Eccouncil 312-50 Exam Dumps

You are the security administrator for a large online auction company based out of LosAngeles. After getting your ENSA CERTIFICATION last year, you have steadily beenfortifying your network’s security including training OS hardening and network security.One of the last things you just changed for security reasons was to modify all the built-inadministrator accounts on the local computers of PCs and in Active Directory. Afterthrough testing you found and no services or programs were affected by the namechanges.Your company undergoes an outside security audit by a consulting company and they saidthat even through all the administrator account names were changed, the accounts couldstill be used by a clever hacker to gain unauthorized access. You argue with the auditorsand say that is not possible, so they use a tool and show you how easy it is to utilize theadministrator account even though its name was changed. What tool did the auditors use?

You are the IT Manager of a large legal firm in California. Your firm represents manyimportant clients whose names always must remain anonymous to the public. Your boss,Mr. Smith is always concerned about client information being leaked or revealed to the presor public. You have just finished a complete security overhaul of your information systemincluding an updated IPS, new firewall, email encryption and employee security awarenesstraining. Unfortunately, many of your firm’s clients do not trust technology to completelysecure their information, so couriers routinely have to travel back and forth to and from theoffice with sensitive information.Your boss has charged you with figuring out how to secure the information the couriersmust transport. You propose that the data be transferred using burned CD’s or USB flashdrives. You initially think of encrypting the files, but decide against that method for fear theencryption keys could eventually be broken.What software application could you use to hide the data on the CD’s and USB flashdrives?

Which of the following is an attack in which a secret value like a hash is captured and thenreused at a later time to gain access to a system without ever decrypting or decoding the hash.

Travis works primarily from home as a medical transcriptions.He just bought a brand new Dual Core Pentium Computer with over 3 GB of RAM. He usesvoice recognition software is processor intensive, which is why he bought the newcomputer. Travis frequently has to get on the Internet to do research on what he is workingon. After about two months of working on his new computer, he notices that it is notrunning nearly as fast as it used to.Travis uses antivirus software, anti-spyware software and always keeps the computer upto-date with Microsoft patches.After another month of working on the computer, Travis computer is even more noticeableslow. Every once in awhile, Travis also notices a window or two pop-up on his screen, butthey quickly disappear. He has seen these windows show up, even when he has not beenon the Internet. Travis is really worried about his computer because he spent a lot ofmoney on it and he depends on it to work. Travis scans his through Windows Explorer andcheck out the file system, folder by folder to see if there is anything he can find. He spendsover four hours pouring over the files and folders and can’t find anything but before hegives up, he notices that his computer only has about 10 GB of free space available. Sincehas drive is a 200 GB hard drive, Travis thinks this is very odd.Travis downloads Space Monger and adds up the sizes for all the folders and files on hiscomputer. According to his calculations, he should have around 150 GB of free space.What is mostly likely the cause of Travi’s problems?

LAN Manager passwords are concatenated to 14 bytes and split in half. The two halves arehashed individually. If the password is 7 characters or less, than the second half of thehash is always:

Samuel is the network administrator of DataX communications Inc. He is trying to configurehis firewall to block password brute force attempts on his network. He enables blocking theintruder’s IP address for a period of 24 hours time after more than three unsuccessfulattempts. He is confident that this rule will secure his network hackers on the Internet.But he still receives hundreds of thousands brute-force attempts generated from various IPaddresses around the world. After some investigation he realizes that the intruders areusing a proxy somewhere else on the Internet which has been scripted to enable therandom usage of various proxies on each request so as not to get caught by the firewalluse.Later he adds another rule to his firewall and enables small sleep on the password attemptso that if the password is incorrect, it would take 45 seconds to return to the user to beginanother attempt. Since an intruder may use multiple machines to brute force the password,he also throttles the number of connections that will be prepared to accept from aparticular IP address. This action will slow the intruder’s attempts.Samuel wants to completely block hackers brute force attempts on his network.What are the alternatives to defending against possible brute-force password attacks onhis site?

In the following example, which of these is the "exploit"?Today, Microsoft Corporation released a security notice. It detailed how a person couldbring down the Windows 2003 Server operating system, by sending malformed packets toit. They detailed how this malicious process had been automated using basic scripting.Even worse, the new automated method for bringing down the server has already beenused to perform denial of service attacks on many large commercial websites.Select the best answer.

One of your junior administrator is concerned with Windows LM hashes and passwordcracking. In your discussion with them, which of the following are true statements that youwould point out?Select the best answers.

You are a Administrator of Windows server. You want to find the port number for POP3.What file would you find the information in and where?Select the best answer.

_____ is the process of converting something from one representation to the simplestform. It deals with the way in which systems convert data from one form to another.

Which of the following keyloggers cannot be detected by anti-virus or anti-spywareproducts?

How would you describe an attack where an attacker attempts to deliver the payload overmultiple packets over long periods of time with the purpose of defeating simple patternmatching in IDS systems without session reconstruction? A characteristic of this attackwould be a continuous stream of small packets.

LM authentication is not as strong as Windows NT authentication so you may want todisable its use, because an attacker eavesdropping on network traffic will attack the weakerprotocol. A successful attack can compromise the user's password. How do you disableLM authentication in Windows XP?

_____ is found in all versions of NTFS and is described as the ability to fork file data intoexisting files without affecting their functionality, size, or display to traditional file browsingutilities like dir or Windows Explorer

Which of the following steganography utilities exploits the nature of white space andallows the user to conceal information in these white spaces?

Attackers can potentially intercept and modify unsigned SMB packets, modify the trafficand forward it so that the server might perform undesirable actions. Alternatively, theattacker could pose as the server or client after a legitimate authentication and gainunauthorized access to data. Which of the following is NOT a means that can be used tominimize or protect against such an attack?

What file system vulnerability does the following command take advantage of? type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe

What hacking attack is challenge/response authentication used to prevent?

What does the following command in netcat do? nc -l -u -p 55555 < /etc/passwd

In the context of Windows Security, what is a 'null' user?

Fingerprinting an Operating System helps a cracker because:

What is GINA?

You are the Security Administrator of Xtrinity, Inc. You write security policies and conductassesments to protect the company's network. During one of your periodic checks to seehow well policy is being observed by the employees, you discover an employee hasattached a modem to his telephone line and workstation. He has used this modem to dial into his workstation, thereby bypassing your firewall. A security breach has occurred as adirect result of this activity. The employee explains that he used the modem because hehad to download software for a department project. How would you resolve this situation?

An attacker runs netcat tool to transfer a secret file between two hosts. Machine A: netcat -l -p 1234 < secretfile Machine B: netcat 192.168.3.4 > 1234 He is worried about information being sniffed on the network. How would the attacker usenetcat to encrypt the information before transmitting onto the wire?

You have retrieved the raw hash values from a Windows 2000 Domain Controller. Usingsocial engineering, you come to know that they are enforcing strong passwords. Youunderstand that all users are required to use passwords that are at least 8 characters inlength. All passwords must also use 3 of the 4 following categories: lower case letters,capital letters, numbers and special characters.With your existing knowledge of users, likely user account names and the possibility thatthey will choose the easiest passwords possible, what would be the fastest type ofpassword cracking attack you can run against these hash values and still get results?