312-50 Exam - Ethical Hacking and Countermeasures (CEHv6)

certleader.com

Q1. Statistics from cert.org and other leading security organizations has clearly showed a steady rise in the number of hacking incidents perpetrated against companies. 

What do you think is the main reason behind the significant increase in hacking attempts over the past years? 

A. It is getting more challenging and harder to hack for non technical people. 

B. There is a phenomenal increase in processing power. 

C. New TCP/IP stack features are constantly being added. 

D. The ease with which hacker tools are available on the Internet. 

Answer:

Explanation: Today you don’t need to be a good hacker in order to break in to various systems, all you need is the knowledge to use search engines on the internet. 

Q2. 802.11b is considered a ____________ protocol. 

A. Connectionless 

B. Secure 

C. Unsecure 

D. Token ring based 

E. Unreliable 

Answer: C

Explanation: 802.11b is an insecure protocol. It has many weaknesses that can be used by a hacker. 

Q3. Jack Hacker wants to break into Brown Co.'s computers and obtain their secret double fudge cookie recipe. Jack calls Jane, an accountant at Brown Co., pretending to be an administrator from Brown Co. Jack tells Jane that there has been a problem with some accounts and asks her to tell him her password 'just to double check our records'. Jane believes that Jack is really an administrator, and tells him her password. Jack now has a user name and password, and can access Brown Co.'s computers, to find the cookie recipe. This is an example of what kind of attack? 

A. Reverse Psychology 

B. Social Engineering 

C. Reverse Engineering 

D. Spoofing Identity 

E. Faking Identity 

Answer: B

Explanation: This is a typical case of pretexting. Pretexting is the act of creating and using an invented scenario (the pretext) to persuade a target to release information or perform an action and is usually done over the telephone. 

Q4. Which are true statements concerning the BugBear and Pretty Park worms? 

Select the best answers. 

A. Both programs use email to do their work. 

B. Pretty Park propagates via network shares and email 

C. BugBear propagates via network shares and email 

D. Pretty Park tries to connect to an IRC server to send your personal passwords. 

E. Pretty Park can terminate anti-virus applications that might be running to bypass them. 

Answer: ACD

Explanations: Both Pretty Park and BugBear use email to spread. Pretty Park cannot propagate via network shares, only email. BugBear propagates via network shares and email. It also terminates anti-virus applications and acts as a backdoor server for someone to get into the infected machine. Pretty Park tries to connect to an IRC server to send your personal passwords and all sorts of other information it retrieves from your PC. Pretty Park cannot terminate anti-virus applications. However, BugBear can terminate AV software so that it can bypass them. 

Topic 17, Physical Security 

432. Joseph has just been hired on to a contractor company of the Department of Defense as their senior Security Analyst. Joseph has been instructed on the Company’s strict security policies that have been implemented and the policies that have yet to be put in place. Per the Department of Defense, all DoD users and the users of their contractors must use two-factor authentication to access their networks. Joseph has been delegated the task of researching and implementing the best two-factor authentication method for his company. Joseph’s supervisor has told him that they would like to use some type of hardware device in tandem with a security or identifying pin number. 

Joseph’s company has already researched using smart cards and all the resources needed to implement them, but found the smart cards to not be cost effective. What type of device should Joseph use for two-factor authentication? 

A. Security token 

B. Biometric device 

C. OTP 

D. Proximity cards 

Q5. The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. From the options given below choose the one best interprets the following entry: 

Apr 26 06:43:05 [6282] IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 

(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) 

Interpret the following entry: 

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107.53 

A. An IDS evasion technique 

B. A buffer overflow attempt 

C. A DNS zone transfer 

D. Data being retrieved from 63.226.81.13. 

Answer: B

Explanation: The IDS log file is depicting numerous attacks, however, most of them are from different attackers, in reference to the attack in question, he is trying to mask his activity by trying to act legitimate, during his session on the honeypot, he changes users two times by using the "su" command, but never triess to attempt anything to severe. 

Q6. How does Traceroute map the route that a packet travels from point A to point B? 

A. It uses a TCP Timestamp packet that will elicit a time exceed in transit message. 

B. It uses a protocol that will be rejected at the gateways on its way to its destination. 

C. It manipulates the value of time to live (TTL) parameter packet to elicit a time exceeded in transit message. 

D. It manipulated flags within packets to force gateways into generating error messages. 

Answer: C

Explanation: Traceroute works by increasing the "time-to-live" value of each successive batch of packets sent. The first three packets have a time-to-live (TTL) value of one (implying that they make a single hop). The next three packets have a TTL value of 2, and so on. When a packet passes through a host, normally the host decrements the TTL value by one, and forwards the packet to the next host. When a packet with a TTL of one reaches a host, the host discards the packet and sends an ICMP time exceeded (type 11) packet to the sender. The traceroute utility uses these returning packets to produce a list of hosts that the packets have traversed en route to the destination. 

Q7. What are the different between SSL and S-HTTP? 

A. SSL operates at the network layer and S-HTTP operates at the application layer 

B. SSL operates at the application layer and S-HTTP operates at the network layer 

C. SSL operates at transport layer and S-HTTP operates at the application layer 

D. SSL operates at the application layer and S-HTTP operates at the transport layer 

Answer: C

Explanation: Whereas SSL is designed to establish a secure connection between two computers, S-HTTP is designed to send individual messages securely. S-HTTP is defined in RFC 2660 

Q8. Lori was performing an audit of her company's internal Sharepoint pages when she came across the following code: What is the purpose of this code? 

A. This JavaScript code will use a Web Bug to send information back to another server. 

B. This code snippet will send a message to a server at 192.154.124.55 whenever the "escape" key is pressed. 

C. This code will log all keystrokes. 

D. This bit of JavaScript code will place a specific image on every page of the RSS feed. 

Answer: C

Q9. You want to know whether a packet filter is in front of 192.168.1.10. Pings to 192.168.1.10 don't get answered. A basic nmap scan of 192.168.1.10 seems to hang without returning any information. What should you do next? 

A. Use NetScan Tools Pro to conduct the scan 

B. Run nmap XMAS scan against 192.168.1.10 

C. Run NULL TCP hping2 against 192.168.1.10 

D. The firewall is blocking all the scans to 192.168.1.10 

Answer: C

Q10. Attacking well-known system defaults is one of the most common hacker attacks. Most software is shipped with a default configuration that makes it easy to install and setup the application. You should change the default settings to secure the system. 

Which of the following is NOT an example of default installation? 

A. Many systems come with default user accounts with well-known passwords that administrators forget to change 

B. Often, the default location of installation files can be exploited which allows a hacker to retrieve a file from the system 

C. Many software packages come with "samples" that can be exploited, such as the sample programs on IIS web services 

D. Enabling firewall and anti-virus software on the local system 

Answer: D