EC-COUNCIL Certified Ethical Hacker 312-50 Questions & Answers

• Question 31:

  The FIN flag is set and sent from host A to host B when host A has no more data to transmit (Closing a TCP connection). This flag releases the connection resources. However, host A can continue to receive data as long as the SYN sequence number of transmitted packets from host B are lower than the packet segment containing the set FIN flag.

  A. True

  B. False

  Correct Answer: A

  For sequence number purposes, the SYN is considered to occur before the first actual data octet of the segment in which it occurs, while the FIN is considered to occur after the last actual data octet in a segment in which it occurs. So packets receiving out of order will still be accepted.

• Question 32:

  War dialing is one of the oldest methods of gaining unauthorized access to the target systems, it is one of the dangers most commonly forgotten by network engineers and system administrators. A hacker can sneak past all the expensive firewalls and IDS and connect easily into the network. Through wardialing an attacker searches for the devices located in the target network infrastructure that are also accessible through the telephone line.

  `Dial backup' in routers is most frequently found in networks where redundancy is required. Dial-on- demand routing(DDR) is commonly used to establish connectivity as a backup.

  As a security testers, how would you discover what telephone numbers to dial-in to the router?

  A. Search the Internet for leakage for target company's telephone number to dial-in

  B. Run a war-dialing tool with range of phone numbers and look for CONNECT Response

  C. Connect using ISP's remote-dial in number since the company's router has a leased line connection established with them

  D. Brute force the company's PABX system to retrieve the range of telephone numbers to dial-in

  Correct Answer: B

  Use a program like Toneloc to scan the company's range of phone numbers.

• Question 33:

  Jack is conducting a port scan of a target network. He knows that his target network has a web server and that a mail server is up and running. Jack has been sweeping the network but has not been able to get any responses from the remote target. Check all of the following that could be a likely cause of the lack of response?

  A. The host might be down

  B. UDP is filtered by a gateway

  C. ICMP is filtered by a gateway

  D. The TCP window Size does not match

  E. The destination network might be down

  F. The packet TTL value is too low and can't reach the target

  Correct Answer: ACEF

  Wrong answers is B and D as sweeping a network uses ICMP

• Question 34:

  You are scanning the target network for the first time. You are able to detect few convention open ports. While attempting to perform conventional service identification by connecting to the open ports, the scan yields either bad or no result. As you are unsure of the protocols in use, you want to discover as many different protocols as possible. Which of the following scan options can help you achieve this?

  A. Nessus sacn with TCP based pings

  B. Netcat scan with the switches

  C. Nmap scan with the P (ping scan) switch

  D. Nmap with the O (Raw IP Packets switch

  Correct Answer: D

  -sO IP protocol scans: This method is used to determine which IP protocols are supported on a host. The technique is to send raw IP packets without any further protocol header to each specified protocol on the target machine. If we receive an ICMP protocol unreachable message, then the protocol is not in use. Otherwise we assume it is open. Note that some hosts (AIX, HP-UX, Digital UNIX) and firewalls may not send protocol unreachable messages.

• Question 35:

  Paula works as the primary help desk contact for her company. Paula has just received a call from a user reporting that his computer just displayed a Blue Screen of Death screen and he ca no longer work. Paula walks over to the user's computer and sees the Blue Screen of Death screen. The user's computer is running Windows XP, but the Blue screen looks like a familiar one that Paula had seen a Windows 2000 Computers periodically.

  The user said he stepped away from his computer for only 15 minutes and when he got back, the Blue Screen was there. Paula also noticed that the hard drive activity light was flashing meaning that the computer was processing some thing.

  Paula knew this should not be the case since the computer should be completely frozen during a Blue screen. She checks the network IDS live log entries and notices numerous nmap scan alerts.

  What is Paula seeing happen on this computer?

  A. Paula's Network was scanned using FloppyScan

  B. Paula's Netwrok was scanned using Dumpsec

  C. There was IRQ conflict in Paula's PC

  D. Tool like Nessus will cause BSOD

  Correct Answer: A

  Floppyscan is a dangerous hacking tool which can be used to portscan a system using a floppy disk Bootsup mini Linux Displays Blue screen of death screen Port scans the network using NMAP Send the results by e-mail to a remote server.

• Question 36:

  Samantha has been actively scanning the client network for which she is doing a vulnerability assessment test. While doing a port scan she notices ports open in the 135 to 139 range. What protocol is most likely to be listening on those ports?

  A. SMB

  B. FTP

  C. SAMBA

  D. FINGER

  Correct Answer: A

  Port 135 is for RPC and 136-139 is for NetBIOS traffic. SMB is an upper layer service that runs on top of the Session Service and the Datagram service of NetBIOS.

• Question 37:

  Lori has just been tasked by her supervisor conduct vulnerability scan on the corporate network. She has been instructed to perform a very thorough test of the network to ensure that there are no security holes on any of the machines. Lori's company does not own any commercial scanning products, so she decides to download a free one off the Internet. Lori has never done a vulnerability scan before, so she is unsure of some of the settings available in the software she downloaded. One of the option is to choose which ports that can be scanned. Lori wants to do exactly what her boos has told her, but she does not know ports should be scanned.

  If Lori is supposed to scan all known TCP ports, how many ports should she select in the software?

  A. 65536

  B. 1024

  C. 1025

  D. Lori should not scan TCP ports, only UDP ports

  Correct Answer: A

  In both TCP and UDP, each packet header will specify a source port and a destination port, each of which is a 16-bit unsigned integer (i.e. ranging from 0 to 65535).

• Question 38:

  Mark works as a contractor for the Department of Defense and is in charge of network security. He has spent the last month securing access to his network from all possible entry points. He has segmented his network into several subnets and has installed firewalls all over the network. He has placed very stringent rules on all the firewalls, blocking everything in and out except ports that must be used. He does need to have port 80 open since his company hosts a website that must be accessed from the Internet. Mark is fairly confident of his perimeter defense, but is still worried about programs like Hping2 that can get into a network through convert channels.

  How should mark protect his network from an attacker using Hping2 to scan his internal network?

  A. Blocking ICMP type 13 messages

  B. Block All Incoming traffic on port 53

  C. Block All outgoing traffic on port 53 D. Use stateful inspection on the firewalls

  Correct Answer: A

  An ICMP type 13 message is an ICMP timestamp request and waits for an ICMP timestamp reply. The remote node is right to do, still it would not be necessary as it is optional and thus many ip stacks ignore such packets. Nevertheless, nmap again achived to make its packets unique by setting the originating timestamp field in the packet to 0.

• Question 39:

  John has performed a scan of the web server with NMAP but did not gather enough information to accurately identify which operating system is running on the remote host. How could you use a web server to help in identifying the OS that is being used?

  A. Telnet to an Open port and grab the banner

  B. Connect to the web server with an FTP client

  C. Connect to the web server with a browser and look at the web page

  D. Telnet to port 8080 on the web server and look at the default page code

  Correct Answer: A

  Most Web servers politely identify themselves and the OS to anyone who asks.

• Question 40:

  Which FTP transfer mode is required for FTP bounce attack?

  A. Active Mode

  B. Passive Mode

  C. User Mode

  D. Anonymous Mode

  Correct Answer: B

  FTP bounce attack needs the server the support passive connections and the client program needs to use PORT command instead of the PASV command.