Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home EC-Council 312-50v11

EC-Council 312-50v11 Exam Practice Questions (P. 1)

  • Full Access (400 questions)
  • Six months of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #1
While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts and displays a video of cats playing a piano. The next business day, the user receives what looks like an email from his bank, indicating that his bank account has been accessed from a foreign country. The email asks the user to call his bank and verify the authorization of a funds transfer that took place. What Web browser-based security vulnerability was exploited to compromise the user?
  1. A
    Clickjacking
  2. B
    Cross-Site Scripting
  3. C
    Cross-Site Request Forgery
  4. D
    Web form input validation

Correct Answer:
C
chatbot-img GPT-4o - Answer
The correct answer, involving Cross-Site Request Forgery (CSRF), is justified as the scenario describes a typical CSRF attack where the user's authenticated browser session is misused to perform unauthorized actions, like transferring funds, without the user’s direct knowledge. CSRF exploits the trust that a site has in the user's browser, utilizing the user's active session to execute unwanted actions, often initiated under the guise of an innocent-looking link or request. This can occur without the user seeing any visible indication of the malicious activity, making CSRF a particularly stealthy and dangerous security vulnerability in web applications.

Question #2
Which service in a PKI will vouch for the identity of an individual or company?
  1. A
    KDC
  2. B
    CR
  3. C
    CBC
  4. D
    CA

Correct Answer:
D
chatbot-img GPT-4o - Answer
Yes, the Certificate Authority (CA) is indeed the correct answer. The CA not only issues but also validates digital certificates, acting as a trusted third party in the PKI framework. These entities play a pivotal role in confirming the identity of individual or organization holding the certificate, ensuring secure and reliable digital communications. Their responsibilities include verifying the credentials of certificate applicants before certificates are issued, ensuring the legitimacy of users within the network.

Question #3
Identify the web application attack where the attackers exploit vulnerabilities in dynamically generated web pages to inject client-side script into web pages viewed by other users.
  1. A
    LDAP Injection attack
  2. B
    Cross-Site Scripting (XSS)
  3. C
    SQL injection attack
  4. D
    Cross-Site Request Forgery (CSRF)

Correct Answer:
B
chatbot-img GPT-4o - Answer
XSS, or Cross-Site Scripting, is a critical security concern in web applications where attackers manipulate vulnerabilities in dynamically generated pages. This kind of attack allows the malicious injection of client-side scripts, such as JavaScript, into web pages. Notably, it enables these scripts to execute within the context of the victim’s browser, which can lead to unauthorized actions or data theft without the user's consent. Understanding and mitigating XSS risks are crucial for securing user data and maintaining trust in web environments.

Question #4
User A is writing a sensitive email message to user B outside the local network. User A has chosen to use PKI to secure his message and ensure only user B can read the sensitive email. At what layer of the OSI layer does the encryption and decryption of the message take place?
  1. A
    Application
  2. B
    Transport
  3. C
    Session
  4. D
    Presentation

Correct Answer:
D
chatbot-img GPT-4o - Answer
In the context of using PKI to secure an email, the encryption and decryption processes are indeed handled at the Presentation layer, which is layer 6 of the OSI model. This layer facilitates the translation, encryption, and decryption of data. It ensures that information sent over the network is presented in a secure and comprehensible format by transforming data into an encrypted format for safe transmission and then decrypting it upon reaching the intended recipient. This is crucial for maintaining the confidentiality and integrity of sensitive communications.

Question #5
A new wireless client is configured to join a 802.11 network. This client uses the same hardware and software as many of the other clients on the network. The client can see the network, but cannot connect. A wireless packet sniffer shows that the Wireless Access Point (WAP) is not responding to the association requests being sent by the wireless client. What is a possible source of this problem?
  1. A
    The WAP does not recognize the client's MAC address
  2. B
    The client cannot see the SSID of the wireless network
  3. C
    Client is configured for the wrong channel
  4. D
    The wireless client is not configured to use DHCP

Correct Answer:
A
chatbot-img GPT-4o - Answer
In cases where a wireless client can see an 802.11 network but cannot connect, while the WAP is non-responsive to association requests, a likely cause could be related to MAC address filtering. MAC filtering is a security measure allowing only recognized devices, as per their MAC addresses, to connect to the network. If the client’s MAC address is not registered or recognized in the WAP's configuration, the access attempt will be denied. Implementing or checking Network Access Control (NAC) configurations can address and resolve such connectivity issues effectively. This understanding is crucial for maintaining network security protocols.

Question #6
If you want to only scan fewer ports than the default scan using Nmap tool, which option would you use?
  1. A
    -r
  2. B
    -F
  3. C
    -P
  4. D
    -sP

Correct Answer:
B
chatbot-img GPT-4o - Answer
The "-F" option in Nmap is indeed used for a fast scan, targeting only the top 100 most commonly used ports. This is significantly fewer than the default scan, which targets 1,000 ports. This option is particularly useful for quick assessments where time is of the essence and a broad overview is more valuable than depth. However, important ports can indeed be missed if they fall outside the top 100, so one should weigh efficiency against the comprehensive scope based on the specific assessment needs.

Question #7
Which of the following is the structure designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?
  1. A
    SOA
  2. B
    biometrics
  3. C
    single sign on
  4. D
    PKI

Correct Answer:
D
chatbot-img GPT-4o - Answer
PKI (Public Key Infrastructure) is fundamental for secure data exchange through its framework of policies, hardware, software, and procedures. This framework manages digital certificates and public-key encryption to authenticate the identities of individuals in a transaction. PKI ensures both the confidentiality and the integrity of the information exchanged, making it ideal for sensitive data transfers in business environments. Remember, understanding the practical implementations of PKI will be beneficial in real-world data security scenarios.

Question #8
You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist's email, and you send her an email changing the source email to her boss's email (boss@company). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your malicious links (these links contain malware) and send back the modified pdf, saying that the links don't work. She reads your email, opens the links, and her machine gets infected. You now have access to the company network. What testing method did you use?
  1. A
    Social engineering
  2. B
    Piggybacking
  3. C
    Tailgating
  4. D
    Eavesdropping

Correct Answer:
A
chatbot-img GPT-4o - Answer
In the described scenario, the tester uses a combination of techniques that fall under social engineering—namely, impersonation by pretending to be the boss and spear phishing by specifically targeting the receptionist with a deceptive email. This approach manipulates the receptionist into believing the request is legitimate, leading her to unknowingly compromise the security of her system and, by extension, the company's network. This interaction highlights the effectiveness of social engineering in manipulating human elements to bypass security measures.

Question #9
If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TCP?
  1. A
    Traceroute
  2. B
    Hping
  3. C
    TCP ping
  4. D
    Broadcast ping

Correct Answer:
B
chatbot-img GPT-4o - Answer
When ICMP responses are blocked on a network, hping presents a viable alternative because it's versatile enough to send TCP, UDP, and ICMP packets using arbitrary source and destination ports and addresses. This flexibility allows it to bypass common ICMP restrictions and perform various network tests like simple pings over TCP, making it a core tool for ethical hacking purposes.

Question #10
Which is the first step followed by Vulnerability Scanners for scanning a network?
  1. A
    OS Detection
  2. B
    Firewall detection
  3. C
    TCP/UDP Port scanning
  4. D
    Checking if the remote host is alive

Correct Answer:
D
chatbot-img GPT-4o - Answer
Absolutely, the initial step for a vulnerability scanner when scanning a network is indeed checking if the remote host is alive. This is essential as it helps in determining active hosts to target for more detailed scanning activities. This method saves time and resources by avoiding inactive or unreachable systems.

Next Questions

All Pages