312-50 Exam - Ethical Hacking and Countermeasures (CEHv6)

certleader.com

Q1. In order to attack wireless network, you put up an access point and override the signal of the real access point. And when users send authentication data, you are able to capture it. What kind of attack is this? 

A. WEP Attack 

B. Drive by hacking 

C. Rogue Access Point Attack 

D. Unauthorized Access Point Attack 

Answer: C

Explanation: A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network management or has been created to allow a cracker to conduct a man-in-the-middle attack. 

Q2. In the context of using PKI, when Sven wishes to send a secret message to Bob, he looks up Bob’s public key in a directory, uses it to encrypt the message before sending it off. Bob then uses his private key to decrypt the message and reads it. No one listening on can decrypt the message. 

Anyone can send an encrypted message to Bob but only Bob can read it. Thus, although many people may know Bob’s public key and use it to verify Bob’s signature, they cannot discover Bob’s private key and use it to forge digital signatures. 

What does this principle refer to? 

A. Irreversibility 

B. Non-repudiation 

C. Symmetry 

D. Asymmetry 

Answer: D

Explanation: PKI uses asymmetric key pair encryption. One key of the pair is the only way to decrypt data encrypted with the other. 

Q3. What does the this symbol mean? 

A. Open Access Point 

B. WPA Encrypted Access Point 

C. WEP Encrypted Access Point 

D. Closed Access Point 

Answer: A

Explanation: This symbol is a “warchalking” symbol for a open node (open circle) with the SSID tsunami and the bandwidth 2.0 Mb/s 

Q4. Josh is the network administrator for Consultants Galore, an IT consulting firm based in Kansas City. Josh is responsible for the company's entire network which consists of one Windows Server 2003 Active Directory domain. Almost all employees have Remote Desktop access to the servers so they can perform their work duties. Josh has created a security group in Active Directory called "RDP Deny" which contains all the user accounts that should not have Remote Desktop permission to any of the servers. What Group Policy change can Jayson make to ensure that all users in the "RDP Deny" group cannot access the company servers through Remote Desktop? 

A. Josh should add the "RDP Deny" group into the list of Restricted Groups to prevent the users from accessing servers remotely. 

B. By adding the "RDP Deny" group to the "Deny logon as a service" policy, the users in that security group will not be able to establish remote connections to any of the servers. 

C. He should add the "RDP Deny" group to the "Deny RDP connections to member servers" policy. 

D. Josh needs to add the "RDP Deny" group to the "Deny logon through Terminal Services" policy. * 

Answer: D

New questions 

604. Which of the following countermeasure can specifically protect against both the MAC Flood and MAC Spoofing attacks? 

A. Configure Port Security on the switch 

B. Configure Port Recon on the switch 

C. Configure Switch Mapping 

D. Configure Multiple Recognition on the switch 

Q5. Theresa is the chief information security officer for her company, a large shipping company based out of New York City. In the past, Theresa and her IT employees manually checked the status of client computers on the network to see if they had the most recent Microsoft updates. Now that the company has added over 100 more clients to accommodate new departments, Theresa must find some kind of tool to see whether the clients are up-to-date or not. Theresa decides to use Qfecheck to monitor all client computers. When Theresa runs the tool, she is repeatedly told that the software does not have the proper permissions to scan. Theresa is worried that the operating system hardening that she performs on all clients is keeping the software from scanning the necessary registry keys on the client computers. 

What registry key permission should Theresa check to ensure that Qfecheck runs properly? 

A. In order for Qfecheck to run properly, it must have enough permission to read 

B. She needs to check the permissions of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates registry key 

C. Theresa needs to look over the permissions of the registry key 

D. The registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Microsoft must be checked 

Answer: B

Explanation: Qfecheck check the registry HKLM\Software\Microsoft\Updates 

Q6. This is an example of whois record. 

Sometimes a company shares a little too much information on their organization through public domain records. Based on the above whois record, what can an attacker do? (Select 2 answers) 

A. Search engines like Google, Bing will expose information listed on the WHOIS record 

B. An attacker can attempt phishing and social engineering on targeted individuals using the information from WHOIS record 

C. Spammers can send unsolicited e-mails to addresses listed in the WHOIS record 

D. IRS Agents will use this information to track individuals using the WHOIS record information 

Answer: BC

Q7. Web servers are often the most targeted and attacked hosts on organizations' networks. Attackers may exploit software bugs in the Web server, underlying operating system, or active content to gain unauthorized access. 

Identify the correct statement related to the above Web Server installation? 

A. Lack of proper security policy, procedures and maintenance 

B. Bugs in server software, OS and web applications 

C. Installing the server with default settings 

D. Unpatched security flaws in the server software, OS and applications 

Answer: C

Q8. Which of the following Netcat commands would be used to perform a UDP scan of the lower 1024 ports? 

A. Netcat -h -U 

B. Netcat -hU <host(s.> 

C. Netcat -sU -p 1-1024 <host(s.> 

D. Netcat -u -v -w2 <host> 1-1024 

E. Netcat -sS -O target/1024 

Answer:

Explanation: The proper syntax for a UDP scan using Netcat is "Netcat -u -v -w2 <host> 1-1024". 

Netcat is considered the Swiss-army knife of hacking tools because it is so versatile. 

Q9. Your company has blocked all the ports via external firewall and only allows port 80/443 to connect to the Internet. You want to use FTP to connect to some remote server on the Internet. How would you accomplish this? 

A. Use HTTP Tunneling 

B. Use Proxy Chaining 

C. Use TOR Network 

D. Use Reverse Chaining 

Answer: A

Q10. Exhibit 

Joe Hacker runs the hping2 hacking tool to predict the target host’s sequence numbers in one of the hacking session. 

What does the first and second column mean? Select two. 

A. The first column reports the sequence number 

B. The second column reports the difference between the current and last sequence number 

C. The second column reports the next sequence number 

D. The first column reports the difference between current and last sequence number 

Answer: AB