ECCouncil EC0-350 - Ethical Hacking and Countermeasures V8 Exam
Page: 3 / 176
Total 878 questions
Question #11 (Topic: Topic 1)
[ECCouncil-EC0-350-5.1/ECCouncil-EC0-350-8_2.png]
An attacker finds a web page for a target organization that supplies contact information for
the company. Using available details to make the message seem authentic, the attacker
drafts e-mail to an employee on the contact page that appears to come from an individual
who might reasonably request confidential information, such as a network administrator.
The email asks the employee to log into a bogus page that requests the employee's user
name and password or click on a link that will download spyware or other malicious
programming.
Google's Gmail was hacked using this technique and attackers stole source code and
sensitive data from Google servers. This is highly sophisticated attack using zero-day
exploit vectors, social engineering and malware websites that focused on targeted
individuals working for the company.
What is this deadly attack called?
An attacker finds a web page for a target organization that supplies contact information for
the company. Using available details to make the message seem authentic, the attacker
drafts e-mail to an employee on the contact page that appears to come from an individual
who might reasonably request confidential information, such as a network administrator.
The email asks the employee to log into a bogus page that requests the employee's user
name and password or click on a link that will download spyware or other malicious
programming.
Google's Gmail was hacked using this technique and attackers stole source code and
sensitive data from Google servers. This is highly sophisticated attack using zero-day
exploit vectors, social engineering and malware websites that focused on targeted
individuals working for the company.
What is this deadly attack called?
A. Spear phishing attack
B. Trojan server attack
C. Javelin attack
D. Social networking attack
Answer: A
Question #12 (Topic: Topic 1)
Cyber Criminals have long employed the tactic of masking their true identity. In IP spoofing,
an attacker gains unauthorized access to a computer or a network by making it appear that
a malicious message has come from a trusted machine, by "spoofing" the IP address of
that machine.
How would you detect IP spoofing?
an attacker gains unauthorized access to a computer or a network by making it appear that
a malicious message has come from a trusted machine, by "spoofing" the IP address of
that machine.
How would you detect IP spoofing?
A. Check the IPID of the spoofed packet and compare it with TLC checksum. If the numbers match then it is spoofed packet
B. Probe a SYN Scan on the claimed host and look for a response SYN/FIN packet, if the connection completes then it is a spoofed packet
C. Turn on 'Enable Spoofed IP Detection' in Wireshark, you will see a flag tick if the packet is spoofed
D. Sending a packet to the claimed host will result in a reply. If the TTL in the reply is not the same as the packet being checked then it is a spoofed packet
Answer: D
Question #13 (Topic: Topic 1)
Dan is conducting penetration testing and has found a vulnerability in a Web Application
which gave him the sessionID token via a cross site scripting vulnerability. Dan wants to
replay this token. However, the session ID manager (on the server) checks the originating
IP address as well. Dan decides to spoof his IP address in order to replay the sessionID.
Why do you think Dan might not be able to get an interactive session?
which gave him the sessionID token via a cross site scripting vulnerability. Dan wants to
replay this token. However, the session ID manager (on the server) checks the originating
IP address as well. Dan decides to spoof his IP address in order to replay the sessionID.
Why do you think Dan might not be able to get an interactive session?
A. Dan cannot spoof his IP address over TCP network
B. The scenario is incorrect as Dan can spoof his IP and get responses
C. The server will send replies back to the spoofed IP address
D. Dan can establish an interactive session only if he uses a NAT
Answer: C
Question #14 (Topic: Topic 1)
Steven the hacker realizes the network administrator of Acme Corporation is using syskey
in Windows 2008 Server to protect his resources in the organization. Syskey independently
encrypts the hashes so that physical access to the server, tapes, or ERDs is only first step
to cracking the passwords. Steven must break through the encryption used by syskey
before he can attempt to use brute force dictionary attacks on the hashes. Steven runs a
program called "SysCracker" targeting the Windows 2008 Server machine in attempting to
crack the hash used by Syskey. He needs to configure the encryption level before he can
launch the attack. How many bits does Syskey use for encryption?
in Windows 2008 Server to protect his resources in the organization. Syskey independently
encrypts the hashes so that physical access to the server, tapes, or ERDs is only first step
to cracking the passwords. Steven must break through the encryption used by syskey
before he can attempt to use brute force dictionary attacks on the hashes. Steven runs a
program called "SysCracker" targeting the Windows 2008 Server machine in attempting to
crack the hash used by Syskey. He needs to configure the encryption level before he can
launch the attack. How many bits does Syskey use for encryption?
A. 40-bit encryption
B. 128-bit encryption
C. 256-bit encryption
D. 64-bit encryption
Answer: B
Question #15 (Topic: Topic 1)
SYN Flood is a DOS attack in which an attacker deliberately violates the three-way
handshake and opens a large number of half-open TCP connections. The signature of
attack for SYN Flood contains:
handshake and opens a large number of half-open TCP connections. The signature of
attack for SYN Flood contains:
A. The source and destination address having the same value
B. A large number of SYN packets appearing on a network without the corresponding reply packets
C. The source and destination port numbers having the same value
D. A large number of SYN packets appearing on a network with the corresponding reply packets
Answer: B
