[Jan-2023] Dumps Brief Outline Of The 312-50v12 Exam - CertkingdomPDF
312-50v12 Training & Certification Get Latest CEH v12
ECCouncil 312-50v12 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
| Topic 11 |
|
| Topic 12 |
|
| Topic 13 |
|
| Topic 14 |
|
NEW QUESTION 79
Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor". Here is the output of the SIDs:
From the above list identify the user account with System Administrator privileges.
- A. Micah
- B. Somia
- C. Shawn
- D. John
- E. Rebecca
- F. Sheela
- G. Chang
Answer: G
NEW QUESTION 80
If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?
- A. Smurf
- B. Man-in-the-middle
- C. Brute force
- D. Birthday
Answer: C
NEW QUESTION 81
Robin, a professional hacker, targeted an organization's network to sniff all the traffic. During this process.
Robin plugged in a rogue switch to an unused port in the LAN with a priority lower than any other switch in the network so that he could make it a root bridge that will later allow him to sniff all the traffic in the network.
What is the attack performed by Robin in the above scenario?
- A. VLAN hopping attack
- B. STP attack
- C. DNS poisoning attack
- D. ARP spoofing attack
Answer: B
Explanation:
STP prevents bridging loops in a redundant switched network environment. By avoiding loops, you can ensure that broadcast traffic does not become a traffic storm.
STP is a hierarchical tree-like topology with a "root" switch at the top. A switch is elected as root based on the lowest configured priority of any switch (0 through 65,535). When a switch boots up, it begins a process of identifying other switches and determining the root bridge. After a root bridge is elected, the topology is established from its perspective of the connectivity. The switches determine the path to the root bridge, and all redundant paths are blocked. STP sends configuration and topology change notifications and acknowledgments (TCN/TCA) using bridge protocol data units (BPDU).
An STP attack involves an attacker spoofing the root bridge in the topology. The attacker broadcasts out an STP configuration/topology change BPDU in an attempt to force an STP recalculation. The BPDU sent out announces that the attacker's system has a lower bridge priority. The attacker can then see a variety of frames forwarded from other switches to it. STP recalculation may also cause a denial-of-service (DoS) condition on the network by causing an interruption of 30 to 45 seconds each time the root bridge changes. An attacker using STP network topology changes to force its host to be elected as the root bridge.
NEW QUESTION 82
Which of these is capable of searching for and locating rogue access points?
- A. WIPS
- B. NIDS
- C. HIDS
- D. WISS
Answer: A
Explanation:
A Wireless Intrusion Prevention System (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).
NEW QUESTION 83
When you are testing a web application, it is very useful to employ a proxy tool to save every request and response. You can manually test every request and analyze the response to find vulnerabilities. You can test parameter and headers manually to get more precise results than if using web vulnerability scanners.
What proxy tool will help you find web vulnerabilities?
- A. Maskgen
- B. Dimitry
- C. Proxychains
- D. Burpsuite
Answer: D
NEW QUESTION 84
Which is the first step followed by Vulnerability Scanners for scanning a network?
- A. OS Detection
- B. Firewall detection
- C. Checking if the remote host is alive
- D. TCP/UDP Port scanning
Answer: C
Explanation:
Vulnerability scanning solutions perform vulnerability penetration tests on the organizational network in three steps:
1. Locating nodes: The first step in vulnerability scanning is to locate live hosts in the target network using various scanning techniques.
2. Performing service and OS discovery on them: After detecting the live hosts in the target network, the next step is to enumerate the open ports and services and the operating system on the target systems.
3. Testing those services and OS for known vulnerabilities: Finally, after identifying the open services and the operating system running on the target nodes, they are tested for known vulnerabilities.
NEW QUESTION 85
You have compromised a server and successfully gained a root access. You want to pivot and pass traffic undetected over the network and evade any possible Intrusion Detection System. What is the best approach?
- A. Install and use Telnet to encrypt all outgoing traffic from this server.
- B. Use Alternate Data Streams to hide the outgoing packets from this server.
- C. Use HTTP so that all traffic can be routed vis a browser, thus evading the internal Intrusion Detection Systems.
- D. Install Cryptcat and encrypt outgoing packets from this server.
Answer: D
Explanation:
https://linuxsecurityblog.com/2018/12/23/create-a-backdoor-with-cryptcat/ Cryptcat enables us to communicate between two systems and encrypts the communication between them with twofish, one of many excellent encryption algorithms from Bruce Schneier et al. Twofish's encryption is on par with AES encryption, making it nearly bulletproof. In this way, the IDS can't detect the malicious behavior taking place even when its traveling across normal HTTP ports like 80 and 443.
NEW QUESTION 86
Which definition among those given below best describes a covert channel?
- A. A server program using a port that is not well known.
- B. Making use of a protocol in a way it is not intended to be used.
- C. It is one of the weak channels used by WEP which makes it insecure
- D. It is the multiplexing taking place on a communication link.
Answer: B
NEW QUESTION 87
Which of the following are well known password-cracking programs?
- A. NetCat
- B. Netbus
- C. John the Ripper
- D. Jack the Ripper
- E. L0phtcrack
Answer: C,E
NEW QUESTION 88
Your company performs penetration tests and security assessments for small and medium-sized business in the local are a. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.
What should you do?
- A. Confront the client in a respectful manner and ask her about the data.
- B. Copy the data to removable media and keep it in case you need it.
- C. Immediately stop work and contact the proper legal authorities.
- D. Ignore the data and continue the assessment until completed as agreed.
Answer: C
NEW QUESTION 89
John, a professional hacker, targeted CyberSol Inc., an MNC. He decided to discover the loT devices connected in the target network that are using default credentials and are vulnerable to various hijacking attacks. For this purpose, he used an automated tool to scan the target network for specific types of loT devices and detect whether they are using the default, factory-set credentials. What is the tool employed by John in the above scenario?
- A. loTSeeker
- B. AT&T loT Platform
- C. Azure loT Central
- D. loT Inspector
Answer: A
NEW QUESTION 90
John, a professional hacker, decided to use DNS to perform data exfiltration on a target network, in this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique. John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server. What is the technique employed by John to bypass the firewall?
- A. DNS cache snooping
- B. DNSSEC zone walking
- C. DNS enumeration
- D. DNS tunneling method
Answer: D
Explanation:
DNS tunneling may be a method wont to send data over the DNS protocol, a protocol which has never been intended for data transfer. due to that, people tend to overlook it and it's become a well-liked but effective tool in many attacks. Most popular use case for DNS tunneling is obtaining free internet through bypassing captive portals at airports, hotels, or if you are feeling patient the not-so-cheap on the wing Wi-Fi. On those shared internet hotspots HTTP traffic is blocked until a username/password is provided, however DNS traffic is usually still allowed within the background: we will encode our HTTP traffic over DNS and voila, we've internet access. This sounds fun but reality is, browsing anything on DNS tunneling is slow. Like, back to 1998 slow. Another more dangerous use of DNS tunneling would be bypassing network security devices (Firewalls, DLP appliances...) to line up an immediate and unmonitored communications channel on an organisation's network. Possibilities here are endless: Data exfiltration, fixing another penetration testing tool... you name it. To make it even more worrying, there's an outsized amount of easy to use DNS tunneling tools out there. There's even a minimum of one VPN over DNS protocol provider (warning: the planning of the web site is hideous, making me doubt on the legitimacy of it). As a pentester all this is often great, as a network admin not such a lot .
How does it work:
For those that ignoramus about DNS protocol but still made it here, i feel you deserve a really brief on what DNS does: DNS is sort of a phonebook for the web , it translates URLs (human-friendly language, the person's name), into an IP address (machine-friendly language, the phone number). That helps us remember many websites, same as we will remember many people's names. For those that know what DNS is i might suggest looking here for a fast refresh on DNS protocol, but briefly what you would like to understand is: * A Record: Maps a website name to an IP address. example.com ? 12.34.52.67 * NS Record (a.k.a. Nameserver record): Maps a website name to an inventory of DNS servers, just in case our website is hosted in multiple servers. example.com ? server1.example.com, server2.example.com Who is involved in DNS tunneling? * Client. Will launch DNS requests with data in them to a website . * One Domain that we will configure. So DNS servers will redirect its requests to an outlined server of our own. * Server. this is often the defined nameserver which can ultimately receive the DNS requests. The 6 Steps in DNS tunneling (simplified): 1. The client encodes data during a DNS request. The way it does this is often by prepending a bit of knowledge within the domain of the request. for instance : mypieceofdata.server1.example.com 2. The DNS request goes bent a DNS server. 3. The DNS server finds out the A register of your domain with the IP address of your server. 4. The request for mypieceofdata.server1.example.com is forwarded to the server. 5. The server processes regardless of the mypieceofdata was alleged to do. Let's assume it had been an HTTP request. 6. The server replies back over DNS and woop woop, we've got signal.
Bypassing Firewalls through the DNS Tunneling Method DNS operates using UDP, and it has a 255-byte limit on outbound queries. Moreover, it allows only alphanumeric characters and hyphens. Such small size constraints on external queries allow DNS to be used as an ideal choice to perform data exfiltration by various malicious entities. Since corrupt or malicious data can be secretly embedded into the DNS protocol packets, even DNSSEC cannot detect the abnormality in DNS tunneling. It is effectively used by malware to bypass the firewall to maintain communication between the victim machine and the C&C server. Tools such as NSTX (https://sourceforge.net), Heyoka (http://heyoka.sourceforge.netuse), and Iodine (https://code.kryo.se) use this technique of tunneling traffic across DNS port 53. CEH v11 Module 12 Page 994
NEW QUESTION 91
This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from the server. By observing the response, an attacker can extract sensitive information. What type of attack is this?
- A. Blind SQL injection
- B. Union SQL injection
- C. Error-based SQL injection
- D. Time-based SQL injection
Answer: A
NEW QUESTION 92
Which of the following allows attackers to draw a map or outline the target organization's network infrastructure to know about the actual environment that they are going to hack.
- A. Malware analysis
- B. Scanning networks
- C. Enumeration
- D. Vulnerability analysis
Answer: B
Explanation:
Objectives of Footprinting Draw Network Map - Combining footprinting techniques with tools such as Tracert allows the attacker to create diagrammatic representations of the target organization's network presence. Specficially, it allows attackers to draw a map or outline of the target organization's network infrastructure to know about the actual environment that they are going to break into. These network diagrams can guide the attacker in performing an attack. (P.114/98)
NEW QUESTION 93
You are attempting to run an Nmap port scan on a web server. Which of the following commands would result in a scan of common ports with the least amount of noise In order to evade IDS?
- A. nmap-A-host-time 99-T1
- B. nmap -A -Pn
- C. nmap -sP- -p-65535-T5
- D. nmap -sT-O- To
Answer: D
Explanation:
-A: Perform an aggressive scan which select most of the commonly used options within nmap
-Pn: Means Don't ping
-p:scan specific ports
-sT: TCP Connect scan
-O: Operating system detection
-T0: timing template (extremely slow- evade FW)
NEW QUESTION 94
In Trojan terminology, what is a covert channel?
- A. It is a kernel operation that hides boot processes and services to mask detection
- B. It is Reverse tunneling technique that uses HTTPS protocol instead of HTTP protocol to establish connections
- C. A legitimate communication path within a computer system or network for transfer of data
- D. A channel that transfers information within a computer system or network in a way that violates the security policy
Answer: D
NEW QUESTION 95
A security analyst uses Zenmap to perform an ICMP timestamp ping scan to acquire information related to the current time from the target host machine.
Which of the following Zenmap options must the analyst use to perform the ICMP timestamp ping scan?
- A. -PU
- B. -PP
- C. -Pn
- D. -PY
Answer: B
NEW QUESTION 96
Taylor, a security professional, uses a tool to monitor her company's website, analyze the website's traffic, and track the geographical location of the users visiting the company's website. Which of the following tools did Taylor employ in the above scenario?
- A. WAFW00F
- B. WebSite Watcher
- C. Webroot
- D. web-Stat
Answer: D
Explanation:
Increase your web site's performance and grow! Add Web-Stat to your site (it's free!) and watch individuals act together with your pages in real time.
Learn how individuals realize your web site. Get details concerning every visitor's path through your web site and track pages that flip browsers into consumers.
One-click install. observe locations, in operation systems, browsers and screen sizes and obtain alerts for new guests and conversions
NEW QUESTION 97
If executives are found liable for not properly protecting their company's assets and information systems, what type of law would apply in this situation?
- A. International
- B. Criminal
- C. Common
- D. Civil
Answer: D
NEW QUESTION 98
Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks. What is the type of threat intelligence collected by Arnold in the above scenario?
- A. Tactical threat intelligence
- B. Technical threat intelligence
- C. Operational threat intelligence
- D. Strategic threat intelligence
Answer: C
NEW QUESTION 99
The network in ABC company is using the network address 192.168.1.64 with mask 255.255.255.192. In the network the servers are in the addresses 192.168.1.122, 192.168.1.123 and 192.168.1.124. An attacker is trying to find those servers but he cannot see them in his scanning. The command he is using is: nmap 192.168.1.64/28.
Why he cannot see the servers?
- A. The network must be dawn and the nmap command and IP address are ok
- B. He needs to change the address to 192.168.1.0 with the same mask
- C. He needs to add the command ""ip address"" just before the IP address
- D. He is scanning from 192.168.1.64 to 192.168.1.78 because of the mask /28 and the servers are not in that range
Answer: D
Explanation:
https://en.wikipedia.org/wiki/Subnetwork
This is a fairly simple question. You must to understand what a subnet mask is and how it works.
A subnetwork or subnet is a logical subdivision of an IP network.The practice of dividing a network into two or more networks is called subnetting.
Computers that belong to the same subnet are addressed with an identical most-significant bit-group in their IP addresses. This results in the logical division of an IP address into two fields: the network number or routing prefix and the rest field or host identifier. The rest field is an identifier for a specific host or network interface.
The routing prefix may be expressed in Classless Inter-Domain Routing (CIDR) notation written as the first address of a network, followed by a slash character (/), and ending with the bit-length of the prefix. For example, 198.51.100.0/24 is the prefix of the Internet Protocol version 4 network starting at the given address, having 24 bits allocated for the network prefix, and the remaining 8 bits reserved for host addressing. Addresses in the range 198.51.100.0 to 198.51.100.255 belong to this network. The IPv6 address specification 2001:db8::/32 is a large address block with 296 addresses, having a 32-bit routing prefix.
For IPv4, a network may also be characterized by its subnet mask or netmask, which is the bitmask that when applied by a bitwise AND operation to any IP address in the network, yields the routing prefix. Subnet masks are also expressed in dot-decimal notation like an address. For example, 255.255.255.0 is the subnet mask for the prefix 198.51.100.0/24.
NEW QUESTION 100
What type of a vulnerability/attack is it when the malicious person forces the user's browser to send an authenticated request to a server?
- A. Cross-site request forgery
- B. Cross-site scripting
- C. Server side request forgery
- D. Session hijacking
Answer: A
NEW QUESTION 101
What did the following commands determine?
- A. These commands demonstrate that the guest account has been disabled
- B. That the Joe account has a SID of 500
- C. These commands demonstrate that the guest account has NOT been disabled
- D. Issued alone, these commands prove nothing
- E. That the true administrator is Joe
Answer: E
NEW QUESTION 102
E-mail scams and mail fraud are regulated by which of the following?
- A. 18 U.S.C. par. 1030 Fraud and Related activity in connection with Computers
- B. 18 U.S.C. par. 1362 Communication Lines, Stations, or Systems
- C. 18 U.S.C. par. 2510 Wire and Electronic Communications Interception and Interception of Oral Communication
- D. 18 U.S.C. par. 1029 Fraud and Related activity in connection with Access Devices
Answer: A
NEW QUESTION 103
......
Certification Training for 312-50v12 Exam Dumps Test Engine: https://www.certkingdompdf.com/312-50v12-latest-certkingdom-dumps.html
CEH v12 312-50v12 Real Exam Questions and Answers FREE Updated: https://drive.google.com/open?id=1tVL74Pb_fAkcnrcERu6Uqu7G0Pfe2Ll6