EC-COUNCIL EC0-350 Online Practice Questions and Exam Preparation

EC-COUNCIL EC0-350 Online Questions & Answers

• Question 201:

  While performing a ping sweep of a local subnet you receive an ICMP reply of Code 3/Type 13 for all the pings you have sent out. What is the most likely cause of this?

  A. The firewall is dropping the packets
  B. An in-line IDS is dropping the packets
  C. A router is blocking ICMP
  D. The host does not respond to ICMP packets
  C. A router is blocking ICMP

• Question 202:

  Shayla is an IT security consultant, specializing in social engineering and external penetration tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense. Shayla has been given authority to perform any and all tests necessary to audit the company's network security.

  No employees for the company, other than the IT director, know about Shayla's work she will be doing. Shayla's first step is to obtain a list of employees through company website contact pages. Then she befriends a female employee of the company through an online chat website. After meeting with the female employee numerous times, Shayla is able to gain her trust and they become friends. One day, Shayla steals the employee's access badge and uses it to gain unauthorized access to the Treks Avionics offices.

  What type of insider threat would Shayla be considered?

  A. She would be considered an Insider Affiliate
  B. Because she does not have any legal access herself, Shayla would be considered an Outside Affiliate
  C. Shayla is an Insider Associate since she has befriended an actual employee
  D. Since Shayla obtained access with a legitimate company badge; she would be considered a Pure Insider
  A. She would be considered an Insider Affiliate

• Question 203:

  Which of the following is optimized for confidential communications, such as bidirectional voice and video?

  A. RC4
  B. RC5
  C. MD4
  D. MD5
  A. RC4

• Question 204:

  What is the IV key size used in WPA2?

  A. 32
  B. 24
  C. 16
  D. 48
  E. 128
  D. 48

• Question 205:

  Jacob would like your advice on using a wireless hacking tool that can save him time and get him better results with lesser packets. You would like to recommend a tool that uses KoreK's implementation. Which tool would you recommend from the list below?

  A. Kismet
  B. Shmoo
  C. Aircrack
  D. John the Ripper
  C. Aircrack

• Question 206:

  The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The file Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.

  He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below:

  

  What can you infer from the exploit given?

  A. It is a local exploit where the attacker logs in using username johna2k.
  B. There are two attackers on the system ?johna2k and haxedj00.
  C. The attack is a remote exploit and the hacker downloads three files.
  D. The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port.
  C. The attack is a remote exploit and the hacker downloads three files.

• Question 207:

  While performing ping scans into a target network you get a frantic call from the organization's security team. They report that they are under a denial of service attack. When you stop your scan, the smurf attack event stops showing up on the organization's IDS monitor. How can you modify your scan to prevent triggering this event in the IDS?

  A. Scan more slowly.
  B. Do not scan the broadcast IP.
  C. Spoof the source IP address.
  D. Only scan the Windows systems.
  B. Do not scan the broadcast IP.

• Question 208:

  Bill is a security analyst for his company. All the switches used in the company's office are Cisco switches. Bill wants to make sure all switches are safe from ARP poisoning. How can Bill accomplish this?

  A. Bill can use the command: ip dhcp snooping.
  B. Bill can use the command: no ip snoop.
  C. Bill could use the command: ip arp no flood.
  D. He could use the command: ip arp no snoop.
  A. Bill can use the command: ip dhcp snooping.

• Question 209:

  Which of the following are well know password-cracking programs?(Choose all that apply.

  A. L0phtcrack
  B. NetCat
  C. Jack the Ripper
  D. Netbus
  E. John the Ripper
  A. L0phtcrack
  E. John the Ripper

• Question 210:

  Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them?

  A. Detective
  B. Passive
  C. Intuitive
  D. Reactive
  B. Passive