Feb-2024 Pass EC-COUNCIL 312-50v11 Exam in First Attempt Easily
Free 312-50v11 Exam Files Downloaded Instantly 100% Dumps & Practice Exam
NEW QUESTION # 103
An attacker decided to crack the passwords used by industrial control systems. In this process, he employed a loop strategy to recover these passwords. He used one character at a time to check whether the first character entered is correct; if so, he continued the loop for consecutive characters. If not, he terminated the loop. Furthermore, the attacker checked how much time the device took to finish one complete password authentication process, through which he deduced how many characters entered are correct.
What is the attack technique employed by the attacker to crack the passwords of the industrial control systems?
- A. Side-channel attack
- B. Denial-of-service attack
- C. HMI-based attack
- D. Buffer overflow attack
Answer: D
NEW QUESTION # 104
The tools which receive event logs from servers, network equipment, and applications, and perform analysis and correlation on those logs, and can generate alarms for security relevant issues, are known as what?
- A. Vulnerability Scanner
- B. network Sniffer
- C. Security incident and event Monitoring
- D. Intrusion prevention Server
Answer: C
NEW QUESTION # 105
Gavin owns a white-hat firm and is performing a website security audit for one of his clients. He begins by running a scan which looks for common misconfigurations and outdated software versions. Which of the following tools is he most likely using?
- A. Armitage
- B. Metasploit
- C. Nmap
- D. Nikto
Answer: C
NEW QUESTION # 106
Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN standards on a linux platform?
- A. Abel
- B. Kismet
- C. Netstumbler
- D. Nessus
Answer: B
NEW QUESTION # 107
An attacker redirects the victim to malicious websites by sending them a malicious link by email. The link appears authentic but redirects the victim to a malicious web page, which allows the attacker to steal the victim's data. What type of attack is this?
- A. DDoS
- B. Phishing
- C. Vlishing
- D. Spoofing
Answer: A
NEW QUESTION # 108
What did the following commands determine?
- A. That the true administrator is Joe
- B. Issued alone, these commands prove nothing
- C. These commands demonstrate that the guest account has been disabled
- D. These commands demonstrate that the guest account has NOT been disabled
- E. That the Joe account has a SID of 500
Answer: A
NEW QUESTION # 109
Gregory, a professional penetration tester working at Sys Security Ltd., is tasked with performing a security test of web applications used in the company. For this purpose, Gregory uses a tool to test for any security loopholes by hijacking a session between a client and server. This tool has a feature of intercepting proxy that can be used to inspect and modify the traffic between the browser and target application. This tool can also perform customized attacks and can be used to test the randomness of session tokens. Which of the following tools is used by Gregory in the above scenario?
- A. Burp Suite
- B. Nmap
- C. CxSAST
- D. Wireshark
Answer: A
NEW QUESTION # 110
In order to tailor your tests during a web-application scan, you decide to determine which web-server version is hosting the application. On using the sV flag with Nmap. you obtain the following response:
80/tcp open http-proxy Apache Server 7.1.6
what Information-gathering technique does this best describe?
- A. Dictionary attack
- B. Brute forcing
- C. WhOiS lookup
- D. Banner grabbing
Answer: A
NEW QUESTION # 111
During the enumeration phase. Lawrence performs banner grabbing to obtain information such as OS details and versions of services running. The service that he enumerated runs directly on TCP port 445.
Which of the following services is enumerated by Lawrence in this scenario?
- A. Network File System (NFS)
- B. Remote procedure call (RPC)
- C. Telnet
- D. Server Message Block (SMB)
Answer: D
Explanation:
Worker Message Block (SMB) is an organization document sharing and information texture convention. SMB is utilized by billions of gadgets in a different arrangement of working frameworks, including Windows, MacOS, iOS , Linux, and Android. Customers use SMB to get to information on workers. This permits sharing of records, unified information the board, and brought down capacity limit needs for cell phones. Workers additionally use SMB as a feature of the Software-characterized Data Center for outstanding burdens like grouping and replication.
Since SMB is a far off record framework, it requires security from assaults where a Windows PC may be fooled into reaching a pernicious worker running inside a confided in organization or to a far off worker outside the organization edge. Firewall best practices and arrangements can upgrade security keeping malevolent traffic from leaving the PC or its organization.
For Windows customers and workers that don't have SMB shares, you can obstruct all inbound SMB traffic utilizing the Windows Defender Firewall to keep far off associations from malignant or bargained gadgets. In the Windows Defender Firewall, this incorporates the accompanying inbound principles.
You should also create a new blocking rule to override any other inbound firewall rules. Use the following suggested settings for any Windows clients or servers that do not host SMB Shares:
Name: Block all inbound SMB 445
Description: Blocks all inbound SMB TCP 445 traffic. Not to be applied to domain controllers or computers that host SMB shares.
Action: Block the connection
Programs: All
Remote Computers: Any
Protocol Type: TCP
Local Port: 445
Remote Port: Any
Profiles: All
Scope (Local IP Address): Any
Scope (Remote IP Address): Any
Edge Traversal: Block edge traversal
You must not globally block inbound SMB traffic to domain controllers or file servers. However, you can restrict access to them from trusted IP ranges and devices to lower their attack surface. They should also be restricted to Domain or Private firewall profiles and not allow Guest/Public traffic.
NEW QUESTION # 112
Tony wants to integrate a 128-bit symmetric block cipher with key sizes of 128,192, or 256 bits into a software program, which involves 32 rounds of computational operations that include substitution and permutation operations on four 32-bit word blocks using 8-variable S-boxes with 4-bit entry and 4-bit exit. Which of the following algorithms includes all the above features and can be integrated by Tony into the software program?
- A. RC5
- B. TEA
- C. serpent
- D. CAST-128
Answer: C
NEW QUESTION # 113
is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.
- A. Zone transfer
- B. Resource transfer
- C. Resource records
- D. DNSSEC
Answer: D
NEW QUESTION # 114
Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to feed data and specifies the incorrect field in case of invalid credentials. Later, Calvin uses this information to perform social engineering.
Which of the following design flaws in the authentication mechanism is exploited by Calvin?
- A. Password reset mechanism
- B. Verbose failure messages
- C. Insecure transmission of credentials
- D. User impersonation
Answer: A
NEW QUESTION # 115
John the Ripper is a technical assessment tool used to test the weakness of which of the following?
- A. File permissions
- B. Firewall rulesets
- C. Passwords
- D. Usernames
Answer: C
NEW QUESTION # 116
What two conditions must a digital signature meet?
- A. Must be unique and have special characters.
- B. Has to be legible and neat.
- C. Has to be unforgeable, and has to be authentic.
- D. Has to be the same number of characters as a physical signature and must be unique.
Answer: C
NEW QUESTION # 117
jane invites her friends Alice and John over for a LAN party. Alice and John access Jane's wireless network without a password. However. Jane has a long, complex password on her router. What attack has likely occurred?
- A. Piggybacking
- B. Wireless sniffing
- C. Evil twin
- D. Wardriving
Answer: C
Explanation:
An evil twin may be a fraudulent Wi-Fi access point that appears to be legitimate but is about up to pay attention to wireless communications.[1] The evil twin is that the wireless LAN equivalent of the phishing scam. This type of attack could also be wont to steal the passwords of unsuspecting users, either by monitoring their connections or by phishing, which involves fixing a fraudulent internet site and luring people there. The attacker snoops on Internet traffic employing a bogus wireless access point. Unwitting web users could also be invited to log into the attacker's server, prompting them to enter sensitive information like usernames and passwords. Often, users are unaware they need been duped until well after the incident has occurred. When users log into unsecured (non-HTTPS) bank or e-mail accounts, the attacker intercepts the transaction, since it's sent through their equipment. The attacker is additionally ready to hook up with other networks related to the users' credentials. Fake access points are found out by configuring a wireless card to act as an access point (known as HostAP). they're hard to trace since they will be shut off instantly. The counterfeit access point could also be given an equivalent SSID and BSSID as a close-by Wi-Fi network. The evil twin are often configured to pass Internet traffic through to the legitimate access point while monitoring the victim's connection, or it can simply say the system is temporarily unavailable after obtaining a username and password.
NEW QUESTION # 118
Louis, a professional hacker, had used specialized tools or search engines to encrypt all his browsing activity and navigate anonymously to obtain sensitive/hidden information about official government or federal databases. After gathering the Information, he successfully performed an attack on the target government organization without being traced. Which of the following techniques is described in the above scenario?
- A. Dark web footprinting
- B. website footprinting
- C. VPN footprinting
- D. VoIP footpnnting
Answer: A
Explanation:
Explanation
Accessing dim web and profound web sources can be incredibly amazing-in the event that you center around important use cases. The best techniques we notice have clear necessities, for example, misrepresentation identification, danger checking, and finding uncovered certifications.
Be that as it may, observing these sources is testing, and few arrangements have modern inclusion. "Profound and dull web" ranges a tremendous scope of expected sources; commercial centers, shut discussions, informing applications, and glue destinations. Scarcely any organizations range every one of these sources; less actually have capacities to go past basic scratching of destinations.
Shockingly, there is a ton of ear, vulnerability, and uncertainty (FUD) concerning the dim web. Ice shelf analogies have been basic for quite a long while, apparently exhibiting the profound and dull web is fundamentally bigger than the open web. In truth, the dull web just adds to a little piece of cybercrime-we should consider extra sources to get a more genuine feeling of the danger scene.
WHAT IS THE DARK WEB?The dim web is a region of the web that is just available with explicit program programming, for example, Tor or I2P. It is a snare of secrecy where clients' characters and areas are secured by encryption innovation that courses client information through numerous workers across the globe - making it very hard to follow clients.
The namelessness of the dim web makes it an appealing innovation for unlawful purposes. Shockingly, acquiring perceivability into criminal areas is troublesome: it requires particular information, admittance to shut sources, and innovation that is equipped for checking these hotspots for abuses of your information.
Be that as it may, we should initially scatter a few confusions about the dim web.
* Assumption 1: The dull web is inseparable from the criminal web. While the dull web is home to bunches of wrongdoing, it likewise has many genuine organizations like New York Times and Facebook who offer Tor-based administrations, just as for the most part benevolent substance. The dim web isn't inseparable from cybercrime.
* Assumption 2: The dull web is something very similar as the profound web. To explain, the profound web is extensively characterized as whatever isn't recorded by customary web crawlers. Obviously, the profound web is additionally home to guiltiness - however so too is the unmistakable web. The dull web doesn't corner cybercrime.
Essentially on the grounds that it isn't available by a customary internet searcher, it doesn't mean the profound web is fundamentally fascinating. The vast majority of the information on the profound web is ordinary or
"typical"; for instance, email or Facebook records may fall under this definition as they expect enrollment to see the substance. While some profound and dim sites are significant sources, you need to understand what you're searching for, in any case it's not difficult to sit around and assets.
NEW QUESTION # 119
John, a professional hacker, decided to use DNS to perform data exfiltration on a target network, in this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique. John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server. What is the technique employed by John to bypass the firewall?
- A. DNS enumeration
- B. DNS tunneling method
- C. DNS cache snooping
- D. DNSSEC zone walking
Answer: B
Explanation:
DNS tunneling may be a method wont to send data over the DNS protocol, a protocol which has never been intended for data transfer. due to that, people tend to overlook it and it's become a well-liked but effective tool in many attacks. Most popular use case for DNS tunneling is obtaining free internet through bypassing captive portals at airports, hotels, or if you are feeling patient the not-so-cheap on the wing Wi-Fi. On those shared internet hotspots HTTP traffic is blocked until a username/password is provided, however DNS traffic is usually still allowed within the background: we will encode our HTTP traffic over DNS and void, we've internet access. This sounds fun but reality is, browsing anything on DNS tunneling is slow. Like, back to 1998 slow. Another more dangerous use of DNS tunneling would be bypassing network security devices (Firewalls, DLP appliances...) to line up an immediate and unmonitored communications channel on an organisation's network. Possibilities here are endless: Data exfiltration, fixing another penetration testing tool... you name it. To make it even more worrying, there's an outsized amount of easy to use DNS tunneling tools out there. There's even a minimum of one VPN over DNS protocol provider (warning: the planning of the web site is hideous, making me doubt on the legitimacy of it). As a pentester all this is often great, as a network admin not such a lot .
How does it work:
For those that ignoramus about DNS protocol but still made it here, i feel you deserve a really brief explanation on what DNS does: DNS is sort of a phonebook for the web , it translates URLs (human-friendly language, the person's name), into an IP address (machine-friendly language, the phone number). That helps us remember many websites, same as we will remember many people's names. For those that know what DNS is i might suggest looking here for a fast refresh on DNS protocol, but briefly what you would like to understand is: * A Record: Maps a website name to an IP address. example.com ? 12.34.52.67 * NS Record (a.k.a. Nameserver record): Maps a website name to an inventory of DNS servers, just in case our website is hosted in multiple servers. example.com ? server1.example.com, server2.example.com Who is involved in DNS tunneling? * Client. Will launch DNS requests with data in them to a website . * One Domain that we will configure. So DNS servers will redirect its requests to an outlined server of our own. * Server. this is often the defined nameserver which can ultimately receive the DNS requests. The 6 Steps in DNS tunneling (simplified): 1. The client encodes data during a DNS request. The way it does this is often by prepending a bit of knowledge within the domain of the request. for instance : mypieceofdata.server1.example.com 2. The DNS request goes bent a DNS server. 3. The DNS server finds out the A register of your domain with the IP address of your server. 4. The request for mypieceofdata.server1.example.com is forwarded to the server. 5. The server processes regardless of the mypieceofdata was alleged to do. Let's assume it had been an HTTP request. 6. The server replies back over DNS and woop woop, we've got signal.
NEW QUESTION # 120
Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks. What is the type of threat intelligence collected by Arnold in the above scenario?
- A. Tactical threat intelligence
- B. Operational threat intelligence
- C. Strategic threat intelligence
- D. Technical threat intelligence
Answer: B
NEW QUESTION # 121
You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c
What is the hexadecimal value of NOP instruction?
- A. 0x90
- B. 0x80
- C. 0x70
- D. 0x60
Answer: A
NEW QUESTION # 122
Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?
- A. To test for virus protection
- B. To create needless SPAM
- C. To perform a DoS
- D. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail
- E. To determine who is the holder of the root account
Answer: D
NEW QUESTION # 123
Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session 10 to the target employee. The session ID links the target employee to Boneys account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boneys account. What is the attack performed by Boney in the above scenario?
- A. Session donation attack
- B. Session fixation attack
- C. CRIME attack
- D. Forbidden attack
Answer: A
Explanation:
Explanation
In a session donation attack, the attacker donates their own session ID to the target user. In this attack, the attacker first obtains a valid session ID by logging into a service and later feeds the same session ID to the target user. This session ID links a target user to the attacker's account page without disclosing any information to the victim. When the target user clicks on the link and enters the details (username, password, payment details, etc.) in a form, the entered details are linked to the attacker's account. To initiate this attack, the attacker can send their session ID using techniques such as cross-site cooking, an MITM attack, and session fixation. A session donation attack involves the following steps.
NEW QUESTION # 124
......
Free Exam Updates 312-50v11 dumps with test Engine Practice: https://www.testsimulate.com/312-50v11-study-materials.html