EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 251:

  Your computer is infected by E-mail tracking and spying Trojan. This Trojan infects the computer with a single file - emos.sys Which step would you perform to detect this type of Trojan?

  

  A. Scan for suspicious startup programs using msconfig
  B. Scan for suspicious network activities using Wireshark
  C. Scan for suspicious device drivers in c:\windows\system32\drivers
  D. Scan for suspicious open ports using netstat
  C. Scan for suspicious device drivers in c:\windows\system32\drivers

• Question 252:

  Google uses a unique cookie for each browser used by an individual user on a computer. This cookie contains information that allows Google to identify records about that user on its database. This cookie is submitted every time a user launches a Google search, visits a site using AdSense etc. The information stored in Google's database, identified by the cookie, includes

  How would you prevent Google from storing your search keywords?

  A. Block Google Cookie by applying Privacy and Security settings in your web browser
  B. Disable the Google cookie using Google Advanced Search settings on Google Search page
  C. Do not use Google but use another search engine Bing which will not collect and store your search keywords
  D. Use MAC OS X instead of Windows 7. Mac OS has higher level of privacy controls by default.
  A. Block Google Cookie by applying Privacy and Security settings in your web browser

• Question 253:

  You are trying to package a RAT Trojan so that Anti-Virus software will not detect it. Which of the listed technique will NOT be effective in evading Anti-Virus scanner?

  A. Convert the Trojan.exe file extension to Trojan.txt disguising as text file
  B. Break the Trojan into multiple smaller files and zip the individual pieces
  C. Change the content of the Trojan using hex editor and modify the checksum
  D. Encrypt the Trojan using multiple hashing algorithms like MD5 and SHA-1
  A. Convert the Trojan.exe file extension to Trojan.txt disguising as text file

• Question 254:

  What does the following command in netcat do?

  nc -l -u -p 55555 < /etc/passwd

  A. logs the incoming connections to /etc/passwd file
  B. loads the /etc/passwd file to the UDP port 55555
  C. grabs the /etc/passwd file when connected to UDP port 55555
  D. deletes the /etc/passwd file when connected to the UDP port 55555
  C. grabs the /etc/passwd file when connected to UDP port 55555

  ---

  -l forces netcat to listen for incoming connections.

  -u tells netcat to use UDP instead of TCP

  -p 5555 tells netcat to use port 5555

  < /etc/passwd tells netcat to grab the /etc/passwd file when connected to.

• Question 255:

  Hackers usually control Bots through:

  A. IRC Channel
  B. MSN Messenger
  C. Trojan Client Software
  D. Yahoo Chat
  E. GoogleTalk
  A. IRC Channel

  ---

  Most of the bots out today has a function to connect to a predetermined IRC channel in order to get orders.

• Question 256:

  Which Type of scan sends a packets with no flags set ? Select the Answer

  A. Open Scan
  B. Null Scan
  C. Xmas Scan
  D. Half-Open Scan
  B. Null Scan

  ---

  The types of port connections supported are:

• Question 257:

  You are the security administrator of Jaco Banking Systems located in Boston. You are setting up e- banking website (http://www.ejacobank.com) authentication system. Instead of issuing banking customer with a single password, you give them a printed list of 100 unique passwords. Each time the customer needs to log into the e-banking system website, the customer enters the next password on the list. If someone sees them type the password using shoulder surfing, MiTM or keyloggers, then no damage is done because the password will not be accepted a second time. Once the list of 100 passwords is almost finished, the system automatically sends out a new password list by encrypted e- mail to the customer.

  You are confident that this security implementation will protect the customer from password abuse.

  Two months later, a group of hackers called "HackJihad" found a way to access the one-time password list issued to customers of Jaco Banking Systems. The hackers set up a fake website (http://www.e- jacobank.com) and used phishing attacks to direct ignorant customers to it. The fake website asked users for their e- banking username and password, and the next unused entry from their one-time password sheet. The hackers collected 200 customer's username/passwords this way. They transferred money from the customer's bank account to various offshore accounts.

  Your decision of password policy implementation has cost the bank with USD 925,000 to hackers. You immediately shut down the e-banking website while figuring out the next best security solution

  What effective security solution will you recommend in this case?

  A. Implement Biometrics based password authentication system. Record the customers face image to the authentication database
  B. Configure your firewall to block logon attempts of more than three wrong tries
  C. Enable a complex password policy of 20 characters and ask the user to change the password immediately after they logon and do not store password histories
  D. Implement RSA SecureID based authentication system
  D. Implement RSA SecureID based authentication system

• Question 258:

  Which of the following is NOT true of cryptography?

  A. Science of protecting information by encoding it into an unreadable format
  B. Method of storing and transmitting data in a form that only those it is intended for can read and process
  C. Most (if not all) algorithms can be broken by both technical and non-technical means
  D. An effective way of protecting sensitive information in storage but not in transit
  D. An effective way of protecting sensitive information in storage but not in transit

  ---

  Cryptography will protect data in both storage and in transit.

• Question 259:

  If you receive a RST packet while doing an ACK scan, it indicates that the port is open.(True/False).

  A. True
  B. False
  A. True

  ---

  When and ACK is sent to an open port, a RST is returned.

• Question 260:

  What is a primary advantage a hacker gains by using encryption or programs such as Loki?

  A. It allows an easy way to gain administrator rights
  B. It is effective against Windows computers
  C. It slows down the effective response of an IDS
  D. IDS systems are unable to decrypt it
  E. Traffic will not be modified in transit
  D. IDS systems are unable to decrypt it

  ---

  Because the traffic is encrypted, an IDS cannot understand it or evaluate the payload.