Free 312-50V8 Exam Dumps Preview

An Evil Cracker is attempting to penetrate your private network security. To do this, he must not be seen by your IDS, as it may take action to stop him.

What tool might he use to bypass the IDS? Select the best answer.

You are the security administrator for a large network. You want to prevent attackers from running any sort of traceroute into your DMZ and discovering the internal structure of publicly accessible areas of the network.

How can you achieve this?

A Buffer Overflow attack involves:

MX record priority increases as the number increases. (True/False.

Why would an ethical hacker use the technique of firewalking?

Fingerprinting VPN firewalls is possible with which of the following tools?

You are the CIO for Avantes Finance International, a global finance company based in Geneva. You are responsible for network functions and logical security throughout the entire corporation. Your company has over 250 servers running Windows Server, 5000 workstations running Windows Vista, and 200 mobile users working from laptops on Windows 7.

Last week, 10 of your company's laptops were stolen from salesmen while at a conference in Amsterdam.
These laptops contained proprietary company information. While doing damage assessment on the possible public relations nightmare this may become, a news story leaks about the stolen laptops and also that sensitive information from those computers was posted to a blog online.

What built-in Windows feature could you have implemented to protect the sensitive information on these laptops?

Take a look at the following attack on a Web Server using obstructed URL:

How would you protect from these attacks?

Your company was hired by a small healthcare provider to perform a technical assessment on the network.

What is the best approach for discovering vulnerabilities on a Windows-based computer?

How do you defend against Privilege Escalation?

You are writing security policy that hardens and prevents Footprinting attempt by Hackers.

Which of the following countermeasures will NOT be effective against this attack?

Why attackers use proxy servers?

In which step Steganography fits in CEH System Hacking Cycle (SHC)

NTP allows you to set the clocks on your systems very accurately, to within 100ms and sometimes-even 10ms. Knowing the exact time is extremely important for enterprise security. Various security protocols depend on an accurate source of time information in order to prevent "playback" attacks. These protocols tag their communications with the current time, to prevent attackers from replaying the same communications, e.g., a login/password interaction or even an entire communication, at a later date. One can circumvent this tagging, if the clock can be set back to the time the communication was recorded. An attacker attempts to try corrupting the clocks on devices on your network. You run Wireshark to detect the NTP traffic to see if there are any irregularities on the network.

What port number you should enable in Wireshark display filter to view NTP packets?

You want to know whether a packet filter is in front of 192.168.1.10. Pings to 192.168.1.10 don't get answered. A basic nmap scan of 192.168.1.10 seems to hang without returning any information.

What should you do next?

To send a PGP encrypted message, which piece of information from the recipient must the sender have before encrypting the message?

Fingerprinting an Operating System helps a cracker because:

Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

If the final set of security controls does not eliminate all risk in a system, what could be done next?

What makes web application vulnerabilities so aggravating? (Choose two)

While performing ping scans into a target network you get a frantic call from the organization's security team. They report that they are under a denial of service attack.

When you stop your scan, the smurf attack event stops showing up on the organization's IDS monitor.

How can you modify your scan to prevent triggering this event in the IDS?

Take a look at the following attack on a Web Server using obstructed URL:

http://www.example.com/script.ext?template%2e%2e%2e%2e%2e%2f%2e%2f%65%74%63%2f%70%61%73%73%77%64

The request is made up of:

%2e%2e%2f%2e%2e%2f%2e%2f% = ../../../

%65%74%63 = etc

%2f = /

%70%61%73%73%77%64 = passwd

How would you protect information systems from these attacks?

In keeping with the best practices of layered security, where are the best places to place intrusion detection/intrusion prevention systems? (Choose two.)

Which tool/utility can help you extract the application layer data from each TCP connection from a log file into separate files?

What is the problem with this ASP script (login.asp)?

Which of the following is a client-server tool utilized to evade firewall inspection?

Trojan horse attacks pose one of the most serious threats to computer security. The image below shows different ways a Trojan can get into a system.

Which are the easiest and most convincing ways to infect a computer?

A pentester gains acess to a Windows application server and needs to determine the settings of the built-in Windows firewall.

Which command would be used?

Which Open Web Application Security Project (OWASP) implements a web application full of known vulnerabilities?

Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor".
Here is the output of the SIDs:

From the above list identify the user account with System Administrator privileges.

Which of the following guidelines or standards is associated with the credit card industry?

WPA2 uses AES for wireless data encryption at which of the following encryption levels?

Which of the following defines the role of a root Certificate Authority (CA) in a Public Key Infrastructure (PKI)?

According to the CEH methodology, what is the next step to be performed after footprinting?

What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?

What is a sniffing performed on a switched network called?

Which regulationdefines security and privacy controls for Federal information systems and organizations?

How does traceroute map the route a packet travels from point A to point B?

Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned.
As a security professional, what would you infer from this scan?

On a Linux device, which of the following commands will start the Nessus client in the background so that the Nessus server can be configured?

You want to perform advanced SQL Injection attack against a vulnerable website. You are unable to perform command shell hacks on this server.

What must be enabled in SQL Server to launch these attacks?

Which of the following algorithms can be used to guarantee the integrity of messages being sent, in transit, or stored? (Choose the best answer)

In Linux, the three most common commands that hackers usually attempt to Trojan are:

What is a sheepdip?

A Security Engineer at a medium-sized accounting firm has been tasked with discovering how much information can be obtained from the firm's public facing web servers. The engineer decides to start by using netcat to port 80.

The engineer receives this output:

HTTP/1.1 200 OK

Server: Microsoft-IIS/6

Expires: Tue, 17 Jan 2011 01:41:33 GMT

DatE. Mon, 16 Jan 2011 01:41:33 GMT

Content-TypE. text/html

Accept-Ranges: bytes

Last-ModifieD. Wed, 28 Dec 2010 15:32:21 GMT

ETaG. "b0aac0542e25c31:89d"

Content-Length: 7369

Which of the following is an example of what the engineer performed?

Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the cookie even while the session is invalid on the server.

Why do you think this is possible?

What type of cookies can be generated while visiting different web sites on the Internet?

What is the proper response for a X-MAS scan if the port is closed?

Which of the followingis the least-likely physical characteristic to be used in biometric control that supports a large company?

A security engineer has been asked to deploy a secure remote access solution that will allow employees to connect to the company's internal network.

Which of the following can be implemented to minimize the opportunity for the man-in-the-middle attack to occur?

Which of the following keyloggers cannot be detected by anti-virus or anti-spyware products?

Jason's Web server was attacked by a trojan virus. He runs protocol analyzer and notices that the trojan communicates to a remote server on the Internet. Shown below is the standard "hexdump" representation of the network packet, before being decoded. Jason wants to identify the trojan by looking at the destination port number and mapping to a trojan-port number database on the Internet.

Identify the remote server's port number by decoding the packet?

The following is part of a log file taken from the machine on the network with the IP address of
192.168.1.106:

Time:Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP

Time:Mar 13 17:30:17 Port:21 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP
Time:Mar 13 17:30:19 Port:22 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP

Time:Mar 13 17:30:21 Port:23 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP

Time:Mar 13 17:30:22 Port:25 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP

Time:Mar 13 17:30:23 Port:80 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP

Time:Mar 13 17:30:30 Port:443 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP

What type of activity has been logged?

Windows file servers commonly hold sensitive files, databases, passwords and more.

Which of the following choices would be a common vulnerability that usually exposes them?

How does an operating system protect the passwords used for account logins?

Company A and Company B have just merged and each has its own Public Key Infrastructure (PKI).

What must the Certificate Authorities (CAs) establish so that the private PKIs for Company A and Company B trust one another and each private PKI can validate digital certificates from the other company?

Jacob is looking through a traffic log that was captured using Wireshark. Jacob has come across what appears to be SYN requests to an internal computer from a spoofed IP address.

What is Jacob seeing here?

Bill is attempting a series of SQL queries in order to map out the tables within the database that he is trying to exploit.

Choose the attack type from the choices given below.

Which of the following incident handling process phases is responsible for defining rules, creating a back- up plan, and testing the plans for an enterprise?

One of the most common and the best way of cracking RSA encryption is to begin to derive the two prime numbers, which are used in the RSA PKI mathematical process. If the two numbers p and q are discovered through a _____________ process, then the private key can be derived.

When discussing passwords, what is considered a brute force attack?

You visit a website to retrieve the listing of a company's staff members. But you can not find it on the website. You know the listing was certainly present one year before.

How can you retrieve information from the outdated website?

Which of the following Nmap commands would be used to perform a stack fingerprinting?

Paul has just finished setting up his wireless network. He has enabled numerous security features such as changing the default SSID, enabling WPA encryption, and enabling MAC filtering on his wireless router.
Paul notices that when he uses his wireless connection, the speed is sometimes 54 Mbps and sometimes it is only 24Mbps or less. Paul connects to his wireless router's management utility and notices that a machine with an unfamiliar name is connected through his wireless connection. Paul checks the router's logs and notices that the unfamiliar machine has the same MAC address as his laptop.

What is Paul seeing here?

Blane is a network security analyst for his company. From an outside IP, Blane performs an XMAS scan using Nmap. Almost every port scanned does not illicit a response.

What can he infer from this kind of response?

While testing web applications, you attempt to insert the following test script into the search area on the
company's web site:

<script>alert('Testing Testing Testing')</script>

Later, when you press the search button, a pop up box appears on your screen with the text "Testing Testing Testing".

What vulnerability is detected in the web application here?

Virus Scrubbers and other malware detection program can only detect items that they are aware of.

Which of the following tools would allow you to detect unauthorized changes or modifications of binary files on your system by unknown malware?

ARP poisoning is achieved in _____ steps

What is the command used to create a binary log file using tcpdump?

Ricardo wants to send secret messages to acompetitor company. To secure these messages, he uses a technique of hiding a secret message within an ordinary message, the technique provides 'security through obscurity'.

What technique is Ricardo using?

While probing an organization you discover that they have a wireless network. From your attempts to connect to the WLAN you determine that they have deployed MAC filtering by using ACL on the access points.

What would be the easiest way to circumvent and communicate on the WLAN?

Perspective clients wantto see sample reports from previous penetration tests.

What should you do next?

Which of the followingtypes of firewalls ensures that the packets are part of the established session?

What is the primary drawback to using advanced encryption standard (AES) algorithm with a 256 bit key to share sensitive data?

You wish to determine the operating system and type of web server being used. At the same time you wish to arouse no suspicion within the target organization.

While some of the methods listed below work, which holds the least risk of detection?

Which of the following does proper basic configuration of snort as a network intrusion detection system require?

Clive is conducting a pen-test and has just port scanned a system on the network. He has identified the operating system as Linux and been able to elicit responses from ports 23, 25 and 53. He infers port 23 as running Telnet service, port 25 as running SMTP service and port 53 as running DNS service. The client confirms these findings and attests to the current availability of the services. When he tries to telnet to port 23 or 25, he gets a blank screen in response. On typing other commands, he sees only blank spaces or underscores symbols on the screen.

What are you most likely to infer from this?

A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters.

What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?

Which of the following are advantages of adopting a Single Sign On (SSO) system? (Choose two.)

SOAP services use which technology to format information?

In this type of Man-in-the-Middle attack, packets and authentication tokens are captured using a sniffer.
Once the relevant information is extracted, the tokens are placed back on the network to gain access.

If you come across a sheepdip machaine at your client site, what would you infer?

Which of the following encryption is NOT based on block cipher?

This kind of attack will let you assume a users identity at a dynamically generated web page or site:

John is discussing security with Jane. Jane had mentioned to John earlier that she suspects an LKM has been installed on her server. She believes this is the reason that the server has been acting erratically lately. LKM stands for Loadable Kernel Module.

What does this mean in the context of Linux Security?

Which of the following would be the best reason for sending a single SMTP message to an address that does not exist within the target company?

During a wireless penetration test, a tester detects an access point using WPA2 encryption.

Which of the following attacks should be used to obtain the key?

Which of the following tools can be used to perform a zone transfer?

You are the Systems Administrator for a large corporate organization. You need to monitor all network traffic on your local network for suspicious activities and receive notifications when an attack is occurring.

Which tool would allow you to accomplish this goal?

Jimmy, an attacker, knows that he can take advantage of poorly designed input validation routines to create or alter SQL commands to gain access to private data or execute commands in the database.

What technique does Jimmy use to compromise a database?

A rootkit is a collection of tools (programs) that enable administrator-level access to a computer. This program hides itself deep into an operating system for malicious activity and is extremely difficult to detect.
The malicious software operates in a stealth fashion by hiding its files, processes and registry keys and may be used to create a hidden directory or folder designed to keep out of view from a user's operating system and security software.

What privilege level does a rootkit require to infect successfully on a Victim's machine?

What are two things that are possible when scanning UDP ports? (Choose two.

Fred is scanning his network to ensure it is as secure as possible. Fred sends a TCP probe packet to a host with a FIN flag and he receives a RST/ACK response.

What does this mean?

While using your bank's online servicing you notice the following stringin the URL bar:
"http://www.MyPersonalBank/Account?

Id=368940911028389&Damount=10980&Camount=21"

You observe that if you modify the Damount & Camount values and submit the request, that data on the web page reflect the changes.

What type of vulnerability is present on this site?

Jayden is a network administrator for her company. Jayden wants to prevent MAC spoofing on all the Cisco switches in the network.

How can she accomplish this?

What is one thing a tester can do to ensure that the software is trusted and is not changing or tampering with critical data on the back end of a system it is loaded on?

This TCP flag instructs the sending system to transmit all buffered data immediately.

Study the snort rule given below:

From the options below, choose the exploit against which this rule applies.

What is the goal of a Denial of Service Attack?

Which type of hacker represents the highest risk to your network?