All About Verified 312-50 Vce

NEW QUESTION 1

According to the CEH methodology, what is the next step to be performed after footprinting?

• A. Enumeration
• B. Scanning
• C. System Hacking
• D. Social Engineering
• E. Expanding Influence

Answer: B

Explanation:
Once footprinting has been completed, scanning should be attempted next. Scanning should take place on two distinct levels: network and host.

NEW QUESTION 2

You are scanning into the target network for the first time. You find very few conventional ports open. When you attempt to perform traditional service identification by connecting to the open ports, it yields either unreliable or no results. You are unsure of what protocols are being used. You need to discover as many different protocols as possible. Which kind of scan would you use to do this?

• A. Nmap with the –sO (Raw IP packets) switch
• B. Nessus scan with TCP based pings
• C. Nmap scan with the –sP (Ping scan) switch
• D. Netcat scan with the –u –e switches

Answer: A

Explanation:
Running Nmap with the –sO switch will do a IP Protocol Scan. The IP
protocol scan is a bit different than the other nmap scans. The IP protocol scan is searching for additional IP protocols in use by the remote station, such as ICMP, TCP, and UDP. If a router is scanned, additional IP protocols such as EGP or IGP may be identified.

NEW QUESTION 3

Jake is a network administrator who needs to get reports from all the computer and network devices on his network. Jake wants to use SNMP but is afraid that won't be secure since passwords and messages are in clear text. How can Jake gather network information in a secure manner?

• A. He can use SNMPv3
• B. Jake can use SNMPrev5
• C. He can use SecWMI
• D. Jake can use SecSNMP

Answer: A

NEW QUESTION 4

Study the log below and identify the scan type. tcpdump –w host 192.168.1.10

• A. nmap R 192.168.1.10
• B. nmap S 192.168.1.10
• C. nmap V 192.168.1.10
• D. nmap –sO –T 192.168.1.10

Answer: D

Explanation:
-sO: IP protocol scans: This method is used to determine which IP protocols are supported on a host. The technique is to send raw IP packets without any further protocol header to each specified protocol on the target machine.

NEW QUESTION 5

You suspect that your Windows machine has been compromised with a Trojan virus. When you run anti-virus software it does not pick of the Trojan. Next you run netstat
command to look for open ports and you notice a strange port 6666 open. What is the next step you would do?

• A. Re-install the operating system.
• B. Re-run anti-virus software.
• C. Install and run Trojan removal software.
• D. Run utility fport and look for the application executable that listens on port 6666.

Answer: D

Explanation:
Fport reports all open TCP/IP and UDP ports and maps them to the owning application. This is the same information you would see using the 'netstat -an' command, but it also maps those ports to running processes with the PID, process name and path. Fport can be used to quickly identify unknown open ports and their associated applications.

NEW QUESTION 6

You are trying to hijack a telnet session from a victim machine with IP address 10.0.0.5 to Cisco router at 10.0.0.1. You sniff the traffic and attempt to predict the sequence and acknowledgement numbers to successfully hijack the telnet session.
Here is the captured data in tcpdump.

What are the next sequence and acknowledgement numbers that the router will send to the victim machine?

• A. Sequence number: 82980070 Acknowledgement number: 17768885A.
• B. Sequence number: 17768729 Acknowledgement number: 82980070B.
• C. Sequence number: 87000070 Acknowledgement number: 85320085C.
• D. Sequence number: 82980010 Acknowledgement number: 17768885D.

Answer: A

NEW QUESTION 7

How would you describe an attack where an attacker attempts to deliver the payload over multiple packets over long periods of time with the purpose of defeating simple pattern matching in IDS systems without session reconstruction? A characteristic of this attack would be a continuous stream of small packets.

• A. Session Splicing
• B. Session Stealing
• C. Session Hijacking
• D. Session Fragmentation

Answer: A

NEW QUESTION 8

Why would an attacker want to perform a scan on port 137?

• A. To discover proxy servers on a network
• B. To disrupt the NetBIOS SMB service on the target host
• C. To check for file and print sharing on Windows systems
• D. To discover information about a target host using NBTSTAT

Answer: D

Explanation:
Microsoft encapsulates netbios information within TCP/Ip using ports 135-139. It is trivial for an attacker to issue the following command:
nbtstat -A (your Ip address)
from their windows machine and collect information about your windows machine (if you are not blocking traffic to port 137 at your borders).

NEW QUESTION 9

You are the Security Administrator of Xtrinity, Inc. You write security policies and conduct assesments to protect the company's network. During one of your periodic checks to see how well policy is being observed by the employees, you discover an employee has attached a modem to his telephone line and workstation. He has used this modem to dial in to his workstation, thereby bypassing your firewall. A security breach has occurred as a direct result of this activity. The employee explains that he used the modem because he had to download software for a department project. How would you resolve this situation?

• A. Reconfigure the firewall
• B. Conduct a needs analysis
• C. Install a network-based IDS
• D. Enforce the corporate security policy

Answer: D

Explanation:
The security policy is meant to always be followed until changed. If a need rises to perform actions that might violate the security policy you’ll have to find another way to accomplish the task or wait until the policy has been changed.

NEW QUESTION 10

Attacker forges a TCP/IP packet, which causes the victim to try opening a connection with itself. This causes the system to go into an infinite loop trying to resolve this unexpected connection. Eventually, the connection times out, but during this resolution, the machine appears to hang or become very slow. The attacker sends such packets on a regular basis to slow down the system.
Unpatched Windows XP and Windows Server 2003 machines are vulnerable to these attacks. What type of Denial of Service attack is represented here?

• A. SMURF Attacks
• B. Targa attacks
• C. LAND attacks
• D. SYN Flood attacks

Answer: C

Explanation:
The attack involves sending a spoofed TCP SYN packet (connection initiation) with the target host's IP address and an open port
as both source and destination.The reason a LAND attack works is because it causes the machine to reply to itself continuously.
http://en.wikipedia.org/wiki/LAND

NEW QUESTION 11

Carl has successfully compromised a web server from behind a firewall by exploiting a vulnerability in the web server program. He wants to proceed by installing a backdoor program. However, he is aware that not all inbound ports on the firewall are in the open state.
From the list given below, identify the port that is most likely to be open and allowed to reach the server that Carl has just compromised.

• A. 53
• B. 110
• C. 25
• D. 69

Answer: A

Explanation:
Port 53 is used by DNS and is almost always open, the problem is often that the port is opened for the hole world and not only for outside DNS servers.

NEW QUESTION 12

Which of the following buffer overflow exploits are related to Microsoft IIS web server? (Choose three)

• A. Internet Printing Protocol (IPP) buffer overflow
• B. Code Red Worm
• C. Indexing services ISAPI extension buffer overflow
• D. NeXT buffer overflow

Answer: ABC

Explanation:
Both the buffer overflow in the Internet Printing Protocol and the ISAPI extension buffer overflow is explained in Microsoft Security Bulletin MS01-023. The Code Red worm was a computer worm released on the Internet on July 13, 2001. It attacked computers running Microsoft's IIS web server.

NEW QUESTION 13

How do you defend against ARP Poisoning attack? (Select 2 answers)

• A. Enable DHCP Snooping Binding Table
• B. Restrict ARP Duplicates
• C. Enable Dynamic ARP Inspection
• D. Enable MAC snooping Table

Answer: AC

NEW QUESTION 14

A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?

• A. The packets were sent by a worm spoofing the IP addresses of 47 infected sites
• B. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
• C. All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
• D. 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0

Answer: B

NEW QUESTION 15

How would you prevent session hijacking attacks?

• A. Using biometrics access tokens secures sessions against hijacking
• B. Using non-Internet protocols like http secures sessions against hijacking
• C. Using hardware-based authentication secures sessions against hijacking
• D. Using unpredictable sequence numbers secures sessions against hijacking

Answer: D

Explanation:
Protection of a session needs to focus on the unique session identifier because it is the only thing that distinguishes users. If the session ID is compromised, attackers can impersonate other users on the system. The first thing is to ensure that the sequence of identification numbers issued by the session management system is unpredictable; otherwise, it's trivial to hijack another user's session. Having a large number of possible session IDs (meaning that they should be very long) means that there are a lot more permutations for an attacker to try.

NEW QUESTION 16

Exhibit:

Given the following extract from the snort log on a honeypot, what do you infer from the attack?

• A. A new port was opened
• B. A new user id was created
• C. The exploit was successful
• D. The exploit was not successful

Answer: D

Explanation:
The attacker submits a PASS to the honeypot and receives a login incorrect
before disconnecting.

NEW QUESTION 17

Jacob is looking through a traffic log that was captured using Wireshark. Jacob has come across what appears to be SYN requests to an internal computer from a spoofed IP address. What is Jacob seeing here?

• A. Jacob is seeing a Smurf attack.
• B. Jacob is seeing a SYN flood.
• C. He is seeing a SYN/ACK attack.
• D. He has found evidence of an ACK flood.

Answer: B

NEW QUESTION 18

Which of the following is NOT a reason 802.11 WEP encryption is vulnerable?

• A. There is no mutual authentication between wireless clients and access points
• B. Automated tools like AirSnort are available to discover WEP keys
• C. The standard does not provide for centralized key management
• D. The 24 bit Initialization Vector (IV) field is too small

Answer: C

Explanation:
The lack of centralized key management in itself is not a reason that the WEP encryption is vulnerable, it is the people setting the user shared key that makes it unsecure.

NEW QUESTION 19

Bob has a good understanding of cryptography, having worked with it for many years. Cryptography is used to secure data from specific threat, but it does not secure the application from coding errors. It can provide data privacy, integrity and enable strong authentication but it cannot mitigate programming errors.
What is a good example of a programming error that Bob can use to illustrate to the management that encryption will not address all of their security concerns?

• A. Bob can explain that a random generator can be used to derive cryptographic keys but it uses a weak seed value and it is a form of programming error.
• B. Bob can explain that by using passwords to derive cryptographic keys it is a form of a programming error.
• C. Bob can explain that a buffer overflow is an example of programming error and it is a common mistake associated with poor programming technique.
• D. Bob can explain that by using a weak key management technique it is a form of programming error.

Answer: C

Explanation:
A buffer overflow occurs when you write a set of values (usually a string of characters) into a fixed length buffer and write at least one value outside that buffer's boundaries (usually past its end). A buffer overflow can occur when reading input from the user into a buffer, but it can also occur during other kinds of processing in a program. Technically, a buffer overflow is a problem with the program's internal implementation.

NEW QUESTION 20

In an attempt to secure his wireless network, Bob implements a VPN to cover the wireless communications. Immediately after the implementation, users begin complaining about how slow the wireless network is. After benchmarking the network’s speed. Bob discovers that throughput has dropped by almost half even though the number of users has remained the same.
Why does this happen in the VPN over wireless implementation?

• A. The stronger encryption used by the VPN slows down the network.
• B. Using a VPN with wireless doubles the overhead on an access point for all direct client to access point communications.
• C. VPNs use larger packets then wireless networks normally do.
• D. Using a VPN on wireless automatically enables WEP, which causes additional overhead.

Answer: B

Explanation:
By applying VPN the access point will have to recalculate all headers destined for client and from clients twice.

NEW QUESTION 21


Which of the following nmap command in Linux procedures the above output?

• A. sudo nmap –sP 192.168.0.1/24
• B. root nmap –sA 192.168.0.1/24
• C. run nmap –TX 192.168.0.1/24
• D. launch nmap –PP 192.168.0.1/24

Answer: A

Explanation:
This is an output from a ping scan. The option –sP will give you a ping scan of the 192.168.0.1/24 network.

NEW QUESTION 22

ARP poisoning is achieved in steps

• A. 1
• B. 2
• C. 3
• D. 4

Answer: B

Explanation:
The hacker begins by sending a malicious ARP "reply" (for which there was no previous request) to your router, associating his computer's MAC address with your IP Address. Now your router thinks the hacker's computer is your computer. Next, the hacker sends a malicious ARP reply to your computer, associating his MAC Address with the routers IP Address. Now your machine thinks the hacker's computer is your router. The hacker has now used ARP poisoning to accomplish a MitM attack.

NEW QUESTION 23

Sniffing is considered an active attack.

• A. True
• B. False

Answer: B

Explanation:
Sniffing is considered a passive attack.

NEW QUESTION 24

Exhibit:

Study the following log extract and identify the attack.

• A. Hexcode Attack
• B. Cross Site Scripting
• C. Multiple Domain Traversal Attack
• D. Unicode Directory Traversal Attack

Answer: D

Explanation:
The “Get /msadc/……/……/……/winnt/system32/cmd.exe?” shows that a Unicode Directory Traversal Attack has been performed.

NEW QUESTION 25

Usernames, passwords, e-mail addresses, and the location of CGI scripts may be obtained from which of the following information sources?

• A. Company web site
• B. Search engines
• C. EDGAR Database query
• D. Whois query

Answer: A

Explanation:
Whois query would not enable us to find the CGI scripts whereas in the actual website, some of them will have scripts written to make the website more user friendly. The EDGAR database would in fact give us a lot of the information requested but not the location of CGI scripts, as would a simple search engine on the Internet if you have the time needed.

NEW QUESTION 26

Choose one of the following pseudo codes to describe this statement:
If we have written 200 characters to the buffer variable, the stack should stop because it cannot hold any more data.

• A. If (I > 200) then exit (1)
• B. If (I < 200) then exit (1)
• C. If (I <= 200) then exit (1)
• D. If (I >= 200) then exit (1)

Answer: D

NEW QUESTION 27
......