EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 271:

  SYN Flood is a DOS attack in which an attacker deliberately violates the three-way handshake and opens a large number of half-open TCP connections. The signature for SYN Flood attack is:

  A. The source and destination address having the same value.

  B. The source and destination port numbers having the same value.

  C. A large number of SYN packets appearing on a network without the corresponding reply packets.

  D. A large number of SYN packets appearing on a network with the corresponding reply packets.

  Correct Answer: C

  A SYN attack occurs when an attacker exploits the use of the buffer space during a Transmission Control Protocol (TCP) session initialization handshake. The attacker floods the target system's small "in-process" queue with connection requests, but it does not respond when a target system replies to those requests. This causes the target system to time out while waiting for the proper response, which makes the system crash or become unusable.

• Question 272:

  You have been called to investigate a sudden increase in network traffic at company. It seems that the traffic generated was too heavy that normal business functions could no longer be rendered to external employees and clients. After a quick investigation, you find that the computer has services running attached to TFN2k and Trinoo software. What do you think was the most likely cause behind this sudden increase in traffic?

  A. A distributed denial of service attack.

  B. A network card that was jabbering.

  C. A bad route on the firewall.

  D. Invalid rules entry at the gateway.

  Correct Answer: A

  In computer security, a denial-of-service attack (DoS attack) is an attempt to make a computer resource unavailable to its intended users. Typically the targets are high-profile web servers, and the attack attempts to make the hosted web pages unavailable on the Internet. It is a computer crime that violates the Internet proper use policy as indicated by the Internet Architecture Board (IAB). TFN2K and Trinoo are tools used for conducting DDos attacks.

• Question 273:

  When working with Windows systems, what is the RID of the true administrator account?

  A. 500

  B. 501

  C. 1000

  D. 1001

  E. 1024

  F. 512

  Correct Answer: A

  Because of the way in which Windows functions, the true administrator account always has a RID of 500.

• Question 274:

  When working with Windows systems, what is the RID of the true administrator account?

  A. 500

  B. 501

  C. 512

  D. 1001

  E. 1024

  F. 1000

  Correct Answer: A

  The built-in administrator account always has a RID of 500.

• Question 275:

  If you send a SYN to an open port, what is the correct response?(Choose all correct answers.

  A. SYN

  B. ACK

  C. FIN

  D. PSH

  Correct Answer: AB

  The proper response is a SYN / ACK. This technique is also known as half-open scanning.

• Question 276:

  How does a denial-of-service attack work?

  A. A hacker tries to decipher a password by using a system, which subsequently crashes the network

  B. A hacker attempts to imitate a legitimate user by confusing a computer or even another person

  C. A hacker prevents a legitimate user (or group of users) from accessing a service

  D. A hacker uses every character, word, or letter he or she can think of to defeat authentication

  Correct Answer: C

  In computer security, a denial-of-service attack (DoS attack) is an attempt to make a computer resource unavailable to its intended users. Typically the targets are high-profile web servers, and the attack attempts to make the hosted web pages unavailable on the Internet. It is a computer crime that violates the Internet proper use policy as indicated by the Internet Architecture Board (IAB).

• Question 277:

  A Buffer Overflow attack involves:

  A. Using a trojan program to direct data traffic to the target host's memory stack

  B. Flooding the target network buffers with data traffic to reduce the bandwidth available to legitimate users

  C. Using a dictionary to crack password buffers by guessing user names and passwords

  D. Poorly written software that allows an attacker to execute arbitrary code on a target system

  Correct Answer: D

  B is a denial of service. By flooding the data buffer in an application with trash you could get access to write in the code segment in the application and that way insert your own code.

• Question 278:

  What would best be defined as a security test on services against a known vulnerability database using an automated tool?

  A. A penetration test

  B. A privacy review

  C. A server audit

  D. A vulnerability assessment

  Correct Answer: D

  Vulnerability assessment is the process of identifying and quantifying vulnerabilities in a system. The system being studied could be a physical facility like a nuclear power plant, a computer system, or a larger system (for example the communications infrastructure or water infrastructure of a region).

• Question 279:

  Clive has been monitoring his IDS and sees that there are a huge number of ICMP Echo Reply packets that are being received on the external gateway interface. Further inspection reveals that they are not responses from the internal hosts' requests but simply responses coming from the Internet.

  What could be the most likely cause?

  A. Someone has spoofed Clive's IP address while doing a smurf attack.

  B. Someone has spoofed Clive's IP address while doing a land attack.

  C. Someone has spoofed Clive's IP address while doing a fraggle attack.

  D. Someone has spoofed Clive's IP address while doing a DoS attack.

  Correct Answer: A

  The smurf attack, named after its exploit program, is a denial-of-service attack that uses spoofed broadcast ping messages to flood a target system. In such an attack, a perpetrator sends a large amount of ICMP echo (ping) traffic to IP broadcast addresses, all of it having a spoofed source address of the intended victim. If the routing device delivering traffic to those broadcast addresses performs the IP broadcast to layer 2 broadcast function, most hosts on that IP network will take the ICMP echo request and reply to it with an echo reply, multiplying the traffic by the number of hosts responding. On a multi-access broadcast network, hundreds of machines might reply to each packet.

• Question 280:

  What do you call a system where users need to remember only one username and password, and be authenticated for multiple services?

  A. Simple Sign-on

  B. Unique Sign-on

  C. Single Sign-on

  D. Digital Certificate

  Correct Answer: C

  Single sign-on (SSO) is a specialized form of software authentication that enables a user to authenticate once and gain access to the resources of multiple software systems.