EC0-350無料問題集「EC-COUNCIL Ethical hacking and countermeasures」

質問 1

Which of the following settings enables Nessus to detect when it is sending too many packets and the network pipe is approaching capacity?

（A）Reduce parallel connections on congestion

（B）Silent Dependencies

（C）Consider unscanned ports as closed

（D）Netstat WMI Scan

正解：A 解答を投票する

質問 2

The following is a sample of output from a penetration tester's machine targeting a machine with the IP address of 192.168.1.106:

What is most likely taking place?

（A）Remote service brute force attempt

（B）Port scan of 192.168.1.106

（C）Ping sweep of the 192.168.1.106 network

（D）Denial of service attack on 192.168.1.106

正解：A 解答を投票する

質問 3

Which of the following type of scanning utilizes automated process of proactively identifying vulnerabilities of the computing systems present on a network?

（A）Port Scanning

（B）Single Scanning

（C）External Scanning

（D）Vulnerability Scanning

正解：D 解答を投票する

質問 4

Sandra is conducting a penetration test for XYZ.com. She knows that XYZ.com is using wireless networking for some of the offices in the building right down the street. Through social engineering she discovers that they are using 802.11g. Sandra knows that 802.11g uses the same 2.4GHz frequency range as 802.11b. Using NetStumbler and her 802.11b wireless NIC, Sandra drives over to the building to map the wireless networks. However, even though she repositions herself around the building several times, Sandra is not able to detect a single AP.
What do you think is the reason behind this?

（A）You can only pick up 802.11g signals with 802.11a wireless cards.

（B）The access points probably have disabled broadcasting of the SSID so they cannot be detected.

（C）The access points probably have WEP enabled so they cannot be detected.

（D）Netstumbler does not work against 802.11g.

（E）802.11g uses OFDM while 802.11b uses DSSS so despite the same frequency and 802.11b card cannot see an 802.11g signal.

（F）Sandra must be doing something wrong, as there is no reason for her to not see the signals.

正解：D 解答を投票する

質問 5

All the web servers in the DMZ respond to ACK scan on port 80. Why is this happening ?

（A）The company is not using IDS

（B）They are all Unix based webserver

（C）The company is not using a stateful firewall

（D）They are all Windows based webserver

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

Syslog is a standard for logging program messages. It allows separation of the software that generates messages from the system that stores them and the software that reports and analyzes them. It also provides devices, which would otherwise be unable to communicate a means to notify administrators of problems or performance.

What default port Syslog daemon listens on?

（A）416

（B）514

（C）312

（D）242

正解：B 解答を投票する

質問 7

Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?

（A）Change management

（B）Regulatory compliance

（C）Penetration testing

（D）Peer review

正解：A 解答を投票する

質問 8

You wish to determine the operating system and type of web server being used. At the same time you wish to arouse no suspicion within the target organization.
While some of the methods listed below work, which holds the least risk of detection?

（A）Make some phone calls and attempt to retrieve the information using social engineering.

（B）Use the netcraft web site look for the target organization's web site.

（C）Use nmap in paranoid mode and scan the web server.

（D）Telnet to the web server and issue commands to illicit a response.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

What does an ICMP (Code 13) message normally indicates?

（A）It is a request to the host to cut back the rate at which it is sending traffic to the Internet destination

（B）It indicates that the packet has been administratively dropped in transit

（C）It indicates to the host that the datagram which triggered the source quench message will need to be re-sent

（D）It indicates that the destination host is unreachable

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

Joe Hacker is going wardriving. He is going to use PrismStumbler and wants it to go to a GPS mapping software application. What is the recommended and well-known GPS mapping package that would interface with PrismStumbler?
Select the best answer.

（A）GPSDrive

（B）Microsoft Mappoint

（C）WinPcap

（D）GPSMap

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 11

An attacker is attempting to telnet into a corporation's system in the DMZ. The attacker doesn't want to get caught and is spoofing his IP address. After numerous tries he remains unsuccessful in connecting to the system. The attacker rechecks that the target system is actually listening on Port 23 and he verifies it with both nmap and hping2. He is still unable to connect to the target system. What could be the reason?

（A）He is attacking an operating system that does not reply to telnet even when open

（B）He needs to use an automated tool to telnet in

（C）The firewall is blocking port 23 to that system

（D）He cannot spoof his IP and successfully use TCP

正解：D 解答を投票する

質問 12

Fred is scanning his network to ensure it is as secure as possible. Fred sends a TCP probe packet to a host with a FIN flag and he receives a RST/ACK response. What does this mean?

（A）This means the port he is scanning is half open.

（B）This means that the port he is scanning on the host is closed.

（C）This response means the port he is scanning is open.

（D）The RST/ACK response means the port Fred is scanning is disabled.

正解：B 解答を投票する

質問 13

How can a rootkit bypass Windows 7 operating system's kernel mode, code signing policy?

（A）Performing common services for the application process and replacing real applications with fake ones

（B）Replacing patch system calls with its own version that hides the rootkit (attacker's) actions

（C）Attaching itself to the master boot record in a hard drive and changing the machine's boot sequence/options

（D）Defeating the scanner from detecting any code change at the kernel

正解：C 解答を投票する

質問 14

LAN Manager Passwords are concatenated to 14 bytes, and split in half. The two halves are hashed individually. If the password is 7 characters or less, than the second half of the hash is always:

（A）0xAAD3B435B51404CC

（B）0xAAD3B435B51404EE

（C）0xAAD3B435B51404BB

（D）0xAAD3B435B51404AA

正解：B 解答を投票する

質問 15

Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them?

（A）Passive

（B）Reactive

（C）Intuitive

（D）Detective

正解：A 解答を投票する

EC0-350 無料問題集「EC-COUNCIL Ethical hacking and countermeasures」

弊社を連絡する

関連リンク

トップ試験