EC-Council 312-50 Free Practice Questions

Q1. While performing a ping sweep of a subnet you receive an ICMP reply of Code 3/Type 13 for all the pings sent out.

What is the most likely cause behind this response?

A. The firewall is dropping the packets.

B. An in-line IDS is dropping the packets.

C. A router is blocking ICMP.

D. The host does not respond to ICMP packets.

Answer: C

Explanation: Type 3 message = Destination Unreachable [RFC792], Code 13 (cause) =

Communication Administratively Prohibited [RFC1812]

Q2. Your lab partner is trying to find out more information about a competitors web site. The site has a .com extension. She has decided to use some online whois tools and look in one of the regional Internet registrys. Which one would you suggest she looks in first?

A. LACNIC

B. ARIN

C. APNIC

D. RIPE

E. AfriNIC

Answer: B

Explanation: Regional registries maintain records from the areas from which they govern. ARIN is responsible for domains served within North and South America and therefore, would be a good starting point for a .com domain.

Q3. Bill has started to notice some slowness on his network when trying to update his company’s website while trying to access the website from the Internet. Bill asks the help desk manager if he has received any calls about slowness from the end users, but the help desk manager says that he has not. Bill receives a number of calls from customers that can’t access the company website and can’t purchase anything online. Bill logs on to a couple of this routers and notices that the logs shows network traffic is at all time high. He also notices that almost all the traffic is originating from a specific address.

Bill decides to use Geotrace to find out where the suspect IP is originates from. The Geotrace utility runs a traceroute and finds that IP is coming from Panama. Bill knows that none of his customers are in Panama so he immediately thinks that his company is under a Denial of Service attack. Now Bill needs to find out more about the originating IP Address.

What Internet registry should Bill look in to find the IP Address?

A. LACNIC

B. ARIN

C. RIPELACNIC

D. APNIC

Answer: A

Explanation: LACNIC is the Latin American and Caribbean Internet Addresses Registry that administers IP addresses, autonomous system numbers, reverse DNS, and other network resources for that region.

Q4. In Trojan terminology, what is required to create the executable file chess.exe as shown below?

A. Mixer

B. Converter

C. Wrapper

D. Zipper

Answer: C

Q5. Michael is a junior security analyst working for the National Security Agency (NSA) working primarily on breaking terrorist encrypted messages. The NSA has a number of methods they use to decipher encrypted messages including Government Access to Keys (GAK) and inside informants. The NSA holds secret backdoor keys to many of the encryption algorithms used on the Internet. The problem for the NSA, and Michael, is that terrorist organizations are starting to use custom-built algorithms or obscure algorithms purchased from corrupt governments. For this reason, Michael and other security analysts like him have been forced to find different methods of deciphering terrorist messages. One method that Michael thought of using was to hide malicious code inside seemingly harmless programs. Michael first monitors sites and bulletin boards used by known terrorists, and then he is able to glean email addresses to some of these suspected terrorists. Michael then inserts a stealth keylogger into a mapping program file readme.txt and then sends that as an attachment to the terrorist. This keylogger takes screenshots every 2 minutes and also logs all keyboard activity into a hidden file on the terrorist's computer. Then, the keylogger emails those files to Michael twice a day with a built in SMTP server. What technique has Michael used to disguise this keylogging software?

A. Steganography

B. Wrapping

C. ADS

D. Hidden Channels

Answer: A

Q6. One of the ways to map a targeted network for live hosts is by sending an ICMP ECHO request to the broadcast or the network address. The request would be broadcasted to all hosts on the targeted network. The live hosts will send an ICMP ECHO Reply to the attacker's source IP address.

You send a ping request to the broadcast address 192.168.5.255.

There are 40 computers up and running on the target network. Only 13 hosts send a reply while others do not. Why?

A. Windows machines will not generate an answer (ICMP ECHO Reply) to an ICMP ECHO request aimed at the broadcast address or at the network address.

B. Linux machines will not generate an answer (ICMP ECHO Reply) to an ICMP ECHO request aimed at the broadcast address or at the network address.

C. You should send a ping request with this command ping ? 192.168.5.0-255

D. You cannot ping a broadcast address. The above scenario is wrong.

Answer: A

Q7. To scan a host downstream from a security gateway, Firewalking:

A. Sends a UDP-based packet that it knows will be blocked by the firewall to determine how specifically the firewall responds to such packets

B. Uses the TTL function to send packets with a TTL value set to expire one hop past the identified security gateway

C. Sends an ICMP ''administratively prohibited'' packet to determine if the gateway will drop the packet without comment.

D. Assesses the security rules that relate to the target system before it sends packets to any hops on the route to the gateway

Answer: B

Explanation: Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker’s host to a destination host through a packet-filtering device. This technique can be used to map ‘open’ or ‘pass through’ ports on a gateway. More over, it can determine whether packets with various control information can pass through a given gateway.

Q8. Jack is conducting a port scan of a target network. He knows that his target network has a web server and that a mail server is up and running. Jack has been sweeping the network but has not been able to get any responses from the remote target. Check all of the following that could be a likely cause of the lack of response?

A. The host might be down

B. UDP is filtered by a gateway

C. ICMP is filtered by a gateway

D. The TCP window Size does not match

E. The destination network might be down

F. The packet TTL value is too low and can’t reach the target

Answer: ACEF

Explanation: Wrong answers is B and D as sweeping a network uses ICMP

Q9. Which type of scan does not open a full TCP connection?

A. Stealth Scan

B. XMAS Scan

C. Null Scan

D. FIN Scan

Answer: A

Explanation: Stealth Scan: Instead of completing the full TCP three-way-handshake a full connection is not made. A SYN packet is sent to the system and if a SYN/ACK packet is received it is assumed that the port on the system is active. In that case a RST/ACK will be sent which will determined the listening state the system is in. If a RST/ACK packet is received, it is assumed that the port on the system is not active.

Q10. When Jason moves a file via NFS over the company's network, you want to grab a copy of it by sniffing. Which of the following tool accomplishes this?

A. macof

B. webspy

C. filesnarf

D. nfscopy

Answer: C

Explanation: Filesnarf - sniff files from NFS traffic

OPTIONS

-i interface

Specify the interface to listen on.

-v "Versus" mode. Invert the sense of matching, to

select non-matching files.

pattern

Specify regular expression for filename matching.

expression

Specify a tcpdump(8) filter expression to select

traffic to sniff.

312-50 Premium Bundle

Ethical Hacking and Countermeasures (CEHv6) Certification Exam

EC-Council 312-50 Free Practice Questions