Eccouncil 312-50v11 practice test

Which of the following programs is usually targeted at Microsoft Office products?

• A. Polymorphic virus
• B. Multipart virus
• C. Macro virus
• D. Stealth virus

In an internal security audit, the white hat hacker gains control over a user account and attempts to
acquire access to another account's confidential files and information. How can he achieve this?

• A. Privilege Escalation
• B. Shoulder-Surfing
• C. Hacking Active Directory
• D. Port Scanning

A technician is resolving an issue where a computer is unable to connect to the Internet using a
wireless access point. The computer is able to transfer files locally to other machines, but cannot
successfully reach the Internet. When the technician examines the IP address and default gateway
they are both on the 192.168.1.0/24. Which of the following has occurred?

• A. The computer is not using a private IP address.
• B. The gateway is not routing to a public IP address.
• C. The gateway and the computer are not on the same network.
• D. The computer is using an invalid IP address.

Identify the UDP port that Network Time Protocol (NTP) uses as its primary means of
communication?

• A. 113
• B. 69
• C. 123
• D. 161

Due to a slowdown of normal network operations, the IT department decided to monitor internet
traffic for all of the employees. From a legal standpoint, what would be troublesome to take this kind
of measure?

• A. All of the employees would stop normal work activities
• B. IT department would be telling employees who the boss is
• C. Not informing the employees that they are going to be monitored could be an invasion of privacy.
• D. The network could still experience traffic slow down.

Which of the following tools performs comprehensive tests against web servers, including dangerous
files and CGIs?

• A. Nikto
• B. John the Ripper
• C. Dsniff
• D. Snort

An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and
Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible
breach of security. When the investigator attempts to correlate the information in all of the logs, the
sequence of many of the logged events do not match up.
What is the most likely cause?

• A. The network devices are not all synchronized.
• B. Proper chain of custody was not observed while collecting the logs.
• C. The attacker altered or erased events from the logs.
• D. The security breach was a false positive.

DNS cache snooping is a process of determining if the specified resource address is present in the
DNS cache records. It may be useful during the examination of the network to determine what
software update resources are used, thus discovering what software is installed.
What command is used to determine if the entry is present in DNS cache?

• A. nslookup -fullrecursive update.antivirus.com
• B. dnsnooping –rt update.antivirus.com
• C. nslookup -norecursive update.antivirus.com
• D. dns --snoop update.antivirus.com

Which of the following is an extremely common IDS evasion technique in the web world?

• A. Spyware
• B. Subnetting
• C. Unicode Characters
• D. Port Knocking

John the Ripper is a technical assessment tool used to test the weakness of which of the following?

• A. Passwords
• B. File permissions
• C. Firewall rulesets
• D. Usernames