EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 71:

  Sandra is the security administrator of ABC.com. One day she notices that the ABC.com Oracle database server has been compromised and customer information along with financial data has been stolen. The financial loss will be estimated in millions of dollars if the database gets into the hands of competitors. Sandra wants to report this crime to the law enforcement agencies immediately. Which organization coordinates computer crime investigations throughout the United States?

  A. NDCA

  B. NICP

  C. CIRP

  D. NPC

  E. CIA

  Correct Answer: D

• Question 72:

  Name two software tools used for OS guessing.(Choose two.

  A. Nmap

  B. Snadboy

  C. Queso

  D. UserInfo

  E. NetBus

  Correct Answer: AC

  Nmap and Queso are the two best-known OS guessing programs. OS guessing software has the ability to look at peculiarities in the way that each vendor implements the RFC's. These differences are compared with its database of known OS fingerprints. Then a best guess of the OS is provided to the user.

• Question 73:

  Which type of Nmap scan is the most reliable, but also the most visible, and likely to be picked up by and IDS?

  A. SYN scan

  B. ACK scan

  C. RST scan

  D. Connect scan

  E. FIN scan

  Correct Answer: D

  The TCP full connect (-sT) scan is the most reliable.

• Question 74:

  Exhibit

  

  (Note: the student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)

  Snort has been used to capture packets on the network. On studying the packets, the penetration tester finds it to be abnormal. If you were the penetration tester, why would you find this abnormal?

  What is odd about this attack? Choose the best answer.

  A. This is not a spoofed packet as the IP stack has increasing numbers for the three flags.

  B. This is back orifice activity as the scan comes form port 31337.

  C. The attacker wants to avoid creating a sub-carries connection that is not normally valid.

  D. These packets were crafted by a tool, they were not created by a standard IP stack.

  Correct Answer: B

  Port 31337 is normally used by Back Orifice. Note that 31337 is hackers spelling of `elite', meaning `elite hackers'.

• Question 75:

  Which of the following Nmap commands would be used to perform a stack fingerprinting?

  A. Nmap -O -p80

  B. Nmap -hU -Q

  C. Nmap -sT -p

  D. Nmap -u -o -w2

  E. Nmap -sS -0p target

  Correct Answer: A

  This option activates remote host identification via TCP/IP fingerprinting. In other words, it uses a bunch of techniques to detect subtlety in the underlying operating system network stack of the computers you are scanning. It uses this information to create a "fingerprint" which it compares with its database of known OS fingerprints (the nmap-os-fingerprints file. to decide what type of system you are scanning.

• Question 76:

  Destination unreachable administratively prohibited messages can inform the hacker to what?

  A. That a circuit level proxy has been installed and is filtering traffic

  B. That his/her scans are being blocked by a honeypot or jail

  C. That the packets are being malformed by the scanning software

  D. That a router or other packet-filtering device is blocking traffic

  E. That the network is functioning normally

  Correct Answer: D

  Destination unreachable administratively prohibited messages are a good way to discover that a router or other low-level packet device is filtering traffic. Analysis of the ICMP message will reveal the IP address of the blocking device and the filtered port. This further adds the to the network map and information being discovered about the network and hosts.

• Question 77:

  What does a type 3 code 13 represent?(Choose two.

  A. Echo request

  B. Destination unreachable

  C. Network unreachable

  D. Administratively prohibited

  E. Port unreachable

  F. Time exceeded

  Correct Answer: BD

  Type 3 code 13 is destination unreachable administratively prohibited. This type of message is typically returned from a device blocking a port.

• Question 78:

  Which of the following ICMP message types are used for destinations unreachables?

  A. 0

  B. 3

  C. 11

  D. 13

  E. 17

  Correct Answer: B

  Type 3 messages are used for unreachable messages. 0 is Echo Reply, 8 is Echo request, 11 is time exceeded, 13 is timestamp and 17 is subnet mask request. Learning these would be advisable for the test.

• Question 79:

  What are two things that are possible when scanning UDP ports? (Choose two.

  A. A reset will be returned

  B. An ICMP message will be returned

  C. The four-way handshake will not be completed

  D. An RFC 1294 message will be returned

  E. Nothing

  Correct Answer: BE

  Closed UDP ports can return an ICMP type 3 code 3 message. No response can mean the port is open or the packet was silently dropped.

• Question 80:

  ________ is an automated vulnerability assessment tool.

  A. Whack a Mole

  B. Nmap

  C. Nessus

  D. Kismet

  E. Jill32

  Correct Answer: C

  Nessus is a vulnerability assessment tool.