EC-COUNCIL Certified Ethical Hacker 312-50 Questions & Answers

• Question 1:

  You are footprinting the www.xsecurity.com domain using the Google Search Engine. You would like to determine what sites link to www.xsecurity .com at the first level of revelance. Which of the following operator in Google search will you use to achieve this?

  A. Link: www.xsecurity.com

  B. serch?l:www.xsecurity.com

  C. level1.www.security.com

  D. pagerank:www.xsecurity.com

  Correct Answer: A

  The query [link:] will list webpages that have links to the specified webpage. For instance, [link:www.google.com] will list webpages that have links pointing to the Google homepage. Note there can be no space between the "link:" and the web page url.

• Question 2:

  Which of the following activities would not be considered passive footprinting?

  A. Search on financial site such as Yahoo Financial

  B. Perform multiple queries through a search engine

  C. Scan the range of IP address found in their DNS database

  D. Go through the rubbish to find out any information that might have been discarded

  Correct Answer: C

  Passive footprinting is a method in which the attacker never makes contact with the target. Scanning the targets IP addresses can be logged at the target and therefore contact has been made.

• Question 3:

  System Administrators sometimes post questions to newsgroups when they run into technical challenges. As an ethical hacker, you could use the information in newsgroup posting to glean insight into the makeup of a target network. How would you search for these posting using Google search?

  A. Search in Google using the key strings "the target company" and "newsgroups"

  B. Search for the target company name at http://groups.google.com

  C. Use NNTP websites to search for these postings

  D. Search in Google using the key search strings "the target company" and "forums"

  Correct Answer: B

  Using http://groups.google.com is the easiest way to access various newsgroups today. Before http://groups.google.com you had to use special NNTP clients or subscribe to some nntp to web services.

• Question 4:

  Bill has started to notice some slowness on his network when trying to update his company's website while trying to access the website from the Internet. Bill asks the help desk manager if he has received any calls about slowness from the end users, but the help desk manager says that he has not. Bill receives a number of calls from customers that can't access the company website and can't purchase anything online. Bill logs on to a couple of this routers and notices that the logs shows network traffic is at all time high. He also notices that almost all the traffic is originating from a specific address.

  Bill decides to use Geotrace to find out where the suspect IP is originates from. The Geotrace utility runs a traceroute and finds that IP is coming from Panama. Bill knows that none of his customers are in Panama so he immediately thinks that his company is under a Denial of Service attack. Now Bill needs to find out more about the originating IP Address.

  What Internet registry should Bill look in to find the IP Address?

  A. LACNIC

  B. ARIN

  C. RIPELACNIC

  D. APNIC

  Correct Answer: A

  LACNIC is the Latin American and Caribbean Internet Addresses Registry that administers IP addresses, autonomous system numbers, reverse DNS, and other network resources for that region.

• Question 5:

  The terrorist organizations are increasingly blocking all traffic from North America or from Internet Protocol addresses that point to users who rely on the English Language.

  Hackers sometimes set a number of criteria for accessing their website. This information is shared among the co-hackers. For example if you are using a machine with the Linux Operating System and the Netscape browser then you will have

  access to their website in a convert way. When federal investigators using PCs running windows and using Internet Explorer visited the hacker's shared site, the hacker's system immediately mounted a distributed denial-of-service attack

  against the federal system.

  Companies today are engaging in tracking competitor's through reverse IP address lookup sites like whois.com, which provide an IP address's domain. When the competitor visits the companies website they are directed to a products page

  without discount and prices are marked higher for their product. When normal users visit the website they are directed to a page with full-blown product details along with attractive discounts. This is based on IP-based blocking, where certain

  addresses are barred from accessing a site.

  What is this masking technique called?

  A. Website Cloaking

  B. Website Filtering

  C. IP Access Blockade

  D. Mirrored WebSite

  Correct Answer: A

  Website Cloaking travels under a variety of alias including Stealth, Stealth scripts, IP delivery, Food Script, and Phantom page technology. It's hot- due to its ability to manipulate those elusive top-ranking results from spider search engines.

• Question 6:

  Network Administrator Patricia is doing an audit of the network. Below are some of her findings concerning DNS. Which of these would be a cause for alarm? Select the best answer.

  A. There are two external DNS Servers for Internet domains. Both are AD integrated.

  B. All external DNS is done by an ISP.

  C. Internal AD Integrated DNS servers are using private DNS names that are

  D. unregistered.

  E. Private IP addresses are used on the internal network and are registered with the internal AD integrated DNS server.

  Correct Answer: A

  A. There are two external DNS Servers for Internet domains. Both are AD integrated. This is the correct answer. Having an AD integrated DNS external server is a serious cause for alarm. There is no need for this and it causes vulnerability

  on the network.

  B. All external DNS is done by an ISP.

  This is not the correct answer. This would not be a cause for alarm. This would actually reduce the company's network risk as it is offloaded onto the ISP. C. Internal AD Integrated DNS servers are using private DNS names that are

  unregistered. This is not the correct answer. This would not be a cause for alarm. This would actually reduce the company's network risk.

  D. Private IP addresses are used on the internal network and are registered with the internal AD integrated DNS server. This is not the correct answer. This would not be a cause for alarm. This would actually reduce the company's network

  risk.

• Question 7:

  Your lab partner is trying to find out more information about a competitors web site. The site has a .com extension. She has decided to use some online whois tools and look in one of the regional Internet registrys. Which one would you suggest she looks in first?

  A. LACNIC

  B. ARIN

  C. APNIC

  D. RIPE

  E. AfriNIC

  Correct Answer: B

  Regional registries maintain records from the areas from which they govern. ARIN is responsible for domains served within North and South America and therefore, would be a good starting point for a .com domain.

• Question 8:

  While footprinting a network, what port/service should you look for to attempt a zone transfer?

  A. 53 UDP

  B. 53 TCP

  C. 25 UDP

  D. 25 TCP

  E. 161 UDP

  F. 22 TCP

  G. 60 TCP

  Correct Answer: B

  IF TCP port 53 is detected, the opportunity to attempt a zone transfer is there.

• Question 9:

  NSLookup is a good tool to use to gain additional information about a target network. What does the following command accomplish? nslookup

  > server

  > set type =any

  > ls -d

  A. Enables DNS spoofing

  B. Loads bogus entries into the DNS table

  C. Verifies zone security

  D. Performs a zone transfer

  E. Resets the DNS cache

  Correct Answer: D

  If DNS has not been properly secured, the command sequence displayed above will perform a zone transfer.

• Question 10:

  According to the CEH methodology, what is the next step to be performed after footprinting?

  A. Enumeration

  B. Scanning

  C. System Hacking

  D. Social Engineering

  E. Expanding Influence

  Correct Answer: B

  Once footprinting has been completed, scanning should be attempted next. Scanning should take place on two distinct levels: network and host.