Downloadable Exam Engine for 312-50,Whatsoever key factors to the exam are generally included inside the 312-50 training materials at Examcollection. Youll be able to download the EC-Council simulated tests for free. The particular professional writers of Examcollection make sure to current the related and accurate 312-50 practice questions in the training materials. All of us provide the EC-Council questions along with answers in Pdf formatting. They are reliable and most recent EC-Council tests.

2021 Mar 312-50 practice test

Q391. What do Trinoo, TFN2k, WinTrinoo, T-Sight, and Stracheldraht have in common? 

A. All are hacking tools developed by the legion of doom 

B. All are tools that can be used not only by hackers, but also security personnel 

C. All are DDOS tools 

D. All are tools that are only effective against Windows 

E. All are tools that are only effective against Linux 

Answer: C 

Explanation: All are DDOS tools. 


Q392. Bill has successfully executed a buffer overflow against a Windows IIS web server. He has been able to spawn an interactive shell and plans to deface the main web page. He first attempts to use the “Echo” command to simply overwrite index.html and remains unsuccessful. He then attempts to delete the page and achieves no progress. Finally, he tries to overwrite it with another page again in vain. 

What is the probable cause of Bill’s problem? 

A. The system is a honeypot. 

B. There is a problem with the shell and he needs to run the attack again. 

C. You cannot use a buffer overflow to deface a web page. 

D. The HTML file has permissions of ready only. 

Answer: D

Explanation: The question states that Bill had been able to spawn an interactive shell. By this statement we can tell that the buffer overflow and its corresponding code was enough to spawn a shell. Any shell should make it possible to change the webpage. So we either don’t have sufficient privilege to change the webpage (answer D) or it’s a honeypot (answer A). We think the preferred answer is D 


Q393. What port number is used by LDAP protocol? 

A. 110 

B. 389 

C. 445 

D. 464 

Answer: B 

Explanation: Active Directory and Exchange use LDAP via TCP port 389 for clients. 


Q394. Peter is a Network Admin. He is concerned that his network is vulnerable to a smurf attack. 

What should Peter do to prevent a smurf attack? 

Select the best answer. 

A. He should disable unicast on all routers 

B. Disable multicast on the router 

C. Turn off fragmentation on his router 

D. Make sure all anti-virus protection is updated on all systems 

E. Make sure his router won't take a directed broadcast 

Answer: E 

Explanation: Unicasts are one-to-one IP transmissions, by disabling this he would disable most network transmissions but still not prevent the smurf attack. Turning of multicast or fragmentation on the router has nothing to do with Peter’s concerns as a smurf attack uses broadcast, not multicast and has nothing to do with fragmentation. Anti-virus protection will not help prevent a smurf attack. A smurf attack is a broadcast from a spoofed source. If directed broadcasts are enabled on the destination all the computers at the destination will respond to the spoofed source, which is really the victim. Disabling directed broadcasts on a router can prevent the attack. 


Q395. After studying the following log entries, how many user IDs can you identify that the attacker has tampered with? 

1. mkdir -p /etc/X11/applnk/Internet/.etc 

2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd 

3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd 

4. touch -acmr /etc /etc/X11/applnk/Internet/.etc 

5. passwd nobody -d 

6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash 

7. passwd dns -d 

8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd 

9. touch -acmr /etc/X11/applnk/Internet/.etc /etc 

A. IUSR_ 

B. acmr, dns 

C. nobody, dns 

D. nobody, IUSR_ 

Answer: C

Explanation: Passwd is the command used to modify a user password and it has been used together with the usernames nobody and dns. 


Rebirth 312-50 exam topics:

Q396. How can you determine if an LM hash you extracted contains a password that is less than 8 characters long? 

A. There is no way to tell because a hash cannot be reversed 

B. The right most portion of the hash is always the same 

C. The hash always starts with AB923D 

D. The left most portion of the hash is always the same 

E. A portion of the hash will be all 0's 

Answer: B

Explanation: When looking at an extracted LM hash, you will sometimes observe that the right most portion is always the same. This is padding that has been added to a password that is less than 8 characters long. 


Q397. What port number is used by Kerberos protocol? 

A. 44 

B. 88 

C. 419 

D. 487 

Answer: B 

Explanation: Kerberos traffic uses UDP/TCP protocol source and destination port 88. 


Q398. What is GINA? 

A. Gateway Interface Network Application 

B. GUI Installed Network Application CLASS 

C. Global Internet National Authority (G-USA) 

D. Graphical Identification and Authentication DLL 

Answer: D

Explanation: In computing, GINA refers to the graphical identification and authentication library, a component of some Microsoft Windows operating systems that provides secure authentication and interactive logon services. 


Q399. XSS attacks occur on Web pages that do not perform appropriate bounds checking on data entered by users. Characters like < > that mark the beginning/end of a tag should be converted into HTML entities. 

What is the correct code when converted to html entities? 

A. Option A 

B. Option B 

C. Option C 

D. Option D 

Answer: D


Q400. Destination unreachable administratively prohibited messages can inform the hacker to what? 

A. That a circuit level proxy has been installed and is filtering traffic 

B. That his/her scans are being blocked by a honeypot or jail 

C. That the packets are being malformed by the scanning software 

D. That a router or other packet-filtering device is blocking traffic 

E. That the network is functioning normally 

Answer: D

Explanation: Destination unreachable administratively prohibited messages are a good way to discover that a router or other low-level packet device is filtering traffic. Analysis of the ICMP message will reveal the IP address of the blocking device and the filtered port. This further adds the to the network map and information being discovered about the network and hosts.