Proper study guides for Leading EC-Council Ethical Hacking and Countermeasures (CEHv6) certified begins with EC-Council 312-50 preparation products which designed to deliver the Pinpoint 312-50 questions by making you pass the 312-50 test at your first time. Try the free 312-50 demo right now.

2021 Oct 312-50 testing engine

Q431. You work for Acme Corporation as Sales Manager. The company has tight network security restrictions. You are trying to steal data from the company's Sales database (Sales.xls) and transfer them to your home computer. Your company filters and monitors traffic that leaves from the internal network to the Internet. How will you achieve this without raising suspicion? 

A. Encrypt the Sales.xls using PGP and e-mail it to your personal gmail account 

B. Package the Sales.xls using Trojan wrappers and telnet them back your home computer 

C. You can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent looking email or file transfer using Steganography techniques 

D. Change the extension of Sales.xls to sales.txt and upload them as attachment to your hotmail account 

Answer: C


Q432. ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. 

Here is a section of the Virus code: 

What is this technique called? 

A. Polymorphic Virus 

B. Metamorphic Virus 

C. Dravidic Virus 

D. Stealth Virus 

Answer: A


Q433. If an attacker's computer sends an IPID of 31400 to a zombie (Idle Scanning) computer on an open port, what will be the response? 

A. 31400 

B. 31402 

C. The zombie will not send a response 

D. 31401 

Answer: D


Q434. Ursula is a college student at a University in Amsterdam. Ursula originally went to college to study engineering but later changed to marine biology after spending a month at sea with her friends. These friends frequently go out to sea to follow and harass fishing fleets that illegally fish in foreign waters. Ursula eventually wants to put companies practicing illegal fishing out of business. Ursula decides to hack into the parent company's computers and destroy critical data knowing fully well that, if caught, she probably would be sent to jail for a very long time. What would Ursula be considered? 

A. Ursula would be considered a gray hat since she is performing an act against illegal activities. 

B. She would be considered a suicide hacker. 

C. She would be called a cracker. 

D. Ursula would be considered a black hat. 

Answer: B


Q435. Oregon Corp is fighting a litigation suit with Scamster Inc. Oregon has assigned a private investigative agency to go through garbage, recycled paper, and other rubbish at Scamster's office site in order to find relevant information. What would you call this kind of activity? 

A. Garbage Scooping 

B. Dumpster Diving 

C. Scanning 

D. CI Gathering 

Answer: B

Explanation: Dumpster diving is the colloquial name for going through somebody's garbage --which will usually be in dumpsters for large organizations. This is a powerful tactic because it is protected by social taboos. Trash is bad, and once it goes into the trash, something is best forgotten. The reality is that most company trash is fairly clean, and provides a gold mine of information. 


Far out 312-50 book:

Q436. How do you defend against DHCP Starvation attack? 

A. Enable ARP-Block on the switch 

B. Enable DHCP snooping on the switch 

C. Configure DHCP-BLOCK to 1 on the switch 

D. Install DHCP filters on the switch to block this attack 

Answer: B


Q437. What are the differences between SSL and S-HTTP? 

A. SSL operates at the network layer and S-HTTP operates at the application layer 

B. SSL operates at the application layer and S-HTTP operates at the network layer 

C. SSL operates at the transport layer and S-HTTP operates at the application layer 

D. SSL operates at the application layer and S-HTTP operates at the transport layer 

Answer: C

Explanation: The main difference between the protocols is the layer at which they operate. SSL operates at the transport layer and mimics the "socket library," while S-HTTP operates at the application layer. Encryption of the transport layer allows SSL to be application-independent, while S-HTTP is limited to the specific software implementing it. The protocols adopt different philosophies towards encryption as well, with SSL encrypting the entire communications channel and S-HTTP encrypting each message independently. 


Q438. Bob is a Junior Administrator at ABC.com is searching the port number of POP3 in a file. The partial output of the file is look like: 

In which file he is searching? 

A. services 

B. protocols 

C. hosts 

D. resolve.conf 

Answer: A

Explanation: The port numbers on which certain standard services are offered are defined in the RFC 1700 Assigned Numbers. The /etc/services file enables server and client programs to convert service names to these numbers -ports. The list is kept on each host and it is stored in the file /etc/services. 


Q439. Eric notices repeated probes to port 1080. He learns that the protocol being used is designed to allow a host outside of a firewall to connect transparently and securely through the firewall. He wonders if his firewall has been breached. What would be your inference? 

A. Eric network has been penetrated by a firewall breach 

B. The attacker is using the ICMP protocol to have a covert channel 

C. Eric has a Wingate package providing FTP redirection on his network 

D. Somebody is using SOCKS on the network to communicate through the firewall 

Answer: D

Explanation: Port Description: SOCKS. SOCKS port, used to support outbound tcp services (FTP, HTTP, etc). Vulnerable similar to FTP Bounce, in that attacker can connect to this port and \bounce\ out to another internal host. Done to either reach a protected internal host or mask true source of attack. Listen for connection attempts to this port -- good sign of port scans, SOCKS-probes, or bounce attacks. Also a means to access restricted resources. Example: Bouncing off a MILNET gateway SOCKS port allows attacker to access web sites, etc. that were restricted only to.mil domain hosts. 


Q440. You want to hide a secret.txt document inside c:\windows\system32\tcpip.dll kernel library using ADS streams. How will you accomplish this? 

A. copy secret.txt c:\windows\system32\tcpip.dll kernel>secret.txt 

B. copy secret.txt c:\windows\system32\tcpip.dll:secret.txt 

C. copy secret.txt c:\windows\system32\tcpip.dll |secret.txt 

D. copy secret.txt >< c:\windows\system32\tcpip.dll kernel secret.txt 

Answer: B