EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 171:

  Travis works primarily from home as a medical transcriptions.

  He just bought a brand new Dual Core Pentium Computer with over 3 GB of RAM. He uses voice recognition software is processor intensive, which is why he bought the new computer. Travis frequently has to get on the Internet to do research on what he is working on. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to.

  Travis uses antivirus software, anti-spyware software and always keeps the computer up-to-date with Microsoft patches.

  After another month of working on the computer, Travis computer is even more noticeable slow. Every once in awhile, Travis also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Travis is really worried about his computer because he spent a lot of money on it and he depends on it to work. Travis scans his through Windows Explorer and check out the file system, folder by folder to see if there is anything he can find. He spends over four hours pouring over the files and folders and can't find anything but before he gives up, he notices that his computer only has about 10 GB of free space available. Since has drive is a 200 GB hard drive, Travis thinks this is very odd.

  Travis downloads Space Monger and adds up the sizes for all the folders and files on his computer. According to his calculations, he should have around 150 GB of free space. What is mostly likely the cause of Travi's problems?

  A. Travis's Computer is infected with stealth kernel level rootkit

  B. Travi's Computer is infected with Stealth Torjan Virus

  C. Travis's Computer is infected with Self-Replication Worm that fills the hard disk space

  D. Logic Bomb's triggered at random times creating hidden data consuming junk files

  Correct Answer: A

  A rootkit can take full control of a system. A rootkit's only purpose is to hide files, network connections, memory addresses, or registry entries from other programs used by system administrators to detect intended or unintended special privilege accesses to the computer resources.

• Question 172:

  LAN Manager passwords are concatenated to 14 bytes and split in half. The two halves are hashed individually. If the password is 7 characters or less, than the second half of the hash is always:

  A. 0xAAD3B435B51404EE

  B. 0xAAD3B435B51404AA

  C. 0xAAD3B435B51404BB

  D. 0xAAD3B435B51404CC

  Correct Answer: A

  A problem with LM stems from the total lack of salting or cipher block chaining in the hashing process. To hash a password the first 7 bytes of it are transformed into an 8 byte odd parity DES key. This key is used to encrypt the 8 byte string "KGS!@". Same thing happens with the second part of the password. This lack of salting creates two interesting consequences. Obviously this means the password is always stored in the same way, and just begs for a typical lookup table attack. The other consequence is that it is easy to tell if a password is bigger than 7 bytes in size. If not, the last 7 bytes will all be null and will result in a constant DES hash of 0xAAD3B435B51404EE.

• Question 173:

  Samuel is the network administrator of DataX communications Inc. He is trying to configure his firewall to block password brute force attempts on his network. He enables blocking the intruder's IP address for a period of 24 hours time after more than three unsuccessful attempts. He is confident that this rule will secure his network hackers on the Internet.

  But he still receives hundreds of thousands brute-force attempts generated from various IP addresses around the world. After some investigation he realizes that the intruders are using a proxy somewhere else on the Internet which has been scripted to enable the random usage of various proxies on each request so as not to get caught by the firewall use.

  Later he adds another rule to his firewall and enables small sleep on the password attempt so that if the password is incorrect, it would take 45 seconds to return to the user to begin another attempt. Since an intruder may use multiple machines to brute force the password, he also throttles the number of connections that will be prepared to accept from a particular IP address. This action will slow the intruder's attempts.

  Samuel wants to completely block hackers brute force attempts on his network.

  What are the alternatives to defending against possible brute-force password attacks on his site?

  A. Enforce a password policy and use account lockouts after three wrong logon attempts even through this might lock out legit users

  B. Enable the IDS to monitor the intrusion attempts and alert you by e-mail about the IP address of the intruder so that you can block them at the firewall manually

  C. Enforce complex password policy on your network so that passwords are more difficult to brute force

  D. You can't completely block the intruders attempt if they constantly switch proxies

  Correct Answer: D

  Without knowing from where the next attack will come there is no way of proactively block the attack. This is becoming a increasing problem with the growth of large bot nets using ordinary workstations and home computers in large numbers.

• Question 174:

  In the following example, which of these is the "exploit"? Today, Microsoft Corporation released a security notice. It detailed how a person could bring down the Windows 2003 Server operating system, by sending malformed packets to it.

  They detailed how this malicious process had been automated using basic scripting. Even worse, the new automated method for bringing down the server has already been used to perform denial of service attacks on many large commercial

  websites.

  Select the best answer.

  A. Microsoft Corporation is the exploit.

  B. The security "hole" in the product is the exploit.

  C. Windows 2003 Server

  D. The exploit is the hacker that would use this vulnerability.

  E. The documented method of how to use the vulnerability to gain unprivileged access.

  Correct Answer: E

  Microsoft is not the exploit, but if Microsoft documents how the vulnerability can be used to gain unprivileged access, they are creating the exploit. If they just say that there is a hole in the product, then it is only a vulnerability. The security "hole" in the product is called the "vulnerability". It is documented in a way that shows how to use the vulnerability to gain unprivileged access, and it then becomes an "exploit". In the example given, Windows 2003 Server is the TOE (Target of Evaluation). A TOE is an IT System, product or component that requires security evaluation or is being identified. The hacker that would use this vulnerability is exploiting it, but the hacker is not the exploit. The documented method of how to use the vulnerability to gain unprivileged access is the correct answer.

• Question 175:

  One of your junior administrator is concerned with Windows LM hashes and password cracking. In your discussion with them, which of the following are true statements that you would point out? Select the best answers.

  A. John the Ripper can be used to crack a variety of passwords, but one limitation is that the output doesn't show if the password is upper or lower case.

  B. BY using NTLMV1, you have implemented an effective countermeasure to password cracking.

  C. SYSKEY is an effective countermeasure.

  D. If a Windows LM password is 7 characters or less, the hash will be passed with the following characters, in HEX- 00112233445566778899.

  E. Enforcing Windows complex passwords is an effective countermeasure.

  Correct Answer: ACE

  John the Ripper can be used to crack a variety of passwords, but one limitation is that the output doesn't show if the password is upper or lower case. John the Ripper is a very effective password cracker. It can crack passwords for many different types of operating systems. However, one limitation is that the output doesn't show if the password is upper or lower case. BY using NTLMV1, you have implemented an effective countermeasure to password cracking. NTLM Version 2 (NTLMV2) is a good countermeasure to LM password cracking (and therefore a correct answer). To do this, set Windows 9x and NT systems to "send NTLMv2 responses only". SYSKEY is an effective countermeasure. It uses 128 bit encryption on the local copy of the Windows SAM. If a Windows LM password is 7 characters or less, the has will be passed with the following characters: 0xAAD3B435B51404EE Enforcing Windows complex passwords is an effective countermeasure to password cracking. Complex passwords are- greater than 6 characters and have any 3 of the following 4 items: upper case, lower case, special characters, and numbers.

• Question 176:

  You are a Administrator of Windows server. You want to find the port number for POP3. What file would you find the information in and where? Select the best answer.

  A. %windir%\\etc\\services

  B. system32\\drivers\\etc\\services

  C. %windir%\\system32\\drivers\\etc\\services

  D. /etc/services

  E. %windir%/system32/drivers/etc/services

  Correct Answer: C

  %windir%\\system32\\drivers\\etc\\services is the correct place to look for this information.

• Question 177:

  Which of the following keyloggers cannot be detected by anti-virus or anti-spyware products?

  A. Covert keylogger

  B. Stealth keylogger

  C. Software keylogger

  D. Hardware keylogger

  Correct Answer: D

  As the hardware keylogger never interacts with the Operating System it is undetectable by anti-virus or anti-spyware products.

• Question 178:

  _____ is the process of converting something from one representation to the simplest form. It deals with the way in which systems convert data from one form to another.

  A. Canonicalization

  B. Character Mapping

  C. Character Encoding

  D. UCS transformation formats

  Correct Answer: A

  Canonicalization (abbreviated c14n) is the process of converting data that has more than one possible representation into a "standard" canonical representation. This can be done to compare different representations for equivalence, to count the number of distinct data structures (e.g., in combinatorics), to improve the efficiency of various algorithms by eliminating repeated calculations, or to make it possible to impose a meaningful sorting order.

• Question 179:

  How would you describe an attack where an attacker attempts to deliver the payload over multiple packets over long periods of time with the purpose of defeating simple pattern matching in IDS systems without session reconstruction? A characteristic of this attack would be a continuous stream of small packets.

  A. Session Splicing

  B. Session Stealing

  C. Session Hijacking

  D. Session Fragmentation

  Correct Answer: A

• Question 180:

  LM authentication is not as strong as Windows NT authentication so you may want to disable its use, because an attacker eavesdropping on network traffic will attack the weaker protocol. A successful attack can compromise the user's password. How do you disable LM authentication in Windows XP?

  A. Stop the LM service in Windows XP

  B. Disable LSASS service in Windows XP

  C. Disable LM authentication in the registry

  D. Download and install LMSHUT.EXE tool from Microsoft website

  Correct Answer: C

  http://support.microsoft.com/kb/299656