EC-COUNCIL EC-COUNCIL Certifications 312-50V8 Questions & Answers

• Question 771:

  Which definition among those given below best describes a covert channel?

  A. A server program using a port that is not well known.

  B. Making use of a protocol in a way it is not intended to be used.

  C. It is the multiplexing taking place on a communication link.

  D. It is one of the weak channels used by WEP which makes it insecure.

  Correct Answer: B

• Question 772:

  What did the following commands determine?

  C:

  user2sid \earth guest S-1-5-21-343818398-789336058-1343024091-501 C:sid2user 5 21 343818398 789336058 1343024091 500 Name is Joe Domain is EARTH

  A.

  That the Joe account has a SID of 500

  B.

  These commands demonstrate that the guest account has NOT been disabled

  C.

  These commands demonstrate that the guest account has been disabled

  D.

  That the true administrator is Joe

  E.

  Issued alone,these commands prove nothing

  Correct Answer: D

• Question 773:

  Which of the following tools are used for enumeration? (Choose three.)

  A. SolarWinds

  B. USER2SID

  C. Cheops

  D. SID2USER

  E. DumpSec

  Correct Answer: BDE

• Question 774:

  Joseph was the Web site administrator for the Mason Insurance in New York, who's main Web site was

  located at www.masonins.com. Joseph uses his laptop computer regularly to administer the Web site.

  One night, Joseph received an urgent phone call from his friend, Smith. According to Smith, the main

  Mason Insurance web site had been vandalized! All of its normal content was removed and replaced with

  an attacker's message ''Hacker Message: You are dead! Freaks!

  From his office, which was directly connected to Mason Insurance's internal network, Joseph surfed to the

  Web site using his laptop. In his browser, the Web site looked completely intact. No changes were

  apparent. Joseph called a friend of his at his home to help troubleshoot the problem. The Web site

  appeared defaced when his friend visited using his DSL connection. So, while Smith and his friend could

  see the defaced page, Joseph saw the intact Mason Insurance web site. To help make sense of this

  problem, Joseph decided to access the Web site using his dial-up ISP. He disconnected his laptop from

  the corporate internal network and used his modem to dial up the same ISP used by Smith.

  After his modem connected, he quickly typed www.masonins.com in his browser to reveal the following

  web page:

  H@cker Mess@ge:

  Y0u @re De@d! Fre@ks!

  After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal network,

  and used Secure Shell (SSH) to log in directly to the Web server. He ran

  Tripwire against the entire Web site, and determined that every system file and all the Web content on the

  server were intact.

  How did the attacker accomplish this hack?

  A. ARP spoofing

  B. SQL injection

  C. DNS poisoning

  D. Routing table injection

  Correct Answer: C

• Question 775:

  Which DNS resource record can indicate how long any "DNS poisoning" could last?

  A. MX

  B. SOA

  C. NS

  D. TIMEOUT

  Correct Answer: B

• Question 776:

  Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B.

  How do you prevent DNS spoofing? (Select the Best Answer.)

  A. Install DNS logger and track vulnerable packets

  B. Disable DNS timeouts

  C. Install DNS Anti-spoofing

  D. Disable DNS Zone Transfer

  Correct Answer: C

• Question 777:

  A zone file consists of which of the following Resource Records (RRs)?

  A. DNS,NS,AXFR,and MX records

  B. DNS,NS,PTR,and MX records

  C. SOA,NS,AXFR,and MX records

  D. SOA,NS,A,and MX records

  Correct Answer: D

• Question 778:

  Tess King is using the nslookup command to craft queries to list all DNS information (such as Name Servers, host names, MX records, CNAME records, glue records (delegation for child Domains), zone serial number, TimeToLive (TTL) records, etc) for a Domain.

  What do you think Tess King is trying to accomplish? Select the best answer.

  A. A zone harvesting

  B. A zone transfer

  C. A zone update

  D. A zone estimate

  Correct Answer: B

• Question 779:

  You have the SOA presented below in your Zone. Your secondary servers have not been able to contact your primary server to synchronize information. How long will the secondary servers attempt to contact the primary server before it considers that zone is dead and stops responding to queries?

  collegae.edu.SOA, cikkye.edu ipad.college.edu. (200302028 3600 3600 604800 3600) A. One day

  B. One hour

  C. One week

  D. One month

  Correct Answer: C

• Question 780:

  Which of the following statements about a zone transfer correct?(Choose three.)

  A. A zone transfer is accomplished with the DNS

  B. A zone transfer is accomplished with the nslookup service

  C. A zone transfer passes all zone information that a DNS server maintains

  D. A zone transfer passes all zone information that a nslookup server maintains

  E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections

  F. Zone transfers cannot occur on the Internet

  Correct Answer: ACE