312-50

312-50 practice questions, page 20 of 25, with answer review and explanations.

Question 96

When an alert rule is matched in a network-based IDS like snort, the IDS does which of the following?

  1. Drops the packet and moves on to the next one
  2. Continues to evaluate the packet until all rules are checked
  3. Stops checking rules, sends an alert, and lets the packet continue
  4. Blocks the connection with the source IP address in the packet

Question 97

Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them?

  1. Detective
  2. Passive
  3. Intuitive
  4. Reactive B

Question 98

An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the following is the most likely reason for lack of management or control packets?

  1. The wireless card was not turned on.
  2. The wrong network card drivers were in use by Wireshark.
  3. On Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
  4. Certain operating systems and adapters do not collect the management or control packets.

Question 99

From the two screenshots below, which of the following is occurring?

  1. 10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
  2. 10.0.0.253 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.
  3. 10.0.0.2 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
  4. 10.0.0.252 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.

Question 100

Pentest results indicate that voice over IP traffic is traversing a network. Which of the following tools will decode a packet capture and extract the voice conversations?

  1. Cain
  2. John the Ripper
  3. Nikto
  4. Hping