EC-COUNCIL EC-COUNCIL Certifications 312-50V10 Questions & Answers

• Question 401:

  Which of the following is the structure designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?

  A. PKI

  B. single sign on

  C. biometrics

  D. SOA

  Correct Answer: A

  A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates [1] and manage public- key encryption. The purpose of a PKI is to facilitate the secure electronic transfer of information for a range of network activities such as e-commerce, internet banking and confidential email. References: https://en.wikipedia.org/wiki/Public_key_infrastructure

• Question 402:

  You've just been hired to perform a pen test on an organization that has been subjected to a large-scale attack. The CIO is concerned with mitigating threats and vulnerabilities to totally eliminate risk.

  What is one of the first things you should do when given the job?

  A. Explain to the CIO that you cannot eliminate all risk, but you will be able to reduce risk to acceptable levels.

  B. Interview all employees in the company to rule out possible insider threats.

  C. Establish attribution to suspected attackers.

  D. Start the wireshark application to start sniffing network traffic.

  Correct Answer: A

  The goals of penetration tests are:

  References: https://en.wikipedia.org/wiki/Penetration_test

• Question 403:

  What is a "Collision attack" in cryptography?

  A. Collision attacks try to find two inputs producing the same hash.

  B. Collision attacks try to break the hash into two parts, with the same bytes in each part to get the private key.

  C. Collision attacks try to get the public key.

  D. Collision attacks try to break the hash into three parts to get the plaintext value.

  Correct Answer: A

  A Collision Attack is an attempt to find two input strings of a hash function that produce the same hash result.

  References: https://learncryptography.com/hash-functions/hash-collision-attack

• Question 404:

  You are attempting to man-in-the-middle a session. Which protocol will allow you to guess a sequence number?

  A. TCP

  B. UPD

  C. ICMP

  D. UPX

  Correct Answer: A

  At the establishment of a TCP session the client starts by sending a SYN-packet (SYN=synchronize) with a sequence number. To hijack a session it is required to send a packet with a right seq-number, otherwise they are dropped.

  References: https://www.exploit-db.com/papers/13587/

• Question 405:

  You've gained physical access to a Windows 2008 R2 server which has an accessible disc drive. When you attempt to boot the server and log in, you are unable to guess the password. In your tool kit you have an Ubuntu 9.10 Linux LiveCD. Which Linux based tool has the ability to change any user's password or to activate disabled Windows accounts?

  A. CHNTPW

  B. Cain and Abel

  C. SET

  D. John the Ripper

  Correct Answer: A

  chntpw is a software utility for resetting or blanking local passwords used by Windows NT, 2000, XP, Vista, 7, 8 and 8.1. It does this by editing the SAM database where Windows stores password hashes.

  References: https://en.wikipedia.org/wiki/Chntpw

• Question 406:

  Which of the following is the greatest threat posed by backups?

  A. A backup is the source of Malware or illicit information.

  B. A backup is unavailable during disaster recovery.

  C. A backup is incomplete because no verification was performed.

  D. An un-encrypted backup can be misplaced or stolen.

  Correct Answer: D

  If the data written on the backup media is properly encrypted, it will be useless for anyone without the key.

  References: http://resources.infosecinstitute.com/backup-media-encryption/

• Question 407:

  You have compromised a server and successfully gained a root access. You want to pivot and pass traffic undetected over the network and evade any possible Intrusion Detection System.

  What is the best approach?

  A. Install Cryptcat and encrypt outgoing packets from this server.

  B. Install and use Telnet to encrypt all outgoing traffic from this server.

  C. Use Alternate Data Streams to hide the outgoing packets from this server.

  D. Use HTTP so that all traffic can be routed via a browser, thus evading the internal Intrusion Detection Systems.

  Correct Answer: A

  Cryptcat enables us to communicate between two systems and encrypts the communication between them with twofish.

  References: http://null-byte.wonderhowto.com/how-to/hack-like-pro-create-nearly- undetectable-backdoorwith-cryptcat-0149264/

• Question 408:

  After trying multiple exploits, you've gained root access to a Centos 6 server. To ensure you maintain access, what would you do first?

  A. Create User Account

  B. Disable Key Services

  C. Disable IPTables

  D. Download and Install Netcat

  Correct Answer: A

• Question 409:

  Which of the following is an extremely common IDS evasion technique in the web world?

  A. unicode characters

  B. spyware

  C. port knocking

  D. subnetting

  Correct Answer: A

  Unicode attacks can be effective against applications that understand it. Unicode is the international standard whose goal is to represent every character needed by every written human language as a single integer number. What is known as Unicode evasion should more correctly be referenced as UTF-8 evasion. Unicode characters are normally represented with two bytes, but this is impractical in real life. One aspect of UTF-8 encoding causes problems: non-Unicode characters can be represented encoded. What is worse is multiple representations of each character can exist. Non-Unicode character encodings are known as overlong characters, and may be signs of attempted attack.

  References: http://books.gigatux.nl/mirror/apachesecurity/0596007248/apachesc-chp-10- sect-8.html

• Question 410:

  > NMAP -sn 192.168.11.200-215

  The NMAP command above performs which of the following?

  A. A ping scan

  B. A trace sweep

  C. An operating system detect

  D. A port scan

  Correct Answer: A

  NMAP -sn (No port scan)

  This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that

  responded to the host discovery probes. This is often known as a "ping scan", but you can also request

  that traceroute and NSE host scripts be run.

  References: https://nmap.org/book/man-host-discovery.html