Prepare Top EC-COUNCIL 312-50v11 Exam Study Guide Practice Questions Edition
Go to 312-50v11 Questions - Try 312-50v11 dumps pdf
NEW QUESTION # 178
Which of the following programs is usually targeted at Microsoft Office products?
- A. Stealth virus
- B. Macro virus
- C. Polymorphic virus
- D. Multipart virus
Answer: B
NEW QUESTION # 179
Sam is working as a system administrator In an organization. He captured the principal characteristics of a vulnerability and produced a numerical score to reflect Its severity using CVSS v3.0 to property assess and prioritize the organization's vulnerability management processes. The base score that Sam obtained after performing cvss rating was 4.0. What is the CVSS severity level of the vulnerability discovered by Sam in the above scenario?
- A. Medium
- B. Low
- C. Critical
- D. High
Answer: B
NEW QUESTION # 180
What piece of hardware on a computer's motherboard generates encryption keys and only releases a part of the key so that decrypting a disk on a new piece of hardware is not possible?
- A. UEFI
- B. GPU
- C. TPM
- D. CPU
Answer: C
Explanation:
The TPM is a chip that's part of your computer's motherboard - if you bought an off-the-shelf PC, it's soldered onto the motherboard. If you built your own computer, you can buy one as an add-on module if your motherboard supports it. The TPM generates encryption keys, keeping part of the key to itself
NEW QUESTION # 181
The network team has well-established procedures to follow for creating new rules on the firewall. This includes having approval from a manager prior to implementing any new rules. While reviewing the firewall configuration, you notice a recently implemented rule but cannot locate manager approval for it. What would be a good step to have in the procedures for a situation like this?
- A. Do not roll back the firewall rule as the business may be relying upon it, but try to get manager approval as soon as possible.
- B. Immediately roll back the firewall rule until a manager can approve it
- C. Have the network team document the reason why the rule was implemented without prior manager approval.
- D. Monitor all traffic using the firewall rule until a manager can approve it.
Answer: B
NEW QUESTION # 182
which of the following information security controls creates an appealing isolated environment for hackers to prevent them from compromising critical targets while simultaneously gathering information about the hacker?
- A. Botnet
D Firewall - B. intrusion detection system
- C. Honeypot
Answer: C
Explanation:
Explanation
A honeypot may be a trap that an IT pro lays for a malicious hacker, hoping that they will interact with it during a way that gives useful intelligence. It's one among the oldest security measures in IT, but beware:
luring hackers onto your network, even on an isolated system, are often a dangerous game.honeypot may be a good starting place: "A honeypot may be a computer or computing system intended to mimic likely targets of cyberattacks." Often a honeypot are going to be deliberately configured with known vulnerabilities in situation to form a more tempting or obvious target for attackers. A honeypot won't contain production data or participate in legitimate traffic on your network - that's how you'll tell anything happening within it's a results of an attack. If someone's stopping by, they're up to no good.That definition covers a various array of systems, from bare-bones virtual machines that only offer a couple of vulnerable systems to ornately constructed fake networks spanning multiple servers. and therefore the goals of these who build honeypots can vary widely also , starting from defense thorough to academic research. additionally , there's now an entire marketing category of deception technology that, while not meeting the strict definition of a honeypot, is certainly within the same family. But we'll get thereto during a moment.honeypots aim to permit close analysis of how hackers do their dirty work. The team controlling the honeypot can watch the techniques hackers use to infiltrate systems, escalate privileges, and otherwise run amok through target networks. These sorts of honeypots are found out by security companies, academics, and government agencies looking to look at the threat landscape. Their creators could also be curious about learning what kind of attacks are out there, getting details on how specific sorts of attacks work, or maybe trying to lure a specific hackers within the hopes of tracing the attack back to its source. These systems are often inbuilt fully isolated lab environments, which ensures that any breaches don't end in non-honeypot machines falling prey to attacks.Production honeypots, on the opposite hand, are usually deployed in proximity to some organization's production infrastructure, though measures are taken to isolate it the maximum amount as possible. These honeypots often serve both as bait to distract hackers who could also be trying to interrupt into that organization's network, keeping them faraway from valuable data or services; they will also function a canary within the coalpit , indicating that attacks are underway and are a minimum of partially succeeding.
NEW QUESTION # 183
These hackers have limited or no training and know how to use only basic techniques or tools.
What kind of hackers are we talking about?
- A. Black-Hat Hackers A
- B. White-Hat Hackers
- C. Script Kiddies
- D. Gray-Hat Hacker
Answer: C
Explanation:
Script Kiddies: These hackers have limited or no training and know how to use only basictechniques or tools. Even then they may not understand any or all of what they are doing.
NEW QUESTION # 184
You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain, if the DNS server is at
192.168.10.2 and the domain name is abccorp.local, what command would you type at the nslookup prompt to attempt a zone transfer?
- A. is-d abccorp.local
- B. List domain=Abccorp.local type=zone
- C. Iserver 192.168.10.2-t all
- D. list server=192.168.10.2 type=all
Answer: A
NEW QUESTION # 185
You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic. If you did not have a VPN, how would you identify whether someone is performing an ARP spoofing attack on your laptop?
- A. You should use netstat to check for any suspicious connections with another IP address within the LAN.
- B. You should check your ARP table and see if there is one IP address with two different MAC addresses.
- C. You cannot identify such an attack and must use a VPN to protect your traffic, r
- D. You should scan the network using Nmap to check the MAC addresses of all the hosts and look for duplicates.
Answer: C
NEW QUESTION # 186
Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions.
Which of the following master components is explained in the above scenario?
- A. Kube-scheduler
- B. Kube-apiserver
- C. Kube-controller-manager
- D. Etcd cluster
Answer: A
NEW QUESTION # 187
jane, an ethical hacker. Is testing a target organization's web server and website to identity security loopholes.
In this process, she copied the entire website and its content on a local drive to view the complete profile of the site's directory structure, file structure, external links, images, web pages, and so on. This information helps jane map the website's directories and gain valuable information. What is the attack technique employed by Jane in the above scenario?
- A. website mirroring
- B. Session hijacking
- C. Website defacement
- D. Web cache poisoning
Answer: D
Explanation:
Explanation
Web cache poisoning is a complicated technique whereby an attacker exploits the behavior of an internet server and cache in order that a harmful HTTP response is served to other users.Fundamentally, web cache poisoning involves two phases. First, the attacker must compute the way to elicit a response from the back-end server that inadvertently contains some quite dangerous payload. Once successful, they have to form sure that their response is cached and subsequently served to the intended victims.A poisoned web cache can potentially be a devastating means of distributing numerous different attacks, exploiting vulnerabilities like XSS, JavaScript injection, open redirection, and so on.
How does an internet cache work?To understand how web cache poisoning vulnerabilities arise, it's important to possess a basic understanding of how web caches work.If a server had to send a replacement response to each single HTTP request separately, this is able to likely overload the server, leading to latency issues and a poor user experience, especially during busy periods. Caching is primarily a way of reducing such issues.The cache sits between the server and therefore the user, where it saves (caches) the responses to particular requests, usually for a hard and fast amount of your time . If another user then sends the same request, the cache simply serves a replica of the cached response on to the user, with none interaction from the back-end.
This greatly eases the load on the server by reducing the amount of duplicate requests it's to handle.
Cache keysWhen the cache receives an HTTP request, it first has got to determine whether there's a cached response that it can serve directly, or whether it's to forward the request for handling by the back-end server.
Caches identify equivalent requests by comparing a predefined subset of the request's components, known collectively because the "cache key". Typically, this is able to contain the request line and Host header.
Components of the request that aren't included within the cache key are said to be "unkeyed".If the cache key of an incoming request matches the key of a previous request, then the cache considers them to be equivalent.
As a result, it'll serve a replica of the cached response that was generated for the first request. this is applicable to all or any subsequent requests with the matching cache key, until the cached response expires.Crucially, the opposite components of the request are ignored altogether by the cache. We'll explore the impact of this behavior in additional detail later.
What is the impact of an internet cache poisoning attack?The impact of web cache poisoning is heavily hooked in to two key factors:* What precisely the attacker can successfully get cachedAs the poisoned cache is more a way of distribution than a standalone attack, the impact of web cache poisoning is inextricably linked to how harmful the injected payload is. like most sorts of attack, web cache poisoning also can be utilized in combination with other attacks to escalate the potential impact even further.* The quantity of traffic on the affected pageThe poisoned response will only be served to users who visit the affected page while the cache is poisoned. As a result, the impact can range from non-existent to massive counting on whether the page is popular or not. If an attacker managed to poison a cached response on the house page of a serious website, for instance , the attack could affect thousands of users with none subsequent interaction from the attacker.Note that the duration of a cache entry doesn't necessarily affect the impact of web cache poisoning. An attack can usually be scripted in such how that it re-poisons the cache indefinitely.
NEW QUESTION # 188
A DDOS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete.
Which attack is being described here?
- A. Phlashing
- B. Desynchronization
- C. Slowloris attack
- D. Session splicing
Answer: C
Explanation:
Explanation
Developed by Robert "RSnake" Hansen, Slowloris is DDoS attack software that permits one computer to require down an internet server. Due the straightforward yet elegant nature of this attack, it requires minimal bandwidth to implement and affects the target server's web server only, with almost no side effects on other services and ports.Slowloris has proven highly-effective against many popular sorts of web server software, including Apache 1.x and 2.x.Over the years, Slowloris has been credited with variety of high-profile server takedowns. Notably, it had been used extensively by Iranian 'hackivists' following the 2009 Iranian presidential election to attack Iranian government internet sites .Slowloris works by opening multiple connections to the targeted web server and keeping them open as long as possible. It does this by continuously sending partial HTTP requests, none of which are ever completed. The attacked servers open more and connections open, expecting each of the attack requests to be completed.Periodically, the Slowloris sends subsequent HTTP headers for every request, but never actually completes the request. Ultimately, the targeted server's maximum concurrent connection pool is filled, and extra (legitimate) connection attempts are denied.By sending partial, as against malformed, packets, Slowloris can easily elapse traditional Intrusion Detection systems.Named after a kind of slow-moving Asian primate, Slowloris really does win the race by moving slowly and steadily. A Slowloris attack must await sockets to be released by legitimate requests before consuming them one by one.For a high-volume internet site , this will take a while . the method are often further slowed if legitimate sessions are reinitiated. But within the end, if the attack is unmitigated, Slowloris-like the tortoise-wins the race.If undetected or unmitigated, Slowloris attacks also can last for long periods of your time . When attacked sockets outing , Slowloris simply reinitiates the connections, continuing to reach the online server until mitigated.Designed for stealth also as efficacy, Slowloris are often modified to send different host headers within the event that a virtual host is targeted, and logs are stored separately for every virtual host.More importantly, within the course of an attack, Slowloris are often set to suppress log file creation. this suggests the attack can catch unmonitored servers off-guard, with none red flags appearing in log file entries.Methods of mitigationImperva's security services are enabled by reverse proxy technology, used for inspection of all incoming requests on their thanks to the clients' servers.Imperva's secured proxy won't forward any partial connection requests-rendering all Slowloris DDoS attack attempts completely and utterly useless.
NEW QUESTION # 189
OpenSSL on Linux servers includes a command line tool for testing TLS. What is the name of the tool and the correct syntax to connect to a web server?
- A. openssl_client -connect www.website.com:443
- B. openssl s_client -site www.website.com:443
- C. openssl s_client -connect www.website.com:443
- D. openssl_client -site www.website.com:443
Answer: C
NEW QUESTION # 190
Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to feed data and specifies the incorrect field in case of invalid credentials. Later, Calvin uses this information to perform social engineering.
Which of the following design flaws in the authentication mechanism is exploited by Calvin?
- A. Verbose failure messages
- B. Insecure transmission of credentials
- C. Password reset mechanism
- D. User impersonation
Answer: D
NEW QUESTION # 191
The Heartbleed bug was discovered in 2014 and is widely referred to under MITRE's Common Vulnerabilities and Exposures (CVE) as CVE-2014-0160. This bug affects the OpenSSL implementation of the Transport Layer Security (TLS) protocols defined in RFC6520.
What type of key does this bug leave exposed to the Internet making exploitation of any compromised system very easy?
- A. Shared
- B. Public
- C. Private
- D. Root
Answer: C
NEW QUESTION # 192
A penetration tester is conducting a port scan on a specific host. The tester found several ports opened that were confusing in concluding the Operating System (OS) version installed. Considering that NMAP result below, which of the following is likely to be installed on the target machine by the OS? Starting NMAP 5.21 at
2011-03-15 11:06 NMAP scan report for 172.16.40.65 Host is up (1.00s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 80/tcp open http 139/tcp open netbios-ssn 515/tcp open 631/tcp open ipp 9100/tcp open MAC Address: 00:00:48:0D:EE:8
- A. The host is likely a router.
- B. The host is likely a Linux machine.
- C. The host is likely a Windows machine.
- D. The host is likely a printer.
Answer: D
NEW QUESTION # 193
Daniel Is a professional hacker who Is attempting to perform an SQL injection attack on a target website.
www.movlescope.com. During this process, he encountered an IDS that detects SQL Injection attempts based on predefined signatures. To evade any comparison statement, he attempted placing characters such as ''or
'1'='1" In any bask injection statement such as "or 1=1." Identify the evasion technique used by Daniel in the above scenario.
- A. Char encoding
- B. Null byte
- C. IP fragmentation
- D. Variation
Answer: B
NEW QUESTION # 194
which of the following protocols can be used to secure an LDAP service against anonymous queries?
- A. NTLM
- B. WPA
- C. RADIUS
- D. SSO
Answer: D
Explanation:
Explanation
Single sign-on (SSO) may be a session and user authentication service that allows a user to use one set of login credentials as an example, a reputation and arcanum to access multiple applications. SSO will be employed by enterprises, smaller organizations and people to ease the management of varied usernames and passwords.
In a basic net SSO service, an agent module on the appliance server retrieves the precise authentication credentials for a personal user from a frenzied SSO policy server, whereas authenticating the user against a user repository, like a light-weight Directory Access Protocol (LDAP) directory. The service authenticates the top user for all the applications the user has been given rights to and eliminates future arcanum prompts for individual applications throughout constant session.
How single sign-on worksSingle sign-on may be a united identity management (FIM) arrangement, and also the use of such a system is typically referred to as identity federation. OAuth, that stands for Open Authorization and is pronounced "oh-auth," is that the framework that permits AN finish user's account data to be employed by third-party services, like Facebook, while not exposing the user's arcanum.
This graphic provides a mental image of however single sign-on worksOAuth acts as AN mediator on behalf of the top user by providing the service with AN access token that authorizes specific account data to be shared. once a user {attempts|makes AN attempt|tries} to access an application from the service supplier, the service supplier can send letter of invitation to the identity supplier for authentication. The service supplier can then verify the authentication and log the user in.
Types of SSO configurationsSome SSO services use protocols, like Kerberos, and Security Assertion terminology (SAML).
* SAML is AN protrusible terminology (XML) customary that facilitates the exchange of user authentication and authorization knowledge across secure domains. SAML-based SSO services involve communications among the user, AN identity supplier that maintains a user directory and a service supplier.
* In a Kerberos-based setup, once the user credentials are provided, a price tag-granting ticket (TGT) is issued. The TGT fetches service tickets for different applications the user needs to access, while not asking the user to reenter credentials.
* Smart card-based SSO can raise an user to use a card holding the sign-in credentials for the primary log in. Once the cardboard is employed, the user won't got to reenter usernames or passwords. SSO good
* cards can store either certificates or passwords.
Security risks and SSOAlthough single sign-on may be a convenience to users, it presents risks to enterprise security. AN aggressor World Health Organization gains management over a user's SSO credentials are granted access to each application the user has rights to, increasing the number of potential harm. so as to avoid malicious access, it's essential that each facet of SSO implementation be as well as identity governance.
Organizations may use two-factor authentication (2FA) or multifactor authentication (MFA) with SSO to enhance security.
Advantages and downsides of SSOAdvantages of SSO embody the following:
* It allows users to recollect and manage fewer passwords and usernames for every application.
* It streamlines the method of linguistic communication on and exploitation applications - no ought to reenter passwords.
* It lessens the prospect of phishing.
* It ends up in fewer complaints or hassle concerning passwords for IT facilitate desks.
Disadvantages of SSO embody the following:
* It doesn't address sure levels of security every application sign-on might have.
* If availableness is lost, then users are fast out of the multiple systems connected to the SSO.
* If unauthorized users gain access, then they might gain access to over one application.
SSO vendorsThere are multiple SSO vendors that are accepted. Some offer different services, and SSO is a further feature. SSO vendors embody the following:
* Rippling allows users to sign on to cloud applications from multiple devices.
* Avatier Identity anyplace is an SSO for manual laborer container-based platforms.
* OneLogin may be a cloud-based identity and access management (IAM) platform that supports SSO.
* Okta may be a tool with AN SSO practicality. Okta additionally supports 2FA and is primarily used by enterprise users.
NEW QUESTION # 195
An organization has automated the operation of critical infrastructure from a remote location. For this purpose, all the industrial control systems are connected to the Internet. To empower the manufacturing process, ensure the reliability of industrial networks, and reduce downtime and service disruption, the organization decided to install an OT security tool that further protects against security incidents such as cyber espionage, zero-day attacks, and malware.
Which of the following tools must the organization employ to protect its critical infrastructure?
- A. BalenaCloud
- B. Flowmon
- C. IntentFuzzer
- D. Robotium
Answer: A
NEW QUESTION # 196
Mike, a security engineer, was recently hired by BigFox Ltd. The company recently experienced disastrous DoS attacks. The management had instructed Mike to build defensive strategies for the company's IT infrastructure to thwart DoS/DDoS attacks. Mike deployed some countermeasures to handle jamming and scrambling attacks. What is the countermeasure Mike applied to defend against jamming and scrambling attacks?
- A. Implement cognitive radios in the physical layer
- B. Allow the usage of functions such as gets and strcpy
- C. A Disable TCP SYN cookie protection
- D. Allow the transmission of all types of addressed packets at the ISP level
Answer: C
NEW QUESTION # 197
Lewis, a professional hacker, targeted the loT cameras and devices used by a target venture-capital firm. He used an information-gathering tool to collect information about the loT devices connected to a network, open ports and services, and the attack surface are a. Using this tool, he also generated statistical reports on broad usage patterns and trends. This tool helped Lewis continually monitor every reachable server and device on the Internet, further allowing him to exploit these devices in the network. Which of the following tools was employed by Lewis in the above scenario?
- A. Wapiti
- B. Censys
- C. Lacework
- D. NeuVector
Answer: A
NEW QUESTION # 198
Gilbert, a web developer, uses a centralized web API to reduce complexity and increase the Integrity of updating and changing data. For this purpose, he uses a web service that uses HTTP methods such as PUT.
POST. GET. and DELETE and can improve the overall performance, visibility, scalability, reliability, and portability of an application. What is the type of web-service API mentioned in the above scenario?
- A. SOAP API
- B. REST API
- C. RESTful API
- D. JSON-RPC
Answer: B
NEW QUESTION # 199
Robert, a professional hacker, is attempting to execute a fault injection attack on a target IoT device. In this process, he injects faults into the power supply that can be used for remote execution, also causing the skipping of key instructions. He also injects faults into the clock network used for delivering a synchronized signal across the chip.
Which of the following types of fault injection attack is performed by Robert in the above scenario?
- A. Temperature attack
- B. Frequency/voltage tampering
- C. Optical, electromagnetic fault injection (EMFI)
- D. Power/clock/reset glitching
Answer: C
NEW QUESTION # 200
Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?
- A. To create needless SPAM
- B. To perform a DoS
- C. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail
- D. To test for virus protection
- E. To determine who is the holder of the root account
Answer: C
NEW QUESTION # 201
Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/feed.php?url=externalsite.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server.
What is the type of attack Jason performed in the above scenario?
- A. Web server misconfiguration
- B. Website defacement
- C. Web cache poisoning attack
- D. Server-side request forgery (SSRF) attack
Answer: D
NEW QUESTION # 202
A newly joined employee, Janet, has been allocated an existing system used by a previous employee. Before issuing the system to Janet, it was assessed by Martin, the administrator. Martin found that there were possibilities of compromise through user directories, registries, and other system parameters. He also identified vulnerabilities such as native configuration tables, incorrect registry or file permissions, and software configuration errors.
What is the type of vulnerability assessment performed by Martin?
- A. Credentialed assessment
- B. Distributed assessment
- C. Database assessment
- D. Host-based assessment
Answer: D
NEW QUESTION # 203
......
EC-COUNCIL 312-50v11 exam, also known as the Certified Ethical Hacker Exam (CEH v11), is a certification exam designed for individuals interested in pursuing a career in ethical hacking. 312-50v11 exam is aimed at testing the candidate's knowledge and skills in identifying vulnerabilities in systems and networks, analyzing and exploiting them, and using the findings to enhance system security. The CEH v11 exam is recognized globally and is a prestigious certification for professionals in cybersecurity and information technology.
Free CEH v11 312-50v11 Exam Question: https://prepaway.testkingpdf.com/312-50v11-testking-pdf-torrent.html
