ExamGecko
Home Home / ECCouncil / 112-51

ECCouncil 112-51 Practice Test - Questions Answers, Page 2

Question list
Search
Search

List of questions

Search

Related questions











Cibel.org, an organization, wanted to develop a web application for marketing its products to the public. In this process, they consulted a cloud service provider and requested provision of development tools, configuration management, and deployment platforms for developing customized applications.

Identify the type of cloud service requested by Cibel.org in the above scenario.

A.
Security-as-a-service (SECaaS)
A.
Security-as-a-service (SECaaS)
Answers
B.
Platform-as-a-service
B.
Platform-as-a-service
Answers
C.
Infrastructure-as-a-service {laaS)
C.
Infrastructure-as-a-service {laaS)
Answers
D.
ldentity-as-a-service {IDaaS)
D.
ldentity-as-a-service {IDaaS)
Answers
Suggested answer: B

Explanation:

The type of cloud

The type of cloud service requested by Cibel.org in the above scenario is Platform-as-a-service (PaaS). PaaS is a cloud-based service that delivers a range of developer tools and deployment capabilities. PaaS provides a complete, ready-to-use, cloud-hosted platform for developing, running, maintaining and managing applications. PaaS customers do not need to install, configure, or manage the underlying infrastructure, such as servers, storage, network, or operating system. Instead, they can focus on the application development and deployment process, using the tools and services provided by the cloud service provider. PaaS solutions support cloud-native development technologies, such as microservices, containers, Kubernetes, serverless computing, that enable developers to build once, then deploy and manage consistently across private cloud, public cloud and on-premises environments. PaaS also offers features such as scalability, availability, security, backup, and monitoring for the applications.PaaS is suitable for organizations that want to develop customized applications without investing in or maintaining the infrastructure123.Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-40 to 3-41

What is PaaS? A Beginner's Guide to Platform as a Service - G2, G2, February 19, 2020

Cloud Service Models Explained: SaaS, IaaS, PaaS, FaaS - Jelvix, Jelvix, July 14, 2020

Ben, a computer user, applied for a digital certificate. A component of PKI verifies Ben's identity using the credentials provided and passes that request on behalf of Ben to grant the digital certificate.

Which of the following PKI components verified Ben as being legitimate to receive the certificate?

A.
Certificate authority (CA)
A.
Certificate authority (CA)
Answers
B.
Registration authority {RA)
B.
Registration authority {RA)
Answers
C.
Certificate directory
C.
Certificate directory
Answers
D.
Validation authority (VA)
D.
Validation authority (VA)
Answers
Suggested answer: B

Explanation:

The PKI component that verified Ben as being legitimate to receive the certificate is the registration authority (RA). An RA is an entity that is responsible for identifying and authenticating certificate applicants, approving or rejecting certificate applications, and initiating certificate revocations or suspensions under certain circumstances. An RA acts as an intermediary between the certificate authority (CA) and the certificate applicant, and performs the necessary checks and validations before forwarding the request to the CA. The CA is the entity that signs and issues the certificates, and maintains the certificate directory and the certificate revocation list. A certificate directory is a repository of issued certificates that can be accessed by users or applications to verify the validity and status of a certificate. A validation authority (VA) is an entity that provides online certificate validation services, such as OCSP or SCVP, to verify the revocation status of a certificate in real time123.

Reference:

Public key infrastructure - Wikipedia, Wikipedia, March 16, 2021

Components of a PKI - The National Cyber Security Centre, NCSC, 2020

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-26 to 3-27

George, a certified security professional, was hired by an organization to ensure that the server accurately responds to customer requests. In this process, George employed a security solution to monitor the network traffic toward the server. While monitoring the traffic, he identified attack signatures such as SYN flood and ping of death attempts on the server.

Which of the following categories of suspicious traffic signature has George identified in the above scenario?

A.
Informational
A.
Informational
Answers
B.
Reconnaissance
B.
Reconnaissance
Answers
C.
Unauthorized access
C.
Unauthorized access
Answers
D.
Denial-of-service (DoS)
D.
Denial-of-service (DoS)
Answers
Suggested answer: D

Explanation:

Denial-of-service (DoS) is the category of suspicious traffic signature that George identified in the above scenario. DoS signatures are designed to detect attempts to disrupt or degrade the availability or performance of a system or network by overwhelming it with excessive or malformed traffic. SYN flood and ping of death are examples of DoS attacks that exploit the TCP/IP protocol to consume the resources or crash the target server. A SYN flood attack sends a large number of TCP SYN packets to the target server, without completing the three-way handshake, thus creating a backlog of half-open connections that exhaust the server's memory or bandwidth. A ping of death attack sends a malformed ICMP echo request packet that exceeds the maximum size allowed by the IP protocol, thus causing the target server to crash or reboot. DoS attacks can cause serious damage to the organization's reputation, productivity, and revenue, and should be detected and mitigated as soon as possible123.

Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34

What is a denial-of-service attack?, Cloudflare, 2020

Denial-of-service attack - Wikipedia, Wikipedia, March 16, 2021

Identify the loT communication model that serves as an analyzer for a company to track monthly or yearly energy consumption. Using this analysis, companies can reduce the expenditure on energy.

A.
Device-to-device model
A.
Device-to-device model
Answers
B.
Cloud-to-cloud model
B.
Cloud-to-cloud model
Answers
C.
Device-to-cloud model
C.
Device-to-cloud model
Answers
D.
Device-to-gateway model
D.
Device-to-gateway model
Answers
Suggested answer: C

Explanation:

The loT communication model that serves as an analyzer for a company to track monthly or yearly energy consumption is the device-to-cloud model. The device-to-cloud model is a loT communication model where the loT devices, such as smart meters, sensors, or thermostats, send data directly to the cloud platform, such as AWS, Azure, or Google Cloud, over the internet. The cloud platform then processes, analyzes, and stores the data, and provides feedback, control, or visualization to the users or applications. The device-to-cloud model enables the company to monitor and optimize the energy consumption of the loT devices in real time, and to leverage the cloud services, such as machine learning, big data analytics, or artificial intelligence, to perform advanced energy management and demand response. The device-to-cloud model also reduces the complexity and cost of the loT infrastructure, as it does not require intermediate gateways or servers to connect the loT devices to the cloud123.

Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-38 to 3-39

loT Communication Models: Device-to-Device, Device-to-Cloud, Device-to-Gateway, and Back-End Data-Sharing, DZone, July 9, 2018

loT Communication Models: Device-to-Device, Device-to-Cloud, Device-to-Gateway, and Back-End Data-Sharing, Medium, March 26, 2019

Amber is working as a team lead in an organization. She was instructed to share a policy document with all the employees working from remote locations and collect them after filling. She shared the files from her mobile device to the concerned employees through the public Internet. An unauthorized user accessed the file in transit, modified the file, and forwarded it to the remote employees.

Based on the above scenario, identify the security risk associated with mobile usage policies.

A.
Lost or stolen devices
A.
Lost or stolen devices
Answers
B.
Infrastructure issues
B.
Infrastructure issues
Answers
C.
Improperly disposing of devices
C.
Improperly disposing of devices
Answers
D.
Sharing confidential data on an unsecured network
D.
Sharing confidential data on an unsecured network
Answers
Suggested answer: D

Explanation:

Sharing confidential data on an unsecured network is a security risk associated with mobile usage policies. Mobile devices are often used to access and transmit sensitive information over public or untrusted networks, such as WiFi hotspots, cellular networks, or Bluetooth connections. This exposes the data to interception, modification, or redirection by malicious actors who may exploit mobile security vulnerabilities or use network-based attacks, such as man-in-the-middle, spoofing, or sniffing. To prevent this risk, mobile users should follow best practices such as using encryption, VPN, certificate pinning, and secure protocols to protect the data in transit. They should also avoid sending or receiving sensitive data over unsecured networks or applications, and verify the identity and integrity of the endpoint servers before establishing a connection.

Reference:

The 9 Most Common Security Threats to Mobile Devices in 2021, Auth0, June 25, 2021

7 Mobile App Security Risks and How to Mitigate Them, Cypress Data Defense, July 10, 2020

The Latest Mobile Security Threats and How to Prevent Them, Security Intelligence, February 19, 2019

Barbara, a security professional, was monitoring the loT traffic through a security solution. She identified that one of the infected devices is trying to connect with other loT devices and spread malware onto the network. Identify the port number used by the malware to spread the infection to other loT devices.

A.
Port 25
A.
Port 25
Answers
B.
Port 443
B.
Port 443
Answers
C.
Port 110
C.
Port 110
Answers
D.
Port 48101
D.
Port 48101
Answers
Suggested answer: D

Explanation:

Port 48101 is the port number used by the malware to spread the infection to other loT devices. This port is associated with the Mirai botnet, which is one of the most notorious loT malware that targets vulnerable loT devices and turns them into a network of bots that can launch distributed denial-of-service (DDoS) attacks. Mirai scans the internet for loT devices that use default or weak credentials and infects them by logging in via Telnet or SSH. Once infected, the device connects to a command and control (C&C) server on port 48101 and waits for instructions. The C&C server can then direct the botnet to attack a target by sending TCP, UDP, or HTTP requests. Mirai has been responsible for some of the largest DDoS attacks in history, such as the one that disrupted Dyn DNS in 2016 and affected major websites like Twitter, Netflix, and Reddit.

Reference:

Mirai (malware), Wikipedia, March 16, 2021

Mirai Botnet: A History of the Largest loT Botnet Attacks, Imperva, December 10, 2020

Mirai Botnet: How loT Devices Almost Brought Down the Internet, Cloudflare, March 17, 2021

Below are the various steps involved in establishing a network connection using the shared key authentication process.

1.The AP sends a challenge text to the station.

2.The station connects to the network.

3.The station encrypts the challenge text using its configured 128-bit key and sends the encrypted text to the AP.

4.The station sends an authentication frame to the AP.

5.The AP uses its configured WEP key to decrypt the encrypted text and compares it with the original challenge text.

What is the correct sequence of steps involved in establishing a network connection using the shared key authentication process?

A.
4 -- >2 -- >1 -- >3 -- >5
A.
4 -- >2 -- >1 -- >3 -- >5
Answers
B.
4 -- >1 -- >3 -- >5 -- >2
B.
4 -- >1 -- >3 -- >5 -- >2
Answers
C.
2 -- >4 -- >5 -- >1 -- >3
C.
2 -- >4 -- >5 -- >1 -- >3
Answers
D.
4 -- >5 -- >3 -- >2 -- >1
D.
4 -- >5 -- >3 -- >2 -- >1
Answers
Suggested answer: B

Explanation:

The correct sequence of steps involved in establishing a network connection using the shared key authentication process is 4 -> 1 -> 3 -> 5 -> 2. This is based on the following description of the shared key authentication process from the Network Defense Essentials courseware:

The station sends an authentication frame to the AP, indicating that it wants to use shared key authentication.

The AP responds with an authentication frame containing a challenge text, which is a random string of bits.

The station encrypts the challenge text using its configured WEP key, which is derived from the shared secret key (password) that is also known by the AP. The station sends the encrypted text back to the AP in another authentication frame.

The AP decrypts the encrypted text using its configured WEP key and compares it with the original challenge text. If they match, the AP sends a positive authentication response to the station. If they do not match, the AP sends a negative authentication response to the station.

The station connects to the network if the authentication is successful.

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-18 to 3-19

Shared Key Authentication - Techopedia, Techopedia, June 15, 2017

Identify the backup mechanism that is performed within the organization using external devices such as hard disks and requires human interaction to perform the backup operations, thus, making it suspectable to theft or natural disasters.

A.
Cloud data backup
A.
Cloud data backup
Answers
B.
Onsite data backup
B.
Onsite data backup
Answers
C.
Offsite data backup
C.
Offsite data backup
Answers
D.
Online data backup
D.
Online data backup
Answers
Suggested answer: B

Explanation:

Onsite data backup is the backup mechanism that is performed within the organization using external devices such as hard disks and requires human interaction to perform the backup operations, thus, making it susceptible to theft or natural disasters. Onsite data backup means storing the backup data on a local storage device, such as an external hard drive, a USB flash drive, a CD/DVD, or a tape drive, that is physically located in the same premises as the original data source. Onsite data backup has some advantages, such as fast backup and restore speed, easy access, and low cost. However, it also has some disadvantages, such as requiring manual intervention, occupying physical space, and being vulnerable to damage, loss, or theft. If a disaster, such as a fire, flood, earthquake, or power outage, occurs in the organization, both the original data and the backup data may be destroyed or inaccessible. Therefore, onsite data backup is not a reliable or secure way to protect the data from unforeseen events.

Reference:

Should I Use an External Hard Drive for Backup in 2024?, Cloudwards, February 8, 2024

How to Back Up a Computer to an External Hard Drive, Lifewire, April 1, 2022

Best Way to Backup Multiple Computers to One External Drive, AOMEI, December 29, 2020

Which of the following types of network traffic flow does not provide encryption in the data transfer process, and the data transfer between the sender and receiver is in plain text?

A.
SSL traffic
A.
SSL traffic
Answers
B.
HTTPS traffic
B.
HTTPS traffic
Answers
C.
SSH traffic
C.
SSH traffic
Answers
D.
FTP traffic
D.
FTP traffic
Answers
Suggested answer: D

Explanation:

FTP traffic does not provide encryption in the data transfer process, and the data transfer between the sender and receiver is in plain text. FTP stands for File Transfer Protocol, and it is a standard network protocol for transferring files between a client and a server over a TCP/IP network. FTP uses two separate channels for communication: a control channel for sending commands and receiving responses, and a data channel for transferring files. However, FTP does not encrypt any of the data that is sent or received over these channels, which means that anyone who can intercept the network traffic can read or modify the contents of the files, as well as the usernames and passwords used for authentication. This poses a serious security risk for the confidentiality, integrity, and availability of the data and the systems involved in the file transfer. Therefore, FTP is not a secure way to transfer sensitive or confidential data over the network.

Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-31 to 3-32

What is FTP, and Why Does It Matter in 2021?, Kinsta, January 4, 2021

FTP Security, Wikipedia, February 9, 2021

Alice was working on her major project; she saved all her confidential files and locked her laptop. Bob wanted to access Alice's laptop for his personal use but was unable to access the laptop due to biometric authentication.

Which of the following network defense approaches was employed by Alice on her laptop?

A.
Retrospective approach
A.
Retrospective approach
Answers
B.
Preventive approach
B.
Preventive approach
Answers
C.
Reactive approach
C.
Reactive approach
Answers
D.
Proactive approach
D.
Proactive approach
Answers
Suggested answer: B

Explanation:

The network defense approach that was employed by Alice on her laptop was the preventive approach. The preventive approach aims to stop or deter potential attacks before they happen by implementing security measures that reduce the attack surface and increase the difficulty of exploitation. Biometric authentication is an example of a preventive measure that uses a physical characteristic, such as a fingerprint, iris, or face, to verify the identity of the user and grant access to the device or system. Biometric authentication is more secure than traditional methods, such as passwords or PINs, because it is harder to forge, guess, or steal. By locking her laptop and using biometric authentication, Alice prevented Bob from accessing her laptop and her confidential files without her permission.

Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 1-7 to 1-8

What is Biometric Authentication?, Norton, July 29, 2020

An introduction to network defense basics, Enable Sysadmin, November 26, 2019

Total 75 questions
Go to page: of 8