He wants to eliminate unencrypted traffic inside his company's network. He decides to setup a SPAN port and capture all traffic to the datacenter. He immediately discovers unencrypted traffic in port UDP 161. what protocol is this port using and how can he secure that traffic?
- A. SNMP and he should change it to SNMP V3
- B. RPC and the best practice is to disable RPC completely
- C. it is not necessary to perform any actions, as SNMP is not carrying important information.
- D. SNMP and he should change it to SNMP v2, which is encrypted
Answer: A
Explanation:
We have various articles already in our documentation for setting up SNMPv2 trap handling in Opsview, but SNMPv3 traps are a whole new ballgame. They can be quite confusing and complicated to set up the first time you go through the process, but when you understand what is going on, everything should make more sense.
SNMP has gone through several revisions to improve performance and security (version 1, 2c and 3). By default, it is a UDP port based protocol where communication is based on a 'fire and forget' methodology in which network packets are sent to another device, but there is no check for receipt of that packet (versus TCP port when a network packet must be acknowledged by the other end of the communication link).
There are two modes of operation with SNMP - get requests (or polling) where one device requests information from an SNMP enabled device on a regular basis (normally using UDP port 161), and traps where the SNMP enabled device sends a message to another device when an event occurs (normally using UDP port 162). The latter includes instances such as someone logging on, the device powering up or down, or a wide variety of other problems that would need this type of investigation.
This blog covers SNMPv3 traps, as polling and version 2c traps are covered elsewhere in our documentation.
SNMP traps
Since SNMP is primarily a UDP port based system, traps may be 'lost' when sending between devices; the sending device does not wait to see if the receiver got the trap. This means if the configuration on the sending device is wrong (using the wrong receiver IP address or port) or the receiver isn't listening for traps or rejecting them out of hand due to misconfiguration, the sender will never know.
The SNMP v2c specification introduced the idea of splitting traps into two types; the original 'hope it gets there' trap and the newer 'INFORM' traps. Upon receipt of an INFORM, the receiver must send an acknowledgement back. If the sender doesn't get the acknowledgement back, then it knows there is an existing problem and can log it for sysadmins to find when they interrogate the device.
NEW QUESTION 85
......
Certified Ethical Hacker Exam (CEH v11) Certification Sample Questions and Practice Exam: https://www.exams4collection.com/312-50v11-latest-braindumps.html
Real Exam Questions & Answers - EC-COUNCIL 312-50v11 Dump is Ready: https://drive.google.com/open?id=1SMe-luEq8F_ZGxRJjoRfd0Bh5R9RrbvO
