EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 251:

  When Jason moves a file via NFS over the company's network, you want to grab a copy of it by sniffing. Which of the following tool accomplishes this?

  A. macof

  B. webspy

  C. filesnarf

  D. nfscopy

  Correct Answer: C

  Filesnarf - sniff files from NFS traffic

  OPTIONS

  -i interface

  Specify the interface to listen on.

  -v "Versus" mode. Invert the sense of matching, to

  select non-matching files.

  pattern

  Specify regular expression for filename matching.

  expression

  Specify a tcpdump(8) filter expression to select

  traffic to sniff.

  SEE ALSO

  Dsniff, nfsd

• Question 252:

  John the hacker is sniffing the network to inject ARP packets. He injects broadcast frames onto the wire to conduct MiTM attack. What is the destination MAC address of a broadcast frame?

  A. 0xFFFFFFFFFFFF

  B. 0xAAAAAAAAAAAA

  C. 0xBBBBBBBBBBBB

  D. 0xDDDDDDDDDDDD

  Correct Answer: A

  0xFFFFFFFFFFFF is the destination MAC address of the broadcast frame.

• Question 253:

  Which of the following display filters will you enable in Ethereal to view the three-way handshake for a connection from host 192.168.0.1?

  A. ip == 192.168.0.1 and tcp.syn

  B. ip.addr = 192.168.0.1 and syn = 1

  C. ip.addr==192.168.0.1 and tcp.flags.syn

  D. ip.equals 192.168.0.1 and syn.equals on

  Correct Answer: C

• Question 254:

  Which tool/utility can help you extract the application layer data from each TCP connection from a log file into separate files?

  A. Snort

  B. argus

  C. TCPflow

  D. Tcpdump

  Correct Answer: C

  Tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.

• Question 255:

  Bob wants to prevent attackers from sniffing his passwords on the wired network. Which of the following lists the best options?

  A. RSA, LSA, POP

  B. SSID, WEP, Kerberos

  C. SMB, SMTP, Smart card

  D. Kerberos, Smart card, Stanford SRP

  Correct Answer: D

  Kerberos, Smart cards and Stanford SRP are techniques where the password never leaves the computer.

• Question 256:

  The follows is an email header. What address is that of the true originator of the message?

  Return-Path:

  Received: from smtp.com (fw.emumail.com [215.52.220.122]. by raq-221-181.ev1.net (8.10.2/8.10.2. with ESMTP id h78NIn404807 for ; Sat, 9 Aug 2003 18:18:50 -0500 Received: (qmail 12685 invoked from

  network.; 8 Aug 2003 23:25:25 -0000 Received: from ([19.25.19.10].

  by smtp.com with SMTP

  Received: from unknown (HELO CHRISLAPTOP. (168.150.84.123.

  by localhost with SMTP; 8 Aug 2003 23:25:01 -0000

  From: "Bill Gates"

  To: "mikeg"

  Subject: We need your help!

  Date: Fri, 8 Aug 2003 19:12:28 -0400

  Message-ID: <51.32.123.21@CHRISLAPTOP>

  MIME-Version: 1.0

  Content-Type: multipart/mixed;

  boundary="----=_NextPart_000_0052_01C35DE1.03202950"

  X-Priority: 3 (Normal.

  X-MSMail-Priority: Normal

  X-Mailer: Microsoft Outlook, Build 10.0.2627

  X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal

  A. 19.25.19.10

  B. 51.32.123.21

  C. 168.150.84.123

  D. 215.52.220.122

  E. 8.10.2/8.10.2

  Correct Answer: C

  Spoofing can be easily achieved by manipulating the "from" name field, however, it is much more difficult to hide the true source address. The "received from" IP address 168.150.84.123 is the true source of the

• Question 257:

  Ethereal works best on ____________.

  A. Switched networks

  B. Linux platforms

  C. Networks using hubs

  D. Windows platforms

  E. LAN's

  Correct Answer: C

  Ethereal is used for sniffing traffic. It will return the best results when used on an unswitched (i.e. hub. network.

• Question 258:

  Samantha was hired to perform an internal security test of company. She quickly realized that all networks are making use of switches instead of traditional hubs. This greatly limits her ability to gather information through network sniffing.

  Which of the following techniques can she use to gather information from the switched network or to disable some of the traffic isolation features of the switch? (Choose two)

  A. Ethernet Zapping

  B. MAC Flooding

  C. Sniffing in promiscuous mode

  D. ARP Spoofing

  Correct Answer: BD

  In a typical MAC flooding attack, a switch is flooded with packets, each containing different source MAC addresses. The intention is to consume the limited memory set aside in the switch to store the MAC address-to-physical port translation table.The result of this attack causes the switch to enter a state called failopen mode, in which all incoming packets are broadcast out on all ports (as with a hub), instead of just down the correct port as per normal operation. The principle of ARP spoofing is to send fake, or 'spoofed', ARP messages to an Ethernet LAN. These frames contain false MAC addresses, confusing network devices, such as network switches. As a result frames intended for one machine can be mistakenly sent to another (allowing the packets to be sniffed) or an unreachable host (a denial of service attack).

• Question 259:

  A POP3 client contacts the POP3 server:

  A. To send mail

  B. To receive mail

  C. to send and receive mail

  D. to get the address to send mail to

  E. initiate a UDP SMTP connection to read mail

  Correct Answer: B

  POP is used to receive e-mail.SMTP is used to send e-mail.

• Question 260:

  A remote user tries to login to a secure network using Telnet, but accidently types in an invalid user name or password. Which responses would NOT be preferred by an experienced Security Manager? (multiple answer)

  A. Invalid Username

  B. Invalid Password

  C. Authentication Failure

  D. Login Attempt Failed

  E. Access Denied

  Correct Answer: AB

  As little information as possible should be given about a failed login attempt. Invalid username or password is not desirable.