EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 541:

  An attacker runs netcat tool to transfer a secret file between two hosts.

  Machine A: netcat -1 p 1234 < secretfile

  Machine B: netcat 192.168.3.4 > 1234

  He is worried about information being sniffed on the network.

  How would the attacker use netcat to encrypt information before transmitting it on the wire?

  A. Machine A: netcat -1 p s password 1234 < testfileMachine B: netcat 1234

  B. Machine A: netcat -1 e magickey p 1234 < testfileMachine B: netcat 1234

  C. Machine A: netcat -1 p 1234 < testfile pw passwordMachine B: netcat 1234 pw password

  D. Use cryptcat instead of netcat.

  Correct Answer: D

  Cryptcat is the standard netcat enhanced with twofish encryption with ports for WIndows NT, BSD and Linux. Twofish is courtesy of counterpane, and cryptix. A default netcat installation does not contain any cryptography support.

• Question 542:

  Jane wishes to forward X-Windows traffic to a remote host as well as POP3 traffic. She is worried that adversaries might be monitoring the communication link and could inspect captured traffic. She would line to tunnel the information to the remote end but does not have VPN capabilities to do so.

  Which of the following tools can she use to protect the link?

  A. MD5

  B. SSH

  C. RSA

  D. PGP

  Correct Answer: B

  Port forwarding, or tunneling, is a way to forward otherwise insecure TCP traffic through SSH Secure Shell. You can secure for example POP3, SMTP and HTTP connections that would otherwise be insecure.

• Question 543:

  You just purchased the latest DELL computer, which comes pre-installed with Windows XP, McAfee antivirus software and a host of other applications. You want to connect Ethernet wire to your cable modem and start using the computer immediately.

  Windows is dangerously insecure when unpacked from the box, and there are a few things that you must do before you use it.

  A. New Installation of Windows Should be patched by installation the latest service packs and hotfixes

  B. Enable "guest" account

  C. Install a personal firewall and lock down unused ports from connecting to your computer

  D. Install the latest signatures for Antivirus software

  E. Configure "Windows Update" to automatic

  F. Create a non-admin user with a complex password and login to this account

  Correct Answer: ACDEF

  The guest account is a possible vulnerability to your system so you should not enable it unless needed. Otherwise you should perform all other actions mentioned in order to have a secure system.

• Question 544:

  Jim was having no luck performing a penetration test on his company's network. He was running the test from home and had downloaded every security scanner he could lay his hands on. Despite knowing the IP range of all of the systems and the exact network configuration, Jim was unable to get any useful results. Why is Jim having these problems?

  A. Security scanners can't perform vulnerability linkage

  B. Security Scanners are not designed to do testing through a firewall

  C. Security Scanners are only as smart as their database and can't find unpublished vulnerabilities

  D. All of the above

  Correct Answer: D

  Security scanners are designed to find vulnerabilities but not to use them, also they will only find well known vulnerabilities that and no zero day exploits. Therefore you can't use a security scanner for penetration testing but need a more powerful program.

• Question 545:

  Which type of attack is port scanning?

  A. Web server attack

  B. Information gathering

  C. Unauthorized access

  D. Denial of service attack

  Correct Answer: B

• Question 546:

  Oregon Corp is fighting a litigation suit with Scamster Inc. Oregon has assigned a private investigative agency to go through garbage, recycled paper, and other rubbish at Scamster's office site in order to find relevant information. What would you call this kind of activity?

  A. Garbage Scooping

  B. Dumpster Diving

  C. Scanning

  D. CI Gathering

  Correct Answer: B

  Dumpster diving is the colloquial name for going through somebody's garbage -- which will usually be in dumpsters for large organizations. This is a powerful tactic because it is protected by social taboos. Trash is bad, and once it goes into

  the trash, something is best forgotten. The reality is that most company trash is fairly clean, and provides a gold mine of information.

• Question 547:

  Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

  A. To determine who is the holder of the root account

  B. To perform a DoS

  C. To create needless SPAM

  D. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail

  E. To test for virus protection

  Correct Answer: D

  Sending a bogus email is one way to find out more about internal servers. Also, to gather additional IP addresses and learn how they treat mail.

• Question 548:

  In which of the following should be performed first in any penetration test?

  A. System identification

  B. Intrusion Detection System testing

  C. Passive information gathering

  D. Firewall testing

  Correct Answer: C

• Question 549:

  Vulnerability mapping occurs after which phase of a penetration test?

  A. Host scanning

  B. Passive information gathering

  C. Analysis of host scanning

  D. Network level discovery

  Correct Answer: C

  The order should be Passive information gathering, Network level discovery, Host scanning and Analysis of host scanning.

• Question 550:

  A client has approached you with a penetration test requirements. They are concerned with the possibility of external threat, and have invested considerable resources in protecting their Internet exposure. However, their main concern is the possibility of an employee elevating his/her privileges and gaining access to information outside of their respective department.

  What kind of penetration test would you recommend that would best address the client's concern?

  A. A Black Box test

  B. A Black Hat test

  C. A Grey Box test

  D. A Grey Hat test

  E. A White Box test

  F. A White Hat test

  Correct Answer: C