EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 351:

  Which of the following Nmap commands would be used to perform a stack fingerprinting?

  A. Nmap -O -p80
  B. Nmap -hU -Q
  C. Nmap -sT -p
  D. Nmap -u -o -w2
  E. Nmap -sS -0p target
  A. Nmap -O -p80

  ---

  This option activates remote host identification via TCP/IP fingerprinting. In other words, it uses a bunch of techniques to detect subtlety in the underlying operating system network stack of the computers you are scanning. It uses this information to create a "fingerprint" which it compares with its database of known OS fingerprints (the nmap-os-fingerprints file. to decide what type of system you are scanning.

• Question 352:

  Which of the following represents the initial two commands that an IRC client sends to join an IRC network?

  A. USER, NICK
  B. LOGIN, NICK
  C. USER, PASS
  D. LOGIN, USER
  A. USER, NICK

  ---

  A "PASS" command is not required for either client or server connection to be registered, but it must precede the server message or the latter of the NICK/USER combination. (RFC 1459)

• Question 353:

  Which of the following is true of the wireless Service Set ID (SSID)? (Select all that apply.)

  A. Identifies the wireless network
  B. Acts as a password for network access
  C. Should be left at the factory default setting
  D. Not broadcasting the SSID defeats NetStumbler and other wireless discovery tools
  A. Identifies the wireless network
  B. Acts as a password for network access

• Question 354:

  Hayden is the network security administrator for her company, a large finance firm based in Miami. Hayden just returned from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. Hayden is worried about the current security state of her company's network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established she sends RST packets to those hosts to stop the session. She does this to see how her intrusion detection system will log the traffic. What type of scan is Hayden attempting here?

  A. Hayden is attempting to find live hosts on her company's network by using an XMAS scan
  B. She is utilizing a SYN scan to find live hosts that are listening on her network
  C. The type of scan, she is using is called a NULL scan
  D. Hayden is using a half-open scan to find live hosts on her network
  D. Hayden is using a half-open scan to find live hosts on her network

• Question 355:

  The GET method should never be used when sensitive data such as credit card is being sent to a CGI program. This is because any GET command will appear in the URL, and will be logged by any servers. For example, let's say that you've entered your credit card information into a form that uses the GET method. The URL may appear like this:

  https://www.xsecurity-bank.com/creditcard.asp?cardnumber=453453433532234

  The GET method appends the credit card number to the URL. This means that anyone with access to a server log will be able to obtain this information. How would you protect from this type of attack?

  A. Never include sensitive information in a script
  B. Use HTTPS SSLv3 to send the data instead of plain HTTPS
  C. Replace the GET with POST method when sending data
  D. Encrypt the data before you send using GET method
  C. Replace the GET with POST method when sending data

• Question 356:

  SYN Flood is a DOS attack in which an attacker deliberately violates the three-way handshake and opens a large number of half-open TCP connections.

  The signature for SYN Flood attack is:

  A. The source and destination address having the same value.
  B. The source and destination port numbers having the same value.
  C. A large number of SYN packets appearing on a network without the corresponding reply packets.
  D. A large number of SYN packets appearing on a network with the corresponding reply packets.
  C. A large number of SYN packets appearing on a network without the corresponding reply packets.

  ---

  A SYN attack occurs when an attacker exploits the use of the buffer space during a Transmission Control Protocol (TCP) session initialization handshake. The attacker floods the target system's small "in-process" queue with connection requests, but it does not respond when a target system replies to those requests. This causes the target system to time out while waiting for the proper response, which makes the system crash or become unusable.

• Question 357:

  One of the most common and the best way of cracking RSA encryption is to being to derive the two prime numbers, which are used in the RSA PKI mathematical process. If the two numbers p and q are discovered through a _________________ process, then the private key can be derived.

  A. Factorization
  B. Prime Detection
  C. Hashing
  D. Brute-forcing
  A. Factorization

  ---

  In April 1994, an international cooperative group of mathematicians and computer scientists solved a 17-year-old challenge problem, the factoring of a 129-digit number, called RSA-129, into two primes. That is, RSA-129 = 1143816257578888676692357799761466120102182 9672124236256256184293570693524573389783059 7123563958705058989075147599290026879543541 = 34905295108476509491478496199038 98133417764638493387843990820577 times 32769132993266709549961988190834 461413177642967992942539798288533. Se more at http://en.wikipedia.org/wiki/RSA_Factoring_Challenge

• Question 358:

  Ivan is auditing a corporate website. Using Winhex, he alters a cookie as shown below.

  Before Alteration: Cookie: lang=en-us; ADMIN=no; y=1 ; time=10:30GMT ;

  After Alteration: Cookie: lang=en-us; ADMIN=yes; y=1 ; time=12:30GMT ;

  What attack is being depicted here?

  A. Cookie Stealing
  B. Session Hijacking
  C. Cross Site Scripting
  D. Parameter Manipulation
  D. Parameter Manipulation

  ---

  Cookies are the preferred method to maintain state in the stateless HTTP protocol. They are however also used as a convenient mechanism to store user preferences and other data including session tokens. Both persistent and non-persistent cookies, secure or insecure can be modified by the client and sent to the server with URL requests. Therefore any malicious user can modify cookie content to his advantage. There is a popular misconception that non-persistent cookies cannot be modified but this is not true; tools like Winhex are freely available. SSL also only protects the cookie in transit.

• Question 359:

  Which of the following systems would not respond correctly to an nmap XMAS scan?

  A. Windows 2000 Server running IIS 5
  B. Any Solaris version running SAMBA Server
  C. Any version of IRIX
  D. RedHat Linux 8.0 running Apache Web Server
  A. Windows 2000 Server running IIS 5

  ---

  When running a XMAS Scan, if a RST packet is received, the port is considered closed, while no response means it is open|filtered. The big downside is that not all systems follow RFC 793 to the letter. A number of systems send RST responses to the probes regardless of whether the port is open or not. This causes all of the ports to be labeled closed. Major operating systems that do this are Microsoft Windows, many Cisco devices, BSDI, and IBM OS/400.

• Question 360:

  Neil is a network administrator working in Istanbul. Neil wants to setup a protocol analyzer on his network that will receive a copy of every packet that passes through the main office switch. What type of port will Neil need to setup in order to accomplish this?

  A. Neil will have to configure a Bridged port that will copy all packets to the protocol analyzer.
  B. Neil will need to setup SPAN port that will copy all network traffic to the protocol analyzer.
  C. He will have to setup an Ether channel port to get a copy of all network traffic to the analyzer.
  D. He should setup a MODS port which will copy all network traffic.
  B. Neil will need to setup SPAN port that will copy all network traffic to the protocol analyzer.