312-50v11 : Certified Ethical Hacker v11 Exam : Part 04

312-50v11 : Certified Ethical Hacker v11 Exam : Part 04

1. An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML code to embed a malicious applet in all HTTP connections.

   When users accessed any page, the applet ran and exploited many machines.

   Which one of the following tools the hacker probably used to inject HTML code?

   • Wireshark
   • Ettercap
   • Aircrack-ng
   • Tcpdump

2. Which mode of IPSec should you use to assure security and confidentiality of data within the same LAN?

   • ESP transport mode
   • ESP confidential
   • AH permiscuous
   • AH Tunnel mode

3. Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers. The time a hacker spends performing research to locate this information about a company is known as?

   • Exploration
   • Investigation
   • Reconnaissance
   • Enumeration

4. Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?

   • Macro virus
   • Stealth/Tunneling virus
   • Cavity virus
   • Polymorphic virus

5. The “Gray-box testing” methodology enforces what kind of restriction?

   • Only the external operation of a system is accessible to the tester.
   • The internal operation of a system in only partly accessible to the tester.
   • Only the internal operation of a system is known to the tester.
   • The internal operation of a system is completely known to the tester.

6. When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator’s Computer to update the router configuration. What type of an alert is this?

   • False negative
   • True negative
   • True positive
   • False positive

7. A large company intends to use Blackberry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the Prometric Online Testing – Reports https://ibt1.prometric.com/users/custom/report_queue/rq_str… corporate network. What tool should the analyst use to perform a Blackjacking attack?

   • Paros Proxy
   • BBProxy
   • Blooover
   • BBCrack

8. When you are getting information about a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from the server. You can detect all these methods (GET, POST, HEAD, PUT, DELETE, TRACE) using NMAP script engine. What Nmap script will help you with this task?

   • http-methods
   • http enum
   • http-headers
   • http-git

9. Todd has been asked by the security officer to purchase a counter-based authentication system. Which of the following best describes this type of system?

   • A biometric system that bases authentication decisions on behavioral attributes.
   • A biometric system that bases authentication decisions on physical attributes.
   • An authentication system that creates one-time passwords that are encrypted with secret keys.
   • An authentication system that uses passphrases that are converted into virtual passwords.

10. Which of the following is a low-tech way of gaining unauthorized access to systems?

    • Social Engineering
    • Eavesdropping
    • Scanning
    • Sniffing

11. Which system consists of a publicly available set of databases that contain domain name registration contact information?

    • WHOIS
    • CAPTCHA
    • IANA
    • IETF

12. Why is a penetration test considered to be more thorough than vulnerability scan?

    • Vulnerability scans only do host discovery and port scanning by default.
    • A penetration test actively exploits vulnerabilities in the targeted infrastructure, while a vulnerability scan does not typically involve active exploitation.
    • It is not – a penetration test is often performed by an automated tool, while a vulnerability scan requires active engagement.
    • The tools used by penetration testers tend to have much more comprehensive vulnerability databases.

13. Bob received this text message on his mobile phone: “Hello, this is Scott Smelby from the Yahoo Bank. Kindly contact me for a vital transaction on: [email protected]”. Which statement below is true?

    • This is a scam as everybody can get a @yahoo address, not the Yahoo customer service employees.
    • This is a scam because Bob does not know Scott.
    • Bob should write to [email protected] to verify the identity of Scott.
    • This is probably a legitimate message as it comes from a respectable organization.

14. env x=’(){ :;};echo exploit’ bash –c ‘cat/etc/passwd’

    What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?

    • Removes the passwd file
    • Changes all passwords in passwd
    • Add new user to the passwd file
    • Display passwd content to prompt

15. Which of the following is assured by the use of a hash?

    • Authentication
    • Confidentiality
    • Availability
    • Integrity

16. Which results will be returned with the following Google search query? site:target.com –

    site:Marketing.target.com accounting

    • Results from matches on the site marketing.target.com that are in the domain target.com but do not include the word accounting.
    • Results matching all words in the query.
    • Results for matches on target.com and Marketing.target.com that include the word “accounting”
    • Results matching “accounting” in domain target.com but not on the site Marketing.target.com

17. Email is transmitted across the Internet using the Simple Mail Transport Protocol. SMTP does not encrypt email, leaving the information in the message vulnerable to being read by an unauthorized person. SMTP can upgrade a connection between two mail servers to use TLS. Email transmitted by SMTP over TLS is encrypted. What is the name of the command used by SMTP to transmit email over TLS?

    • OPPORTUNISTICTLS
    • UPGRADETLS
    • FORCETLS
    • STARTTLS

18. In the field of cryptanalysis, what is meant by a “rubber-hose” attack?

    • Forcing the targeted keystream through a hardware-accelerated device such as an ASIC.
    • A backdoor placed into a cryptographic algorithm by its creator.
    • Extraction of cryptographic secrets through coercion or torture.
    • Attempting to decrypt ciphertext by making logical assumptions about the contents of the original plaintext.

19. You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What Wireshark filter will show the connections from the snort machine to kiwi syslog machine?

    • tcp.srcport= = 514 && ip.src= = 192.168.0.99
    • tcp.srcport= = 514 && ip.src= = 192.168.150
    • tcp.dstport= = 514 && ip.dst= = 192.168.0.99
    • tcp.dstport= = 514 && ip.dst= = 192.168.0.150

20. What two conditions must a digital signature meet?

    • Has to be the same number of characters as a physical signature and must be unique.
    • Has to be unforgeable, and has to be authentic.
    • Must be unique and have special characters.
    • Has to be legible and neat.