312-50 exam dumps: questions 101 to 200 of 473

Correct answer: A

• A. Correct.

  Correct. ike-scan is a well-known enumeration tool for IKE/IPsec that can identify supported security associations, vendor identifiers, and whether a responder supports aggressive mode. In environments using IKEv1 aggressive mode with PSK authentication, captured handshake data can be analyzed offline to assess weak PSK exposure without repeatedly guessing against the live service. This is aligned with a low-impact enumeration approach during an authorized assessment.

• B. Incorrect.

  Incorrect. SNMP may expose useful configuration information if it is enabled and misconfigured, but brute-forcing SNMP community strings is a different attack path and does not directly validate whether the IPsec service itself is vulnerable to offline PSK attacks. In many cases, the VPN gateway will not expose the pre-shared key via SNMP even if SNMP is accessible. This option confuses management-plane weaknesses with IPsec enumeration.

• C. Incorrect.

  Incorrect. rpcinfo is used to query RPC services, typically on Unix-like systems running portmapper/rpcbind, to enumerate registered RPC programs and versions. It has no role in identifying IKE transforms, aggressive mode behavior, or PSK policy on an IPsec gateway. This distractor reflects confusion between RPC enumeration and IPsec enumeration techniques.

• D. Incorrect.

  Incorrect. SIP OPTIONS and REGISTER are VoIP-related methods used to enumerate SIP endpoints, user agents, or registrar behavior. They do not provide reliable evidence about IPsec pre-shared key strength or IKE negotiation settings. This option incorrectly mixes VoIP enumeration techniques with VPN/IPsec assessment objectives.

Correct answer: A

• A. Correct.

  Correct. rpcinfo is specifically designed to query rpcbind/portmapper on systems exposing RPC services. In a scenario where TCP 111 is open, rpcinfo can enumerate registered RPC program numbers, versions, protocols, and mapped ports. This is a standard and non-exploitative enumeration step for identifying services such as mountd, nlockmgr, status, and NFS-related daemons that may be listening on dynamic high ports.

• B. Incorrect.

  Incorrect. SIP OPTIONS is used in VoIP enumeration to identify SIP endpoints, capabilities, or PBX behavior, typically on SIP services such as UDP/TCP 5060 or 5061. It is not relevant to enumerating RPC services exposed through rpcbind on TCP 111. This distractor reflects confusion between VoIP enumeration and RPC enumeration.

• C. Incorrect.

  Incorrect. ike-scan is used for IPsec/IKE enumeration, typically against UDP 500 and sometimes UDP 4500 for NAT-T, to identify VPN gateways, IKE versions, and certain policy details. It does not query RPC portmapper services and cannot enumerate RPC program registrations on TCP 111. The mention of pre-shared keys is also misleading because ike-scan does not simply retrieve PSKs from a compliant target.

• D. Incorrect.

  Incorrect. SNMP walk can enumerate management information only if SNMP is enabled and accessible on UDP 161 with a valid community string or credentials. It does not directly query rpcbind to list RPC program mappings. While SNMP may reveal host configuration in some environments, it is not the most appropriate next step for RPC-specific enumeration in this scenario.

Correct answers: A, C

• A. Correct.

  Correct. Telnet transmits session data, including usernames and passwords, in plaintext and provides no built-in encryption. On an internal network or across a WAN, this makes credential interception straightforward for an attacker with packet-capture capability or a position on the path. In practice, secure administration should use SSH instead of Telnet.

• B. Incorrect.

  Incorrect. BGP does have well-known security concerns, and IPv6 does not inherently make it secure. However, the key issue in the scenario is 'lack of built-in confidentiality or authentication in the protocol itself' leading to immediate exposure like sniffable credentials or trivial unauthenticated changes. Standard BGP sessions typically rely on TCP and can be protected with mechanisms such as MD5/TCP-AO, GTSM, prefix filtering, and route-policy controls. The protocol is not typically used for interactive credential exchange in the way Telnet is.

• C. Correct.

  Correct. TFTP is intentionally simple and does not provide authentication, encryption, or robust access controls. If router configuration backups are stored or retrieved via TFTP, an attacker who can reach the service may be able to read sensitive configuration files or potentially upload malicious ones, depending on server configuration. This is a classic weakness in legacy network management environments.

• D. Incorrect.

  Incorrect. SMB has had significant historical vulnerabilities, but 'authenticated SMB' is not inherently insecure purely because of the protocol in the same way Telnet or TFTP are. Modern SMB versions support authentication, message signing, and in some cases encryption. The presence of an authenticated SMB share alone does not automatically indicate a lack of built-in confidentiality or authentication.

• E. Incorrect.

  Incorrect. Anonymous FTP is a security concern because it can expose files to unauthorized users and classic FTP does not encrypt traffic. However, in this scenario the strongest protocol-level weakness tied specifically to unauthorized configuration handling and lack of built-in authentication is TFTP, while the clearest credential-exposure issue is Telnet. Anonymous FTP may be risky depending on what firmware is hosted, but it is not as immediately severe as Telnet credential disclosure or unauthenticated TFTP access to configurations.

Correct answer: B

• A. Incorrect.

  Anonymous FTP is a legitimate security concern because it can expose or permit transfer of files depending on server configuration. However, FTP access to a Linux server does not directly imply the ability to alter a router's BGP table. That would require access to the router itself or to a management workflow that imports files from that FTP server. The option overstates FTP's impact and incorrectly assumes direct BGP manipulation.

• B. Correct.

  This is the best answer. TFTP provides no authentication and no encryption, and many network devices historically use it for configuration backup and restore. If a router is reachable over the local IPv6 segment and accepts TFTP-based config operations, an attacker may be able to retrieve the current configuration, learn credentials or routing policy details, or replace the startup/running configuration depending on device settings and ACLs. Because the router is the infrastructure device maintaining the BGP session, compromise of its configuration is a direct path to administrative control and routing manipulation.

• C. Incorrect.

  SMB can be abused in various attack paths, especially where weak authentication, legacy dialects, or relay conditions exist. However, SMB file sharing on a Linux host does not inherently allow BGP session hijacking. BGP session compromise depends on access to the routing device, BGP credentials if used, TCP session manipulation, or control-plane weaknesses. This option conflates unrelated protocols and overgeneralizes the effect of SMB exposure.

• D. Incorrect.

  Telnet is insecure because credentials and session data are sent in cleartext, making sniffing and credential theft feasible on a local segment. That is a serious issue, especially on IPv6 LANs where assessors may overlook local exposure. However, in this scenario, Telnet is on the Linux server, not necessarily on the router. Even if compromised, it is not as direct or as impactful as unauthenticated TFTP access to the router's configuration itself. Therefore this is true but not the best answer.

Correct answer: A

• A. Correct.

  Correct. Telnet and traditional FTP transmit credentials in cleartext, and this remains true whether they run over IPv4 or IPv6. From a compromised Linux host with access to an IPv6-only segment, passively capturing traffic with tools such as tcpdump or Wireshark is a practical, low-impact way to identify exposed credentials without altering network behavior. This directly targets the most serious cleartext authentication risk among the listed protocols.

• B. Incorrect.

  Incorrect. While BGP can influence routing, changing BGP advertisements is intrusive, high risk, and could disrupt production traffic. It is not the least disruptive next step. Also, manipulating routes to redirect traffic is far more invasive than first checking for existing cleartext credential exposure. In an assessment, passive collection is typically preferred before active interference with routing protocols.

• C. Incorrect.

  Incorrect. SMB does not require restarting a service on a compromised Linux host to identify credential exposure elsewhere, and enabling guest access would alter system configuration and likely create instability or detection risk. SMB authentication is not equivalent to cleartext password transmission; NTLM challenge-response is not sent as plain usernames and passwords on the wire. This option reflects the misconception that any visible SMB authentication yields reusable cleartext credentials.

• D. Incorrect.

  Incorrect. TFTP is a trivial file transfer protocol over UDP and does not provide authenticated directory listing functionality like FTP or SMB. It is commonly used for simple file transfers such as network device boot images or configs, but it does not enumerate shares. This option is based on a false assumption about TFTP capabilities.