Valid 312-50v12 Test Answers & ECCouncil 312-50v12 Exam PDF
ECCouncil 312-50v12 Certification Real 2024 Mock Exam
The 312-50v12 exam covers a wide range of topics including network scanning, system hacking, web application hacking, cryptography, and social engineering. 312-50v12 exam is designed to test the candidate's knowledge of ethical hacking principles and techniques, as well as their ability to identify and address security vulnerabilities in various types of systems and networks. 312-50v12 exam is also designed to test the candidate's ability to think creatively and outside the box when it comes to identifying potential security threats.
NEW QUESTION # 174
John, a professional hacker, targeted CyberSol Inc., an MNC. He decided to discover the loT devices connected in the target network that are using default credentials and are vulnerable to various hijacking attacks. For this purpose, he used an automated tool to scan the target network for specific types of loT devices and detect whether they are using the default, factory-set credentials. What is the tool employed by John in the above scenario?
- A. Azure loT Central
- B. loT Inspector
- C. AT&T loT Platform
- D. loTSeeker
Answer: D
NEW QUESTION # 175
You are logged in as a local admin on a Windows 7 system and you need to launch the Computer Management Console from command line.
Which command would you use?
- A. c:\gpedit
- B. c:\ncpa.cp
- C. c:\compmgmt.msc
- D. c:\services.msc
Answer: C
Explanation:
To start the Computer Management Console from command line just type compmgmt.msc
/computer:computername in your run box or at the command line and it should automatically open the Computer Management console.
References:
http://www.waynezim.com/tag/compmgmtmsc/
NEW QUESTION # 176
Annie, a cloud security engineer, uses the Docker architecture to employ a client/server model in the application she is working on. She utilizes a component that can process API requests and handle various Docker objects, such as containers, volumes. Images, and networks. What is the component of the Docker architecture used by Annie in the above scenario?
- A. Docker registries
- B. Docker client
- C. Docker objects
- D. Docker daemon
Answer: D
Explanation:
Docker uses a client-server design. The docker client talks to the docker daemon, that will the work of building, running, and distributing your docker containers. The docker client and daemon will run on the same system, otherwise you will connect a docker consumer to a remote docker daemon. The docker consumer and daemon communicate using a REST API, over OS sockets or a network interface.
The docker daemon (dockerd) listens for docker API requests and manages docker objects like pictures, containers, networks, and volumes. A daemon may communicate with other daemons to manage docker services.
NEW QUESTION # 177
In the field of cryptanalysis, what is meant by a "rubber-hose" attack?
- A. A backdoor placed into a cryptographic algorithm by its creator.
- B. Extraction of cryptographic secrets through coercion or torture.
- C. Forcing the targeted key stream through a hardware-accelerated device such as an ASIC.
- D. Attempting to decrypt cipher text by making logical assumptions about the contents of the original plain text.
Answer: B
NEW QUESTION # 178
A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named "nc." The FTP server's access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The "ps" command shows that the "nc" file is running as process, and the netstat command shows the "nc" process is listening on a network port.
What kind of vulnerability must be present to make this remote attack possible?
- A. File system permissions
- B. Privilege escalation
- C. Brute force login
- D. Directory traversal
Answer: A
Explanation:
File system permissions
Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
NEW QUESTION # 179
ViruXine.W32 virus hides their presence by changing the underlying executable code.
This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all.
Here is a section of the Virus code:
What is this technique called?
- A. Stealth Virus
- B. Metamorphic Virus
- C. Polymorphic Virus
- D. Dravidic Virus
Answer: C
NEW QUESTION # 180
Vlady works in a fishing company where the majority of the employees have very little understanding of IT let alone IT Security. Several information security issues that Vlady often found includes, employees sharing password, writing his/her password on a post it note and stick it to his/her desk, leaving the computer unlocked, didn't log out from emails or other social media accounts, and etc.
After discussing with his boss, Vlady decided to make some changes to improve the security environment in his company. The first thing that Vlady wanted to do is to make the employees understand the importance of keeping confidential information, such as password, a secret and they should not share it with other persons.
Which of the following steps should be the first thing that Vlady should do to make the employees in his company understand to importance of keeping confidential information a secret?
- A. Information security awareness training
- B. Developing a strict information security policy
- C. Conducting a one to one discussion with the other employees about the importance of information security
- D. Warning to those who write password on a post it note and put it on his/her desk
Answer: D
NEW QUESTION # 181
What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
- F. 5
Answer: B,C,F
NEW QUESTION # 182
During a red team engagement, an ethical hacker is tasked with testing the security measures of an organization's wireless network. The hacker needs to select an appropriate tool to carry out a session hijacking attack. Which of the following tools should the hacker use to effectively perform session hijacking and subsequent security analysis, given that the target wireless network has the Wi-Fi Protected Access-preshared key (WPA-PSK) security protocol in place?
- A. bettercap
- B. Droidsheep
- C. Hetty
- D. FaceNiff
Answer: A
Explanation:
bettercap is a tool that can perform session hijacking attacks on wireless networks, among other network security and penetration testing tasks. bettercap can capture and manipulate network traffic, perform man-in-the-middle attacks, spoof and sniff protocols, inject custom payloads, and more1.
bettercap can perform session hijacking attacks on wireless networks that use the WPA-PSK security protocol by exploiting the four-way handshake process that occurs when a client connects to a wireless access point.
The four-way handshake is used to establish a shared encryption key between the client and the access point, based on the pre-shared key (PSK) that is configured on both devices. However, the four-way handshake also exposes some information that can be used to crack the PSK offline, such as the nonce values, the MAC addresses, and the message integrity code (MIC) of the packets2.
bettercap can capture the four-way handshake packets using its Wi-Fi module and save them in a file. The file can then be fed to a tool like Hashcat or Aircrack-ng to crack the PSK using brute force or dictionary attacks. Once the PSK is obtained, bettercap can use it to decrypt the wireless traffic and perform session hijacking attacks on the clients connected to the access point3.
Therefore, bettercap is an appropriate tool to carry out a session hijacking attack on a wireless network that uses the WPA-PSK security protocol.
References:
* bettercap: the Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks
* How the WPA2 Enterprise Wireless Security Protocol Works
* Cracking WPA/WPA2 Passwords with Bettercap and Hashcat
NEW QUESTION # 183
is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.
- A. Zone transfer
- B. DNSSEC
- C. Resource records
- D. Resource transfer
Answer: B
Explanation:
The Domain Name System Security Extensions (DNSSEC) is a suite of Internet Engineering Task Force (IETF) specifications for securing certain kinds of information provided by DNS for use on IP networks. DNSSEC is a set of extensions to DNS provide to DNS clients (resolvers) origin authentication of DNS data, authenticated denial of existence, and data integrity, but not availability or confidentiality. DNSSEC is necessary because the original DNS design did not include security but was designed to be a scalable distributed system. DNSSEC adds security while maintaining backward compatibility.
NEW QUESTION # 184
Annie, a cloud security engineer, uses the Docker architecture to employ a client/server model in the application she is working on. She utilizes a component that can process API requests and handle various Docker objects, such as containers, volumes. Images, and networks. What is the component of the Docker architecture used by Annie in the above scenario?
- A. Docker registries
- B. Docker client
- C. Docker objects
- D. Docker daemon
Answer: D
Explanation:
Docker uses a client-server design. The docker client talks to the docker daemon, that will the work of building, running, and distributing your docker containers. The docker client and daemon will run on the same system, otherwise you will connect a docker consumer to a remote docker daemon. The docker consumer and daemon communicate using a REST API, over OS sockets or a network interface.
The docker daemon (dockerd) listens for docker API requests and manages docker objects like pictures, containers, networks, and volumes. A daemon may communicate with other daemons to manage docker services.
NEW QUESTION # 185
On performing a risk assessment, you need to determine the potential impacts when some of the critical business processes of the company interrupt its service.
What is the name of the process by which you can determine those critical businesses?
- A. Risk Mitigation
- B. Emergency Plan Response (EPR)
- C. Disaster Recovery Planning (DRP)
- D. Business Impact Analysis (BIA)
Answer: D
NEW QUESTION # 186
Which Metasploit Framework tool can help penetration tester for evading Anti-virus Systems?
- A. msfpayload
- B. msfd
- C. msfcli
- D. msfencode
Answer: D
Explanation:
https://www.offensive-security.com/metasploit-unleashed/msfencode/
One of the best ways to avoid being stopped by antivirus software is to encode our payload with msfencode. Msfencode is a useful tool that alters the code in an executable so that it looks different to antivirus software but will still run the same way. Much as the binary attachment in email is encoded in Base64, msfencode encodes the original executable in a new binary. Then, when the executable is run, msfencode decodes the original code into memory and exe-cutes it.
Incorrect answers:
msfpayload
https://www.offensive-security.com/metasploit-unleashed/msfpayload/
MSFpayload is a command line instance of Metasploit that is used to generate and output all of the various types of shellcode that are available in Metasploit. The most common use of this tool is for the generation of shellcode for an exploit that is not currently in the Metasploit Framework or for testing different types of shellcode and options before finalizing an Exploit Module.
msfcli
https://www.offensive-security.com/metasploit-unleashed/msfcli/
The msfcli provides a powerful command line interface to the framework. This allows you to easily add Metasploit exploits into any scripts you may create.
NEW QUESTION # 187
You are the chief security officer at AlphaTech, a tech company that specializes in data storage solutions.
Your company is developing a new cloud storage platform where users can store their personal files. To ensure data security, the development team is proposing to use symmetric encryption for data at rest. However, they are unsure of how to securely manage and distribute the symmetric keys to users. Which of the following strategies would you recommend to them?
- A. Use hash functions to distribute the keys.
- B. implement the Diffie-Hellman protocol for secure key exchange.
- C. Use HTTPS protocol for secure key transfer.
- D. Use digital signatures to encrypt the symmetric keys.
Answer: C
Explanation:
Symmetric encryption is a method of encrypting and decrypting data using the same secret key. Symmetric encryption is fast and efficient, but it requires a secure way of managing and distributing the keys to the users who need them. If the keys are compromised, the data is no longer secure.
One of the strategies to securely manage and distribute symmetric keys is to use HTTPS protocol for secure key transfer. HTTPS is a protocol that uses SSL/TLS to encrypt the communication between a client and a server over the Internet. HTTPS can protect the symmetric keys from being intercepted or modified by an attacker during the key transfer process. HTTPS can also authenticate the server and the client using certificates, ensuring that the keys are sent to and received by the intended parties.
To use HTTPS protocol for secure key transfer, the development team needs to implement the following steps1:
* Generate a symmetric key for each user who wants to store their files on the cloud storage platform. The symmetric key will be used to encrypt and decrypt the user's files.
* Generate a certificate for the cloud storage server. The certificate will contain the server's public key and other information, such as the server's domain name, the issuer, and the validity period. The certificate will be signed by a trusted certificate authority (CA), which is a third-party entity that verifies the identity and legitimacy of the server.
* Install the certificate on the cloud storage server and configure the server to use HTTPS protocol for communication.
* When a user wants to upload or download their files, the user's client (such as a web browser or an app)
* will initiate a HTTPS connection with the cloud storage server. The client will verify the server's certificate and establish a secure session with the server using SSL/TLS. The client and the server will negotiate a session key, which is a temporary symmetric key that will be used to encrypt the data exchanged during the session.
* The cloud storage server will send the user's symmetric key to the user's client, encrypted with the session key. The user's client will decrypt the symmetric key with the session key and use it to encrypt or decrypt the user's files.
* The user's client will store the symmetric key securely on the user's device, such as in a password-protected file or a hardware token. The user's client will also delete the session key after the session is over.
Using HTTPS protocol for secure key transfer can ensure that the symmetric keys are protected from eavesdropping, tampering, or spoofing attacks. However, this strategy also has some challenges and limitations, such as:
* The development team needs to obtain and maintain valid certificates for the cloud storage server from a trusted CA, which might incur costs and administrative overhead.
* The users need to trust the CA that issued the certificates for the cloud storage server and verify the certificates before accepting them.
* The users need to protect their symmetric keys from being lost, stolen, or corrupted on their devices.
The development team needs to provide a mechanism for key backup, recovery, or revocation in case of such events.
* The users need to update their symmetric keys periodically to prevent key exhaustion or reuse attacks.
The development team needs to provide a mechanism for key rotation or renewal in a secure and efficient manner.
References:
* Key Management - OWASP Cheat Sheet Series
* Symmetric Cryptography & Key Management: Exhaustion, Rotation, Defence
* What is Key Management? How does Key Management work? | Encryption Consulting
NEW QUESTION # 188
You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic. If you did not have a VPN, how would you identify whether someone is performing an ARP spoofing attack on your laptop?
- A. You should check your ARP table and see if there is one IP address with two different MAC addresses.
- B. You should use netstat to check for any suspicious connections with another IP address within the LAN.
- C. You cannot identify such an attack and must use a VPN to protect your traffic, r
- D. You should scan the network using Nmap to check the MAC addresses of all the hosts and look for duplicates.
Answer: A
NEW QUESTION # 189
Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results:
TTL: 64 Window Size: 5840
What is the OS running on the target machine?
- A. Windows OS
- B. Mac OS
- C. Linux OS
- D. Solaris OS
Answer: C
NEW QUESTION # 190
What is not a PCI compliance recommendation?
- A. Rotate employees handling credit card transactions on a yearly basis to different departments.
- B. Use a firewall between the public network and the payment card data.
- C. Limit access to card holder data to as few individuals as possible.
- D. Use encryption to protect all transmission of card holder data over any public network.
Answer: A
Explanation:
https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security Build and Maintain a Secure Network
1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters.
Protect Cardholder Data
3. Protect stored cardholder data.
4. Encrypt transmission of cardholder data across open, public networks.
Maintain a Vulnerability Management Program
5. Use and regularly update anti-virus software or programs.
6. Develop and maintain secure systems and applications.
Implement Strong Access Control Measures
7. Restrict access to cardholder data by business need-to-know.
8. Assign a unique ID to each person with computer access.
9. Restrict physical access to cardholder data.
Regularly Monitor and Test Networks
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
Maintain an Information Security Policy
12. Maintain a policy that addresses information security for employees and contractors.
NEW QUESTION # 191
......
The EC-Council 312-50v12 exam is intended for individuals who are interested in pursuing a career in information security or for those who are already working in the field but want to enhance their knowledge and skills. 312-50v12 exam is also suitable for IT professionals, security officers, auditors, and anyone else who is responsible for ensuring the security of computer systems and networks.
312-50v12 Exam Questions and Valid 312-50v12 Dumps PDF: https://www.actualtestsit.com/ECCouncil/312-50v12-exam-prep-dumps.html
312-50v12 Brain Dump: A Study Guide with Tips & Tricks for passing Exam: https://drive.google.com/open?id=1SHcEhZ54FXTVUqZDtRVILYfsnBklOUd_