Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-50

EC-Council 312-50 Exam Questions
Ethical Hacker Certified (Page 9 )

Updated On: 10-Mar-2026
Page 9 of 154
PDF with 765 Questions

Exhibit:

Joe Hacker runs the hping2 hacking tool to predict the target host’s sequence numbers in one of the hacking session.
What does the first and second column mean? Select two.

  1. The first column reports the sequence number
  2. The second column reports the difference between the current and last sequence number
  3. The second column reports the next sequence number
  4. The first column reports the difference between current and last sequence number

Answer(s): A,B



While performing a ping sweep of a subnet you receive an ICMP reply of Code 3/Type 13 for all the pings sent out. What is the most likely cause behind this response?

  1. The firewall is dropping the packets.
  2. An in-line IDS is dropping the packets.
  3. A router is blocking ICMP.
  4. The host does not respond to ICMP packets.

Answer(s): C

Explanation:

Type 3 message = Destination Unreachable [RFC792], Code 13 (cause) = Communication Administratively Prohibited [RFC1812]



The following excerpt is taken from a honeyput log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. Study the log given below and answer the following questions:
(Note: The objective of this question is to test whether the student has learnt about
passive OS fingerprinting (which should tell them the OS from log captures): can they tell a SQL injection attack signature; can they infer if a user ID has been created by an attacker and whether they can read plain source – destination entries from log entries.)


What can you infer from the above log?

  1. The system is a windows system which is being scanned unsuccessfully.
  2. The system is a web application server compromised through SQL injection.
  3. The system has been compromised and backdoored by the attacker.
  4. The actual IP of the successful attacker is 24.9.255.53.

Answer(s): A



Bob has been hired to perform a penetration test on ABC.com. He begins by looking at IP address ranges owned by the company and details of domain name registration. He then goes to News Groups and financial web sites to see if they are leaking any sensitive information of have any technical details online.
Within the context of penetration testing methodology, what phase is Bob involved with?

  1. Passive information gathering
  2. Active information gathering
  3. Attack phase
  4. Vulnerability Mapping

Answer(s): A

Explanation:

He is gathering information and as long as he doesn’t make contact with any of the targets systems, he is considered gathering this information in a passive mode.



Which of the following would be the best reason for sending a single SMTP message to an address that does not exist within the target company?

  1. To create a denial of service attack.
  2. To verify information about the mail administrator and his address.
  3. To gather information about internal hosts used in email treatment.
  4. To gather information about procedures that are in place to deal with such messages.

Answer(s): C

Explanation:

The replay from the email server that states that there is no such recipient will also give you some information about the name of the email server, versions used and so on.



Viewing page 9 of 154
Viewing questions 41 - 45 out of 765 questions



Post your Comments and Discuss EC-Council 312-50 exam dumps with other Community members:

312-50 Exam Discussions & Posts

AI Tutor