Eccouncil 312-50 Dumps Questions Answers

Eccouncil 312-50 Dumps

Dumps4download providing 100% reliable Exam dumps that are verified by experts panel. Our Dumps4download 312-50 study material are totally unique and exam questions are valid all over the world. By using our 312-50 dumps we assure you that you will pass your exam on first attempt. You can easily score more than 97%.

100% exam passing Guarantee on your purchased exams.

100% money back guarantee if you will not clear your exam.

Eccouncil 312-50 Practice Test Helps You Turn Dreams To Reality!

IT Professionals from every sector are looking up certifications to boost their careers. Eccouncil being the leader certification provider earns the most demand in the industry.

The Eccouncil Certification is your short-cut to an ever-growing success. In the process, Dumps4download is your strongest coordinator, providing you with the best 312-50 Dumps PDF as well as Online Test Engine. Let’s steer your career to a more stable future with interactive and effective 312-50 Practice Exam Dumps.

Many of our customers are already excelling in their careers after achieving their goals with our help. You can too be a part of that specialized bunch with a little push in the right direction. Let us help you tread the heights of success.

Apply for the 312-50 Exam right away so you can get certified by using our Eccouncil Dumps.

Bulk Exams Package

Dumps4download Leads You To A 100% Success in First Attempt!

Our 312-50 Dumps PDF is intended to meet the requirements of the most suitable method for exam preparation. We especially hired a team of experts to make sure you get the latest and compliant 312-50 Practice Test Questions Answers. These questions are been selected according to the most relevance as well as the highest possibility of appearing in the exam. So, you can be sure of your success in the first attempt.

Interactive & Effective 312-50 Dumps PDF + Online Test Engine

Aside from our Eccouncil 312-50 Dumps PDF, we invest in your best practice through Online Test Engine. They are designed to reflect the actual exam format covering each topic of your exam. Also, with our interactive interface focusing on the exam preparation is easier than ever. With an easy-to-understand, interactive and effective study material assisting you there is nothing that could go wrong. We are 100% sure that our 312-50 Questions Answers Practice Exam is the best choice you can make to pass the exam with top score.

How Dumps4download Creates Better Opportunities for You!

Dumps4download knows how hard it is for you to beat this tough Eccouncil Exam terms and concepts. That is why to ease your preparation we offer the best possible training tactics we know best. Online Test Engine provides you an exam-like environment and PDF helps you take your study guide wherever you are. Best of all, you can download 312-50 Dumps PDF easily or better print it. For the purpose of getting concepts across as easily as possible, we have used simple language. Adding explanations at the end of the 312-50 Questions and Answers Practice Test we ensure nothing slips your grasp.

The exam stimulation is 100 times better than any other test material you would encounter. Besides, if you are troubled with anything concerning Certified Ethical Hacker Exam Exam or the 312-50 Dumps PDF, our 24/7 active team is quick to respond. So, leave us a message and your problem will be solved in a few minutes.

Get an Absolutely Free Demo Today!

Dumps4download offers an absolutely free demo version to test the product with sample features before actually buying it. This shows our concern for your best experience. Once you are thoroughly satisfied with the demo you can get the Certified Ethical Hacker Exam Practice Test Questions instantly.

24/7 Online Support – Anytime, Anywhere

Have a question? You can contact us anytime, anywhere. Our 24/7 Online Support makes sure you have absolutely no problem accessing or using Certified Ethical Hacker Exam Practice Exam Dumps. What’s more, Dumps4download is mobile compatible so you can access the site without having to log in to your Laptop or PC.

Features to use Dumps4download 312-50 Dumps:

• Thousands of satisfied customers.
• Good grades are 100% guaranteed.
• 100% verified by Experts panel.
• Up to date exam data.
• Dumps4download data is 100% trustworthy.
• Passing ratio more than 99%
• 100% money back guarantee.

Eccouncil 312-50 Frequently Asked Questions

Eccouncil 312-50 Sample Questions

Question # 1

Which tool/utility can help you extract the application layer data from each TCP connectionfrom a log file into separate files?

A. Snort  
B. argus 
C. TCPflow 
D. Tcpdump

Show Answer

---

Question # 2

Bob wants to prevent attackers from sniffing his passwords on the wired network. Which ofthe following lists the best options?

A. RSA, LSA, POP 
B. SSID, WEP, Kerberos 
C. SMB, SMTP, Smart card 
D. Kerberos, Smart card, Stanford SRP

Show Answer

---

Question # 3

The follows is an email header. What address is that of the true originator of the message?Return-Path: <[email protected]>Received: from smtp.com (fw.emumail.com [215.52.220.122].by raq-221-181.ev1.net (8.10.2/8.10.2. with ESMTP id h78NIn404807for <[email protected]>; Sat, 9 Aug 2003 18:18:50 -0500Received: (qmail 12685 invoked from network.; 8 Aug 2003 23:25:25 -0000Received: from ([19.25.19.10]. by smtp.com with SMTP Received: from unknown (HELO CHRISLAPTOP. (168.150.84.123.by localhost with SMTP; 8 Aug 2003 23:25:01 -0000From: "Bill Gates" <[email protected]>To: "mikeg" <[email protected]>Subject: We need your help!Date: Fri, 8 Aug 2003 19:12:28 -0400Message-ID: <51.32.123.21@CHRISLAPTOP>MIME-Version: 1.0Content-Type: multipart/mixed;boundary="----=_NextPart_000_0052_01C35DE1.03202950"X-Priority: 3 (Normal.X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook, Build 10.0.2627X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165Importance: Normal

A. 19.25.19.10 
B. 51.32.123.21 
C. 168.150.84.123 
D. 215.52.220.122 
E. 8.10.2/8.10.2 

Show Answer

---

Question # 4

Ethereal works best on ____________. 

A. Switched networks 
B. Linux platforms 
C. Networks using hubs 
D. Windows platforms 
E. LAN's 

Show Answer

---

Question # 5

Samantha was hired to perform an internal security test of company. She quickly realizedthat all networks are making use of switches instead of traditional hubs. This greatly limitsher ability to gather information through network sniffing.Which of the following techniques can she use to gather information from the switchednetwork or to disable some of the traffic isolation features of the switch? (Choose two)

A. Ethernet Zapping 
B. MAC Flooding 
C. Sniffing in promiscuous mode 
D. ARP Spoofing 

Show Answer

---

Question # 6

A POP3 client contacts the POP3 server:

A. To send mail 
B. To receive mail 
C. to send and receive mail 
D. to get the address to send mail to 
E. initiate a UDP SMTP connection to read mail 

Show Answer

---

Question # 7

A remote user tries to login to a secure network using Telnet, but accidently types in an invaliduser name or password. Which responses would NOT be preferred by an experienced SecurityManager? (multiple answer)

A. Invalid Username 
B. Invalid Password 
C. Authentication Failure 
D. Login Attempt Failed 
E. Access Denied 

Show Answer

---

Question # 8

ettercap –NCLzs --quietWhat does the command in the exhibit do in “Ettercap”?

A. This command will provide you the entire list of hosts in the LAN 
B. This command will check if someone is poisoning you and will report its IP. 
C. This command will detach from console and log all the collected passwords from the network toa file. 
D. This command broadcasts ping to scan the LAN instead of ARP request of all the subnet IPs. 

Show Answer

---

Question # 9

You are writing an antivirus bypassing Trojan using C++ code wrapped into chess.c tocreate an executable file chess.exe. This Trojan when executed on the victim machine,scans the entire system (c:\) for data with the following text “Credit Card” and “password”.It then zips all the scanned files and sends an email to a predefined hotmail address.You want to make this Trojan persistent so that it survives computer reboots. Whichregistry entry will you add a key to make it persistent?

A. HKEY_LOCAL_MACHINE\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 
B. HKEY_LOCAL_USER\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 
C. HKEY_LOCAL_SYSTEM\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 
D. HKEY_CURRENT_USER\SOFTWARE\MICROOSFT\Windows\CurrentVersion\RunServices 

Show Answer

---

Question # 10

John wants to try a new hacking tool on his Linux System. As the application comes from asite in his untrusted zone, John wants to ensure that the downloaded tool has not beenTrojaned. Which of the following options would indicate the best course of action for John?

A. Obtain the application via SSL 
B. Obtain the application from a CD-ROM disc 
C. Compare the files’ MD5 signature with the one published on the distribution media 
D. Compare the file’s virus signature with the one published on the distribution media 

Show Answer

---

Question # 11

Spears Technology, Inc is a software development company located in Los Angeles,California. They reported a breach in security, stating that its “security defenses has beenbreached and exploited for 2 weeks by hackers. “The hackers had accessed anddownloaded 90,000 address containing customer credit cards and password. SpearsTechnology found this attack to be so to law enforcement officials to protect theirintellectual property.How did this attack occur? The intruder entered through an employees home machine,which was connected to Spears Technology, Inc’s corporate VPN network. The applicationcalled BEAST Trojan was used in the attack to open a “Back Door” allowing the hackersundetected access. The security breach was discovered when customers complainedabout the usage of their credit cards without their knowledge.The hackers were traced back to Beijing China through e-mail address evidence. The creditcard information was sent to that same e-mail address. The passwords allowed the hackersto access Spears Technology’s network from a remote location, posing as employees. Theintent of the attacker was to steal the source code for their VOIP system and “hold ithostage” from Spears Technology, Inc exchange for ransom.The hackers had intended on selling the stolen VOIP software source code to competitors.How would you prevent such attacks from occurring in the future at Spears Technology?

A. Disable VPN access to all your employees from home machines 
B. Allow VPN access but replace the standard authentication with biometric authentication 
C. Replace the VPN access with dial-up modem access to the company’s network 
D. Enable 25 character complex password policy for employees to access the VPN network. 

Show Answer

---

Question # 12

Which definition below best describes a covert channel?

A. Making use of a Protocol in a way it was not intended to be used 
B. It is the multiplexing taking place on communication link 
C. It is one of the weak channels used by WEP that makes it insecure 
D. A Server Program using a port that is not well known 

Show Answer

---

Question # 13

Erik notices a big increase in UDP packets sent to port 1026 and 1027 occasionally. Heenters the following at the command prompt. $ nc -l -p 1026 -u -v In response, he sees the following message. cell(?(c)????STOPALERT77STOP! WINDOWS REQUIRES IMMEDIATE ATTENTION. Windows has found 47 Critical Errors. To fix the errors please do the following: 1. Download Registry Repair from: www.reg-patch.com 2. Install Registry Repair 3. Run Registry Repair 4. Reboot your computer FAILURE TO ACT NOW MAY LEAD TO DATA LOSS AND CORRUPTION! What would you infer from this alert?

A. The machine is redirecting traffic to www.reg-patch.com using adware 
B. It is a genuine fault of windows registry and the registry needs to be backed up 
C. An attacker has compromised the machine and backdoored ports 1026 and 1027 
D. It is a messenger spam. Windows creates a listener on one of the low dynamic ports from 1026 to 1029 and the message usually promotes malware disguised as legitimate utilities 

Show Answer

---

Question # 14

A file integrity program such as Tripwire protects against Trojan horse attacks by:

A. Automatically deleting Trojan horse programs 
B. Rejecting packets generated by Trojan horse programs 
C. Using programming hooks to inform the kernel of Trojan horse behavior 
D. Helping you catch unexpected changes to a system utility file that might indicate it had beenreplaced by a Trojan horse

Show Answer

---

Question # 15

Sniffing is considered an active attack. 

A. True 
B. False 

Show Answer

---

Question # 16

Which of the following Netcat commands would be used to perform a UDP scan of thelower 1024 ports?

A. Netcat -h -U 
B. Netcat -hU <host(s.> 
C. Netcat -sU -p 1-1024 <host(s.> 
D. Netcat -u -v -w2 <host> 1-1024 
E. Netcat -sS -O target/1024 

Show Answer

---

Question # 17

Exhibit: * Missing*Jason's Web server was attacked by a trojan virus. He runs protocol analyzer and notices that the trojan communicates to a remote server on the Internet. Shown below is thestandard "hexdump" representation of the network packet, before being decoded. Jasonwants to identify the trojan by looking at the destination port number and mapping to atrojan-port number database on the Internet. Identify the remote server's port number bydecoding the packet?

A. Port 1890 (Net-Devil Trojan) 
B. Port 1786 (Net-Devil Trojan) 
C. Port 1909 (Net-Devil Trojan) 
D. Port 6667 (Net-Devil Trojan) 

Show Answer

---

Question # 18

John wishes to install a new application onto his Windows 2000 server.He wants to ensure that any application he uses has not been Trojaned.What can he do to help ensure this?

A. Compare the file's MD5 signature with the one published on the distribution media 
B. Obtain the application via SSL 
C. Compare the file's virus signature with the one published on the distribution media 
D. Obtain the application from a CD-ROM disc 

Show Answer

---

Question # 19

In Linux, the three most common commands that hackers usually attempt to Trojan are:

A. car, xterm, grep 
B. netstat, ps, top 
C. vmware, sed, less 
D. xterm, ps, nc 

Show Answer

---

Question # 20

You suspect that your Windows machine has been compromised with a Trojan virus. Whenyou run anti-virus software it does not pick of the Trojan. Next you run netstat command tolook for open ports and you notice a strange port 6666 open.What is the next step you would do?

A. Re-install the operating system. 
B. Re-run anti-virus software. 
C. Install and run Trojan removal software. 
D. Run utility fport and look for the application executable that listens on port 6666. 

Show Answer

---

Question # 21

You have hidden a Trojan file virus.exe inside another file readme.txt using NTFSstreaming.Which command would you execute to extract the Trojan to a standalone file?

A. c:\> type readme.txt:virus.exe > virus.exe 
B. c:\> more readme.txt | virus.exe > virus.exe 
C. c:\> cat readme.txt:virus.exe > virus.exe 
D. c:\> list redme.txt$virus.exe > virus.exe 

Show Answer

---

Question # 22

Which of the following statements would not be a proper definition for a Trojan Horse?

A. An unauthorized program contained within a legitimate program. This unauthorized program performs functions unknown (and probably unwanted) by the user
B. A legitimate program that has been altered by the placement of unauthorized code within it; thiscode perform functions unknown (and probably unwanted) by the user
C. An authorized program that has been designed to capture keyboard keystrokes while the userremains unaware of such an activity being performed. 
D. Any program that appears to perform a desirable and necessary function but that (because ofunauthorized code within it that is unknown to the user) performs functions unknown (anddefinitely unwanted) by the user. 

Show Answer

---

Question # 23

After an attacker has successfully compromised a remote computer, what would be one ofthe last steps that would be taken to ensure that the compromise is not traced back to thesource of the problem?

A. Install pactehs 
B. Setup a backdoor 
C. Cover your tracks 
D. Install a zombie for DDOS 

Show Answer

---

Question # 24

In the context of Trojans, what is the definition of a Wrapper?

A. An encryption tool to protect the Trojan. 
B. A tool used to bind the Trojan with legitimate file. 
C. A tool used to encapsulated packets within a new header and footer. 
D. A tool used to calculate bandwidth and CPU cycles wasted by the Trojan. 

Show Answer

---

Question # 25

You want to use netcat to generate huge amount of useless network data continuously forvarious performance testing between 2 hosts.Which of the following commands accomplish this?

A. Machine A #yes AAAAAAAAAAAAAAAAAAAAAA | nc –v –v –l –p 2222 > /dev/null Machine B #yes BBBBBBBBBBBBBBBBBBBBBB | nc machinea 2222 > /dev/null
B. Machine A cat somefile | nc –v –v –l –p 2222 Machine B cat somefile | nc othermachine 2222
C. Machine A nc –l –p 1234 | uncompress –c | tar xvfp Machine B tar cfp - /some/dir | compress –c | nc –w 3 machinea 1234
D. Machine A while true : do nc –v –l –s –p 6000 machineb 2 Machine B while true ; do nc –v –l –s –p 6000 machinea 2 done

Show Answer

---

Question # 26

What is a Trojan Horse?

A. A malicious program that captures your username and password 
B. Malicious code masquerading as or replacing legitimate code 
C. An unauthorized user who gains access to your user database and adds themselves as a user 
D. A server that is to be sacrificed to all hacking attempts in order to log and monitor the hackingactivity 

Show Answer

---

Question # 27

Assuring two systems that are using IPSec to protect traffic over the internet, what type ofgeneral attack could compromise the data?

A. Spoof Attack 
B. Smurf Attack 
C. Man in the Middle Attack 
D. Trojan Horse Attack 
E. Back Orifice Attack 

Show Answer

---

Question # 28

You have successfully brute forced basic authentication configured on a Web Server usingBrutus hacking tool. The username/password is “Admin” and “Bettlemani@”. You logon tothe system using the brute forced password and plant backdoors and rootkits.After downloading various sensitive documents from the compromised machine, youproceed to clear the log files to hide your trace..Which event log located at C:\Windows\system32\config contains the trace of your bruteforce attempts?

A. AppEvent.Evt 
B. SecEvent.Evt 
C. SysEvent.Evt 
D. WinEvent.Evt 

Show Answer

---

Question # 29

Michael is the security administrator for the for ABC company. Michael has been chargedwith strengthening the company’s security policies, including its password policies. Due tocertain legacy applications. Michael was only able to enforce a password group policy inActive Directory with a minimum of 10 characters. He has informed the company’semployes, however that the new password policy requires that everyone must havecomplex passwords with at least 14 characters. Michael wants to ensure that everyone isusing complex passwords that meet the new security policy requirements. Michael has justlogged on to one of the network’s domain controllers and is about to run the followingcommand:What will this command accomplish?

A. Dumps SAM password hashes to pwd.txt 
B. Password history file is piped to pwd.txt 
C. Dumps Active Directory password hashes to pwd.txt 
D. Internet cache file is piped to pwd.txt 

Show Answer

---

Question # 30

John Beetlesman, the hacker has successfully compromised the Linux System of AgentTelecommunications, Inc’s WebServer running Apache. He has downloaded sensitivedocuments and database files off the machine.Upon performing various tasks, Beetlesman finally runs the following command on theLinux box before disconnecting.for ((i=0;i<1;i++));do?dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hdadoneWhat exactly is John trying to do?

A. He is making a bit stream copy of the entire hard disk for later download 
B. He is deleting log files to remove his trace 
C. He is wiping the contents of the hard disk with zeros 
D. He is infecting the hard disk with random virus strings 

Show Answer

---

Question # 31

You are the security administrator for a large online auction company based out of LosAngeles. After getting your ENSA CERTIFICATION last year, you have steadily beenfortifying your network’s security including training OS hardening and network security.One of the last things you just changed for security reasons was to modify all the built-inadministrator accounts on the local computers of PCs and in Active Directory. Afterthrough testing you found and no services or programs were affected by the namechanges.Your company undergoes an outside security audit by a consulting company and they saidthat even through all the administrator account names were changed, the accounts couldstill be used by a clever hacker to gain unauthorized access. You argue with the auditorsand say that is not possible, so they use a tool and show you how easy it is to utilize theadministrator account even though its name was changed. What tool did the auditors use?

A. sid2user 
B. User2sid 
C. GetAcct 
D. Fingerprint 

Show Answer

---

Question # 32

You are the IT Manager of a large legal firm in California. Your firm represents manyimportant clients whose names always must remain anonymous to the public. Your boss,Mr. Smith is always concerned about client information being leaked or revealed to the presor public. You have just finished a complete security overhaul of your information systemincluding an updated IPS, new firewall, email encryption and employee security awarenesstraining. Unfortunately, many of your firm’s clients do not trust technology to completelysecure their information, so couriers routinely have to travel back and forth to and from theoffice with sensitive information.Your boss has charged you with figuring out how to secure the information the couriersmust transport. You propose that the data be transferred using burned CD’s or USB flashdrives. You initially think of encrypting the files, but decide against that method for fear theencryption keys could eventually be broken.What software application could you use to hide the data on the CD’s and USB flashdrives?

A. Snow 
B. File Snuff 
C. File Sneaker 
D. EFS 

Show Answer

---

Question # 33

Which of the following is an attack in which a secret value like a hash is captured and thenreused at a later time to gain access to a system without ever decrypting or decoding the hash.

A. Replay Attacks 
B. Brute Force Attacks 
C. Cryptography Attacks 
D. John the Ripper Attacks 

Show Answer

---

Question # 34

Travis works primarily from home as a medical transcriptions.He just bought a brand new Dual Core Pentium Computer with over 3 GB of RAM. He usesvoice recognition software is processor intensive, which is why he bought the newcomputer. Travis frequently has to get on the Internet to do research on what he is workingon. After about two months of working on his new computer, he notices that it is notrunning nearly as fast as it used to.Travis uses antivirus software, anti-spyware software and always keeps the computer upto-date with Microsoft patches.After another month of working on the computer, Travis computer is even more noticeableslow. Every once in awhile, Travis also notices a window or two pop-up on his screen, butthey quickly disappear. He has seen these windows show up, even when he has not beenon the Internet. Travis is really worried about his computer because he spent a lot ofmoney on it and he depends on it to work. Travis scans his through Windows Explorer andcheck out the file system, folder by folder to see if there is anything he can find. He spendsover four hours pouring over the files and folders and can’t find anything but before hegives up, he notices that his computer only has about 10 GB of free space available. Sincehas drive is a 200 GB hard drive, Travis thinks this is very odd.Travis downloads Space Monger and adds up the sizes for all the folders and files on hiscomputer. According to his calculations, he should have around 150 GB of free space.What is mostly likely the cause of Travi’s problems?

A. Travis’s Computer is infected with stealth kernel level rootkit 
B. Travi’s Computer is infected with Stealth Torjan Virus 
C. Travis’s Computer is infected with Self-Replication Worm that fills the hard disk space 
D. Logic Bomb’s triggered at random times creating hidden data consuming junk files 

Show Answer

---

Question # 35

LAN Manager passwords are concatenated to 14 bytes and split in half. The two halves arehashed individually. If the password is 7 characters or less, than the second half of thehash is always:

A. 0xAAD3B435B51404EE 
B. 0xAAD3B435B51404AA 
C. 0xAAD3B435B51404BB 
D. 0xAAD3B435B51404CC 

Show Answer

---

Question # 36

Samuel is the network administrator of DataX communications Inc. He is trying to configurehis firewall to block password brute force attempts on his network. He enables blocking theintruder’s IP address for a period of 24 hours time after more than three unsuccessfulattempts. He is confident that this rule will secure his network hackers on the Internet.But he still receives hundreds of thousands brute-force attempts generated from various IPaddresses around the world. After some investigation he realizes that the intruders areusing a proxy somewhere else on the Internet which has been scripted to enable therandom usage of various proxies on each request so as not to get caught by the firewalluse.Later he adds another rule to his firewall and enables small sleep on the password attemptso that if the password is incorrect, it would take 45 seconds to return to the user to beginanother attempt. Since an intruder may use multiple machines to brute force the password,he also throttles the number of connections that will be prepared to accept from aparticular IP address. This action will slow the intruder’s attempts.Samuel wants to completely block hackers brute force attempts on his network.What are the alternatives to defending against possible brute-force password attacks onhis site?

A. Enforce a password policy and use account lockouts after three wrong logon attempts eventhrough this might lock out legit users
B. Enable the IDS to monitor the intrusion attempts and alert you by e-mail about the IP address ofthe intruder so that you can block them at the firewall manually 
C. Enforce complex password policy on your network so that passwords are more difficult to bruteforce
D. You can’t completely block the intruders attempt if they constantly switch proxies 

Show Answer

---

Question # 37

In the following example, which of these is the "exploit"?Today, Microsoft Corporation released a security notice. It detailed how a person couldbring down the Windows 2003 Server operating system, by sending malformed packets toit. They detailed how this malicious process had been automated using basic scripting.Even worse, the new automated method for bringing down the server has already beenused to perform denial of service attacks on many large commercial websites.Select the best answer.

A. Microsoft Corporation is the exploit. 
B. The security "hole" in the product is the exploit. 
C. Windows 2003 Server 
D. The exploit is the hacker that would use this vulnerability. 
E. The documented method of how to use the vulnerability to gain unprivileged access. 

Show Answer

---

Question # 38

One of your junior administrator is concerned with Windows LM hashes and passwordcracking. In your discussion with them, which of the following are true statements that youwould point out?Select the best answers.

A. John the Ripper can be used to crack a variety of passwords, but one limitation is that theoutput doesn't show if the password is upper or lower case.
B. BY using NTLMV1, you have implemented an effective countermeasure to password cracking. 
C. SYSKEY is an effective countermeasure. 
D. If a Windows LM password is 7 characters or less, the hash will be passed with the followingcharacters, in HEX- 00112233445566778899.
E. Enforcing Windows complex passwords is an effective countermeasure. 

Show Answer

---

Question # 39

You are a Administrator of Windows server. You want to find the port number for POP3.What file would you find the information in and where?Select the best answer.

A. %windir%\\etc\\services 
C. %windir%\\system32\\drivers\\etc\\services 
D. /etc/services 
E. %windir%/system32/drivers/etc/services 

Show Answer

---

Question # 40

_____ is the process of converting something from one representation to the simplestform. It deals with the way in which systems convert data from one form to another.

A. Canonicalization 
B. Character Mapping 
C. Character Encoding 
D. UCS transformation formats 

Show Answer

---

Question # 41

Which of the following keyloggers cannot be detected by anti-virus or anti-spywareproducts?

A. Covert keylogger 
B. Stealth keylogger 
C. Software keylogger 
D. Hardware keylogger 

Show Answer

---

Question # 42

How would you describe an attack where an attacker attempts to deliver the payload overmultiple packets over long periods of time with the purpose of defeating simple patternmatching in IDS systems without session reconstruction? A characteristic of this attackwould be a continuous stream of small packets.

A. Session Splicing
B. Session Stealing 
C. Session Hijacking 
D. Session Fragmentation 

Show Answer

---

Question # 43

LM authentication is not as strong as Windows NT authentication so you may want todisable its use, because an attacker eavesdropping on network traffic will attack the weakerprotocol. A successful attack can compromise the user's password. How do you disableLM authentication in Windows XP?

A. Stop the LM service in Windows XP 
B. Disable LSASS service in Windows XP 
C. Disable LM authentication in the registry 
D. Download and install LMSHUT.EXE tool from Microsoft website 

Show Answer

---

Question # 44

_____ is found in all versions of NTFS and is described as the ability to fork file data intoexisting files without affecting their functionality, size, or display to traditional file browsingutilities like dir or Windows Explorer

A. Steganography 
B. Merge Streams 
C. NetBIOS vulnerability 
D. Alternate Data Streams 

Show Answer

---

Question # 45

Which of the following steganography utilities exploits the nature of white space andallows the user to conceal information in these white spaces?

A. Snow 
B. Gif-It-Up 
C. NiceText 
D. Image Hide 

Show Answer

---

Question # 46

Attackers can potentially intercept and modify unsigned SMB packets, modify the trafficand forward it so that the server might perform undesirable actions. Alternatively, theattacker could pose as the server or client after a legitimate authentication and gainunauthorized access to data. Which of the following is NOT a means that can be used tominimize or protect against such an attack?

A. Timestamps 
B. SMB Signing 
C. File permissions 
D. Sequence numbers monitoring 

Show Answer

---

Question # 47

What file system vulnerability does the following command take advantage of? type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe

A. HFS 
B. ADS 
C. NTFS 
D. Backdoor access

Show Answer

---

Question # 48

What hacking attack is challenge/response authentication used to prevent?

A. Replay attacks 
B. Scanning attacks 
C. Session hijacking attacks 
D. Password cracking attacks 

Show Answer

---

Question # 49

What does the following command in netcat do? nc -l -u -p 55555 < /etc/passwd

A. logs the incoming connections to /etc/passwd file 
B. loads the /etc/passwd file to the UDP port 55555 
C. grabs the /etc/passwd file when connected to UDP port 55555 
D. deletes the /etc/passwd file when connected to the UDP port 55555 

Show Answer

---

Question # 50

In the context of Windows Security, what is a 'null' user?

A. A user that has no skills 
B. An account that has been suspended by the admin 
C. A pseudo account that has no username and password 
D. A pseudo account that was created for security administration purpose 

Show Answer

---

Question # 51

Fingerprinting an Operating System helps a cracker because:

A. It defines exactly what software you have installed 
B. It opens a security-delayed window based on the port being scanned 
C. It doesn't depend on the patches that have been applied to fix existing security holes 
D. It informs the cracker of which vulnerabilities he may be able to exploit on your system 

Show Answer

---

Question # 52

What is GINA?

A. Gateway Interface Network Application 
B. GUI Installed Network Application CLASS 
C. Global Internet National Authority (G-USA) 
D. Graphical Identification and Authentication DLL

Show Answer

---

Question # 53

You are the Security Administrator of Xtrinity, Inc. You write security policies and conductassesments to protect the company's network. During one of your periodic checks to seehow well policy is being observed by the employees, you discover an employee hasattached a modem to his telephone line and workstation. He has used this modem to dial into his workstation, thereby bypassing your firewall. A security breach has occurred as adirect result of this activity. The employee explains that he used the modem because hehad to download software for a department project. How would you resolve this situation?

A. Reconfigure the firewall 
B. Conduct a needs analysis 
C. Install a network-based IDS 
D. Enforce the corporate security policy

Show Answer

---

Question # 54

An attacker runs netcat tool to transfer a secret file between two hosts. Machine A: netcat -l -p 1234 < secretfile Machine B: netcat 192.168.3.4 > 1234 He is worried about information being sniffed on the network. How would the attacker usenetcat to encrypt the information before transmitting onto the wire?

A. Machine A: netcat -l -p -s password 1234 < testfileMachine B: netcat <machine A IP> 1234 
B. Machine A: netcat -l -e magickey -p 1234 < testfileMachine B: netcat <machine A IP> 1234 
C. Machine A: netcat -l -p 1234 < testfile -pw passwordMachine B: netcat <machine A IP> 1234 -pw password 
D. Use cryptcat instead of netcat

Show Answer

---

Question # 55

You have retrieved the raw hash values from a Windows 2000 Domain Controller. Usingsocial engineering, you come to know that they are enforcing strong passwords. Youunderstand that all users are required to use passwords that are at least 8 characters inlength. All passwords must also use 3 of the 4 following categories: lower case letters,capital letters, numbers and special characters.With your existing knowledge of users, likely user account names and the possibility thatthey will choose the easiest passwords possible, what would be the fastest type ofpassword cracking attack you can run against these hash values and still get results?

A. Online Attack 
B. Dictionary Attack 
C. Brute Force Attack 
D. Hybrid Attack

Show Answer

---

Question # 56

Windows LAN Manager (LM) hashes are known to be weak. Which of the following areknown weaknesses of LM? (Choose three)

A. Converts passwords to uppercase. 
B. Hashes are sent in clear text over the network. 
C. Makes use of only 32 bit encryption. 
D. Effective length is 7 characters. 

Show Answer

---

Question # 57

While examining audit logs, you discover that people are able to telnet into the SMTPserver on port 25. You would like to block this, though you do not see any evidence of anattack or other wrong doing. However, you are concerned about affecting the normalfunctionality of the email server. From the following options choose how best you canachieve this objective?

A. Block port 25 at the firewall.  
B. Shut off the SMTP service on the server. 
C. Force all connections to use a username and password. 
D. Switch from Windows Exchange to UNIX Sendmail. 
E. None of the above,

Show Answer

---

Question # 58

Password cracking programs reverse the hashing process to recoverpasswords.(True/False.

A. True 
B. False 

Show Answer

---

Question # 59

Which of the following are well know password-cracking programs?(Choose all that apply. 

A. L0phtcrack 
B. NetCat 
C. Jack the Ripper 
D. Netbus 
E. John the Ripper

Show Answer

---

Question # 60

When discussing passwords, what is considered a brute force attack?

A. You attempt every single possibility until you exhaust all possible combinations or discover thepassword
B. You threaten to use the rubber hose on someone unless they reveal their password
C. You load a dictionary of words into your cracking program 
D. You create hashes of a large number of words and compare it with the encrypted passwords 
E. You wait until the password expires 

Show Answer

---

Question # 61

How can you determine if an LM hash you extracted contains a password that is less than 8characters long? 

A. There is no way to tell because a hash cannot be reversed 
B. The right most portion of the hash is always the same 
C. The hash always starts with AB923D 
D. The left most portion of the hash is always the same 
E. A portion of the hash will be all 0's

Show Answer

---

Question # 62

What do Trinoo, TFN2k, WinTrinoo, T-Sight, and Stracheldraht have in common? 

A. All are hacking tools developed by the legion of doom 
B. All are tools that can be used not only by hackers, but also security personnel 
C. All are DDOS tools 
D. All are tools that are only effective against Windows 
E. All are tools that are only effective against Linux 

Show Answer

---

Question # 63

What is the BEST alternative if you discover that a rootkit has been installed on one of yourcomputers? 

A. Copy the system files from a known good system 
B. Perform a trap and trace 
C. Delete the files and try to determine the source 
D. Reload from a previous backup 
E. Reload from known good media

Show Answer

---

Question # 64

_________ is a tool that can hide processes from the process list, can hide files, registryentries, and intercept keystrokes.

A. Trojan 
B. RootKit 
C. DoS tool 
D. Scanner 
E. Backdoor

Show Answer

---

Question # 65

This kind of password cracking method uses word lists in combination with numbers andspecial characters:

A. Hybrid 
B. Linear 
C. Symmetric 
D. Brute Force

Show Answer

---

Question # 66

Which of the following is the primary objective of a rootkit?

A. It opens a port to provide an unauthorized service 
B. It creates a buffer overflow  
C. It replaces legitimate programs 
D. It provides an undocumented opening in a program

Show Answer

---

Question # 67

Which of the following LM hashes represent a password of less than 8 characters? (Select2)

A. BA810DBA98995F1817306D272A9441BB 
B. 44EFCE164AB921CQAAD3B435B51404EE 
C. 0182BD0BD4444BF836077A718CCDF409 
D. CEC52EB9C8E3455DC2265B23734E0DAC 
E. B757BF5C0D87772FAAD3B435B51404EE 
F. E52CAC67419A9A224A3B108F3FA6CB6D

Show Answer

---

Question # 68

E-mail scams and mail fraud are regulated by which of the following?

A. 18 U.S.C. par. 1030 Fraud and Related activity in connection with Computers 
B. 18 U.S.C. par. 1029 Fraud and Related activity in connection with Access Devices 
C. 18 U.S.C. par. 1362 Communication Lines, Stations, or Systems 
D. 18 U.S.C. par. 2510 Wire and Electronic Communications Interception and Interception of OralCommunication

Show Answer

---

Question # 69

What is the algorithm used by LM for Windows2000 SAM ?

A. MD4 
B. DES 
C. SHA 
D. SSL

Show Answer

---

Question # 70

In the context of password security, a simple dictionary attack involves loading a dictionaryfile (a text file full of dictionary words) into a cracking application such as L0phtCrack orJohn the Ripper, and running it against user accounts located by the application. Thelarger the word and word fragment selection, the more effective the dictionary attack is.The brute force method is the most inclusive, although slow. It usually tries every possibleletter and number combination in its automated exploration. If you would use both brute force and dictionary methods combined together to havevariation of words, what would you call such an attack?

A. Full Blown 
B. Thorough 
C. Hybrid 
D. BruteDics 

Show Answer

---

Question # 71

You are attempting to crack LM Manager hashed from Windows 2000 SAM file. You will beusing LM Brute force hacking tool for decryption.What encryption algorithm will you be decrypting?

A. MD4 
B. DES 
C. SHA 
D. SSL

Show Answer

---

Question # 72

A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniffthe SMB exchanges which carry user logons. The user is plugged into a hub with 23 othersystems. However, he is unable to capture any logons though he knows that other usersare logging in.What do you think is the most likely reason behind this?

A. There is a NIDS present on that segment. 
B. Kerberos is preventing it. 
C. Windows logons cannot be sniffed. 
D. L0phtcrack only sniffs logons to web servers

Show Answer

---

Question # 73

Which of the following algorithms can be used to guarantee the integrity of messagesbeing sent, in transit, or stored? (Choose the best answer)

A. symmetric algorithms 
B. asymmetric algorithms 
C. hashing algorithms 
D. integrity algorithms

Show Answer

---

Question # 74

Bob is doing a password assessment for one of his clients. Bob suspects that securitypolicies are not in place. He also suspects that weak passwords are probably the normthroughout the company he is evaluating. Bob is familiar with password weaknesses andkey loggers.Which of the following options best represents the means that Bob can adopt to retrievepasswords from his clients hosts and servers.

A. Hardware, Software, and Sniffing. 
B. Hardware and Software Keyloggers. 
C. Passwords are always best obtained using Hardware key loggers. 
D. Software only, they are the most effective.

Show Answer

---

Testimonials