Skip to main content

312-50 Real Exam Questions

Certified Ethical Hacker

765 questions available · Page 1 of 77

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

An employee wants to defeat detection by a network-based IDS application. He does not want to attack the system containing the IDS application.

Which of the following strategies can be used to defeat detection by a network-based IDS application? (Choose the best answer)

  1. A

    Create a network tunnel.

  2. B

    Create a multiple false positives.

  3. C

    Create a SYN flood.

  4. D

    Create a ping flood.

Show answer and explanation

Correct answer: A

Explanation

Explanation:
Certain types of encryption presents challenges to network-based intrusion detection and may leave the IDS blind to certain attacks, where a host-based IDS analyzes the data after it has been decrypted.

Question 2 Single choice

TCP SYN Flood attack uses the three-way handshake mechanism.

1. An attacker at system A sends a SYN packet to victim at system B.
2. System B sends a SYN/ACK packet to victim A.
3. As a normal three-way handshake mechanism system A should send an ACK packet to system B, however, system A does not send an ACK packet to system
B. In this case client B is waiting for an ACK packet from client A.

This status of client B is called _________________

  1. A

    "half-closed"

  2. B

    "half open"

  3. C

    "full-open"

  4. D

    "xmas-open"

Show answer and explanation

Correct answer: B

Question 3 Single choice

Michael is the security administrator for the for ABC company. Michael has been charged with strengthening the company's security policies, including its password policies. Due to certain legacy applications. Michael was only able to enforce a password group policy in Active Directory with a minimum of 10 characters. He has informed the company's employes, however that the new password policy requires that everyone must have complex passwords with at least 14 characters. Michael wants to ensure that everyone is using complex passwords that meet the new security policy requirements. Michael has just logged on to one of the network's domain controllers and is about to run the following command:

What will this command accomplish?

  1. A

    Dumps SAM password hashes to pwd.txt

  2. B

    Password history file is piped to pwd.txt

  3. C

    Dumps Active Directory password hashes to pwd.txt

  4. D

    Internet cache file is piped to pwd.txt

Show answer and explanation

Correct answer: A

Explanation

Explanation:
Pwdump is a hack tool that is used to grab Windows password hashes from a remote Windows computer. Pwdump > pwd.txt will redirect the output from pwdump to a text file named pwd.txt

Question 4 Single choice

In what stage of Virus life does a stealth virus gets activated with the user performing certain actions such as running an infected program?

  1. A

    Design

  2. B

    Elimination

  3. C

    Incorporation

  4. D

    Replication

  5. E

    Launch

  6. F

    Detection

Show answer and explanation

Correct answer: E

Question 5 Single choice

What attack is being depicted here?

  1. A

    Cookie Stealing

  2. B

    Session Hijacking

  3. C

    Cross Site scripting

  4. D

    Parameter Manipulation

Show answer and explanation

Correct answer: D

Explanation

Explanation:
Manipulating the data sent between the browser and the web application to an attacker's advantage has long been a simple but effective way to make applications do things in a way the user often shouldn't be able to. In a badly designed and developed web application, malicious users can modify things like prices in web carts, session tokens or values stored in cookies and even HTTP headers. In this case the user has elevated his rights.

Question 6 Single choice

Microsoft Authenticode technology is used for:

  1. A

    Digital Signing Activex controls

  2. B

    Digitally signing SSL Certificates

  3. C

    Digitally Signing JavaScript Files

  4. D

    Digitally Signing Java Applets

Show answer and explanation

Correct answer: A

Explanation

Explanation:
Authenticode identifies the publisher of signed software and verifies that it hasn't been tampered with, before users download software to their PCs. As a result, end users can make a more informed decision as to whether or not to download code. Authenticode relies on digital certificates and is based on specifications that have been used successfully in the industry for some time, including Public Key Cryptography Standards (PKCS) #7 (encrypted key specification), PKCS #10 (certificate request formats), X.509 (certificate specification), and Secure Hash Algorithm (SHA) and MD5 hash algorithms.

Question 7 Single choice

Which type of scan does not open a full TCP connection?

  1. A

    Stealth Scan

  2. B

    XMAS Scan

  3. C

    Null Scan

  4. D

    FIN Scan

Show answer and explanation

Correct answer: A

Explanation

Explanation:
Stealth Scan: Instead of completing the full TCP three-way-handshake a full connection is not made. A SYN packet is sent to the system and if a SYN/ACK packet is received it is assumed that the port on the system is active. In that case a RST/ACK will be sent which will determined the listening state the system is in. If a RST/ACK packet is received, it is assumed that the port on the system is not active.

Question 8 Single choice

Richard is a network Administrator working at a student loan company in lowa. This company processes over 20,000 students loan a year from colleges all over the state. Most communication between the company, schools and lenders is carried out through email. Because of privacy laws that are in the process of being implemented, Richard wants to get ahead of the game and become compliant before any sort of auditing occurs. Much of the email communication used at his company contains sensitive information such as social security numbers. For this reason, Richard wants to utilize email encryption agency-wide. The only problem for Richard is that his department only has couple of servers and they are utilized to their full capacity. Since a server-based PKI is not an option for him, he is looking for a low/no cost solution to encrypt email.

What should Richard use?

  1. A

    PGP

  2. B

    RSA

  3. C

    3DES

  4. D

    OTP

Show answer and explanation

Correct answer: A

Explanation

Explanation:
PGP (Pretty Good Privacy) is an encryption program being used for secure transmission of files and e- mails. This adapts public-key encryption technology in which pairs of keys are used to maintain secure communication. For PGP-based communication both the sender and receiver should have public and private key pairs. The sender's public key should be distributed to the receiver. Similarly, the receiver's public key should be distributed to the sender. When sending a message or a file, the sender can sign using his private key. Also, the sender's private key is never distributed. All encryption is made on the workstation sending the e-mail.

Question 9 Single choice

Study the following exploit code taken from a Linux machine and answer the questions below:

echo "ingreslock stream tcp nowait root /bin/sh sh I" > /tmp/x; /usr/sbin/inetd s /tmp/x;
sleep 10;
/bin/ rm f /tmp/x AAAA...AAA

In the above exploit code, the command "/bin/sh sh I" is given.

What is the purpose, and why is `sh' shown twice?

  1. A

    The command /bin/sh sh i appearing in the exploit code is actually part of an inetd configuration file.

  2. B

    The length of such a buffer overflow exploit makes it prohibitive for user to enter manually.The second `sh' automates this function.

  3. C

    It checks for the presence of a codeword (setting the environment variable) among the environment variables.

  4. D

    It is a giveaway by the attacker that he is a script kiddy.

Show answer and explanation

Correct answer: A

Explanation

Explanation:
What's going on in the above question is the attacker is trying to write to the unix filed /tm/x (his inetd.conf replacement config) -- he is attempting to add a service called ingresslock (which doesnt exist), which is "apparently" suppose to spawn a shell the given port specified by /etc/services for the service "ingresslock", ingresslock is a non-existant service, and if an attempt were made to respawn inetd, the service would error out on that line. (he would have to add the service to / etc/services to suppress the error). Now the question is asking about /bin/sh sh -i which produces an error that should read "sh: /bin/sh: cannot execute binary file", the -i option places the shell in interactive mode and cannot be used to respawn itself.

Question 10 Single choice

Which of the following activities will NOT be considered as passive footprinting?

  1. A

    Go through the rubbish to find out any information that might have been discarded.

  2. B

    Search on financial site such as Yahoo Financial to identify assets.

  3. C

    Scan the range of IP address found in the target DNS database.

  4. D

    Perform multiples queries using a search engine.

Show answer and explanation

Correct answer: C

Explanation

Explanation:
Passive footprinting is a method in which the attacker never makes contact with the target systems. Scanning the range of IP addresses found in the target DNS is considered making contact to the systems behind the IP addresses that is targeted by the scan.