EC-COUNCIL EC-COUNCIL Certifications 312-50V8 Questions & Answers

• Question 711:

  Which of the following Netcat commands would be used to perform a UDP scan of the lower 1024 ports?

  A. Netcat -h -U

  B. Netcat -hU

  C. Netcat -sU -p 1-1024

  D. Netcat -u -v -w2 1-1024

  E. Netcat -sS -O target/1024

  Correct Answer: D

• Question 712:

  Jason's Web server was attacked by a trojan virus. He runs protocol analyzer and notices that the trojan communicates to a remote server on the Internet. Shown below is the standard "hexdump" representation of the network packet, before being decoded. Jason wants to identify the trojan by looking at the destination port number and mapping to a trojan-port number database on the Internet.

  Identify the remote server's port number by decoding the packet?

  A. Port 1890 (Net-Devil Trojan)

  B. Port 1786 (Net-Devil Trojan)

  C. Port 1909 (Net-Devil Trojan)

  D. Port 6667 (Net-Devil Trojan)

  Correct Answer: D

• Question 713:

  In Linux, the three most common commands that hackers usually attempt to Trojan are:

  A. car,xterm,grep

  B. netstat,ps,top

  C. vmware,sed,less

  D. xterm,ps,nc

  Correct Answer: B

• Question 714:

  John wishes to install a new application onto his Windows 2000 server. He wants to ensure that any application he uses has not been Trojaned. What can he do to help ensure this?

  A. Compare the file's MD5 signature with the one published on the distribution media

  B. Obtain the application via SSL

  C. Compare the file's virus signature with the one published on the distribution media

  D. Obtain the application from a CD-ROM disc

  Correct Answer: A

• Question 715:

  You suspect that your Windows machine has been compromised with a Trojan virus. When you run anti-virus software it does not pick of the Trojan. Next you run netstat command to look for open ports and you notice a strange port 6666 open.

  What is the next step you would do?

  A. Re-install the operating system.

  B. Re-run anti-virus software.

  C. Install and run Trojan removal software.

  D. Run utility fport and look for the application executable that listens on port 6666.

  Correct Answer: D

• Question 716:

  After an attacker has successfully compromised a remote computer, what would be one of the last steps that would be taken to ensure that the compromise is not traced back to the source of the problem?

  A. Install pactehs

  B. Setup a backdoor

  C. Cover your tracks

  D. Install a zombie for DDOS

  Correct Answer: C

• Question 717:

  You have hidden a Trojan file virus.exe inside another file readme.txt using NTFS streaming.

  Which command would you execute to extract the Trojan to a standalone file?

  A. c:\> type readme.txt:virus.exe > virus.exe

  B. c:\> more readme.txt | virus.exe > virus.exe

  C. c:\> cat readme.txt:virus.exe > virus.exe

  D. c:\> list redme.txt$virus.exe > virus.exe

  Correct Answer: C

• Question 718:

  You want to use netcat to generate huge amount of useless network data continuously for various performance testing between 2 hosts.

  Which of the following commands accomplish this?

  A. Machine A #yes AAAAAAAAAAAAAAAAAAAAAA | nc –v –v –l –p 2222 > /dev/null

  Machine B

  #yes BBBBBBBBBBBBBBBBBBBBBB | nc machinea 2222 > /dev/null

  B. Machine A cat somefile | nc –v –v –l –p 2222

  Machine B

  cat somefile | nc othermachine 2222

  C. Machine A nc –l –p 1234 | uncompress –c | tar xvfp

  Machine B

  tar cfp - /some/dir | compress –c | nc –w 3 machinea 1234

  D. Machine A while true : do nc –v –l –s –p 6000 machineb 2

  Machine B

  while true ; do

  nc –v –l –s –p 6000 machinea 2 done

  Correct Answer: A

• Question 719:

  What is a Trojan Horse?

  A. A malicious program that captures your username and password

  B. Malicious code masquerading as or replacing legitimate code

  C. An unauthorized user who gains access to your user database and adds themselves as a user

  D. A server that is to be sacrificed to all hacking attempts in order to log and monitor the hacking activity

  Correct Answer: B

• Question 720:

  Assuring two systems that are using IPSec to protect traffic over the internet, what type of general attack could compromise the data?

  A. Spoof Attack

  B. Smurf Attack

  C. Man inthe Middle Attack

  D. Trojan Horse Attack

  E. Back Orifice Attack

  Correct Answer: DE