Your success in EC-Council 312-50 is our sole target and we develop all our 312-50 braindumps in a way that facilitates the attainment of this target. Not only is our 312-50 study material the best you can find, it is also the most detailed and the most updated. 312-50 Practice Exams for EC-Council 312-50 are written to the highest standards of technical accuracy.

Q271. Which are true statements concerning the BugBear and Pretty Park worms? 

Select the best answers. 

A. Both programs use email to do their work. 

B. Pretty Park propagates via network shares and email 

C. BugBear propagates via network shares and email 

D. Pretty Park tries to connect to an IRC server to send your personal passwords. 

E. Pretty Park can terminate anti-virus applications that might be running to bypass them. 

Answer: ACD

Explanations: Both Pretty Park and BugBear use email to spread. Pretty Park cannot propagate via network shares, only email. BugBear propagates via network shares and email. It also terminates anti-virus applications and acts as a backdoor server for someone to get into the infected machine. Pretty Park tries to connect to an IRC server to send your personal passwords and all sorts of other information it retrieves from your PC. Pretty Park cannot terminate anti-virus applications. However, BugBear can terminate AV software so that it can bypass them. 

Topic 17, Physical Security 

432. Joseph has just been hired on to a contractor company of the Department of Defense as their senior Security Analyst. Joseph has been instructed on the Company’s strict security policies that have been implemented and the policies that have yet to be put in place. Per the Department of Defense, all DoD users and the users of their contractors must use two-factor authentication to access their networks. Joseph has been delegated the task of researching and implementing the best two-factor authentication method for his company. Joseph’s supervisor has told him that they would like to use some type of hardware device in tandem with a security or identifying pin number. 

Joseph’s company has already researched using smart cards and all the resources needed to implement them, but found the smart cards to not be cost effective. What type of device should Joseph use for two-factor authentication? 

A. Security token 

B. Biometric device 

C. OTP 

D. Proximity cards 

Answer: A

Explanation: A security token (sometimes called an authentication token) is a small hardware device that the owner carries to authorize access to a network service. The device may be in the form of a smart card or may be embedded in a commonly used object such as a key fob. Security tokens provide an extra level of assurance through a method known as two-factor authentication: the user has a personal identification number (PIN), which authorizes them as the owner of that particular device; the device then displays a number which uniquely identifies the user to the service, allowing them to log in. 


Q272. You have successfully run a buffer overflow attack against a default IIS installation running on a Windows 2000 Server. The server allows you to spawn a shell. In order to perform the actions you intend to do, you need elevated permission. You need to know what your current privileges are within the shell. Which of the following options would be your current privileges? 

A. Administrator 

B. IUSR_COMPUTERNAME 

C. LOCAL_SYSTEM 

D. Whatever account IIS was installed with 

Answer: C

Explanation: If you manage to get the system to start a shell for you, that shell will be running as LOCAL_SYSTEM. 


Q273. What are the two basic types of attacks?(Choose two. 

A. DoS 

B. Passive 

C. Sniffing 

D. Active 

E. Cracking 

Answer: BD 

Explanation: Passive and active attacks are the two basic types of attacks. 


Q274. SSL has been as the solution to a lot of common security problems. Administrator will often time make use of SSL to encrypt communications from points A to Point B. Why do you think this could be a bad idea if there is an Intrusion Detection System deployed to monitor the traffic between Point A to Point B? 

A. SSL is redundant if you already have IDS’s in place 

B. SSL will trigger rules at regular interval and force the administrator to turn them off 

C. SSL will make the content of the packet and Intrusion Detection System are blinded 

D. SSL will slow down the IDS while it is breaking the encryption to see the packet content 

Answer: C 

Explanation: An IDS will not be able to evaluate the content in the packets if it is encrypted. 


Q275. In this type of Man-in-the-Middle attack, packets and authentication tokens are captured using a sniffer. Once the relevant information is extracted, the tokens are placed back on the network to gain access. 

A. Token Injection Replay attacks 

B. Shoulder surfing attack 

C. Rainbow and Hash generation attack 

D. Dumpster diving attack 

Answer: A


Q276. Which of the following is NOT a valid NetWare access level? 

A. Not Logged in 

B. Logged in 

C. Console Access 

D. Administrator 

Answer: D 

Explanation: Administrator is an account not a access level. 


Q277. You have just installed a new Linux file server at your office. This server is going to be used by several individuals in the organization, and unauthorized personnel must not be able to modify any data. 

What kind of program can you use to track changes to files on the server? 

A. Network Based IDS (NIDS) 

B. Personal Firewall 

C. System Integrity Verifier (SIV) 

D. Linux IP Chains 

Answer: C

Explanation: System Integrity Verifiers like Tripwire aids system administrators and users in monitoring a designated set of files for any changes. Used with system files on a regular (e.g., daily) basis, Tripwire can notify system administrators of corrupted or tampered files, so damage control measures can be taken in a timely manner. 


Q278. This tool is widely used for ARP Poisoning attack. Name the tool. 

A. Cain and Able 

B. Beat Infector 

C. Poison Ivy 

D. Webarp Infector 

Answer: A


Q279. The Slammer Worm exploits a stack-based overflow that occurs in a DLL implementing the Resolution Service. 

Which of the following Database Server was targeted by the slammer worm? 

A. Oracle 

B. MSSQL 

C. MySQL 

D. Sybase 

E. DB2 

Answer: B

Explanation: W32.Slammer is a memory resident worm that propagates via UDP Port 1434 and exploits a vulnerability in SQL Server 2000 systems and systems with MSDE 2000 that have not applied the patch released by Microsoft Security Bulletin MS02-039. 


Q280. Kevin is an IT security analyst working for Emerson Time Makers, a watch manufacturing company in Miami. Kevin and his girlfriend Katy recently broke up after a big fight. Kevin believes that she was seeing another person. Kevin, who has an online email account that he uses for most of his mail, knows that Katy has an account with that same company. Kevin logs into his email account online and gets the following URL after successfully logged in: http://www.youremailhere.com/mail.asp?mailbox=Kevin&Smith=121%22 Kevin changes the URL to: http://www.youremailhere.com/mail.asp?mailbox=Katy&Sanchez=121%22 Kevin is trying to access her email account to see if he can find out any information. What is Kevin attempting here to gain access to Katy's mailbox? 

A. This type of attempt is called URL obfuscation when someone manually changes a URL to try and gain unauthorized access 

B. By changing the mailbox's name in the URL, Kevin is attempting directory transversal 

C. Kevin is trying to utilize query string manipulation to gain access to her email account 

D. He is attempting a path-string attack to gain access to her mailbox 

Answer: C