EC-COUNCIL EC-COUNCIL Certifications 412-79 Questions & Answers

• Question 151:

  What is kept in the following directory? HKLM\SECURITY\Policy\Secrets

  A. Service account passwords in plain text

  B. Cached password hashes for the past 20 users

  C. IAS account names and passwords

  D. Local store PKI Kerberos certificates

  Correct Answer: A

• Question 152:

  Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports?

  A. Open

  B. Stealth

  C. Closed

  D. Filtered

  Correct Answer: A

• Question 153:

  Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM file on a computer. Where should Harold navigate on the computer to find the file?

  A. %systemroot%\system32\drivers\etc

  B. %systemroot%\repair

  C. %systemroot%\LSA

  D. %systemroot%\system32\LSA

  Correct Answer: B

• Question 154:

  When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

  A. NIPS

  B. Passive IDS

  C. Progressive IDS

  D. Active IDS

  Correct Answer: D

• Question 155:

  You work as an IT security auditor hired by a law firm in Boston to test whether you can gain access to sensitive information about the company's clients. You have rummaged through their trash and found very little information. You do not want to set off any alarms on their network, so you plan on performing passive footprinting against their Web servers. What tool should you use?

  A. Ping sweep

  B. Netcraft

  C. Dig

  D. Nmap

  Correct Answer: B

• Question 156:

  John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an email with a link to Error! Reference source not found.

  What information will he be able to gather from this?

  A. The SAM file from Hillary computer

  B. Hillary network username and password hash

  C. The SID of Hillary network account

  D. The network shares that Hillary has permissions

  Correct Answer: B

• Question 157:

  James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network. What type of DoS attack is James testing against his network?

  A. Fraggle

  B. SYN flood

  C. Trinoo

  D. Smurf

  Correct Answer: D

• Question 158:

  Paul's company is in the process of undergoing a complete security audit including logical and physical security testing. After all logical tests were performed; it is now time for the physical round to begin. None of the employees are made aware of this round of testing. The security-auditing firm sends in a technician dressed as an electrician. He waits outside in the lobby for some employees to get to work and follows behind them when they access the restricted areas. After entering the main office, he is able to get into the server room telling the IT manager that there is a problem with the outlets in that room. What type of attack has the technician performed?

  A. Fuzzing

  B. Tailgating

  C. Man trap attack

  D. Backtrapping

  Correct Answer: B

• Question 159:

  Kimberly is studying to be an IT security analyst at a vocational school in her town. The school offers many different programming as well as networking languages. What networking protocol language should she learn that routers utilize?

  A. OSPF

  B. BPG

  C. ATM

  D. UDP

  Correct Answer: A

• Question 160:

  You are running through a series of tests on your network to check for any security vulnerabilities. After normal working hours, you initiate a DoS attack against your external firewall. The firewall quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened?

  A. The firewall failed-open

  B. The firewall failed-bypass

  C. The firewall failed-closed

  D. The firewall ACL has been purged

  Correct Answer: A