EC-COUNCIL EC-COUNCIL Certifications 312-50V8 Questions & Answers

• Question 721:

  In the following example, which of these is the "exploit"?

  Today, Microsoft Corporation released a security notice. It detailed how a person could bring down the Windows 2003 Server operating system, by sending malformed packets to it. They detailed how this malicious process had been automated using basic scripting.

  Even worse, the new automated method for bringing down the server has already been used to perform denial of service attacks on many large commercial websites. Select the best answer.

  A. Microsoft Corporation is the exploit.

  B. The security "hole" in the product is the exploit.

  C. Windows 2003 Server

  D. The exploit is the hacker that would use this vulnerability.

  E. The documented method of how to use the vulnerability to gain unprivileged access.

  Correct Answer: E

• Question 722:

  One of your junior administrator is concerned with Windows LM hashes and password cracking. In your discussion with them, which of the following are true statements that you would point out? Select the best answers.

  A. John the Ripper can be used to crack a variety of passwords,but one limitation is that the output doesn't show if the password is upper or lower case.

  B. BY using NTLMV1,you have implemented an effective countermeasure to password cracking.

  C. SYSKEY is an effective countermeasure.

  D. If a Windows LM password is 7 characters or less,the hash will be passed with the following characters,in HEX- 00112233445566778899.

  E. Enforcing Windows complex passwords is an effective countermeasure.

  Correct Answer: ACE

• Question 723:

  You are a Administrator of Windows server. You want to find the port number for POP3.

  What file would you find the information in and where? Select the best answer.

  A. %windir%\\etc\\services

  B. system32\\drivers\\etc\\services

  C. %windir%\\system32\\drivers\\etc\\services

  D. /etc/services

  E. %windir%/system32/drivers/etc/services

  Correct Answer: C

• Question 724:

  _____ is the process of converting something from one representation to the simplest form. It deals with the way in which systems convert data from one form to another.

  A. Canonicalization

  B. Character Mapping

  C. Character Encoding

  D. UCS transformation formats

  Correct Answer: A

• Question 725:

  Which type of attack is port scanning?

  A. Web server attack

  B. Information gathering

  C. Unauthorized access

  D. Denial of service attack

  Correct Answer: B

• Question 726:

  Which of the following keyloggers cannot be detected by anti-virus or anti-spyware products?

  A. Covert keylogger

  B. Stealth keylogger

  C. Software keylogger

  D. Hardware keylogger

  Correct Answer: D

• Question 727:

  LM authentication is not as strong as Windows NT authentication so you may want to disable its use, because an attacker eavesdropping on network traffic will attack the weaker protocol. A successful attack can compromise the user's password.

  How do you disable LM authentication in Windows XP?

  A. Stop the LM service in Windows XP

  B. Disable LSASS service in Windows XP

  C. Disable LM authentication in the registry

  D. Download and install LMSHUT.EXE tool from Microsoft website

  Correct Answer: C

• Question 728:

  Attackers can potentially intercept and modify unsigned SMB packets, modify the traffic and forward it so that the server might perform undesirable actions. Alternatively, the attacker could pose as the server or client after a legitimate authentication and gain unauthorized access to data.

  Which of the following is NOT a means that can be used to minimize or protect against such an attack?

  A. Timestamps

  B. SMB Signing

  C. File permissions

  D. Sequence numbers monitoring

  Correct Answer: ABD

• Question 729:

  What file system vulnerability does the following command take advantage of? type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe

  A. HFS

  B. ADS

  C. NTFS

  D. Backdoor access

  Correct Answer: B

• Question 730:

  What does the following command in netcat do? nc -l -u -p55555 < /etc/passwd

  A. logs the incoming connections to /etc/passwd file

  B. loads the /etc/passwd file to the UDP port 55555

  C. grabs the /etc/passwd file when connected to UDP port 55555

  D. deletes the /etc/passwd file when connected to the UDP port 55555

  Correct Answer: C