312-50 Exam Questions and Answers | Exam-Dumps (Page: 24)

QUESTION: 116

You are scanning the target network for the first time. You are able to detect few convention open ports. While attempting to perform conventional service identification by connecting to the open ports, the scan yields either bad or no result. As you are unsure of the protocols in use, you want to discover as many different protocols as possible. Which of the following scan options can help you achieve this?

Nessus sacn with TCP based pings
Netcat scan with the switches
Nmap scan with the P (ping scan) switch
Nmap with the O (Raw IP Packets switch

Answer(s): D

Explanation:

-sO IP protocol scans: This method is used to determine which IP protocols are supported on a host. The technique is to send raw IP packets without any further protocol header to each specified protocol on the target machine. If we receive an ICMP protocol unreachable message, then the protocol is not in use. Otherwise we assume it is open. Note that some hosts (AIX, HPUX, Digital UNIX) and firewalls may not send protocol unreachable messages.

Reveal Solution Next Question

QUESTION: 117

Jack is conducting a port scan of a target network. He knows that his target network has a web server and that a mail server is up and running. Jack has been sweeping the network but has not been able to get any responses from the remote target. Check all of the following that could be a likely cause of the lack of response?

The host might be down
UDP is filtered by a gateway
ICMP is filtered by a gateway
The TCP window Size does not match
The destination network might be down
The packet TTL value is too low and can’t reach the target

Answer(s): A,C,E,F

Explanation:

Wrong answers is B and D as sweeping a network uses ICMP

Reveal Solution Next Question

QUESTION: 118

War dialing is one of the oldest methods of gaining unauthorized access to the target systems, it is one of the dangers most commonly forgotten by network engineers and system administrators. A hacker can sneak past all the expensive firewalls and IDS and connect easily into the network. Through wardialing an attacker searches for the devices located in the target network infrastructure that are also accessible through the telephone line.
‘Dial backup’ in routers is most frequently found in networks where redundancy is required. Dial-on-demand routing(DDR) is commonly used to establish connectivity as a backup.
As a security testers, how would you discover what telephone numbers to dial-in to the router?

Search the Internet for leakage for target company’s telephone number to dial-in
Run a war-dialing tool with range of phone numbers and look for CONNECT Response
Connect using ISP’s remote-dial in number since the company’s router has a leased line connection established with them
Brute force the company’s PABX system to retrieve the range of telephone numbers to dial-in

Answer(s): B

Explanation:

Use a program like Toneloc to scan the company’s range of phone numbers.

Reveal Solution Next Question

QUESTION: 119

The FIN flag is set and sent from host A to host B when host A has no more data to transmit (Closing a TCP connection). This flag releases the connection resources. However, host A can continue to receive data as long as the SYN sequence number of transmitted packets from host B are lower than the packet segment containing the set FIN flag.

True
False

Answer(s): A

Explanation:

For sequence number purposes, the SYN is considered to occur before the first actual data octet of the segment in which it occurs, while the FIN is considered to occur after the last actual data octet in a segment in which it occurs. So packets receiving out of order will still be accepted.

Reveal Solution Next Question

QUESTION: 120

Which type of scan does not open a full TCP connection?

Stealth Scan
XMAS Scan
Null Scan
FIN Scan

Answer(s): A

Explanation:

Stealth Scan: Instead of completing the full TCP three-way-handshake a full connection is not made. A SYN packet is sent to the system and if a SYN/ACK packet is received it is assumed that the port on the system is active. In that case a RST/ACK will be sent which will determined the listening state the system is in. If a RST/ACK packet is received, it is assumed that the port on the system is not active.

Reveal Solution Next Question

EC-Council 312-50 Exam (page: 24) EC-Council Ethical Hacker Certified Updated on: 12-Jan-2026

QUESTION: 116

Explanation:

QUESTION: 117

Explanation:

QUESTION: 118

Explanation:

QUESTION: 119

Explanation:

QUESTION: 120

Explanation:

EC-Council 312-50 Exam (page: 24)
EC-Council Ethical Hacker Certified
Updated on: 12-Jan-2026