EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 411:

  June, a security analyst, understands that a polymorphic virus has the ability to mutate and can change its known viral signature and hide from signature-based antivirus programs. Can June use an antivirus program in this case and would it be effective against a polymorphic virus?

  A. No. June can't use an antivirus program since it compares the size of executable files to the database of known viral signatures and it is effective on a polymorphic virus

  B. Yes. June can use an antivirus program since it compares the parity bit of executable files to the database of known check sum counts and it is effective on a polymorphic virus

  C. Yes. June can use an antivirus program since it compares the signatures of executable files to the database of known viral signatures and it is very effective against a polymorphic virus

  D. No. June can't use an antivirus program since it compares the signatures of executable files to the database of known viral signatures and in the case the polymorphic viruses cannot be detected by a signature-based anti-virus program

  Correct Answer: D

  Although there are functions like heuristic scanning and sandbox technology, the Antivirus program is still mainly depending of signature databases and can only find already known viruses.

• Question 412:

  You find the following entries in your web log. Each shows attempted access to either root.exe or cmd.exe. What caused this? GET /scripts/root.exe?/c+dir GET /MSADC/root.exe?/c+dir GET /c/winnt/system32/cmd.exe?/c+dir GET /d/winnt/system32/cmd.exe?/c+dir GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir GET /msadc/..%5c../..%5c../..%5c/..xc1x1c../..xc1x1c../..xc1x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/..xc1x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/..xc0/../winnt/system32/cmd.exe?/c+dir GET /scripts/..xc0xaf../winnt/system32/cmd.exe?/c+dir GET /scripts/..xc1x9c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir

  GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir

  A. The Morris worm

  B. The PIF virus

  C. Trinoo

  D. Nimda

  E. Code Red

  F. Ping of Death

  Correct Answer: D

  The Nimda worm modifies all web content files it finds. As a result, any user browsing web content on the system, whether via the file system or via a web server, may download a copy of the worm. Some browsers may automatically execute the downloaded copy, thereby, infecting the browsing system. The high scanning rate of the Nimda worm may also cause bandwidth denial-of-service conditions on networks with infected machines and allow intruders the ability to execute arbitrary commands within the Local System security context on machines running the unpatched versions of IIS.

• Question 413:

  Which of the following is one of the key features found in a worm but not seen in a virus?

  A. The payload is very small, usually below 800 bytes.

  B. It is self replicating without need for user intervention.

  C. It does not have the ability to propagate on its own.

  D. All of them cannot be detected by virus scanners.

  Correct Answer: B

  A worm is similar to a virus by its design, and is considered to be a sub-class of a virus. Worms spread from computer to computer, but unlike a virus, it has the capability to travel without any help from a person. A worm takes advantage of file or information transport features on your system, which allows it to travel unaided.

• Question 414:

  The Slammer Worm exploits a stack-based overflow that occurs in a DLL implementing the Resolution Service.

  Which of the following Database Server was targeted by the slammer worm?

  A. Oracle

  B. MSSQL

  C. MySQL

  D. Sybase

  E. DB2

  Correct Answer: B

  W32.Slammer is a memory resident worm that propagates via UDP Port 1434 and exploits a vulnerability in SQL Server 2000 systems and systems with MSDE 2000 that have not applied the patch released by Microsoft Security Bulletin MS02-039.

• Question 415:

  Melissa is a virus that attacks Microsoft Windows platforms.

  To which category does this virus belong?

  A. Polymorphic

  B. Boot Sector infector

  C. System

  D. Macro

  Correct Answer: D

  The Melissa macro virus propagates in the form of an email message containing an infected Word document as an attachment.

• Question 416:

  What is the best means of prevention against viruses?

  A. Assign read only permission to all files on your system.

  B. Remove any external devices such as floppy and USB connectors.

  C. Install a rootkit detection tool.

  D. Install and update anti-virus scanner.

  Correct Answer: D

  Although virus scanners only can find already known viruses this is still the best defense, together with users that are informed about risks with the internet.

• Question 417:

  What are the main drawbacks for anti-virus software?

  A. AV software is difficult to keep up to the current revisions.

  B. AV software can detect viruses but can take no action.

  C. AV software is signature driven so new exploits are not detected.

  D. It's relatively easy for an attacker to change the anatomy of an attack to bypass AV systems

  E. AV software isn't available on all major operating systems platforms.

  F. AV software is very machine (hardware) dependent.

  Correct Answer: C

  Although there are functions like heuristic scanning and sandbox technology, the Antivirus program is still mainly depending of signature databases and can only find already known viruses.

• Question 418:

  Virus Scrubbers and other malware detection program can only detect items that they are aware of. Which of the following tools would allow you to detect unauthorized changes or modifications of binary files on your system by unknown malware?

  A. System integrity verification tools

  B. Anti-Virus Software

  C. A properly configured gateway

  D. There is no way of finding out until a new updated signature file is released

  Correct Answer: A

  Programs like Tripwire aids system administrators and users in monitoring a designated set of files for any changes. Used with system files on a regular (e.g., daily) basis, Tripwire can notify system administrators of corrupted or tampered files, so damage control measures can be taken in a timely manner.

• Question 419:

  Samuel is high school teenager who lives in Modesto California. Samuel is a straight `A' student who really likes tinkering around with computers and other types of electronic devices. Samuel just received a new laptop for his birthday and has been configuring it ever since. While tweaking the registry, Samuel notices a pop up at the bottom of his screen stating that his computer was now connected to a wireless network. All of a sudden, he was able to get online and surf the Internet.

  Samuel did some quick research and was able to gain access to the wireless router he was connecting to and see al of its settings? Being able to hop onto someone else's wireless network so easily fascinated Samuel so he began doing more and more research on wireless technologies and how to exploit them. The next day Samuel's fried said that he could drive around all over town and pick up hundred of wireless networks. This really excited Samuel so they got into his friend's car and drove around the city seeing which networks they could connect to and which ones they could not.

  What has Samuel and his friend just performed?

  A. Wardriving

  B. Warwalking

  C. Warchalking

  D. Webdriving

  Correct Answer: A

  Wardriving is the act of searching for Wi-Fi wireless networks by a person in a moving vehicle using a Wi-Fi-equipped computer, such as a laptop or a PDA, to detect the networks. It was also known (as of 2002) as "WiLDing" (Wireless Lan Driving, although this term never gained any popularity and is no longer used), originating in the San Francisco Bay Area with the Bay Area Wireless Users Group (BAWUG). It is similar to using a scanner for radio.

• Question 420:

  In an attempt to secure his 802.11b wireless network, Bob decides to use strategic antenna positioning. He places the antenna for the access point near the center of the building. For those access points near the outer edge of the building he uses semi-directional antennas that face towards the buildings center. There is a large parking lot and outlying filed surrounding the building that extends out half a mile around the building. Bob figures that with this and his placement of antennas, his wireless network will be safe from attack. Which of he following statements is true?

  A. Bob's network will not be safe until he also enables WEP

  B. With the 300-foot limit of a wireless signal, Bob's network is safe

  C. Bob's network will be sage but only if he doesn't switch to 802.11a

  D. Wireless signals can be detected from miles away; Bob's network is not safe

  Correct Answer: D

  It's all depending on the capacity of the antenna that a potential hacker will use in order to gain access to the wireless net.