EC-COUNCIL 212-82 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-82 Online Questions & Answers

• Question 1:

  Jordan, a network administrator in an organization, was instructed to identify network- related issues and improve network performance. While troubleshooting the network, he received a message indicating that the datagram could not be forwarded owing to the unavailability of IP-related services (such as FTP or web services) on the target host, which of the following network issues did Jordan find in this scenario?

  A. Time exceeded message
  B. Destination unreachable message
  C. Unreachable networks
  D. Network cable is unplugged
  B. Destination unreachable message

  ---

  Explanation/Reference:

  Destination unreachable message is the network issue that Jordan found in this scenario. Destination unreachable message is a type of ICMP message that indicates that the datagram could not be forwarded owing to the unavailability of IP-related services (such as FTP or web services) on the target host. Destination unreachable message can be caused by various reasons, such as incorrect routing, firewall blocking, or host configuration problems1. References: Destination Unreachable Message

• Question 2:

  Stella purchased a smartwatch online using her debit card. After making payment for the product through the payment gateway, she received a transaction text message with a deducted and available balance from her bank.

  Identify the information security element that ensures that Stella's transaction status is immediately reflected in her bank account in this scenario.

  A. Non-repudiation
  B. Integrity
  C. Availability
  D. Confidentiality
  C. Availability

  ---

  Explanation/Reference:

  Availability is the information security element that ensures that Stella's transaction status is immediately reflected in her bank account in this scenario. Information security is the practice of protecting information and information systems from unauthorized access, use, disclosure, modification, or destruction. Information security can be based on three fundamental principles: confidentiality, integrity, and availability. Confidentiality is the principle that ensures that information is accessible only to authorized parties and not disclosed to unauthorized parties. Integrity is the principle that ensures that information is accurate, complete, and consistent and not altered or corrupted by unauthorized parties. Availability is the principle that ensures that information and information systems are accessible and usable by authorized parties when needed. In the scenario, Stella purchased a smartwatch online using her debit card. After making payment for the product through the payment gateway, she received a transaction text message with a deducted and available balance from her bank. This means that her transaction status was immediately reflected in her bank account, which indicates that availability was ensured by her bank's information system.

• Question 3:

  Mark, a security analyst, was tasked with performing threat hunting to detect imminent threats in an organization's network. He generated a hypothesis based on the observations in the initial step and started the threat-hunting process using existing data collected from DNS and proxy logs.

  Identify the type of threat-hunting method employed by Mark in the above scenario.

  A. Entity-driven hunting
  B. TTP-driven hunting
  C. Data-driven hunting
  D. Hybrid hunting
  C. Data-driven hunting

  ---

  Explanation/Reference:

  A data-driven hunting method is a type of threat hunting method that employs existing data collected from various sources, such as DNS and proxy logs, to generate and test hypotheses about potential threats. This method relies on data analysis and machine learning techniques to identify patterns and anomalies that indicate malicious activity. A data-driven hunting method can help discover unknown or emerging threats that may evade traditional detection methods. An entity-driven hunting method is a type of threat hunting method that focuses on specific entities, such as users, devices, or domains, that are suspected or known to be involved in malicious activity. A TTP-driven hunting method is a type of threat hunting method that leverages threat intelligence and knowledge of adversary tactics, techniques, and procedures (TTPs) to formulate and test hypotheses about potential threats. A hybrid hunting method is a type of threat hunting method that combines different approaches, such as data-driven, entity-driven, and TTP-driven methods, to achieve more comprehensive and effective results.

• Question 4:

  RAT has been setup in one of the machines connected to the network to steal the important Sensitive corporate docs located on Desktop of the server, further investigation revealed the IP address of the server 20.20.10.26. Initiate a remote connection using thief client and determine the number of files present in the folder.

  Hint: Thief folder is located at: Z:\CCT-Tools\CCT Module 01 Information Security Threats and Vulnerabilities\Remote Access Trojans (RAT)\Thief of Attacker Machine-1.

  A. 2
  B. 4
  C. 3
  D. 5
  C. 3

  ---

  Explanation/Reference:

  3 is the number of files present in the folder in the above scenario. A RAT (Remote Access Trojan) is a type of malware that allows an attacker to remotely access and control a compromised system or network. A RAT can be

  used to steal sensitive data, spy on user activity, execute commands, install other malware, etc. To initiate a remote connection using thief client, one has to follow these steps:

  Navigate to the thief folder located at Z:\CCT-Tools\CCT Module 01 Information Security Threats and Vulnerabilities\Remote Access Trojans (RAT)\Thief of Attacker Machine-1.

  Double-click on thief.exe file to launch thief client.

  Enter 20.20.10.26 as IP address of server.

  Enter 1234 as port number.

  Click on Connect button.

  After establishing connection with server, click on Browse button.

  Navigate to Desktop folder on server.

  Count number of files present in folder.

  The number of files present in folder is 3, which are:

  Sensitive corporate docs.docx

  Sensitive corporate docs.pdf

  Sensitive corporate docs.txt

• Question 5:

  Zayn, a network specialist at an organization, used Wireshark to perform network analysis. He selected a Wireshark menu that provided a summary ol captured packets, IO graphs, and flow graphs. Identify the Wireshark menu selected by Zayn in this scenario.

  A. Status bar
  B. Analyze
  C. Statistics
  D. Packet list panel
  C. Statistics

  ---

  Explanation/Reference:

  Statistics is the Wireshark menu selected by Zayn in this scenario. Statistics is a Wireshark menu that provides a summary of captured packets, IO graphs, and flow graphs. Statistics can be used to analyze various aspects of network traffic, such as protocols, endpoints, conversations, or packet lengths3. References: Wireshark Statistics Menu

• Question 6:

  Myles, a security professional at an organization, provided laptops for all the employees to carry out the business processes from remote locations. While installing necessary applications required for the business, Myles has also installed antivirus software on each laptop following the company's policy to detect and protect the machines from external malicious events over the Internet.

  Identify the PCI-DSS requirement followed by Myles in the above scenario.

  A. PCI-DSS requirement no 1.3.2
  B. PCI-DSS requirement no 1.3.5
  C. PCI-DSS requirement no 5.1
  D. PCI-DSS requirement no 1.3.1
  C. PCI-DSS requirement no 5.1

  ---

  Explanation/Reference:

  The correct answer is C, as it identifies the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS is a set of standards that aims to protect cardholder data and ensure secure payment transactions. PCI-DSS has 12 requirements that cover various aspects of security such as network configuration, data encryption, access control, vulnerability management, monitoring, and testing. PCI-DSS requirement no 5.1 states that "Protect all systems against malware and regularly update anti-virus software or programs". In the above scenario, Myles followed this requirement by installing antivirus software on each laptop to detect and protect the machines from external malicious events over the Internet. Option A is incorrect, as it does not identify the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS requirement no 1.3.2 states that "Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet". In the above scenario, Myles did not follow this requirement, as there was no mention of outbound traffic or cardholder data environment. Option B is incorrect, as it does not identify the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS requirement no 1.3.5 states that "Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment". In the above scenario, Myles did not follow this requirement, as there was no mention of inbound or outbound traffic or cardholder data environment. Option D is incorrect, as it does not identify the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS requirement no

  1.3.1 states that "Implement a firewall configuration that restricts connections between publicly accessible servers and any system component storing cardholder data". In the above scenario, Myles did not follow this requirement, as there was no mention of firewall configuration or publicly accessible servers or system components storing cardholder data. References: Section 5.2

• Question 7:

  A pfSense firewall has been configured to block a web application www.abchacker.com. Perform an analysis on the rules set by the admin and select the protocol which has been used to apply the rule.

  Hint: Firewall login credentials are given below:

  Username: admin

  Password: admin@l23

  A. POP3
  B. TCP/UDP
  C. FTP
  D. ARP
  B. TCP/UDP

  ---

  Explanation/Reference:

  TCP/UDP is the protocol that has been used to apply the rule to block the web application www.abchacker.com in the above scenario. pfSense is a firewall and router software that can be installed on a computer or a device to

  protect a network from various threats and attacks. pfSense can be configured to block or allow traffic based on various criteria, such as source, destination, port, protocol, etc. pfSense rules are applied to traffic in the order they appear in the

  firewall configuration . To perform an analysis on the rules set by the admin, one has to follow these steps:

  Open a web browser and type 20.20.10.26

  Press Enter key to access the pfSense web interface. Enter admin as username and admin@l23 as password.

  Click on Login button.

  Click on Firewall menu and select Rules option.

  Click on LAN tab and observe the rules applied to LAN interface.

  The rules applied to LAN interface are:

  

  The first rule blocks any traffic from LAN interface to www.abchacker.com website using TCP/UDP protocol. The second rule allows any traffic from LAN interface to any destination using any protocol. Since the first rule appears before the second rule, it has higher priority and will be applied first. Therefore, TCP/UDP is the protocol that has been used to apply the rule to block the web application www.abchacker.com. POP3 (Post Office Protocol 3) is a protocol that allows downloading emails from a mail server to a client device. FTP (File Transfer Protocol) is a protocol that allows transferring files between a client and a server over a network. ARP (Address Resolution Protocol) is a protocol that resolves IP addresses to MAC (Media Access Control) addresses on a network.

• Question 8:

  Hayes, a security professional, was tasked with the implementation of security controls for an industrial network at the Purdue level 3.5 (IDMZ). Hayes verified all the possible attack vectors on the IDMZ level and deployed a security control that fortifies the IDMZ against cyber-attacks.

  Identify the security control implemented by Hayes in the above scenario.

  A. Point-to-po int communication
  B. MAC authentication
  C. Anti-DoS solution
  D. Use of authorized RTU and PLC commands
  D. Use of authorized RTU and PLC commands

  ---

  Explanation/Reference:

  The use of authorized RTU and PLC commands is the security control implemented by Hayes in the above scenario. RTU (Remote Terminal Unit) and PLC (Programmable Logic Controller) are devices that control and monitor industrial processes, such as power generation, water treatment, oil and gas production, etc. RTU and PLC commands are instructions that are sent from a master station to a slave station to perform certain actions or request certain data. The use of authorized RTU and PLC commands is a security control that fortifies the IDMZ (Industrial Demilitarized Zone) against cyber- attacks by ensuring that only valid and authenticated commands are executed by the RTU and PLC devices. Point-to-point communication is a communication method that establishes a direct connection between two endpoints. MAC authentication is an authentication method that verifies the MAC (Media Access Control) address of a device before granting access to a network. Anti-DoS solution is a security solution that protects a network from DoS (Denial-of-Service) attacks by filtering or blocking malicious traffic.

• Question 9:

  You have been assigned to perform a vulnerability assessment of a web server located at IP address 20.20.10.26. Identify the vulnerability with a severity score of andA. You can use the OpenVAS vulnerability scanner, available with the Parrot Security machine, with credentials admin/password for this challenge.

  A. TCP limestamps
  B. FTP Unencrypted Cleartext Login
  C. Anonymous FTP Login Reporting
  D. UDP limestamps
  A. TCP limestamps

  ---

  Explanation/Reference:

  TCP Timestamps is the vulnerability with a severity score of 8.0. This can be verified by performing a vulnerability assessment of the web server located at IP address 20.20.10.26 using the OpenVAS vulnerability scanner,

  available with the Parrot Security machine, with credentials admin/password. To perform the vulnerability assessment, one can follow these steps:

  Launch the Parrot Security machine and open a terminal. Enter the command sudo openvas-start to start the OpenVAS service and wait for a few minutes until it is ready.

  Open a web browser and navigate to https://127.0.0.1:9392 to access the OpenVAS web interface.

  Enter the credentials admin/password to log in to OpenVAS. Click on Scans -> Tasks from the left menu and then click on the blue icon with a star to create a new task.

  Enter a name and a comment for the task, such as "Web Server Scan". Select "Full and fast" as the scan config from the drop-down menu. Click on the icon with a star next to Target to create a new target. Enter a name and a comment for

  the target, such as "Web Server". Enter 20.20.10.26 as the host in the text box and click on Save. Select "Web Server" as the target from the drop-down menu and click on Save. Click on the green icon with a play button next to the task name

  to start the scan and wait for it to finish.

  Click on the task name to view the scan report and click on Results from the left menu to see the list of vulnerabilities found.

  Sort the list by Severity in descending order and look for the vulnerability with a severity score of 8.0. The screenshot below shows an example of performing these steps: The vulnerability with a severity score of 8.0 is TCP Timestamps, which

  is an option in TCP packets that can be used to measure round-trip time and improve performance, but it can also reveal information about the system's uptime, clock skew, or TCP sequence numbers, which can be used by attackers to

  launch various attacks, such as idle scanning, OS fingerprinting, or TCP hijacking1. The vulnerability report provides more details about this vulnerability, such as its description, impact, solution, references, and CVSS score2. References:

  Screenshot of OpenVAS showing TCP Timestamps vulnerability, TCP Timestamps Vulnerability, Vulnerability Report

• Question 10:

  Maisie. a new employee at an organization, was given an access badge with access to only the first and third floors of the organizational premises. Maisie Hied scanning her access badge against the badge reader at the second-floor entrance but was unsuccessful. Identify the short-range wireless communication technology used by the organization in this scenario.

  A. RFID
  B. Li-Fi
  C. Bluetooth
  D. Wi Fi
  A. RFID

  ---

  Explanation/Reference:

  RFID (Radio Frequency Identification) is a short-range wireless communication technology that uses radio waves to identify and track objects. RFID tags are attached to objects and RFID readers scan the tags to obtain the information stored in them. RFID is commonly used for access control, inventory management, and identification3. References: What is RFID?