Actualtests 312-50 Questions are updated and all 312-50 answers are verified by experts. Once you have completely prepared with our 312-50 exam prep kits you will be ready for the real 312-50 exam without a problem. We have Most up-to-date EC-Council 312-50 dumps study guide. PASSED 312-50 First attempt! Here What I Did.

Q391. What will the following command produce on a website's login page if executed successfully? SELECT email, passwd, login_id, full_name FROM members WHERE email = 'someone@somewhere.com' DROP TABLE members; --' 

A. This code will insert the someone@somewhere.com email address into the members table. 

B. This command will delete the entire members table. 

C. It retrieves the password for the first user in the members table. 

D. This command will not produce anything since the syntax is incorrect. 

Answer: B


Q392. A particular database threat utilizes a SQL injection technique to penetrate a target system. How would an attacker use this technique to compromise a database? 

A. An attacker uses poorly designed input validation routines to create or alter SQL commands to gain access to unintended data or execute commands of the database 

B. An attacker submits user input that executes an operating system command to compromise a target system 

C. An attacker gains control of system to flood the target system with requests, preventing legitimate users from gaining access 

D. An attacker utilizes an incorrect configuration that leads to access with higher-than-expected privilege of the database 

Answer: A

Explanation: Using the poorly designed input validation to alter or steal data from a database is a SQL injection attack. 


Q393. Ivan is auditing a corporate website. Using Winhex, he alters a cookie as shown below. 

Before Alteration: Cookie:; ADMIN=no; y=1 ; time=10:30GMT ; 

After Alteration: Cookie:; ADMIN=yes; y=1 ; time=12:30GMT ; 

What attack is being depicted here? 

A. Cookie Stealing 

B. Session Hijacking 

C. Cross Site Scripting 

D. Parameter Manipulation 

Answer: D

Explanation: Cookies are the preferred method to maintain state in the stateless HTTP protocol. They are however also used as a convenient mechanism to store user preferences and other data including session tokens. Both persistent and non-persistent cookies, secure or insecure can be modified by the client and sent to the server with URL requests. Therefore any malicious user can modify cookie content to his advantage. There is a popular misconception that non-persistent cookies cannot be modified but this is not true; tools like Winhex are freely available. SSL also only protects the cookie in transit. 


Q394. Ethernet switches can be adversely affected by rapidly bombarding them with spoofed ARP responses. He port to MAC Address table (CAM Table) overflows on the switch and rather than failing completely, moves into broadcast mode, then the hacker can sniff all of the packets on the network. 

Which of the following tool achieves this? 

A. ./macof 

B. ./sniffof 

C. ./dnsiff 

D. ./switchsnarf 

Answer: A

Explanation: macof floods the local network with random MAC addresses (causing some switches to fail open in repeating mode, facilitating sniffing). 


Q395. Study the snort rule given below and interpret the rule. 

alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msg: "mountd access";) 

A. An alert is generated when a TCP packet is originated from port 111 of any IP address to the 

192.168.1.0 subnet 

B. An alert is generated when any packet other than a TCP packet is seen on the network and destined for the 192.168.1.0 subnet 

C. An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111 

D. An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111 

Answer: D

Explanation: Refer to the online documentation on creating Snort rules at http://snort.org/docs/snort_htmanuals/htmanual_261/node147.html 


Q396. In which step Steganography fits in CEH System Hacking Cycle (SHC) 

A. Step 2: Crack the password 

B. Step 1: Enumerate users 

C. Step 3: Escalate privileges 

D. Step 4: Execute applications 

E. Step 5: Hide files 

F. Step 6: Cover your tracks 

Answer: ACDEF


Q397. Which of the following represents the initial two commands that an IRC client sends to join an IRC network? 

A. USER, NICK 

B. LOGIN, NICK 

C. USER, PASS 

D. LOGIN, USER 

Answer:

Explanation: A "PASS" command is not required for either client or server connection to be registered, but it must precede the server message or the latter of the NICK/USER combination. (RFC 1459) 


Q398. Eve decides to get her hands dirty and tries out a Denial of Service attack that is relatively new to her. This time she envisages using a different kind of method to attack Brownies Inc. Eve tries to forge the packets and uses the broadcast address. She launches an attack similar to that of fraggle. What is the technique that Eve used in the case above? 

A. Smurf 

B. Bubonic 

C. SYN Flood 

D. Ping of Death 

Answer: A

Explanation: A fraggle attack is a variation of the smurf attack for denial of service in which the attacker sends spoofed UDP packets instead of ICMP echo reply (ping) packets to the broadcast address of a large network. 


Q399. Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the cookie even while the session is valid on the server. Why do you think this is possible? 

A. Any cookie can be replayed irrespective of the session status 

B. The scenario is invalid as a secure cookie cannot be replayed 

C. It works because encryption is performed at the network layer (layer 1 encryption) 

D. It works because encryption is performed at the application layer (single encryption key) 

Answer: D


Q400. Dan is conducting a penetration testing and has found a vulnerability in a Web Application which gave him the sessionID token via a cross site scripting vulnerability. Dan wants to replay this token. However, the session ID manager (on the server) checks the originating IP address as well. Dan decides to spoof his IP address in order to replay the sessionID. Why do you think Dan might not be able to get an interactive session? 

A. Dan cannot spoof his IP address over TCP network 

B. The server will send replies back to the spoofed IP address 

C. Dan can establish an interactive session only if he uses a NAT 

D. The scenario is incorrect as Dan can spoof his IP and get responses 

Answer:

Explanation: Spoofing your IP address is only effective when there is no need to establish a two way connection as all traffic meant to go to the attacker will end up at the place of the spoofed address.