Spring Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the ECCouncil Certified Ethical Hacker EC0-350 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam EC0-350 Premium Access

View all detail and faqs for the EC0-350 exam

Go to Exam

647 Students Passed

91% Average Score

97% Same Questions

Viewing page 9 out of 14 pages

Viewing questions 161-180 out of questions

Questions # 161:

Password cracking programs reverse the hashing process to recover passwords.(True/False.

Options:

True

False

Questions # 162:

Exhibit:

Question # 162

The following is an entry captured by a network IDS.You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor. You figure that the attacker is attempting a buffer overflow attack. You also notice "/bin/sh" in the ASCII part of the output. As an analyst what would you conclude about the attack?

Options:

The buffer overflow attack has been neutralized by the IDS

The attacker is creating a directory on the compromised machine

The attacker is attempting a buffer overflow attack and has succeeded

The attacker is attempting an exploit that launches a command-line shell

Questions # 163:

A POP3 client contacts the POP3 server:

Options:

To send mail

To receive mail

to send and receive mail

to get the address to send mail to

initiate a UDP SMTP connection to read mail

Questions # 164:

What hacking attack is challenge/response authentication used to prevent?

Options:

Replay attacks

Scanning attacks

Session hijacking attacks

Password cracking attacks

Questions # 165:

A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it?

Select the best answers.

Options:

Use port security on his switches.

Use a tool like ARPwatch to monitor for strange ARP activity.

Use a firewall between all LAN segments.

If you have a small network, use static ARP entries.

Use only static IP addresses on all PC's.

Questions # 166:

What port scanning method is the most reliable but also the most detectable?

Options:

Null Scanning

Connect Scanning

ICMP Scanning

Idlescan Scanning

Half Scanning

Verbose Scanning

Questions # 167:

You have initiated an active operating system fingerprinting attempt with nmap against a target system:

Question # 167

What operating system is the target host running based on the open ports shown above?

Options:

Windows XP

Windows 98 SE

Windows NT4 Server

Windows 2000 Server

Questions # 168:

War dialing is a very old attack and depicted in movies that were made years ago.

Why would a modem security tester consider using such an old technique?

Options:

It is cool, and if it works in the movies it must work in real life.

It allows circumvention of protection mechanisms by being on the internal network.

It allows circumvention of the company PBX.

A good security tester would not use such a derelict technique.

Questions # 169:

John is using a special tool on his Linux platform that has a signature database and is therefore able to detect hundred of vulnerabilities in UNIX, Windows, and commonly-used web CGI scripts. Additionally, the database detects DDoS zombies and Trojans. What would be the name of this multifunctional tool?

Options:

nmap

hping

nessus

make

Questions # 170:

The use of alert thresholding in an IDS can reduce the volume of repeated alerts, but introduces which of the following vulnerabilities?

Options:

An attacker, working slowly enough, can evade detection by the IDS.

Network packets are dropped if the volume exceeds the threshold.

Thresholding interferes with the IDS’ ability to reassemble fragmented packets.

The IDS will not distinguish among packets originating from different sources.

Questions # 171:

What two things will happen if a router receives an ICMP packet, which has a TTL value of 1, and the destination host is several hops away? (Select 2 answers)

Options:

The router will discard the packet

The router will decrement the TTL value and forward the packet to the next router on the path to the destination host

The router will send a time exceeded message to the source host

The router will increment the TTL value and forward the packet to the next router on the path to the destination host.

The router will send an ICMP Redirect Message to the source host

Questions # 172:

A distributed port scan operates by:

Options:

Blocking access to the scanning clients by the targeted host

Using denial-of-service software against a range of TCP ports

Blocking access to the targeted host by each of the distributed scanning clients

Having multiple computers each scan a small number of ports, then correlating the results

Questions # 173:

Paul has just finished setting up his wireless network. He has enabled numerous security features such as changing the default SSID, enabling WPA encryption, and enabling MAC filtering on his wireless router. Paul notices that when he uses his wireless connection, the speed is sometimes 54 Mbps and sometimes it is only 24Mbps or less. Paul connects to his wireless router's management utility and notices that a machine with an unfamiliar name is connected through his wireless connection. Paul checks the router's logs and notices that the unfamiliar machine has the same MAC address as his laptop. What is Paul seeing here?

Options:

MAC spoofing

Macof

ARP spoofing

DNS spoofing

Questions # 174:

Which of the following ICMP message types are used for destinations unreachables?

Questions # 175:

What does a type 3 code 13 represent?(Choose two.

Options:

Echo request

Destination unreachable

Network unreachable

Administratively prohibited

Port unreachable

Time exceeded

Questions # 176:

Which of the following is considered an acceptable option when managing a risk?

Options:

Reject the risk.

Deny the risk.

Mitigate the risk.

Initiate the risk.

Questions # 177:

One of your team members has asked you to analyze the following SOA record. What is the TTL?

Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600

3600 604800 2400.

Questions # 178:

While investigating a claim of a user downloading illegal material, the investigator goes through the files on the suspect's workstation. He comes across a file that is just called "file.txt" but when he opens it, he finds the following:

Question # 178

What can he infer from this file?

Options:

A picture that has been renamed with a .txt extension

An encrypted file

An encoded file

A buffer overflow

Questions # 179:

Which Type of scan sends a packets with no flags set? Select the Answer

Options:

Open Scan

Null Scan

Xmas Scan

Half-Open Scan

Answer

Explanation

The types of port connections supported are:

• TCP Full Connect. This mode makes a full connection to the target's TCP ports and can save any data or banners returned from the target. This mode is the most accurate for determining TCP services, but it is also easily recognized by Intrusion Detection Systems (IDS).

• UDP ICMP Port Unreachable Connect. This mode sends a short UDP packet to the target's UDP ports and looks for an ICMP Port Unreachable message in return. The absence of that message indicates either the port is used, or the target does not return the ICMP message which can lead to false positives. It can save any data or banners returned from the target. This mode is also easily recognized by IDS.

• TCP Full/UDP ICMP Combined. This mode combines the previous two modes into one operation.

• TCP SYN Half Open. (Windows XP/2000 only) This mode sends out a SYN packet to the target port and listens for the appropriate response. Open ports respond with a SYN|ACK and closed ports respond with ACK|RST or RST. This mode is less likely to be noted by IDS, but since the connection is never fully completed, it cannot gather data or banner information. However, the attacker has full control over TTL, Source Port, MTU, Sequence number, and Window parameters in the SYN packet.

• TCP Other. (Windows XP/2000 only) This mode sends out a TCP packet with any combination of the SYN, FIN, ACK, RST, PSH, URG flags set to the target port and listens for the response. Again, the attacker can have full control over TTL, Source Port, MTU, Sequence number, and Window parameters in the custom TCP packet. The Analyze feature helps with analyzing the response based on the flag settings chosen. Each operating system responds differently to these special combinations. The tool includes presets for XMAS, NULL, FIN and ACK flag settings.

Questions # 180:

Harold is the senior security analyst for a small state agency in New York. He has no other security professionals that work under him, so he has to do all the security-related tasks for the agency. Coming from a computer hardware background, Harold does not have a lot of experience with security methodologies and technologies, but he was the only one who applied for the position. Harold is currently trying to run a Sniffer on the agency's network to get an idea of what kind of traffic is being passed around, but the program he is using does not seem to be capturing anything. He pours through the Sniffer's manual, but cannot find anything that directly relates to his problem. Harold decides to ask the network administrator if he has any thoughts on the problem. Harold is told that the Sniffer was not working because the agency's network is a switched network, which cannot be sniffed by some programs without some tweaking. What technique could Harold use to sniff his agency's switched network?