EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 681:

  In the context of using PKI, when Sven wishes to send a secret message to Bob, he looks up Bob's public key in a directory, uses it to encrypt the message before sending it off. Bob then uses his private key to decrypt the message and reads it. No one listening on can decrypt the message. Anyone can send an encrypted message to Bob but only Bob can read it. Thus, although many people may know Bob's public key and use it to verify Bob's signature, they cannot discover Bob's private key and use it to forge digital signatures.

  What does this principle refer to?

  A. Irreversibility
  B. Non-repudiation
  C. Symmetry
  D. Asymmetry
  D. Asymmetry

  ---

  PKI uses asymmetric key pair encryption. One key of the pair is the only way to decrypt data encrypted with the other.

• Question 682:

  Which of the following is an automated vulnerability assessment tool.

  A. Whack a Mole
  B. Nmap
  C. Nessus
  D. Kismet
  E. Jill32
  C. Nessus

  ---

  Nessus is a vulnerability assessment tool.

• Question 683:

  Jackson discovers that the wireless AP transmits 128 bytes of plaintext, and the station responds by encrypting the plaintext. It then transmits the resulting ciphertext using the same key and cipher that are used by WEP to encrypt subsequent network traffic. What authentication mechanism is being followed here?

  A. no authentication
  B. single key authentication
  C. shared key authentication
  D. open system authentication
  C. shared key authentication

  ---

  The following picture shows how the WEP authentication procedure:

  

• Question 684:

  Kevin is an IT security analyst working for Emerson Time Makers, a watch manufacturing company in Miami. Kevin and his girlfriend Katy recently broke up after a big fight. Kevin believes that she was seeing another person. Kevin, who has an online email account that he uses for most of his mail, knows that Katy has an account with that same company. Kevin logs into his email account online and gets the following URL after successfully logged in: http:// www.youremailhere.com/ mail.asp? mailbox=KevinandSmith=121%22 Kevin changes the URL to: http://www.youremailhere.com/mail.asp? mailbox=KatyandSanchez=121%22 Kevin is trying to access her email account to see if he can find out any information. What is Kevin attempting here to gain access to Katy's mailbox?

  A. This type of attempt is called URL obfuscation when someone manually changes a URL to try and gain unauthorized access
  B. By changing the mailbox's name in the URL, Kevin is attempting directory transversal
  C. Kevin is trying to utilize query string manipulation to gain access to her email account
  D. He is attempting a path-string attack to gain access to her mailbox
  C. Kevin is trying to utilize query string manipulation to gain access to her email account

• Question 685:

  Barney is looking for a Windows NT/2000/XP command-line tool that can be used to assign display or modify ACLs (Access Control Lists) to files or folders and that could also be used within batch files. Which of the following tools could be used for this purpose?

  A. PERM.EXE
  B. CACLS.EXE
  C. CLACS.EXE
  D. NTPERM.EXE
  B. CACLS.EXE

  ---

  Cacls.exe (Change Access Control Lists) is an executable in Microsoft Windows to change Access Control List (ACL) permissions on a directory, its subcontents, or files. An access control list is a list of permissions for a file or directory that controls who can access it.

• Question 686:

  What do you call a pre-computed hash?

  A. Sun tables
  B. Apple tables
  C. Rainbow tables
  D. Moon tables
  C. Rainbow tables

• Question 687:

  Why attackers use proxy servers?

  A. To ensure the exploits used in the attacks always flip reverse vectors
  B. Faster bandwidth performance and increase in attack speed
  C. Interrupt the remote victim's network traffic and reroute the packets to attackers machine
  D. To hide the source IP address so that an attacker can hack without any legal corollary
  D. To hide the source IP address so that an attacker can hack without any legal corollary

• Question 688:

  Jacob would like your advice on using a wireless hacking tool that can save him time and get him better results with lesser packets. You would like to recommend a tool that uses KoreK's implementation. Which tool would you recommend from the list below?

  A. Kismet
  B. Shmoo
  C. Aircrack
  D. John the Ripper
  C. Aircrack

  ---

  Implementing KoreK's attacks as well as improved FMS, aircrack provides the fastest and most effective statistical attacks available. John the Ripper is a password cracker, Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system, and

• Question 689:

  Basically, there are two approaches to network intrusion detection: signature detection, and anomaly detection. The signature detection approach utilizes well- known signatures for network traffic to identify potentially malicious traffic. The anomaly detection approach utilizes a previous history of network traffic to search for patterns that are abnormal, which would indicate an intrusion. How can an attacker disguise his buffer overflow attack signature such that there is a greater probability of his attack going undetected by the IDS?

  A. He can use a shellcode that will perform a reverse telnet back to his machine
  B. He can use a dynamic return address to overwrite the correct value in the target machine computer memory
  C. He can chain NOOP instructions into a NOOP "sled" that advances the processor's instruction pointer to a random place of choice
  D. He can use polymorphic shell code-with a tool such as ADMmutate - to change the signature of his exploit as seen by a network IDS
  D. He can use polymorphic shell code-with a tool such as ADMmutate - to change the signature of his exploit as seen by a network IDS

  ---

  ADMmutate is using a polymorphic technique designed to circumvent certain forms of signature based intrusion detection. All network based remote buffer overflow exploits have similarities in how they function. ADMmutate has the ability to emulate the protocol of the service the attacker is attempting to exploit. The data payload (sometimes referred to as an egg) contains the instructions the attacker wants to execute on the target machine. These eggs are generally interchangeable and can be utilized in many different buffer overflow exploits. ADMmutate uses several techniques to randomize the contents of the egg in any given buffer overflow exploit. This randomization effectively changes the content or 'signature' of the exploit without changing the functionality of the exploit.

• Question 690:

  You are the chief information officer for your company, a shipping company based out of Oklahoma City. You are responsible for network security throughout the home office and all branch offices. You have implemented numerous layers of security from logical to physical. As part of your procedures, you perform a yearly network assessment which includes vulnerability analysis, internal network scanning, and external penetration tests. Your main concern currently is the server in the DMZ which hosts a number of company websites. To see how the server appears to external users, you log onto a laptop at a Wi-Fi hot spot. Since you already know the IP address of the web server, you create a telnet session to that server and type in the command:

  HEAD /HTTP/1.0

  After typing in this command, you are presented with the following screen:

  What are you trying to do here?

  A. You are attempting to send an html file over port 25 to the web server.
  B. By typing in the HEAD command, you are attempting to create a buffer overflow on the web server.
  C. You are trying to open a remote shell to the web server.
  D. You are trying to grab the banner of the web server. *
  D. You are trying to grab the banner of the web server. *