EC-COUNCIL EC-COUNCIL Certifications 312-38 Questions & Answers

• Question 281:

  Which of the following tools are NOT used for logging network activities in the Linux operating system? Each correct answer represents a complete solution. Choose all that apply.

  A. PsLoggedOn

  B. PsGetSid

  C. Timbersee

  D. Swatch

  Correct Answer: AB

  PsLoggedOn and PsGetSid are not logging tools. They are command-line utilities used in the Windows operating system.

  PsLoggedOn is an applet that displays both the local and remote logged on users. If an attacker specifies a user name instead of a computer, PsLoggedOn searches the computers in the network and tells whether the user is currently logged

  on or not. The command syntax for PsLoggedOn is as follows:

  psloggedon [- ] [-l] [-x] [\\computername | username]

  PsGetSid is a tool that is used to query SIDs remotely. Using PsGetSid, the attacker can access the SIDs of user accounts and translate an SID into the user name. The command syntax for PsGetSid is as follows:

  psgetsid [\\computer[,computer[,...] | @file] [-u username [-p password]]] [account|SID]

  Answer options C and D are incorrect. Timbersee and Swatch are tools used for logging network activities in the Linux operating system.

• Question 282:

  Which of the following types of coaxial cable is used for cable TV and cable modems?

  A. RG-8

  B. RG-62

  C. RG-59

  D. RG-58

  Correct Answer: C

  RG-59 type of coaxial cable is used for cable TV and cable modems.

  Answer option A is incorrect. RG-8 coaxial cable is primarily used as a backbone in an Ethernet LAN environment and often connects one wiring closet to another. It is also known as 10Base5 or ThickNet.

  Answer option B is incorrect. RG-62 coaxial cable is used for ARCNET and automotive radio antennas.

  Answer option D is incorrect. RG-58 coaxial cable is used for Ethernet networks. It uses baseband signaling and 50-Ohm terminator. It is also known as 10Base2 or ThinNet.

• Question 283:

  Which of the following is a software tool used in passive attacks for capturing network traffic?

  A. Intrusion prevention system

  B. Intrusion detection system

  C. Warchalking

  D. Sniffer

  Correct Answer: D

  A sniffer is a software tool that is used to capture any network traffic. Since a sniffer changes the NIC of the LAN card into promiscuous mode, the NIC begins to record incoming and outgoing data traffic across the network. A sniffer attack is

  a passive attack because the attacker does not directly connect with the target host. This attack is most often used to grab logins and passwords from network traffic. Tools such as Ethereal, Snort, Windump, EtherPeek, Dsniff are some good

  examples of sniffers. These tools provide many facilities to users such as graphical user interface, traffic statistics graph, multiple sessions tracking, etc. Answer option A is incorrect. An intrusion prevention system (IPS) is a network security

  device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities.

  When an attack is detected, it can drop the offending packets while still allowing all other traffic to pass.

  Answer option B is incorrect. An IDS (Intrusion Detection System) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station.

  Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging

  information about them, attempting to stop them, and reporting them to security administrators.

  Answer option C is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the

  pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.

• Question 284:

  You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below:

  

  What is the IP address of the sender of this email?

  A. 209.191.91.180

  B. 141.1.1.1

  C. 172.16.10.90

  D. 216.168.54.25

  Correct Answer: D

  The IP address of the sender of this email is 216.168.54.25. According to the scenario, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. Once you start to analyze the email header, you get an entry entitled as X-Originating-IP. You know that in Yahoo, the X-Originating-IP is the IP address of the email sender and in this case, the required IP address is 216.168.54.25. Answer options A, C, and B are incorrect. All these are the IP addresses of the Yahoo and Wetpaint servers.

• Question 285:

  In an Ethernet peer-to-peer network, which of the following cables is used to connect two computers, using RJ-45 connectors and Category-5 UTP cable?

  A. Serial

  B. Loopback

  C. Crossover

  D. Parallel

  Correct Answer: C

  In an Ethernet peer-to-peer network, a crossover cable is used to connect two computers, using RJ-45 connectors and Category-5 UTP cable. Answer options D and A are incorrect. Parallel and serial cables do not use RJ-45 connectors and

  Category-5 UTP cable. Parallel cables are used to connect printers, scanners etc., to computers, whereas serial cables are used to connect modems, digital cameras etc., to computers.

  Answer option B is incorrect. A loopback cable is used for testing equipments.

• Question 286:

  Which of the following statements are TRUE about Demilitarized zone (DMZ)? Each correct answer represents a complete solution. Choose all that apply.

  A. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network like the Internet.

  B. Demilitarized zone is a physical or logical sub-network that contains and exposes external services of an organization to a larger un-trusted network.

  C. The purpose of a DMZ is to add an additional layer of security to the Local Area Network of an organization.

  D. Hosts in the DMZ have full connectivity to specific hosts in the internal network.

  Correct Answer: BCA

  A demilitarized zone (DMZ) is a physical or logical subnetwork that contains and exposes external services of an organization to a larger network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in the DMZ, rather than the whole of the network. Hosts in the DMZ have limited connectivity to specific hosts in the internal network, though communication with other hosts in the DMZ and to the external network is allowed. This allows hosts in the DMZ to provide services to both the internal and external networks, while an intervening firewall controls the traffic between the DMZ servers and the internal network clients. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network such as the Internet.

• Question 287:

  Which of the following is a worldwide organization that aims to establish, refine, and promote Internet security standards?

  A. ANSI

  B. WASC

  C. IEEE

  D. ITU

  Correct Answer: B

  Web Application Security Consortium (WASC) is a worldwide organization that aims to establish, refine, and promote Internet security standards. WASC is vendor-neutral, although members may belong to corporations involved in the

  research, development, design, and distribution of Web security-related products.

  Answer option A is incorrect. ANSI (American National Standards Institute) is the primary organization for fostering the development of technology standards in the United States. ANSI works with industry groups and is the U.S. member of the

  International Organization for Standardization (ISO) and the International Electro-technical Commission (IEC). Long-established computer standards from ANSI include the American Standard Code for Information Interchange (ASCII) and the

  Small Computer System Interface (SCSI).

  Answer option D is incorrect. The International Telecommunication Union (ITU) is an organization established to standardize and regulate international radio and telecommunications. Its main tasks include standardization, allocation of the

  radio spectrum, and organizing interconnection arrangements between different countries to allow international phone calls. ITU sets standards for global telecom networks. The ITU's telecommunications division (ITU-T) produces more than

  200 standard recommendations each year in the converging areas of telecommunications, information technology, consumer electronics, broadcasting and multimedia communications. ITU was streamlined into the following three sectors:

  ITU-D (Telecommunication Development)

  ITU-R (Radio communication)

  ITU-T (Telecommunication Standardization)

  Answer option C is incorrect. The Institute of Electrical and Electronic Engineers (IEEE) is a society of technical professionals. It promotes the development and application of electro-technology and allied sciences. IEEE develops

  communications and network standards, among other activities. The organization publishes number of journals, has many local chapters, and societies in specialized areas.

• Question 288:

  Which of the following is the practice of sending unwanted e-mail messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients? Each correct answer represents a complete solution. Choose all that apply.

  A. Email spoofing

  B. Junk mail

  C. E-mail spam

  D. Email jamming

  Correct Answer: BC

  E-mail spam, also known as unsolicited bulk email (UBE), junk mail, or unsolicited commercial email (UCE), is the practice of sending unwanted e-mail messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients. Answer option A is incorrect. Email spoofing is a fraudulent email activity in which the sender address and other parts of the email header are altered to appear as though the email originated from a different source. Email spoofing is a technique commonly used in spam and phishing emails to hide the origin of the email message. By changing certain properties of the email, such as the From, Return-Path and Reply-To fields (which can be found in the message header), ill-intentioned users can make the email appear to be from someone other than the actual sender. The result is that, although the email appears to come from the address indicated in the From field (found in the email headers), it actually comes from another source. Answer option D is incorrect. Email jamming is the use of sensitive words in e-mails to jam the authorities that listen in on them by providing a form of a red herring and an intentional annoyance. In this attack, an attacker deliberately includes "sensitive" words and phrases in otherwise innocuous emails to ensure that these are picked up by the monitoring systems. As a result, the senders of these emails will eventually be added to a "harmless" list and their emails will be no longer intercepted, hence it will allow them to regain some privacy.

• Question 289:

  Which of the following network scanning tools is a TCP/UDP port scanner that works as a ping sweeper and hostname resolver?

  A. Hping

  B. SuperScan

  C. Netstat

  D. Nmap

  Correct Answer: B

  SuperScan is a TCP/UDP port scanner. It also works as a ping sweeper and hostname resolver. It can ping a given range of IP addresses and resolve the host name of the remote system.

  The features of SuperScan are as follows:

  It scans any port range from a built-in list or any given range.

  It performs ping scans and port scans using any IP range.

  It modifies the port list and port descriptions using the built in editor.

  It connects to any discovered open port using user-specified "helper" applications.

  It has the transmission speed control utility.

  Answer option D is incorrect. Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple

  port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a

  service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc. Answer option C is incorrect. Netstat

  (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface statistics. It is available on Unix, Unix-like, and Windows NT-based operating

  systems. It is used to find problems on the network and to determine the amount of traffic on the network as a performance measurement. Answer option A is incorrect. Hping is a free packet generator and analyzer for the TCP/IP protocol.

  Hping is one of the de facto tools for security auditing and testing of firewalls and networks. The new version of hping, hping3, is scriptable using the Tcl language and implements an engine for string based, human readable description of

  TCP/IP packets, so that the programmer can write scripts related to low level TCP/IP packet manipulation and analysis in very short time. Like most tools used in computer security, hping is useful to both system administrators and crackers

  (or script kiddies).

• Question 290:

  The IP addresses reserved for experimental purposes belong to which of the following classes?

  A. Class E

  B. Class C

  C. Class A

  D. Class D

  Correct Answer: A