EC-COUNCIL EC-COUNCIL Certifications 312-38 Questions & Answers

• Question 591:

  Fill in the blank with the appropriate term. A is a set of tools that take Administrative control of a computer system without authorization by the computer owners and/or legitimate managers.

  Correct Answer: rootkit

  A rootkit is a set of tools that take Administrative control of a computer system without authorization by the computer owners and/or legitimate managers. A rootkit requires root access to be installed in the Linux operating system, but once

  installed, the attacker can get root access at any time. Rootkits have the following features:

  They allow an attacker to run packet sniffers secretly to capture passwords.

  They allow an attacker to set a Trojan into the operating system and thus open a backdoor for anytime access.

  They allow an attacker to replace utility programs that can be used to detect the attacker's activity.

  They provide utilities for installing Trojans with the same attributes as legitimate programs.

• Question 592:

  Fill in the blank with the appropriate term. The is used for routing voice conversations over the Internet. It is also known by other names such as IP Telephony, Broadband Telephony, etc.

  Correct Answer: VoIP

  The Voice over Internet Protocol (VoIP) is used for routing of voice conversation over the Internet. The VoIP is also known by other names such as IP Telephony, Broadband Telephony, etc. Analog signals are used in telephones in which the sound is received as electrical pulsation, which is amplified and then carried to a small loudspeaker attached to the other phone, and the call receiver can hear the sound. In VoIP, analog signals are changed into digital signals, which are transmitted on the Internet. VoIP is used to make free phone calls using an Internet connection, and this can be done by using any VoIP software available in the market. There are various modes for making phone calls through the Internet. Some of the important modes are as follows: Through Analog Telephone Adapter (ATA) In this mode, the traditional phone is attached to the computer through AT

  A. ATA receives analog signals from the phone and then converts these signals to digital signals. The digital signals are then received by the Internet Service Providers (ISP), and the system is ready to make calls over VoIP.

  Through IP Phone

  IP Phones look exactly like the traditional phones, but they differ in that they have RJ-45 Ethernet connectors, instead of RJ-11 phone connectors, for connecting to the computers.

  Computer To Computer

  This is the easiest way to use VoIP. For this, we need software, microphone, speakers, sound card and an Internet connection through a cable or a DSL modem.

  Soft Phones

  Soft phone is a software application that can be loaded onto a computer and used anywhere in the broadband connectivity area.

• Question 593:

  Fill in the blank with the appropriate term. is a free open-source utility for network exploration and security auditing that is used to discover computers and services on a computer network, thus creating a "map" of the network.

  Correct Answer: Nmap

  Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc.

• Question 594:

  Fill in the blank with the appropriate term. is a powerful and low-interaction open source honeypot.

  Correct Answer: Honeyd

  Honeyd is a powerful and low-interaction open source honeypot. It was released by Niels Provos in 2002. It was written in C and designed for Unix platforms. It introduced a variety of new concepts, including the ability to monitor millions of unused IPs, IP stack spoofing, etc. It can also simulate hundreds of operating systems and monitor all UDP and TCP-based ports.

• Question 595:

  Fill in the blank with the appropriate term.

  A is a translation device or service that is often controlled by a separate Media Gateway Controller, which provides the call control and signaling functionality.

  Correct Answer: Media gateway

  A Media gateway is a translation device or service that converts digital media streams between disparate telecommunications networks such as PSTN, SS7, Next Generation Networks (2G, 2.5G and 3G radio access networks) or PBX. Media gateways enable multimedia communications across Next Generation Networks over multiple transport protocols such as Asynchronous Transfer Mode (ATM) and Internet Protocol (IP). Because the media gateway connects different types of networks, one of its main functions is to convert between different transmission and coding techniques. Media streaming functions such as echo cancellation, DTMF, and tone sender are also located in the media gateway. Media gateways are often controlled by a separate Media Gateway Controller, which provides the call control and signaling functionality.

• Question 596:

  Fill in the blank with the appropriate term.The is a communication protocol that communicates information between the network routers and the multicast end stations.

  Correct Answer: IGMP

  The Internet Group Management Protocol (IGMP) is a communication protocol that communicates information between the network routers and the multicast end stations. It allows the receivers to request a multicast data stream from a specific group address. However, multicast traffic is sent to a single MAC address but is processed by multiple hosts. The IGMP allows an end station to connect to a multicast group and leave it, while being connected to the group address. It can be effectively used for gaming and showing online videos. Although it does not actually act as a transport protocol, it operates above the network layer. It is analogous to ICMP for unicast connections. It is susceptible to some attacks, so firewalls commonly allow the user to disable it if not needed.

• Question 597:

  Fill in the blank with the appropriate term. is a protocol used to synchronize the timekeeping among the number of distributed time servers and clients.

  Correct Answer: NTP

  Network Time Protocol (NTP) is used to synchronize the timekeeping among the number of distributed time servers and clients. It is used for the time management in a large and diverse network that contains many interfaces. In this protocol, servers define the time, and clients have to be synchronized with the defined time. These clients can choose the most reliable source of time defined from the several NTP servers for their information transmission.

• Question 598:

  Fill in the blank with the appropriate term. encryption is a type of encryption that uses two keys, i.e., a public key and a private key pair for data encryption. It is also known as public key encryption.

  Correct Answer: Asymmetric

  Asymmetric encryption is a type of encryption that uses two keys, i.e., a public key and a private key pair for data encryption. The public key is available to everyone, while the private or secret key is available only to the recipient of the message. For example, when a user sends a message or data to another user, the sender uses the public key to encrypt the data. The receiver uses his private key to decrypt the data.

• Question 599:

  Fill in the blank with the appropriate term. A is a technique to authenticate digital documents by using computer cryptography.

  Correct Answer: signature

  A digital signature is a technique to authenticate digital documents by using computer cryptography. A digital signature not only validates the sender's identity, but also ensures that the document's contents have not been altered. It verifies that the source and integrity of the document is not compromised since the document is signed. A digital signature provides the following assurances: Authenticity, Integrity, and Non-repudiation. Microsoft Office 2007 Excel and Word provide a feature known as Signature line to insert a user's digital signature on a document.

• Question 600:

  Fill in the blank with the appropriate file system. Alternate Data Streams (ADS) is a feature of the file system, allowing more than one data stream to be associated with a filename.

  Correct Answer: NTFS

  Alternate Data Streams (ADS) is a feature of the NTFS file system that allows more than one data stream to be associated with a filename, using the filename format "filename:streamname". Alternate streams are not listed in Windows Explorer, and their size is not included in the file size. ADS provides the hacker a place to hide root kits or hacker tools, which can be executed without being detected by the system administrator. Alternate Data Streams are strictly a feature of the NTFS file system. Alternate Data Streams may be used as a method of hiding executables or proprietary content.