EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 131:

  Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on your network?

  A. 137 and 139

  B. 137 and 443

  C. 139 and 443

  D. 139 and 445

  Correct Answer: D

  NULL sessions take advantage of "features" in the SMB (Server Message Block) protocol that exist primarily for trust relationships. You can establish a NULL session with a Windows host by logging on with a NULL user name and password. Primarily the following ports are vulnerable if they are accessible: TCP NETBIOS Session Service UDP NETBIOS Session Service TCP SMB/CIFS

• Question 132:

  What port number is used by LDAP protocol?

  A. 110

  B. 389

  C. 445

  D. 464

  Correct Answer: B

  Active Directory and Exchange use LDAP via TCP port 389 for clients.

• Question 133:

  What does FIN in TCP flag define?

  A. Used to close a TCP connection

  B. Used to abort a TCP connection abruptly

  C. Used to indicate the beginning of a TCP connection

  D. Used to acknowledge receipt of a previous packet or transmission

  Correct Answer: A

  The FIN flag stands for the word FINished. This flag is used to tear down the virtual connections created using the previous flag (SYN), so because of this reason, the FIN flag always appears when the last packets are exchanged between a connection.

• Question 134:

  Which of the following represents the initial two commands that an IRC client sends to join an IRC network?

  A. USER, NICK

  B. LOGIN, NICK

  C. USER, PASS

  D. LOGIN, USER

  Correct Answer: A

  A "PASS" command is not required for either client or server connection to be registered, but it must precede the server message or the latter of the NICK/USER combination. (RFC 1459)

• Question 135:

  Eve is spending her day scanning the library computers. She notices that Alice is using a computer whose port 445 is active and listening. Eve uses the ENUM tool to enumerate Alice machine. From the command prompt, she types the following command.

  For /f "tokens=1 %%a in (hackfile.txt) do net use * \\10.1.2.3\c$ /user:"Administrator" %%a What is Eve trying to do?

  A. Eve is trying to connect as an user with Administrator privileges

  B. Eve is trying to enumerate all users with Administrative privileges

  C. Eve is trying to carry out a password crack for user Administrator

  D. Eve is trying to escalate privilege of the null user to that of Administrator

  Correct Answer: C

  Eve tries to get a successful login using the username Administrator and passwords from the file hackfile.txt.

• Question 136:

  Eric has discovered a fantastic package of tools named Dsniff on the Internet. He has learnt to use these tools in his lab and is now ready for real world exploitation. He was able to effectively intercept communications between the two entities and establish credentials with both sides of the connections. The two remote ends of the communication never notice that Eric is relaying the information between the two.

  What would you call this attack?

  A. Interceptor

  B. Man-in-the-middle

  C. ARP Proxy

  D. Poisoning Attack

  Correct Answer: B

  A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised.

• Question 137:

  Susan has attached to her company's network. She has managed to synchronize her boss's sessions with that of the file server. She then intercepted his traffic destined for the server, changed it the way she wanted to and then placed it on the server in his home directory. What kind of attack is Susan carrying on?

  A. A sniffing attack

  B. A spoofing attack

  C. A man in the middle attack

  D. A denial of service attack

  Correct Answer: C

  A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised.

• Question 138:

  Which definition among those given below best describes a covert channel?

  A. A server program using a port that is not well known.

  B. Making use of a protocol in a way it is not intended to be used.

  C. It is the multiplexing taking place on a communication link.

  D. It is one of the weak channels used by WEP which makes it insecure.

  Correct Answer: B

  A covert channel is described as: "any communication channel that can be exploited by a process to transfer information in a manner that violates the systems security policy." Essentially, it is a method of communication that is not part of an actual computer system design, but can be used to transfer information to users or system processes that normally would not be allowed access to the information.

• Question 139:

  What did the following commands determine?

  C : user2sid \earth guest S-1-5-21-343818398-789336058-1343024091-501

  C:sid2user 5 21 343818398 789336058 1343024091 500 Name is Joe Domain is EARTH

  A. That the Joe account has a SID of 500

  B. These commands demonstrate that the guest account has NOT been disabled

  C. These commands demonstrate that the guest account has been disabled

  D. That the true administrator is Joe

  E. Issued alone, these commands prove nothing

  Correct Answer: D

  One important goal of enumeration is to determine who the true administrator is. In the example above, the true administrator is Joe.

• Question 140:

  Which of the following tools are used for enumeration? (Choose three.)

  A. SolarWinds

  B. USER2SID

  C. Cheops

  D. SID2USER

  E. DumpSec

  Correct Answer: BDE

  USER2SID, SID2USER, and DumpSec are three of the tools used for system enumeration. Others are tools such as NAT and Enum. Knowing which tools are used in each step of the hacking methodology is an important goal of the CEH exam. You should spend a portion of your time preparing for the test practicing with the tools and learning to understand their output.