Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-50

EC-Council 312-50 Exam Questions
Ethical Hacker Certified (Page 8 )

Updated On: 17-Feb-2026
Page 8 of 154
PDF with 765 Questions

Bill has started to notice some slowness on his network when trying to update his company’s website while trying to access the website from the Internet. Bill asks the help desk manager if he has received any calls about slowness from the end users, but the help desk manager says that he has not. Bill receives a number of calls from customers that can’t access the company website and can’t purchase anything online. Bill logs on to a couple of this routers and notices that the logs shows network traffic is at all time high. He also notices that almost all the traffic is originating from a specific address.
Bill decides to use Geotrace to find out where the suspect IP is originates from. The Geotrace utility runs a traceroute and finds that IP is coming from PanamA. Bill knows that none of his customers are in Panama so he immediately thinks that his company is under a Denial of Service attack. Now Bill needs to find out more about the originating IP Address. What Internet registry should Bill look in to find the IP Address?

  1. LACNIC
  2. ARIN
  3. RIPELACNIC
  4. APNIC

Answer(s): A

Explanation:

LACNIC is the Latin American and Caribbean Internet Addresses Registry that administers IP addresses, autonomous system numbers, reverse DNS, and other network resources for that region.



System Administrators sometimes post questions to newsgroups when they run into technical challenges. As an ethical hacker, you could use the information in newsgroup posting to glean insight into the makeup of a target network. How would you search for these posting using Google search?

  1. Search in Google using the key strings “the target company” and “newsgroups”
  2. Search for the target company name at http://groups.google.com
  3. Use NNTP websites to search for these postings
  4. Search in Google using the key search strings “the target company” and “forums”

Answer(s): B

Explanation:

Using http://groups.google.com is the easiest way to access various newsgroups today. Before http://groups.google.com you had to use special NNTP clients or subscribe to some nntp to web services.



Which of the following activities would not be considered passive footprinting?

  1. Search on financial site such as Yahoo Financial
  2. Perform multiple queries through a search engine
  3. Scan the range of IP address found in their DNS database
  4. Go through the rubbish to find out any information that might have been discarded

Answer(s): C

Explanation:

Passive footprinting is a method in which the attacker never makes contact with the target. Scanning the targets IP addresses can be logged at the target and therefore contact has been made.



You are footprinting the www.xsecurity.com domain using the Google Search Engine. You would like to determine what sites link to www.xsecurity .com at the first level of revelance. Which of the following operator in Google search will you use to achieve this?

  1. Link: www.xsecurity.com
  2. serch?l:www.xsecurity.com
  3. level1.www.security.com
  4. pagerank:www.xsecurity.com

Answer(s): A

Explanation:

The query [link:] will list webpages that have links to the specified webpage. For instance, [link:www.google.com] will list webpages that have links pointing to the Google homepage. Note there can be no space between the "link:" and the web page url.



Doug is conducting a port scan of a target network. He knows that his client target network has a web server and that there is a mail server also which is up and running. Doug has been sweeping the network but has not been able to elicit any response from the remote target. Which of the following could be the most likely cause behind this lack of response? Select 4.

  1. UDP is filtered by a gateway
  2. The packet TTL value is too low and cannot reach the target
  3. The host might be down
  4. The destination network might be down
  5. The TCP windows size does not match
  6. ICMP is filtered by a gateway

Answer(s): A,B,C,F

Explanation:

If the destination host or the destination network is down there is no way to get an answer and if TTL (Time To Live) is set too low the UDP packets will “die” before reaching the host because of too many hops between the scanning computer and the target. The TCP receive window size is the amount of received data (in bytes) that can be buffered during a connection. The sending host can send only that amount of data before it must wait for an acknowledgment and window update from the receiving host and ICMP is mainly used for echo requests and not in port scans.






Post your Comments and Discuss EC-Council 312-50 exam dumps with other Community members:

Join the 312-50 Discussion