EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 1:

  SNMP is a connectionless protocol that uses UDP instead of TCP packets? (True or False)

  A. True
  B. False
  A. True

  ---

  TCP and UDP provide transport services. But UDP was preferred. This is due to TCP characteristics, it is a complicate protocol and it consume to many memory and CPU resources. Where as UDP is easy to build and run. Into devices (repeaters and modems) vendors have built simple version of IP and UDP.

• Question 2:

  Joe Hacker is going wardriving. He is going to use PrismStumbler and wants it to go to a GPS mapping software application. What is the recommended and well- known GPS mapping package that would interface with PrismStumbler? Select the best answer.

  A. GPSDrive
  B. GPSMap
  C. WinPcap
  D. Microsoft Mappoint
  A. GPSDrive

  ---

  GPSDrive is a Linux GPS mapping package. It recommended to be used to send PrismStumbler data to so that it can be mapped. GPSMap is a generic term and not a real software package. WinPcap is a packet capture library for Windows. It is used to capture packets and deliver them to other programs for analysis. As it is for Windows, it isn't going to do what Joe Hacker is wanting to do. Microsoft Mappoint is a Windows application. PrismStumbler is a Linux application. Thus, these two are not going to work well together.

• Question 3:

  Which of the following is the best way an attacker can passively learn about technologies used in an organization?

  A. By sending web bugs to key personnel
  B. By webcrawling the organization web site
  C. By searching regional newspapers and job databases for skill sets technology hires need to possess in the organization
  D. By performing a port scan on the organization's web site
  C. By searching regional newspapers and job databases for skill sets technology hires need to possess in the organization

  ---

  Note: Sending web bugs, webcrawling their site and port scanning are considered "active" attacks, the question asks "passive"

• Question 4:

  TCP SYN Flood attack uses the three-way handshake mechanism.

  1.

  An attacker at system A sends a SYN packet to victim at system B.

  2.

  System B sends a SYN/ACK packet to victim A.

  3.

  As a normal three-way handshake mechanism system A should send an ACK packet to system B, however, system A does not send an ACK packet to system

  A. In this case client B is waiting for an ACK packet from client A. This status of client B is called _________________
  B. "half-closed"
  C. "half open"
  D. "full-open"
  E. "xmas-open"
  B. "half-closed"

• Question 5:

  You are concerned that someone running PortSentry could block your scans, and you decide to slow your scans so that no one detects them. Which of the following commands will help you achieve this?

  A. nmap -sS -PT -PI -O -T1
  B. nmap -sO -PT -O -C5
  C. nmap -sF -PT -PI -O
  D. nmap -sF -P0 -O
  A. nmap -sS -PT -PI -O -T1

  ---

  -T[0-5]: Set timing template (higher is faster)

• Question 6:

  Peter extracts the SID list from Windows 2008 Server machine using the hacking tool "SIDExtracter". Here is the output of the SIDs:

  

  From the above list identify the user account with System Administrator privileges?

  A. John
  B. Rebecca
  C. Sheela
  D. Shawn
  E. Somia
  F. Chang
  G. Micah
  F. Chang

• Question 7:

  Peter, a Network Administrator, has come to you looking for advice on a tool that would help him perform SNMP enquires over the network. Which of these tools would do the SNMP enumeration he is looking for? Select the best answers.

  A. SNMPUtil
  B. SNScan
  C. SNMPScan
  D. Solarwinds IP Network Browser
  E. NMap
  A. SNMPUtil
  B. SNScan
  D. Solarwinds IP Network Browser

  ---

  SNMPUtil is a SNMP enumeration utility that is a part of the Windows 2000 resource kit. With SNMPUtil, you can retrieve all sort of valuable information through SNMP. SNScan is a SNMP network scanner by Foundstone. It does SNMP scanning to find open SNMP ports. Solarwinds IP Network Browser is a SNMP enumeration tool with a graphical tree-view of the remote machine's SNMP data.

• Question 8:

  You are trying to hijack a telnet session from a victim machine with IP address 10.0.0.5 to Cisco router at 10.0.0.1. You sniff the traffic and attempt to predict the sequence and acknowledgement numbers to successfully hijack the telnet session.

  Here is the captured data in tcpdump.

  

  What are the next sequence and acknowledgement numbers that the router will send to the victim machine?

  A. Sequence number: 82980070 Acknowledgement number: 17768885A.
  B. Sequence number: 17768729 Acknowledgement number: 82980070B.
  C. Sequence number: 87000070 Acknowledgement number: 85320085C.
  D. Sequence number: 82980010 Acknowledgement number: 17768885D.
  A. Sequence number: 82980070 Acknowledgement number: 17768885A.

• Question 9:

  Michael is the security administrator for the for ABC company. Michael has been charged with strengthening the company's security policies, including its password policies. Due to certain legacy applications. Michael was only able to enforce a password group policy in Active Directory with a minimum of 10 characters. He has informed the company's employes, however that the new password policy requires that everyone must have complex passwords with at least 14 characters. Michael wants to ensure that everyone is using complex passwords that meet the new security policy requirements. Michael has just logged on to one of the network's domain controllers and is about to run the following command:

  What will this command accomplish?

  

  A. Dumps SAM password hashes to pwd.txt
  B. Password history file is piped to pwd.txt
  C. Dumps Active Directory password hashes to pwd.txt
  D. Internet cache file is piped to pwd.txt
  A. Dumps SAM password hashes to pwd.txt

  ---

  Pwdump is a hack tool that is used to grab Windows password hashes from a remote Windows computer. Pwdump > pwd.txt will redirect the output from pwdump to a text file named pwd.txt

• Question 10:

  Michael is a junior security analyst working for the National Security Agency (NSA) working primarily on breaking terrorist encrypted messages. The NSA has a number of methods they use to decipher encrypted messages including Government Access to Keys (GAK) and inside informants. The NSA holds secret backdoor keys to many of the encryption algorithms used on the Internet. The problem for the NSA, and Michael, is that terrorist organizations are starting to use custom-built algorithms or obscure algorithms purchased from corrupt governments. For this reason, Michael and other security analysts like him have been forced to find different methods of deciphering terrorist messages. One method that Michael thought of using was to hide malicious code inside seemingly harmless programs. Michael first monitors sites and bulletin boards used by known terrorists, and then he is able to glean email addresses to some of these suspected terrorists. Michael then inserts a stealth keylogger into a mapping program file readme.txt and then sends that as an attachment to the terrorist. This keylogger takes screenshots every 2 minutes and also logs all keyboard activity into a hidden file on the terrorist's computer. Then, the keylogger emails those files to Michael twice a day with a built in SMTP server. What technique has Michael used to disguise this keylogging software?

  A. Steganography
  B. Wrapping
  C. ADS
  D. Hidden Channels
  A. Steganography