EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 181:

  _____ is found in all versions of NTFS and is described as the ability to fork file data into existing files without affecting their functionality, size, or display to traditional file browsing utilities like dir or Windows Explorer

  A. Steganography

  B. Merge Streams

  C. NetBIOS vulnerability

  D. Alternate Data Streams

  Correct Answer: D

  ADS (or Alternate Data Streams) is a "feature" in the NTFS file system that makes it possible to hide information in alternate data streams in existing files. The file can have multiple data streams and the data streams are accessed by filename:stream.

• Question 182:

  Which of the following steganography utilities exploits the nature of white space and allows the user to conceal information in these white spaces?

  A. Snow

  B. Gif-It-Up

  C. NiceText

  D. Image Hide

  Correct Answer: A

  The program snow is used to conceal messages in ASCII text by appending whitespace to the end of lines. Because spaces and tabs are generally not visible in text viewers, the message is effectively hidden from casual observers. And if the built-in encryption is used, the message cannot be read even if it is detected.

• Question 183:

  Attackers can potentially intercept and modify unsigned SMB packets, modify the traffic and forward it so that the server might perform undesirable actions. Alternatively, the attacker could pose as the server or client after a legitimate authentication and gain unauthorized access to data. Which of the following is NOT a means that can be used to minimize or protect against such an attack?

  A. Timestamps

  B. SMB Signing

  C. File permissions

  D. Sequence numbers monitoring

  Correct Answer: ABD

• Question 184:

  What file system vulnerability does the following command take advantage of?

  type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe

  A. HFS

  B. ADS

  C. NTFS

  D. Backdoor access

  Correct Answer: B

  ADS (or Alternate Data Streams) is a "feature" in the NTFS file system that makes it possible to hide information in alternate data streams in existing files. The file can have multiple data streams and the data streams are accessed by filename:stream.

• Question 185:

  What hacking attack is challenge/response authentication used to prevent?

  A. Replay attacks

  B. Scanning attacks

  C. Session hijacking attacks

  D. Password cracking attacks

  Correct Answer: A

  A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it. With a challenge/response authentication you ensure that captured packets can't be retransmitted without a new authentication.

• Question 186:

  What does the following command in netcat do?

  nc -l -u -p 55555 < /etc/passwd

  A. logs the incoming connections to /etc/passwd file

  B. loads the /etc/passwd file to the UDP port 55555

  C. grabs the /etc/passwd file when connected to UDP port 55555

  D. deletes the /etc/passwd file when connected to the UDP port 55555

  Correct Answer: C

  -l forces netcat to listen for incoming connections.

  -u tells netcat to use UDP instead of TCP

  -p 5555 tells netcat to use port 5555

  < /etc/passwd tells netcat to grab the /etc/passwd file when connected to.

• Question 187:

  In the context of Windows Security, what is a 'null' user?

  A. A user that has no skills

  B. An account that has been suspended by the admin

  C. A pseudo account that has no username and password

  D. A pseudo account that was created for security administration purpose

  Correct Answer: C

  NULL sessions take advantage of "features" in the SMB (Server Message Block) protocol that exist primarily for trust relationships. You can establish a NULL session with a Windows host by logging on with a NULL user name and password.

  Using these NULL connections allows you to gather the following information from the host:* List of users and groups * List of machines * List of shares * Users and host SID' (Security Identifiers) NULL sessions exist in windows networking to

  allow: * Trusted domains to enumerate resources * Computers outside the domain to authenticate and enumerate users * The SYSTEM account to authenticate and enumerate resources

  NetBIOS NULL sessions are enabled by default in Windows NT and 2000. Windows XP and 2003 will allow anonymous enumeration of shares, but not SAM accounts.

• Question 188:

  Fingerprinting an Operating System helps a cracker because:

  A. It defines exactly what software you have installed

  B. It opens a security-delayed window based on the port being scanned

  C. It doesn't depend on the patches that have been applied to fix existing security holes

  D. It informs the cracker of which vulnerabilities he may be able to exploit on your system

  Correct Answer: D

  When a cracker knows what OS and Services you use he also knows which exploits might work on your system. If he would have to try all possible exploits for all possible Operating Systems and Services it would take too long time and the possibility of being detected increases.

• Question 189:

  What is GINA?

  A. Gateway Interface Network Application

  B. GUI Installed Network Application CLASS

  C. Global Internet National Authority (G-USA)

  D. Graphical Identification and Authentication DLL

  Correct Answer: D

  In computing, GINA refers to the graphical identification and authentication library, a component of some Microsoft Windows operating systems that provides secure authentication and interactive logon services.

• Question 190:

  You are the Security Administrator of Xtrinity, Inc. You write security policies and conduct assesments to protect the company's network. During one of your periodic checks to see how well policy is being observed by the employees, you discover an employee has attached a modem to his telephone line and workstation. He has used this modem to dial in to his workstation, thereby bypassing your firewall. A security breach has occurred as a direct result of this activity. The employee explains that he used the modem because he had to download software for a department project. How would you resolve this situation?

  A. Reconfigure the firewall

  B. Conduct a needs analysis

  C. Install a network-based IDS

  D. Enforce the corporate security policy

  Correct Answer: D

  The security policy is meant to always be followed until changed. If a need rises to perform actions that might violate the security policy you'll have to find another way to accomplish the task or wait until the policy has been changed.