Want to know Pass4sure 312-50 Exam practice test features? Want to lear more about EC-Council Ethical Hacking and Countermeasures (CEHv6) certification experience? Study Download EC-Council 312-50 answers to Latest 312-50 questions at Pass4sure. Gat a success with an absolute guarantee to pass EC-Council 312-50 (Ethical Hacking and Countermeasures (CEHv6)) test on your first attempt.

Q411. When working with Windows systems, what is the RID of the true administrator account? 

A. 500 

B. 501 

C. 1000 

D. 1001 

E. 1024 

F. 512 

Answer: A

Explanation: Because of the way in which Windows functions, the true administrator account always has a RID of 500. 


Q412. The programmers on your team are analyzing the free, open source software being used to run FTP services on a server in your organization. They notice that there is excessive number of functions in the source code that might lead to buffer overflow. These C++ functions do not check bounds. Identify the line the source code that might lead to buffer overflow. 

A. Line number 31. 

B. Line number 15 

C. Line number 8 

D. Line number 14 

Answer: B


Q413. You are scanning the target network for the first time. You are able to detect few convention open ports. While attempting to perform conventional service identification by connecting to the open ports, the scan yields either bad or no result. As you are unsure of the protocols in use, you want to discover as many different protocols as possible. Which of the following scan options can help you achieve this? 

A. Nessus sacn with TCP based pings 

B. Netcat scan with the switches 

C. Nmap scan with the P (ping scan) switch 

D. Nmap with the O (Raw IP Packets switch 

Answer: D

Explanation: -sO IP protocol scans: This method is used to determine which IP protocols are supported on a host. The technique is to send raw IP packets without any further protocol header to each specified protocol on the target machine. If we receive an ICMP protocol unreachable message, then the protocol is not in use. Otherwise we assume it is open. Note that some hosts (AIX, HP-UX, Digital UNIX) and firewalls may not send protocol unreachable messages. 


Q414. Which one of the following is defined as the process of distributing incorrect Internet Protocol (IP) addresses/names with the intent of diverting traffic? 

A. Network aliasing 

B. Domain Name Server (DNS) poisoning 

C. Reverse Address Resolution Protocol (ARP) 

D. Port scanning 

Answer: B

This reference is close to the one listed DNS poisoning is the correct answer. 

This is how DNS DOS attack can occur. If the actual DNS records are unattainable to the attacker for him to alter in this fashion, which they should be, the attacker can insert this data into the cache of there server instead of replacing the actual records, which is referred to as cache poisoning. 


Q415. Exhibit 

Joe Hacker runs the hping2 hacking tool to predict the target host’s sequence numbers in one of the hacking session. 

What does the first and second column mean? Select two. 

A. The first column reports the sequence number 

B. The second column reports the difference between the current and last sequence number 

C. The second column reports the next sequence number 

D. The first column reports the difference between current and last sequence number 

Answer: AB


Q416. Which of the following wireless technologies can be detected by NetStumbler? (Select all that apply) 

A. 802.11b 

B. 802.11e 

C. 802.11a 

D. 802.11g 

E. 802.11 

Answer: ACD

Explanation: If you check the website, cards for all three (A, B, G) are supported. See: http://www.stumbler.net/ 


Q417. Exhibit: * Missing* 

Jason's Web server was attacked by a trojan virus. He runs protocol analyzer and notices that the trojan communicates to a remote server on the Internet. Shown below is the standard "hexdump" representation of the network packet, before being decoded. Jason wants to identify the trojan by looking at the destination port number and mapping to a trojan-port number database on the Internet. Identify the remote server's port number by decoding the packet? 

A. Port 1890 (Net-Devil Trojan) 

B. Port 1786 (Net-Devil Trojan) 

C. Port 1909 (Net-Devil Trojan) 

D. Port 6667 (Net-Devil Trojan) 

Answer: D

Explanation: From trace, 0x1A0B is 6667, IRC Relay Chat, which is one port used. Other ports are in the 900's. 


Q418. Central Frost Bank was a medium-sized, regional financial institution in New York. The bank recently deployed a new Internet-accessible Web application. Using this application, Central Frost's customers could access their account balances, transfer money between accounts, pay bills and conduct online financial business through a Web browser. John Stevens was in charge of information security at Central Frost Bank. After one month in production, the Internet banking application was the subject of several customer complaints. Mysteriously, the account balances ofmany of Central Frost's customers had been changed! However, moneyhadn't been removed from the bank. Instead, money was transferred between accounts. Given this attack profile, John Stevens reviewed the Web application's logs and found the following entries: 

Attempted login of unknown user: johnm Attempted login of unknown user: susaR Attempted login of unknown user: sencat Attempted login of unknown user: pete'' Attempted login of unknown user: ' or 1=1--Attempted login of unknown user: ' drop table logins--Login of user jason, sessionID= 0x75627578626F6F6B Login of user daniel, sessionID= 0x98627579539E13BE Login of user rebecca, sessionID= 0x9062757944CCB811 Login of user mike, sessionID= 0x9062757935FB5C64 Transfer Funds user jason Pay Bill user mike Logout of user mike 

What type of attack did the Hacker attempt? 

A. Brute force attack in which the Hacker attempted guessing login ID and password from password cracking tools. 

B. The Hacker used a random generator module to pass results to the Web server and exploited Web application CGI vulnerability. 

C. The Hacker attempted SQL Injection technique to gain access to a valid bank login ID. 

D. The Hacker attempted Session hijacking, in which the Hacker opened an account with the bank, then logged in to receive a session ID, guessed the next ID and took over Jason's session. 

Answer: C

Explanation: The 1=1 or drop table logins are attempts at SQL injection. 


Q419. What are the differences between SSL and S-HTTP? 

A. SSL operates at the network layer and S-HTTP operates at the application layer 

B. SSL operates at the application layer and S-HTTP operates at the network layer 

C. SSL operates at the transport layer and S-HTTP operates at the application layer 

D. SSL operates at the application layer and S-HTTP operates at the transport layer 

Answer: C

Explanation: The main difference between the protocols is the layer at which they operate. SSL operates at the transport layer and mimics the "socket library," while S-HTTP operates at the application layer. Encryption of the transport layer allows SSL to be application-independent, while S-HTTP is limited to the specific software implementing it. The protocols adopt different philosophies towards encryption as well, with SSL encrypting the entire communications channel and S-HTTP encrypting each message independently. 


Q420. Which of the following are well know password-cracking programs?(Choose all that apply. 

A. L0phtcrack 

B. NetCat 

C. Jack the Ripper 

D. Netbus 

E. John the Ripper 

Answer: AE

Explanation: L0phtcrack and John the Ripper are two well know password-cracking programs. Netcat is considered the Swiss-army knife of hacking tools, but is not used for password cracking