EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 621:

  Bret is a web application administrator and has just read that there are a number of surprisingly common web application vulnerabilities that can be exploited by unsophisticated attackers with easily available tools on the Internet.

  He has also read that when an organization deploys a web application, they invite the world to send HTTP requests. Attacks buried in these requests sail past firewalls, filters, platform hardening, SSL, and IDS without notice because they are inside legal HTTP requests. Bret is determined to weed out any vulnerabilities. What are some common vulnerabilities in web applications that he should be concerned about?

  A. Non-validated parameters, broken access control, broken account and session management, cross- side scripting and buffer overflows are just a few common vulnerabilities
  B. No IDS configured, anonymous user account set as default, missing latest security patch, no firewall filters set and visible clear text passwords are just a few common vulnerabilities
  C. Visible clear text passwords, anonymous user account set as default, missing latest security patch, no firewall filters set and no SSL configured are just a few common vulnerabilities
  D. No SSL configured, anonymous user account set as default, missing latest security patch, no firewall filters set and an inattentive system administrator are just a few common vulnerabilities
  A. Non-validated parameters, broken access control, broken account and session management, cross- side scripting and buffer overflows are just a few common vulnerabilities

• Question 622:

  Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weaknesses and key loggers.

  Which of the following options best represents the means that Bob can adopt to retrieve passwords from his clients hosts and servers.

  A. Hardware, Software, and Sniffing.
  B. Hardware and Software Keyloggers.
  C. Passwords are always best obtained using Hardware key loggers.
  D. Software only, they are the most effective.
  A. Hardware, Software, and Sniffing.

  ---

  Different types of keylogger planted into the environment would retrieve the passwords for Bob..

• Question 623:

  John is discussing security with Jane. Jane had mentioned to John earlier that she suspects an LKM has been installed on her server. She believes this is the reason that the server has been acting erratically lately. LKM stands for Loadable Kernel Module.

  What does this mean in the context of Linux Security?

  A. Loadable Kernel Modules are a mechanism for adding functionality to a file system without requiring a kernel recompilation.
  B. Loadable Kernel Modules are a mechanism for adding functionality to an operating-system kernel after it has been recompiled and the system rebooted.
  C. Loadable Kernel Modules are a mechanism for adding auditing to an operating-system kernel without requiring a kernel recompilation.
  D. Loadable Kernel Modules are a mechanism for adding functionality to an operating-system kernel without requiring a kernel recompilation.
  D. Loadable Kernel Modules are a mechanism for adding functionality to an operating-system kernel without requiring a kernel recompilation.

  ---

  Loadable Kernel Modules, or LKM, are object files that contain code to extend the running kernel, or so-called base kernel, without the need of a kernel recompilation. Operating systems other than Linux, such as BSD systems, also provide support for LKM's. However, the Linux kernel generally makes far greater and more versatile use of LKM's than other systems. LKM's are typically used to add support for new hardware, filesystems or for adding system calls. When the functionality provided by an LKM is no longer required, it can be unloaded, freeing memory.

• Question 624:

  Why would an ethical hacker use the technique of firewalking?

  A. It is a technique used to discover wireless network on foot.
  B. It is a technique used to map routers on a network link.
  C. It is a technique used to discover the nature of rules configured on a gateway.
  D. It is a technique used to discover interfaces in promiscuous mode.
  C. It is a technique used to discover the nature of rules configured on a gateway.

  ---

  Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker's host to a destination host through a packet-filtering device. This technique can be used to map `open' or `pass through' ports on a gateway. More over, it can determine whether packets with various control information can pass through a given gateway.

• Question 625:

  File extensions provide information regarding the underlying server technology. Attackers can use this information to search vulnerabilities and launch attacks. How would you disable file extensions in Apache servers?

  A. Use disable-eXchange
  B. Use mod_negotiation
  C. Use Stop_Files
  D. Use Lib_exchanges
  B. Use mod_negotiation

• Question 626:

  Which address translation scheme would allow a single public IP address to always correspond to a single machine on an internal network, allowing "server publishing"?

  A. Overloading Port Address Translation
  B. Dynamic Port Address Translation
  C. Dynamic Network Address Translation
  D. Static Network Address Translation
  D. Static Network Address Translation

  ---

  Mapping an unregistered IP address to a registered IP address on a one-to-one basis. Particularly useful when a device needs to be accessible from outside the network.

  

• Question 627:

  You are gathering competitive intelligence on an organization. You notice that they have jobs listed on a few Internet job-hunting sites. There are two jobs for network and system administrators. How can this help you in foot printing the organization?

  A. To learn about the IP range used by the target network
  B. To identify the number of employees working for the company
  C. To test the limits of the corporate security policy enforced in the company
  D. To learn about the operating systems, services and applications used on the network
  D. To learn about the operating systems, services and applications used on the network

• Question 628:

  John has a proxy server on his network which caches and filters web access. He shuts down all unnecessary ports and services. Additionally, he has installed a firewall (Cisco PIX) that will not allow users to connect to any outbound ports. Jack, a network user has successfully connected to a remote server on port 80 using netcat. He could in turn drop a shell from the remote machine. Assuming an attacker wants to penetrate John's network, which of the following options is he likely to choose?

  A. Use ClosedVPN
  B. Use Monkey shell
  C. Use reverse shell using FTP protocol
  D. Use HTTPTunnel or Stunnel on port 80 and 443
  D. Use HTTPTunnel or Stunnel on port 80 and 443

  ---

  As long as you allow http or https traffic attacks can be tunneled over those protocols with Stunnel or HTTPTunnel.

• Question 629:

  In Linux, the three most common commands that hackers usually attempt to Trojan are:

  A. car, xterm, grep
  B. netstat, ps, top
  C. vmware, sed, less
  D. xterm, ps, nc
  B. netstat, ps, top

  ---

  The easiest programs to trojan and the smartest ones to trojan are ones commonly run by administrators and users, in this case netstat, ps, and top, for a complete list of commonly trojaned and rootkited software please reference this URL: http://www.usenix.org/publications/login/1999- 9/features/rootkits.html

• Question 630:

  While probing an organization you discover that they have a wireless network. From your attempts to connect to the WLAN you determine that they have deployed MAC filtering by using ACL on the access points. What would be the easiest way to circumvent and communicate on the WLAN?

  A. Attempt to crack the WEP key using Airsnort.
  B. Attempt to brute force the access point and update or delete the MAC ACL.
  C. Steel a client computer and use it to access the wireless network.
  D. Sniff traffic if the WLAN and spoof your MAC address to one that you captured.
  D. Sniff traffic if the WLAN and spoof your MAC address to one that you captured.

  ---

  The easiest way to gain access to the WLAN would be to spoof your MAC address to one that already exists on the network.