31 free EC-Council 212-82 CCT practice questions from the CertStash pack of 125, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 31 free here, all 125 in the pack, and each step includes the one before it.
Get all 125 questions (US$39) · Download the first 10 as a PDF
Question 1
Thomas, an employee of an organization, is restricted to access specific websites from his office system. He is trying to obtain admin credentials to remove the restrictions. While waiting for an opportunity, he sniffed communication between the administrator and an application server to retrieve the admin credentials. Identify the type of attack performed by Thomas in the above scenario.
Show answer and explanation
Correct answer: B. Eavesdropping
Eavesdropping is the unauthorized interception and monitoring of private communications. Thomas sniffed network communication between the administrator and application server to capture admin credentials without authorization, which is a classic eavesdropping attack. This passive interception of transmitted data matches the definition of eavesdropping perfectly.
Why the other options are wrong
- A. Vishing is voice-based social engineering conducted over phone calls, not network sniffing.
- C. Phishing involves deceptive emails or messages to trick users into revealing information, not packet sniffing.
- D. Dumpster diving is physical retrieval of discarded materials, not electronic communication interception.
Question 2
Kayden successfully cracked the final round of interview at an organization. After few days, he received his offer letter through an official company email address. The email stated that the selected candidate should respond within a specified time. Kayden accepted the opportunity and provided e-signature on the offer letter, then replied to the same email address. The company validated the e-signature and added his details to their database. Here, Kayden could not deny company's message, and company could not deny Kayden's signature. Which of the following information security elements was described in the above scenario?
Show answer and explanation
Correct answer: B. Non-repudiation
Non-repudiation ensures that neither party can deny their participation in a transaction. The scenario describes Kayden providing an e-signature on the offer letter and the company validating it, preventing Kayden from denying his signature and the company from denying the original message. The mutual inability to deny actions is the core principle of non-repudiation.
Why the other options are wrong
- A. Availability refers to ensuring systems and data are accessible when needed, not about denial of actions.
- C. Integrity ensures data is not altered and remains consistent, not about denying participation in communications.
- D. Confidentiality protects information from unauthorized access, not about proving who performed actions.
Question 3
Sam, a software engineer, visited an organization to give a demonstration on a software tool that helps in business development. The administrator at the organization created a least privileged account on a system and allocated that system to Sam for the demonstration. Using this account, Sam can only access the files that are required for the demonstration and cannot open any other file in the system. Which of the following type of accounts the organization has given to Sam in the above scenario?
Show answer and explanation
Correct answer: B. Guest account
A guest account is designed for temporary users with limited privileges and access to only specific resources needed for their purpose. The organization created a least privileged account allowing Sam to access only demonstration files, which is the defining characteristic of a guest account used for temporary external visitors.
Why the other options are wrong
- A. Service accounts are used by applications and system services to run background processes, not for temporary user access.
- C. User accounts are standard employee accounts with broader permissions than the restricted access described here.
- D. Administrator accounts have full system privileges, opposite to the least privileged account given to Sam.
Question 4
Myles, a security professional at an organization, provided laptops for all the employees to carry out the business processes from remote locations. While installing necessary applications required for the business, Myles has also installed antivirus software on each laptop following the company's policy to detect and protect the machines from external malicious events over the Internet. Identify the PCI-DSS requirement followed by Myles in the above scenario.
Show answer and explanation
Correct answer: C. PCI-DSS requirement no 5.1
PCI-DSS requirement 5.1 mandates the deployment of anti-malware software on systems exposed to external networks, including laptops used for remote access. Myles installed antivirus software on employee laptops following company policy to protect against malware from internet threats, which directly corresponds to this specific requirement.
Why the other options are wrong
- A. Requirement 1.3.2 relates to firewall configuration and access control lists, not antivirus deployment.
- B. Requirement 1.3.5 addresses rules for inbound traffic filtering, not malware protection software.
- D. Requirement 1.3.1 deals with outbound traffic restrictions, not antivirus installation.
Question 5
Ashton is working as a security specialist in SoftEight Tech. He was instructed by the management to strengthen the Internet access policy. For this purpose, he implemented a type of Internet access policy that forbids everything and imposes strict restrictions on all company computers, whether it is system or network usage. Identify the type of Internet access policy implemented by Ashton in the above scenario.
Show answer and explanation
Correct answer: A. Paranoid policy
A paranoid policy is the most restrictive approach to internet access, forbidding everything by default and allowing only explicitly approved activities. Ashton's implementation of strict restrictions that deny all access unless specifically permitted is the definition of a paranoid Internet access policy.
Why the other options are wrong
- B. A prudent policy is moderate and balanced, permitting safe activities while blocking known threats, not forbidding everything.
- C. A permissive policy allows broad access with few restrictions, the opposite of what Ashton implemented.
- D. A promiscuous policy allows nearly unrestricted access without meaningful controls, contrary to the strict restrictions described.
Question 6
Zion belongs to a category of employees who are responsible for implementing and managing the physical security equipment installed around the facility. He was instructed by the management to check the functionality of equipment related to physical security. Identify the designation of Zion.
Show answer and explanation
Correct answer: D. Safety officer
A safety officer is responsible for implementing, managing, and monitoring physical security measures and equipment at a facility. Zion's role of checking functionality of physical security equipment and being instructed to manage such installations aligns with the duties of a safety officer.
Why the other options are wrong
- A. A supervisor oversees staff and operations but not specifically physical security equipment management.
- B. A Chief Information Security Officer manages information security strategy and risk, not physical security equipment.
- C. A guard performs security patrols and monitoring but does not typically manage or implement security equipment.
Question 7
In an organization, all the servers and database systems are guarded in a sealed room with a single entry point. The entrance is protected with a physical lock system that requires typing a sequence of numbers and letters by using a rotating dial that intermingles with several other rotating discs. Which of the following types of physical locks is used by the organization in the above scenario?
Show answer and explanation
Correct answer: B. Combination locks
Combination locks operate using a rotating dial mechanism with multiple rotating discs that must be set to the correct sequence of numbers and letters to unlock. The description of a rotating dial intermixed with several other rotating discs directly describes the mechanical operation of a combination lock system.
Why the other options are wrong
- A. Digital locks use electronic components and keypads, not rotating mechanical dials.
- C. Mechanical locks refer to traditional pin and tumbler systems, not rotating dial mechanisms.
- D. Electromagnetic locks use electric current to secure doors, not rotating dial sequences.
Question 8
Lorenzo, a security professional in an MNC, was instructed to establish centralized authentication, authorization, and accounting for remote-access servers. For this purpose, he implemented a protocol that is based on the client-server model and works at the transport layer of the OSI model. Identify the remote authentication protocol employed by Lorenzo in the above scenario.
Show answer and explanation
Correct answer: B. RADIUS
RADIUS (Remote Authentication Dial-In User Service) is a client-server authentication protocol that operates at the transport layer (Layer 4) of the OSI model and provides centralized authentication, authorization, and accounting for remote access. It is the standard protocol for these three functions in remote access scenarios.
Why the other options are wrong
- A. SNMPv3 is a network management protocol, not a remote authentication protocol for user access.
- C. POP3S is an email protocol for retrieving messages, not a remote access authentication system.
- D. IMAPS is an email protocol for accessing mailboxes, not designed for centralized remote authentication.
Question 9
Malachi, a security professional, implemented a firewall in his organization to trace incoming and outgoing traffic. He deployed a firewall that works at the session layer of the OSI model and monitors the TCP handshake between hosts to determine whether a requested session is legitimate. Identify the firewall technology implemented by Malachi in the above scenario.
Show answer and explanation
Correct answer: B. Circuit-level gateways
Circuit-level gateways operate at the session layer (Layer 5) of the OSI model and monitor TCP/UDP handshakes to establish legitimate sessions between hosts. They track the state of connections and make allow/deny decisions based on whether the session establishment appears legitimate, which matches Malachi's implementation exactly.
Why the other options are wrong
- A. Next generation firewalls operate at higher layers and provide additional functionality like deep packet inspection and application-layer filtering, beyond just session monitoring.
- C. Network address translation translates IP addresses but does not specifically monitor or validate the TCP handshake process at the session layer.
- D. Packet filtering operates at the network layer (Layer 3) and examines individual packets, not the session-layer handshake process.
Question 10
Rhett, a security professional at an organization, was instructed to deploy an IDS solution on their corporate network to defend against evolving threats. For this purpose, Rhett selected an IDS solution that first creates models for possible intrusions and then compares these models with incoming events to make detection decisions. Identify the detection method employed by the IDS solution in the above scenario.
Show answer and explanation
Correct answer: D. Signature recognition
Signature recognition, also called misuse detection, works by first building models of possible intrusions and then comparing incoming events against those models to reach a detection decision. That is precisely the process Rhett's IDS follows, so the detection method is signature recognition. Anomaly-based approaches work the other way round, profiling normal activity and alerting on deviations from that baseline.
Why the other options are wrong
- A. Not-use detection is the alternate name for anomaly detection, which profiles normal system and user behavior instead of modeling intrusions.
- B. Protocol anomaly detection flags traffic that violates the specifications and expected structure of a protocol, not events matched against intrusion models.
- C. Anomaly detection builds a baseline of normal behavior and reports deviations from it, the reverse of modeling possible intrusions and matching events to them.
What people say about the full 212-82 pack 5.0 from 1
I took the ECCouncil 212-82 exam yesterday and passed with 93%.
Question 11
At CyberGuard Corp, an industry-leading cybersecurity consulting firm, you are the Principal Incident Responder known for your expertise in dealing with high-profile cyber breaches. Your team primarily serves global corporations, diplomatic entities, and agencies with sensitive national importance. One day, you receive an encrypted, anonymous email indicating a potential breach at WorldBank Inc., a renowned international banking consortium, and one of your prime clients. The email contains hashed files, vaguely hinting at financial transactions of high-net-worth individuals. Initial assessments indicate this might be an advanced persistent threat (APT), likely a state-sponsored actor, given the nature and precision of the data extracted. While preliminary indications point towards a potential zero-day exploit, your team must dive deep into forensics to ascertain the breach’s origin, assess the magnitude, and promptly respond. Given the highly sophisticated nature of this attack and potential geopolitical ramifications, what advanced methodology should you prioritize to dissect this cyber intrusion meticulously?
Show answer and explanation
Correct answer: D. Utilize advanced sandboxing techniques to safely examine the behavior of potential zero-day exploits in the hashed files, gauging any unusual system interactions and network communications.
Given the indication of potential zero-day exploits in this sophisticated APT scenario, utilizing advanced sandboxing techniques is the most appropriate priority. Sandboxing allows safe examination of the hashed files and any suspicious code in an isolated environment, enabling observation of malware behavior, system interactions, and network communications without risking the production environment. This methodology is essential for understanding zero-day vulnerabilities and their exploitation mechanisms before conducting broader forensic analysis.
Why the other options are wrong
- A. While log analysis is important, it comes after understanding the zero-day threat itself; the email hints at zero-day exploits which must be analyzed safely first.
- B. Heuristics and threat-hunting are valuable but secondary to safely examining the actual zero-day exploit in the provided files.
- C. Consulting external alliances is useful for attribution but does not directly address the immediate need to understand the zero-day exploit's mechanics.
Question 12
Richards, a security specialist at an organization, was monitoring an IDS system. While monitoring, he suddenly received an alert of an ongoing intrusion attempt on the organization's network. He immediately averted the malicious actions by implementing the necessary measures. Identify the type of alert generated by the IDS system in the above scenario.
Show answer and explanation
Correct answer: A. True positive
A true positive alert occurs when the IDS correctly identifies an actual intrusion or malicious activity. Richards received an alert about a genuine intrusion attempt and successfully implemented measures to stop it, confirming the alert was accurate and the threat was real.
Why the other options are wrong
- B. A true negative represents the system correctly identifying that no intrusion is occurring, which is not what happened here.
- C. A false negative occurs when the system fails to detect an actual intrusion, but here the intrusion was detected and stopped.
- D. A false positive occurs when the system generates an alert for something that is not actually malicious, but the threat in this scenario was real.
Question 13
Hayes, a security professional, was tasked with the implementation of security controls for an industrial network at the Purdue level 3.5 (IDMZ). Hayes verified all the possible attack vectors on the IDMZ level and deployed a security control that fortifies the IDMZ against cyber-attacks. Identify the security control implemented by Hayes in the above scenario.
Show answer and explanation
Correct answer: C. Anti-DoS solution
An Anti-DoS (Anti-Denial of Service) solution is the appropriate security control for protecting the IDMZ (Industrial De-Militarized Zone) at Purdue level 3.5. The IDMZ is the critical interface between corporate networks and industrial control systems, making it a primary target for denial-of-service attacks. Anti-DoS solutions mitigate volumetric and protocol-based attacks that could compromise the integrity and availability of industrial operations.
Why the other options are wrong
- A. Point-to-point communication is a network topology configuration, not a security control that addresses attack vectors or fortifies against cyber-attacks.
- B. MAC authentication is a data link layer security mechanism that is insufficient as a comprehensive security control for an industrial DMZ facing multiple attack vectors.
- D. Authorized RTU and PLC commands is an application-level control that validates legitimate industrial device commands but does not address network-level attacks like DoS attacks.
Question 14
A web application www.movieabc.com was found to be prone to SQL injection attack. You are given a task to exploit the web application and fetch the user credentials. Select the UID which is mapped to user john in the database table. Note: Username: sam Pass: test
Show answer and explanation
Correct answer: D. 4
In a SQL injection attack on a web application, an attacker can craft malicious SQL queries to extract user credentials from the database. By manipulating input fields with SQL syntax, the attacker can retrieve specific user records. When querying for the user 'john' in the database table, the UID value 4 is the correct identifier mapped to that username in the vulnerable application's database.
Why the other options are wrong
- A. UID 5 does not correspond to the john user account
- B. UID 3 is mapped to a different user in the database
- C. UID 2 does not belong to the john user record
Question 15
An organization hired a network operations center (NOC) team to protect its IT infrastructure from external attacks. The organization utilized a type of threat intelligence to protect its resources from evolving threats. The threat intelligence helped the NOC team understand how attackers are expected to perform an attack on the organization, identify the information leakage, and determine the attack goals as well as attack vectors. Identify the type of threat intelligence consumed by the organization in the above scenario.
Show answer and explanation
Correct answer: D. Tactical threat intelligence
Tactical threat intelligence provides information about specific attack methodologies, attack vectors, and how attackers are expected to execute attacks. It helps organizations understand attack techniques, identify information leakage points, determine attacker goals, and recognize attack vectors; all components explicitly mentioned in the scenario.
Why the other options are wrong
- A. Operational threat intelligence focuses on the details of specific ongoing attacks or incidents, not general attack patterns and methodologies.
- B. Strategic threat intelligence provides high-level information for executives about general threat landscapes and business implications, not specific attack methods.
- C. Technical threat intelligence consists of indicators of compromise like IP addresses and file hashes used for detection, not understanding attack methodologies and vectors.
Question 16
Anderson, a security engineer, was Instructed to monitor all incoming and outgoing traffic on the organization's network to identify any suspicious traffic. For this purpose, he employed an analysis technique using which he analyzed packet header fields such as IP options, IP protocols, IP fragmentation flags, offset, and identification to check whether any fields are altered in transit. Identify the type of attack signature analysis performed by Anderson in the above scenario.
Show answer and explanation
Correct answer: A. Context-based signature analysis
Context-based signature analysis examines packet header fields and their properties to detect anomalies or attacks. Anderson is analyzing IP options, IP protocols, fragmentation flags, offset, and identification fields to determine if they have been altered in transit. This analysis of contextual header information without examining the full packet content or composite patterns is characteristic of context-based analysis.
Why the other options are wrong
- B. Atomic-signature-based analysis focuses on single, isolated events rather than analyzing multiple header fields and their relationships.
- C. Composite-signature-based analysis examines sequences of multiple events or patterns across several packets, not individual header field analysis.
- D. Content-based signature analysis examines the payload content of packets rather than just the header fields and their metadata.
Question 17
Andre, a security professional, was tasked with segregating the employees' names, phone numbers, and credit card numbers before sharing the database with clients. For this purpose, he implemented a deidentification technique that can replace the critical information in database fields with special characters such as asterisks (*) and hashes (#). Which of the following techniques was employed by Andre in the above scenario?
Show answer and explanation
Correct answer: B. Masking
Masking is the deidentification technique employed by Andre. Data masking replaces sensitive information in database fields with special characters such as asterisks (*), hashes (#), or other placeholder characters. This technique obscures the original data while maintaining the same data structure, making it suitable for sharing databases with clients while protecting personally identifiable information and financial details.
Why the other options are wrong
- A. Tokenization replaces sensitive data with randomly generated tokens that map to the original data stored in a secure token vault, rather than replacing data with special characters.
- C. Hashing is a one-way cryptographic function that creates a fixed-length hash value from data; it is used for verification and integrity checking, not for masking sensitive fields with special characters.
- D. Bucketing is a data aggregation technique that groups data into ranges or categories for statistical analysis, not a deidentification technique for replacing individual data elements.
Question 18
Karter, a security professional, deployed a honeypot on the organization's network for luring attackers who attempt to breach the network. For this purpose, he configured a type of honeypot that simulates a real OS as well as applications and services of a target network. Furthermore, the honeypot deployed by Karter only responds to preconfigured commands. Identify the type of Honeypot deployed by Karter in the above scenario.
Show answer and explanation
Correct answer: C. Medium-interaction honeypot
Medium-interaction honeypots simulate real operating systems and applications while only responding to a limited set of preconfigured commands and interactions. They provide more realism than low-interaction honeypots but less full functionality than high-interaction honeypots, matching Karter's deployment that simulates OS and services but only responds to preconfigured commands.
Why the other options are wrong
- A. Low-interaction honeypots provide minimal simulation and limited functionality, not the realistic OS and application simulation described.
- B. Pure honeypots are actual production systems that do nothing but collect attack data, not simulated environments.
- D. High-interaction honeypots provide full functionality of real systems with minimal restrictions, allowing extensive interaction beyond preconfigured commands.
Question 19
Grace, an online shopping freak, has purchased a smart TV using her debit card. During online payment, Grace's browser redirected her from ecommerce website to a third-party payment gateway, where she provided her debit card details and OTP received on her registered mobile phone. After completing the transaction, Grace navigated to her online bank account and verified the current balance in her savings account. Identify the state of data when it is being processed between the ecommerce website and the payment gateway in the above scenario.
Show answer and explanation
Correct answer: C. Data in transit
Data in transit refers to data being transmitted across a network between two systems. In the scenario, Grace's debit card details and OTP are being transmitted from her browser to the third-party payment gateway. This data movement across the network represents data in transit, which is why encryption and secure transport protocols (like HTTPS/TLS) are essential to protect sensitive information during this phase.
Why the other options are wrong
- A. Data at rest refers to data stored in databases, files, or storage media that are not actively moving across networks.
- B. This is not one of the three recognised states of data, which are at rest, in transit and in use.
- D. Data in use refers to data actively being processed in memory by applications or systems, not data being transmitted between systems.
Question 20
Tenda, a network specialist at an organization, was examining logged data using Windows Event Viewer to identify attempted or successful unauthorized activities. The logs analyzed by Tenda include events related to Windows security; specifically, log-on/log-off activities, resource access, and also information based on Windows system's audit policies. Identify the type of event logs analyzed by Tenda in the above scenario.
Show answer and explanation
Correct answer: C. Security event log
The Security event log in Windows Event Viewer records security-related events including logon and logoff activities, resource access attempts, and audit policy-based events. This log is specifically used for tracking unauthorized access attempts and monitoring security events based on the system's audit policies.
Why the other options are wrong
- A. Application event log records events from installed applications and services, not security-specific logon, logoff, or resource access events.
- B. Setup event log tracks installation and configuration of Windows components, not user authentication or security activities.
- D. System event log records system-level events and errors from Windows components, not security-specific audit events like logon activities.
Question 21
Leo has walked to the nearest supermarket to purchase grocery. At the billing section, the billing executive scanned each product's machine-readable tag against a readable machine that automatically reads the product details, displays the prices of the individual product on the computer, and calculates the sum of those scanned items. Upon completion of scanning all the products, Leo has to pay the bill. Identify the type of short-range wireless communication technology that the billing executive has used in the above scenario.
Show answer and explanation
Correct answer: D. QR codes and barcodes
In the given scenario, the billing executive scans a machine-readable tag on each product to retrieve its price and details, which is the classic function of barcode (and QR code) technology. According to the EC-Council CCT courseware, QR codes and barcodes are categorized as short-range wireless communication technologies used for automatic identification, where a scanner reads the encoded pattern on a product's tag and retrieves the associated data from a database. This matches exactly with the supermarket billing process described, making D the correct choice.
Why the other options are wrong
- A. RFID uses embedded chips and radio waves for identification, not the visual scanning of printed tags as described in the scenario.
- B. NFC involves close-proximity wireless data exchange between electronic devices, which is not what occurs when a static printed tag is optically scanned.
- C. QUIC is a transport layer network protocol used for internet communications, unrelated to physical product scanning at a billing counter.
Question 22
Walker, a security team member at an organization, was instructed to check if a deployed cloud service is working as expected. He performed an independent examination of cloud service controls to verify adherence to standards through a review of objective evidence. Further, Walker evaluated the services provided by the CSP regarding security controls, privacy impact, and performance. Identify the role played by Walker in the above scenario.
Show answer and explanation
Correct answer: A. Cloud auditor
Walker is performing the role of a cloud auditor. Cloud auditors conduct independent examinations of cloud service controls, verify adherence to standards, review objective evidence, and evaluate services provided by cloud service providers regarding security controls, privacy impact, and performance. This third-party assessment and verification function defines the cloud auditor role within the cloud computing ecosystem.
Why the other options are wrong
- B. Cloud provider delivers cloud services and manages infrastructure, not conducts independent audits of their own services.
- C. Cloud carrier provides connectivity and network services between cloud providers and consumers, not audits cloud services.
- D. Cloud consumer uses cloud services and may request audits but does not perform independent examinations to verify service provider adherence to standards.
Question 23
Arabella, a forensic officer, documented all the evidence related to the case in a standard forensic investigation report template. She filled different sections of the report covering all the details of the crime along with the daily progress of the investigation process. In which of the following sections of the forensic investigation report did Arabella record the "nature of the claim and information provided to the officers"?
Show answer and explanation
Correct answer: A. Investigation process
The Investigation Process section of a standard forensic investigation report captures the chronological account of the case, including the date and time the allegation was raised, the identity of the person who made the claim, and the nature of the claim along with the information initially provided to the investigating officers. This section establishes the foundation of how the investigation began and documents the early details that prompted the forensic response, making it the correct location for recording the nature of the claim and the information given to officers.
Why the other options are wrong
- B. Investigation objectives outlines the goals and scope of the forensic investigation, not the initial claim details.
- C. Evidence information documents the specifics of collected evidence such as type, location, and chain of custody, not the nature of the original claim.
- D. Evaluation and analysis process describes the methods and findings from analyzing the evidence, not the initial report of the claim.
Question 24
Ryleigh, a system administrator, was instructed to perform a full back up of organizational data on a regular basis. For this purpose, she used a backup technique on a fixed date when the employees are not accessing the system i.e., when a service-level down time is allowed a full backup is taken. Identify the backup technique utilized by Ryleigh in the above scenario.
Show answer and explanation
Correct answer: B. Cold backup
Cold backup is the backup technique utilized by Ryleigh. Cold backup involves taking a full backup of organizational data during scheduled downtime when the system is offline or when service-level downtime is allowed and employees are not accessing the system. This ensures a complete and consistent snapshot of all data without the risk of data changes occurring during the backup process.
Why the other options are wrong
- A. Nearline backup refers to data stored on media that is readily accessible but not immediately online, such as tape storage in a nearby facility.
- C. Hot backup is performed while the system is running and users are actively accessing it, requiring specialized techniques to capture a consistent state.
- D. Warm backup is performed when the system is partially operational or in a standby state, not during complete service-level downtime as described.
Question 25
An attacker with malicious intent used SYN flooding technique to disrupt the network and gain advantage over the network to bypass the Firewall. You are working with a security architect to design security standards and plan for your organization. The network traffic was captured by the SOC team and was provided to you to perform a detailed analysis. Study the Synflood.pcapng file and determine the source IP address. Note: Synflood.pcapng file is present in the Documents folder of Attacker-1 machine.
Show answer and explanation
Correct answer: B. 20.20.10.19
Analyzing the Synflood.pcapng file captured by the SOC team reveals the source IP address conducting the SYN flooding attack. By examining the packet capture file in the Documents folder of Attacker-1 machine, the source IP address of the attacker performing the SYN flooding technique is identified as 20.20.10.19.
Why the other options are wrong
- A. 20.20.10.180 is not the source IP address of the SYN flood attack.
- C. 20.20.10.60 is not the source IP address of the SYN flood attack.
- D. 20.20.10.59 is not the source IP address of the SYN flood attack.
Question 26
An FTP server has been hosted in one of the machines in the network. Using Cain and Abel the attacker was able to poison the machine and fetch the FTP credentials used by the admin. You're given a task to validate the credentials that were stolen using Cain and Abel and read the file flag.txt
Show answer and explanation
Correct answer: C. hat@red
After using Cain and Abel to poison the network and extract FTP credentials, the stolen credentials are validated and used to access the FTP server. Reading the flag.txt file on the server yields the credential 'hat@red', which represents the compromised FTP username or authentication identifier that was captured during the attack.
Why the other options are wrong
- A. white@hat is not the correct credential extracted from the FTP server.
- B. red@hat is not the correct credential extracted from the FTP server.
- D. blue@hat is not the correct credential extracted from the FTP server.
Question 27
You have been assigned to perform banner grabbing on a website, www.royalhotels.com. Perform banner grabbing on the target website and identify the website’s ETag. (Practical Question)
Show answer and explanation
Correct answer: A. 5162fadc8577d61:1
Banner grabbing on www.royalhotels.com reveals the ETag header value. The ETag (entity tag) is an HTTP response header that identifies a specific version of a resource and is commonly returned during banner grabbing operations. The correct ETag for this target website is 5162fadc8577d61:1.
Why the other options are wrong
- B. The ETag value ends in :1, not :b.
- C. The ETag value ends in :1, not :0.
- D. The ETag value ends in :1, not :z.
Question 28
A threat intelligence feed data file has been acquired and stored in the Documents folder of Attacker Machine-1 (File Name: Threatfeed.txt). You are a cybersecurity technician working for an ABC organization. Your organization has assigned you a task to analyze the data and submit a report on the threat landscape. Select the IP address linked with http://securityabc.s21sec.com.
Show answer and explanation
Correct answer: D. 5.9.188.148
When analyzing threat intelligence feed data from the Threatfeed.txt file, the correlation between domain names and their associated IP addresses must be carefully matched. The domain http://securityabc.s21sec.com is linked to the IP address 5.9.188.148 according to the threat intelligence data stored in the file. This mapping represents the identified relationship between the malicious or monitored domain and its hosting infrastructure.
Why the other options are wrong
- A. 5.9.200.200 is associated with a different domain in the threat feed
- B. 5.9.200.150 does not correspond to the securityabc.s21sec.com domain
- C. 5.9.110.120 is mapped to another domain in the threat intelligence data
Question 29
Tristan, a professional penetration tester, was recruited by an organization to test its network infrastructure. The organization wanted to understand its current security posture and its strength in defending against external threats. For this purpose, the organization did not provide any information about their IT infrastructure to Tristan. Thus, Tristan initiated zero-knowledge attacks, with no information or assistance from the organization. Which of the following types of penetration testing has Tristan initiated in the above scenario?
Show answer and explanation
Correct answer: A. Black-box testing
Black-box testing is conducted with zero knowledge of the target system; the penetration tester receives no information or assistance from the organization. Tristan was provided no information about the organization's IT infrastructure and initiated testing with zero knowledge, which is the definition of black-box penetration testing.
Why the other options are wrong
- B. White-box testing provides complete knowledge and full information about the target systems to the penetration tester.
- C. Gray-box testing provides partial information about the target systems, not zero information as described.
- D. Translucent-box testing is not a recognized penetration testing methodology.
Question 30
A pfSense firewall has been configured to block a web application www.abchacker.com. Perform an analysis on the rules set by the admin and select the protocol which has been used to apply the rule. Hint: Firewall login credentials are given below: • Username: admin • Password: admin@l23
Show answer and explanation
Correct answer: B. TCP/UDP
Log in to the pfSense web interface with the given credentials and open Firewall > Rules. The rule blocking www.abchacker.com has its Protocol field set to TCP/UDP, so it matches the site's TCP web traffic on ports 80 and 443 as well as any UDP traffic to it, such as QUIC.
Why the other options are wrong
- A. POP3 is an email retrieval protocol and is not the protocol set on the blocking rule.
- C. FTP is a file transfer protocol and is not the protocol set on the blocking rule.
- D. ARP resolves IP addresses to MAC addresses on the local network and is not the protocol set on the blocking rule.
Question 31
Rickson, a security professional at an organization, was instructed to establish short-range communication between devices within a range of 10 cm. For this purpose, he used a mobile connection method that employs electromagnetic induction to enable communication between devices. The mobile connection method selected by Rickson can also read RFID tags and establish Bluetooth connections with nearby devices to exchange information such as images and contact lists. Which of the following mobile connection methods has Rickson used in above scenario?
Show answer and explanation
Correct answer: A. NFC
NFC (Near Field Communication) is the mobile connection method used by Rickson. NFC operates at short range (typically up to 10 cm), uses electromagnetic induction for communication between devices, can read RFID tags, and can establish connections with nearby devices to exchange information such as images and contact lists. NFC is specifically designed for short-range, close-proximity wireless communication and data exchange.
Why the other options are wrong
- B. Satcom (satellite communication) operates over long distances via satellites, not in 10 cm range for short-range device communication.
- C. Cellular communication operates over large geographic areas through cellular networks, not for short-range 10 cm communication.
- D. ANT is a wireless protocol for personal area networks, but it does not use electromagnetic induction and is not designed for RFID tag reading and Bluetooth connections.
That was 31 of 125.
The full EC-Council 212-82 CCT pack has all 125 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 62 free as one PDF by email. Get the Half Pack →