Latest Certified Success Dumps Download

312-50 Latest Exam (Sep 2017)

[Free] 2017(Sep) EnsurePass Testinsides ECCouncil 312-50 Dumps with VCE and PDF 471-480

September 22, 2017

2017 Sep ECCouncil Official New Released 312-50
100% Free Download! 100% Pass Guaranteed!

Ethical Hacking and Countermeasures

Question No: 471 – (Topic 19)


Ensurepass 2017 PDF and VCE

Given the following extract from the snort log on a honeypot, what service is being exploited? :

  1. FTP

  2. SSH

  3. Telnet

  4. SMTP

Answer: A

Explanation: The connection is done to

Question No: 472 – (Topic 19)

Which of the following are potential attacks on cryptography? (Select 3)

  1. One-Time-Pad Attack

  2. Chosen-Ciphertext Attack

  3. Man-in-the-Middle Attack

  4. Known-Ciphertext Attack

  5. Replay Attack

Answer: B,C,E

Explanation: A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst chooses a ciphertext and causes it to be decrypted with an unknown key. Specific forms of this attack are sometimes termed quot;lunchtimequot; or quot;midnightquot; attacks, referring to a scenario in which an attacker gains access to an unattended decryption machine. In cryptography, a man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised. The attacker must be able to observe and intercept messages going between the two victims. A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack).

Question No: 473 – (Topic 19)

Angela is trying to access an education website that requires a username and password to login. When Angela clicks on the link to access the login page, she gets an error message stating that the page can’t be reached. She contacts the website’s support team and they report that no one else is having any issues with the site.

After handing the issue over to her company’s IT department, it is found that the education website requires any computer accessing the site must be able to respond to a ping from the education’s server. Since Angela’s computer is behind a corporate firewall, her computer can’t ping the education website back.

What ca Angela’s IT department do to get access to the education website?

  1. Change the IP on Angela’s Computer to an address outside the firewall

  2. Change the settings on the firewall to allow all incoming traffic on port 80

  3. Change the settings on the firewall all outbound traffic on port 80

  4. Use a Internet browser other than the one that Angela is currently using

Answer: A

Explanation: Allowing traffic to and from port 80 will not help as this will be UDP or TCP traffic and ping uses ICMP. The browser used by the user will not make any difference. The only alternative here that would solve the problem is to move the computer to outside the firewall.

Question No: 474 – (Topic 19)

While examining a log report you find out that an intrusion has been attempted by a machine whose IP address is displayed as 0xde.0xad.0xbe.0xef. It looks to you like a hexadecimal number. You perform a ping 0xde.0xad.0xbe.0xef. Which of the following IP addresses will respond to the ping and hence will likely be responsible for the the intrusion







Answer: E Explanation:

Convert the hex number to binary and then to decimal.

0xde.0xad.0xbe.0xef translates to and not

0xef = 15*1 = 15

14*16 = 224

Ensurepass 2017 PDF and VCE

= 239

0xbe =

14*1 = 14

11*16 = 176

Ensurepass 2017 PDF and VCE

= 190

0xad = 13*1 = 13

10*16 = 160

Ensurepass 2017 PDF and VCE

= 173

0xde = 14*1 = 14

13*16 = 208

Ensurepass 2017 PDF and VCE

= 222

Question No: 475 – (Topic 19)

Which of the following countermeasure can specifically protect against both the MAC Flood and MAC Spoofing attacks?

  1. Port Security

  2. Switch Mapping

  3. Port Reconfiguring

  4. Multiple Recognition

Answer: A

Explanation: With Port Security the switch will keep track of which ports are allowed to send traffic on a port.

Question No: 476 – (Topic 19)

An Employee wants to bypass detection by a network-based IDS application and does not want to attack the system containing the IDS application. Which of the following strategies can the employee use to evade detection by the network based IDS application?

  1. Create a ping flood

  2. Create a SYN flood

  3. Create a covert network tunnel

  4. Create multiple false positives

Answer: C

Explanation: HTTP Tunneling is a technique by which communications performed using various network protocols are encapsulated using the HTTP protocol, the network protocols in question usually belonging to the TCP/IP family of protocols. The HTTP protocol therefore acts as a wrapper for a covert channel that the network protocol being tunneled uses to communicate. The HTTP stream with its covert channel is termed a HTTP Tunnel. Very few firewalls blocks outgoing HTTP traffic.

Question No: 477 – (Topic 19)

This IDS defeating technique works by splitting a datagram (or packet) into multiple fragments and the IDS will not spot the true nature of the fully assembled datagram. The datagram is not reassembled until it reaches its final destination. It would be a processor-intensive tasks for an IDS to reassemble all fragments itself and on a busy system the packet will slip through the IDS onto the network.

What is this technique called?

  1. IP Fragmentation or Session Splicing

  2. IP Routing or Packet Dropping

  3. IDS Spoofing or Session Assembly

  4. IP Splicing or Packet Reassembly

Answer: A

Explanation: The basic premise behind session splicing, or IP Fragmentation, is to deliver the payload over multiple packets thus defeating simple pattern matching without session reconstruction. This payload can be delivered in many different manners and even spread out over a long period of time. Currently, Whisker and Nessus have session splicing capabilities, and other tools exist in the wild.

Question No: 478 – (Topic 19)

Network Intrusion Detection systems can monitor traffic in real time on networks.

Which one of the following techniques can be very effective at avoiding proper detection?

  1. Fragmentation of packets.

  2. Use of only TCP based protocols.

  3. Use of only UDP based protocols.

  4. Use of fragmented ICMP traffic only.

Answer: A

Explanation: If the default fragmentation reassembly timeout is set to higher on the client than on the IDS then the it is possible to send an attack in fragments that will never be reassembled in the IDS but they will be reassembled and read on the client computer acting victim.

Question No: 479 – (Topic 19)


Ensurepass 2017 PDF and VCE

Given the following extract from the snort log on a honeypot, what do you infer from the attack?

  1. A new port was opened

  2. A new user id was created

  3. The exploit was successful

  4. The exploit was not successful

Answer: D

Explanation: The attacker submits a PASS to the honeypot and receives a login incorrect before disconnecting.

Question No: 480 – (Topic 19)

You are attempting to map out the firewall policy for an organization. You discover your target system is one hop beyond the firewall. Using hping2, you send SYN packets with the exact TTL of the target system starting at port 1 and going up to port 1024. What is this process known as?

  1. Footprinting

  2. Firewalking

  3. Enumeration

  4. Idle scanning

Answer: B

Explanation: Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker’s host to a destination host through a packet-filtering device. This technique can be used to map ‘open’ or ‘pass through’ ports on a gateway. More over, it can determine whether packets with various control information can pass through a given gateway.

100% Free Download!
Download Free Demo:312-50 Demo PDF
100% Pass Guaranteed!
Download 2017 EnsurePass 312-50 Full Exam PDF and VCE

EnsurePass ExamCollection Testking
Lowest Price Guarantee Yes No No
Up-to-Dated Yes No No
Real Questions Yes No No
Explanation Yes No No
Free VCE Simulator Yes No No
Instant Download Yes No No

2017 EnsurePass IT Certification PDF and VCE