EC-COUNCIL EC-COUNCIL Certifications 312-50V9 Questions & Answers

• Question 401:

  Jesse receives an email with an attachment labeled "Court_Notice_21206.zip". Inside the zip file is a file named "Court_Notice_21206.docx.exe" disguised as a word document. Upon execution, a window appears stating, "This word document is corrupt." In the background, the file copies itself to Jesse APPDATA\local directory and begins to beacon to a C2 server to download additional malicious binaries.

  What type of malware has Jesse encountered?

  A. Trojan

  B. Worm

  C. Macro Virus

  D. Key-Logger

  Correct Answer: A Section: (none)

  In computing, Trojan horse, or Trojan, is any malicious computer program which is used to hack into a computer by misleading users of its true intent. Although their payload can be anything, many modern forms act as a backdoor, contacting a controller which can then have unauthorized access to the affected computer.

  References: https://en.wikipedia.org/wiki/Trojan_horse_(computing)

• Question 402:

  This tool is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the PTW attack, thus making the attack much faster compared to other WEP cracking tools.

  Which of the following tools is being described?

  A. Aircrack-ng

  B. Airguard

  C. WLAN-crack

  D. wificracker

  Correct Answer: A Section: (none)

  Aircrack-ng is a complete suite of tools to assess WiFi network security.

  The default cracking method of Aircrack-ng is PTW, but Aircrack-ng can also use the FMS/KoreK method,

  which incorporates various statistical attacks to discover the WEP key and uses these in combination with

  brute forcing.

  References: http://www.aircrack-ng.org/doku.php?id=aircrack-ng

• Question 403:

  The Heartbleed bug was discovered in 2014 and is widely referred to under MITRE's Common Vulnerabilities and Exposures (CVE) as CVE-2014-0160. This bug affects the OpenSSL implementation of the transport layer security (TLS) protocols defined in RFC6520.

  What type of key does this bug leave exposed to the Internet making exploitation of any compromised system very easy?

  A. Private

  B. Public

  C. Shared

  D. Root

  Correct Answer: A Section: (none)

  The data obtained by a Heartbleed attack may include unencrypted exchanges between TLS parties likely to be confidential, including any form post data in users' requests. Moreover, the confidential data exposed could include authentication secrets such as session cookies and passwords, which might allow attackers to impersonate a user of the service. An attack may also reveal private keys of compromised parties.

  References: https://en.wikipedia.org/wiki/Heartbleed

• Question 404:

  A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a single server.

  Based on this information, what should be one of your key recommendations to the bank?

  A. Place a front-end web server in a demilitarized zone that only handles external web traffic

  B. Require all employees to change their passwords immediately

  C. Move the financial data to another server on the same IP subnet

  D. Issue new certificates to the web servers from the root certificate authority

  Correct Answer: A Section: (none)

  A DMZ or demilitarized zone (sometimes referred to as a perimeter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to a larger and untrusted network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's local area network (LAN); an external network node only has direct access to equipment in the DMZ, rather than any other part of the network.

  References: https://en.wikipedia.org/wiki/DMZ_(computing)

• Question 405:

  Port scanning can be used as part of a technical assessment to determine network vulnerabilities. The TCP XMAS scan is used to identify listening ports on the targeted system.

  If a scanned port is open, what happens?

  A. The port will ignore the packets.

  B. The port will send an RST.

  C. The port will send an ACK.

  D. The port will send a SYN.

  Correct Answer: A Section: (none)

  An attacker uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with the all flags sent in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an outof-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.

  References: https://capec.mitre.org/data/definitions/303.html

• Question 406:

  During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.

  What is this type of DNS configuration commonly called?

  A. Split DNS

  B. DNSSEC

  C. DynDNS

  D. DNS Scheme

  Correct Answer: A Section: (none)

  In a split DNS infrastructure, you create two zones for the same domain, one to be used by the internal network, the other used by the external network. Split DNS directs internal hosts to an internal domain name server for name resolution and external hosts are directed to an external domain name server for name resolution.

  References: http://www.webopedia.com/TERM/S/split_DNS.html

• Question 407:

  The network administrator contacts you and tells you that she noticed the temperature on the internal wireless router increases by more than 20% during weekend hours when the office was closed. She asks you to investigate the issue because she is busy dealing with a big conference and she doesn't have time to perform the task.

  What tool can you use to view the network traffic being sent and received by the wireless router?

  A. Wireshark

  B. Nessus

  C. Netcat

  D. Netstat

  Correct Answer: A Section: (none)

  Wireshark is a Free and open source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education.

  Incorrect Answers:

  B: Nessus is an open-source network vulnerability scanner that uses the Common Vulnerabilities and Exposures architecture for easy cross-linking between compliant security tools.

  C: Netcat (often abbreviated to nc) is a computer networking utility for reading from and writing to network connections using TCP or UDP.

  D: Netstat provides network statistics.

  References: https://en.wikipedia.org/wiki/Wireshark

• Question 408:

  When you return to your desk after a lunch break, you notice a strange email in your inbox. The sender is someone you did business with recently, but the subject line has strange characters in it.

  What should you do?

  A. Forward the message to your company's security response team and permanently delete the message from your computer.

  B. Reply to the sender and ask them for more information about the message contents.

  C. Delete the email and pretend nothing happened

  D. Forward the message to your supervisor and ask for her opinion on how to handle the situation

  Correct Answer: A Section: (none)

  By setting up an email address for your users to forward any suspicious email to, the emails can be automatically scanned and replied to, with security incidents created to follow up on any emails with attached malware or links to known bad websites.

  References: https://docs.servicenow.com/bundle/helsinki-security-management/page/product/threatintelligence/task/t_ConfigureScanEmailInboundAction.html

• Question 409:

  It is a vulnerability in GNU's bash shell, discovered in September of 2014, that gives attackers access to run remote commands on a vulnerable system. The malicious software can take control of an infected machine, launch denial-of-service attacks to disrupt websites, and scan for other vulnerable devices (including routers).

  Which of the following vulnerabilities is being described?

  A. Shellshock

  B. Rootshock

  C. Rootshell

  D. Shellbash

  Correct Answer: A Section: (none)

  Shellshock, also known as Bashdoor, is a family of security bugs in the widely used Unix Bash shell, the first of which was disclosed on 24 September 2014.

  References: https://en.wikipedia.org/wiki/Shellshock_(software_bug)

• Question 410:

  An attacker changes the profile information of a particular user (victim) on the target website. The attacker uses this string to update the victim's profile to a text file and then submit the data to the attacker's database.

  What is this type of attack (that can use either HTTP GET or HTTP POST) called?

  A. Cross-Site Request Forgery

  B. Cross-Site Scripting

  C. SQL Injection

  D. Browser Hacking

  Correct Answer: A Section: (none)

  Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts. Different HTTP request methods, such as GET and POST, have different level of susceptibility to CSRF attacks and require different levels of protection due to their different handling by web browsers.

  References: https://en.wikipedia.org/wiki/Cross-site_request_forgery