EC-COUNCIL CEH v10 312-50V10 Questions & Answers

• Question 21:

  A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers.

  A. Use port security on his switches.

  B. Use a tool like ARPwatch to monitor for strange ARP activity.

  C. Use a firewall between all LAN segments.

  D. If you have a small network, use static ARP entries.

  E. Use only static IP addresses on all PC's.

  Correct Answer: ABD

• Question 22:

  Which of the following represents the initial two commands that an IRC client sends to join an IRC network?

  A. USER, NICK

  B. LOGIN, NICK

  C. USER, PASS

  D. LOGIN, USER

  Correct Answer: A

• Question 23:

  John is an incident handler at a financial institution. His steps in a recent incident are not up to the standards of the company. John frequently forgets some steps and procedures while handling responses as they are very stressful to perform. Which of the following actions should John take to overcome this problem with the least administrative effort?

  A. Create an incident checklist.

  B. Select someone else to check the procedures.

  C. Increase his technical skills.

  D. Read the incident manual every time it occurs.

  Correct Answer: C

• Question 24:

  Eve is spending her day scanning the library computers. She notices that Alice is using a computer whose port 445 is active and listening. Eve uses the ENUM tool to enumerate Alice machine. From the command prompt, she types the following command.

  

  What is Eve trying to do?

  A. Eve is trying to connect as a user with Administrator privileges

  B. Eve is trying to enumerate all users with Administrative privileges

  C. Eve is trying to carry out a password crack for user Administrator

  D. Eve is trying to escalate privilege of the null user to that of Administrator

  Correct Answer: C

• Question 25:

  One of your team members has asked you to analyze the following SOA record.

  What is the TTL? Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.)

  A. 200303028

  B. 3600

  C. 604800

  D. 2400

  E. 60

  F. 4800

  Correct Answer: D

• Question 26:

  What do Trinoo, TFN2k, WinTrinoo, T-Sight, and Stracheldraht have in common?

  A. All are hacking tools developed by the legion of doom

  B. All are tools that can be used not only by hackers, but also security personnel

  C. All are DDOS tools

  D. All are tools that are only effective against Windows

  E. All are tools that are only effective against Linux

  Correct Answer: C

• Question 27:

  You are attempting to crack LM Manager hashed from Windows 2000 SAM file. You will be using LM Brute force hacking tool for decryption. What encryption algorithm will you be decrypting?

  A. MD4

  B. DES

  C. SHA

  D. SSL

  Correct Answer: B

• Question 28:

  Yancey is a network security administrator for a large electric company. This company provides power for over 100, 000 people in Las Vegas. Yancey has worked for his company for over 15 years and has become very successful. One day, Yancey comes in to work and finds out that the company will be downsizing and he will be out of a job in two weeks. Yancey is very angry and decides to place logic bombs, viruses, Trojans, and backdoors all over the network to take down the company once he has left. Yancey does not care if his actions land him in jail for 30 or more years, he just wants the company to pay for what they are doing to him.

  What would Yancey be considered?

  A. Yancey would be considered a Suicide Hacker

  B. Since he does not care about going to jail, he would be considered a Black Hat

  C. Because Yancey works for the company currently; he would be a White Hat

  D. Yancey is a Hacktivist Hacker since he is standing up to a company that is downsizing

  Correct Answer: A

• Question 29:

  Which address translation scheme would allow a single public IP address to always correspond to a single machine on an internal network, allowing "server publishing"?

  A. Overloading Port Address Translation

  B. Dynamic Port Address Translation

  C. Dynamic Network Address Translation

  D. Static Network Address Translation

  Correct Answer: D

• Question 30:

  If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?

  A. Birthday

  B. Brute force

  C. Man-in-the-middle

  D. Smurf

  Correct Answer: B