EC-COUNCIL CEH v11 312-50V11 Questions & Answers

• Question 1:

  Nedved is an IT Security Manager of a bank in his country. One day. he found out that there is a security breach to his company's email server based on analysis of a suspicious connection from the email server to an unknown IP Address.

  What is the first thing that Nedved needs to do before contacting the incident response team?

  A. Leave it as it Is and contact the incident response te3m right away

  B. Block the connection to the suspicious IP Address from the firewall

  C. Disconnect the email server from the network

  D. Migrate the connection to the backup email server

  Correct Answer: C

• Question 2:

  The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1(100%). What is the closest approximate cost of this replacement and recovery operation per year?

  A. $1320

  B. $440

  C. $100

  D. $146

  Correct Answer: D

• Question 3:

  You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What Wireshark filter will show the connections from the snort machine to kiwi syslog machine?

  A. tcp.srcport= = 514 andand ip.src= = 192.168.0.99

  B. tcp.srcport= = 514 andand ip.src= = 192.168.150

  C. tcp.dstport= = 514 andand ip.dst= = 192.168.0.99

  D. tcp.dstport= = 514 andand ip.dst= = 192.168.0.150

  Correct Answer: D

• Question 4:

  This form of encryption algorithm is asymmetric key block cipher that is characterized by a 128-bit block size, and its key size can be up to 256 bits. Which among the following is this encryption algorithm?

  A. Twofish encryption algorithm

  B. HMAC encryption algorithm

  C. IDEA D. Blowfish encryption algorithm

  Correct Answer: A

  Twofish is an encryption algorithm designed by Bruce Schneier. It's a symmetric key block cipher with a block size of 128 bits, with keys up to 256 bits. it's associated with AES (Advanced Encryption Standard) and an earlier block cipher called Blowfish. Twofish was actually a finalist to become the industry standard for encryption, but was ultimately beaten out by the present AES.Twofish has some distinctive features that set it aside from most other cryptographic protocols. For one, it uses pre-computed, key- dependent S-boxes. An S-box (substitution-box) may be a basic component of any symmetric key algorithm which performs substitution. within the context of Twofish's block cipher, the S-box works to obscure the connection of the key to the ciphertext. Twofish uses a pre-computed, key-dependent S-box which suggests that the S-box is already provided, but depends on the cipher key to decrypt the knowledge . How Secure is Twofish? Twofish is seen as a really secure option as far as encryption protocols go. one among the explanations that it wasn't selected because the advanced encryption standard is thanks to its slower speed. Any encryption standard that uses a 128- bit or higher key, is theoretically safe from brute force attacks. Twofish is during this category.Because Twofish uses "pre-computed key-dependent S-boxes", it are often susceptible to side channel attacks. this is often thanks to the tables being precomputed. However, making these tables key-dependent helps mitigate that risk. There are a couple of attacks on Twofish, but consistent with its creator, Bruce Schneier, it didn't constitute a real cryptanalysis. These attacks didn't constitue a practical break within the cipher. Products That Use TwofishGnuPG: GnuPG may be a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also referred to as PGP). GnuPG allows you to encrypt and sign your data and communications; it features a flexible key management system, along side access modules for all types of public key directories.KeePass: KeePass may be a password management tool that generates passwords with topnotch security. It's a free, open source, lightweight and easy-to-use password manager with many extensions and plugins.Password Safe: Password Safe uses one master password to stay all of your passwords protected, almost like the functionality of most of the password managers on this list. It allows you to store all of your passwords during a single password database, or multiple databases for various purposes. Creating a database is straightforward , just create the database, set your master password.PGP (Pretty Good Privacy): PGP is employed mostly for email encryption, it encrypts the content of the e-mail . However, Pretty Good Privacy doesn't encrypt the topic and sender of the e- mail , so make certain to never put sensitive information in these fields when using PGP.TrueCrypt: TrueCrypt may be a software program that encrypts and protects files on your devices. With TrueCrypt the encryption is transparent to the user and is completed locally at the user's computer. this suggests you'll store a TrueCrypt file on a server and TrueCrypt will encrypt that file before it's sent over the network.

• Question 5:

  What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?

  A. The attacker queries a nameserver using the DNS resolver.

  B. The attacker makes a request to the DNS resolver.

  C. The attacker forges a reply from the DNS resolver.

  D. The attacker uses TCP to poison the ONS resofver.

  Correct Answer: A

• Question 6:

  A company's security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?

  A. Attempts by attackers to access the user and password information stored in the company's SQL database.

  B. Attempts by attackers to access Web sites that trust the Web browser user by stealing the user's authentication credentials.

  C. Attempts by attackers to access password stored on the user's computer without the user's knowledge.

  D. Attempts by attackers to determine the user's Web browser usage patterns, including when sites were visited and for how long.

  Correct Answer: B

• Question 7:

  Richard, an attacker, targets an MNC In this process, he uses a footprinting technique to gather as much information as possible. Using this technique, he gathers domain information such as the target domain name, contact details of its owner, expiry date, and creation date. With this information, he creates a map of the organization's network and misleads domain owners with social engineering to obtain internal details of its network. What type of footprinting technique is employed by Richard?

  A. VPN footprinting

  B. Email footprinting

  C. VoIP footprinting

  D. Whois footprinting

  Correct Answer: B

• Question 8:

  A company's policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols because the employees do not like changes. You have positioned a network sniffer to capture traffic from the laptops used by employees in the data ingest department. Using Wireshark to examine the captured traffic, which command can be used as display filter to find unencrypted file transfers?

  A. tcp.port = = 21

  B. tcp.port = 23

  C. tcp.port = = 21 | | tcp.port = =22

  D. tcp.port ! = 21

  Correct Answer: A

• Question 9:

  Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session 10 to the target employee. The session ID links the target employee to Boneys account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boneys account. What is the attack performed by Boney in the above scenario?

  A. Session donation attack

  B. Session fixation attack

  C. Forbidden attack

  D. CRIME attack

  Correct Answer: B

• Question 10:

  To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program.

  What term is commonly used when referring to this type of testing?

  A. Randomizing

  B. Bounding

  C. Mutating

  D. Fuzzing

  Correct Answer: D