Exam 5: ECCouncil Computer Hacking Forensic Investigator

Question 1

What is one thing a tester can do to ensure that the software is trusted and is not changing or tampering with critical data on the back end of a system it is loaded on?

A) Proper testing
B) Secure coding principles
C) Systems security and architecture review
D) Analysis of interrupts within the software

Answer 1

D

Question 2

A covert channel is a channel that

A) transfers information over, within a computer system, or network that is outside of the security policy.
B) transfers information over, within a computer system, or network that is within the security policy.
C) transfers information via a communication path within a computer system, or network for transfer of data.
D) transfers information over, within a computer system, or network that is encrypted.

Answer 2

A

Question 3

A bank stores and processes sensitive privacy information related to home loans.  However, auditing has never been enabled on the system.  What is the first step that the bank should take before enabling the audit feature?

A) Perform a vulnerability scan of the system.
B) Determine the impact of enabling the audit feature.
C) Perform a cost/benefit analysis of the audit feature.
D) Allocate funds for staffing of audit log review.

Answer 3

B

Question 4

Which security control role does encryption meet?

A) Preventative
B) Detective
C) Offensive
D) Defensive

Question 5

A penetration tester was hired to perform a penetration test for a bank.  The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news articles online about the bank, watching what times the bank employees come into work and leave from work, searching the bank's job postings (paying special attention to IT related jobs), and visiting the local dumpster for the bank's corporate office. What phase of the penetration test is the tester currently in?

A) Information reporting
B) Vulnerability assessment
C) Active information gathering
D) Passive information gathering

Question 6

If the final set of security controls does not eliminate all risk in a system, what could be done next?

A) Continue to apply controls until there is zero risk.
B) Ignore any remaining risk.
C) If the residual risk is low enough, it can be accepted.
D) Remove current controls since they are not completely effective.

Question 7

Which of the following is a preventive control?

A) Smart card authentication
B) Security policy
C) Audit trail
D) Continuity of operations plan

Question 8

Windows file servers commonly hold sensitive files, databases, passwords and more.  Which of the following choices would be a common vulnerability that usually exposes them?

A) Cross-site scripting
B) SQL injection
C) Missing patches
D) CRLF injection

Question 9

An NMAP scan of a server shows port 69 is open. What risk could this pose?

A) Unauthenticated access
B) Weak SSL version
C) Cleartext login
D) Web portal data leak

Question 10

What information should an IT system analysis provide to the risk assessor?

A) Management buy-in
B) Threat statement
C) Security architecture
D) Impact analysis

Question 11

John the Ripper is a technical assessment tool used to test the weakness of which of the following?

A) Usernames
B) File permissions
C) Firewall rulesets
D) Passwords

Question 12

Which type of access control is used on a router or firewall to limit network activity?

A) Mandatory
B) Discretionary
C) Rule-based
D) Role-based

Question 13

Which of the following examples best represents a logical or technical control?

A) Security tokens
B) Heating and air conditioning
C) Smoke and fire alarms
D) Corporate security policy

Question 14

At a Windows Server command prompt, which command could be used to list the running services?

A) Sc query type= running
B) Sc query \\servername
C) Sc query
D) Sc config

Question 15

A company firewall engineer has configured a new DMZ to allow public systems to be located away from the internal network. The engineer has three security zones set: Untrust (Internet) - (Remote network = 217.77.88.0/24) DMZ (DMZ) - (11.12.13.0/24) Trust (Intranet) - (192.168.0.0/24) The engineer wants to configure remote desktop access from a fixed IP on the remote network to a remote desktop server in the DMZ. Which rule would best fit this requirement?

A) Permit  217.77.88.0/24  11.12.13.0/24   RDP 3389
B) Permit  217.77.88.12    11.12.13.50     RDP 3389
C) Permit  217.77.88.12    11.12.13.0/24   RDP 3389
D) Permit  217.77.88.0/24  11.12.13.50     RDP 3389

Question 16

Least privilege is a security concept that requires that a user is

A) limited to those functions required to do the job.
B) given root or administrative privileges.
C) trusted to keep all data and access to that data under their sole control.
D) given privileges equal to everyone else in the department.

Question 17

A circuit level gateway works at which of the following layers of the OSI Model?

A) Layer 5 - Application
B) Layer 4 - TCP
C) Layer 3 - Internet protocol
D) Layer 2 - Data link

Question 18

Which of the following is considered an acceptable option when managing a risk?

A) Reject the risk.
B) Deny the risk.
C) Mitigate the risk.
D) Initiate the risk.

Question 19

Which results will be returned with the following Google search query? site:target.com -site:Marketing.target.com accounting

A) Results matching all words in the query
B) Results matching "accounting" in domain target.com but not on the site Marketing.target.com
C) Results from matches on the site marketing.target.com that are in the domain target.com but do not include the word accounting
D) Results for matches on target.com and Marketing.target.com that include the word "accounting"

Question 20

While conducting a penetration test, the tester determines that there is a firewall between the tester's machine and the target machine. The firewall is only monitoring TCP handshaking of packets at the session layer of the OSI model.  Which type of firewall is the tester trying to traverse?

A) Packet filtering firewall
B) Application-level firewall
C) Circuit-level gateway firewall
D) Stateful multilayer inspection firewall

Question 21

A computer science student needs to fill some information into a secured Adobe PDF job application that was received from a prospective employer. Instead of requesting a new document that allowed the forms to be completed, the student decides to write a script that pulls passwords from a list of commonly used passwords to try against the secured PDF until the correct password is found or the list is exhausted. Which cryptography attack is the student attempting?

A) Man-in-the-middle attack
B) Brute-force attack
C) Dictionary attack
D) Session hijacking

Question 22

While performing data validation of web content, a security technician is required to restrict malicious input. Which of the following processes is an efficient way of restricting malicious input?

A) Validate web content input for query strings.
B) Validate web content input with scanning tools.
C) Validate web content input for type, length, and range.
D) Validate web content input for extraneous queries.

Question 23

Which of the following processes evaluates the adherence of an organization to its stated security policy?

A) Vulnerability assessment
B) Penetration testing
C) Risk assessment
D) Security auditing

Question 24

A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a user from the IT department had a dial-out modem installed. Which security policy must the security analyst check to see if dial-out modems are allowed?

A) Firewall-management policy
B) Acceptable-use policy
C) Remote-access policy
D) Permissive policy

Question 25

Low humidity in a data center can cause which of the following problems?

A) Heat
B) Corrosion
C) Static electricity
D) Airborne contamination

Question 26

Which of the following is a symmetric cryptographic standard?

A) DSA
B) PKI
C) RSA
D) 3DES

Question 27

Which of the following resources does NMAP need to be used as a basic vulnerability scanner covering several vectors like SMB, HTTP and FTP?

A) Metasploit scripting engine
B) Nessus scripting engine
C) NMAP scripting engine
D) SAINT scripting engine

Question 28

Which of the following scanning tools is specifically designed to find potential exploits in Microsoft Windows products?

A) Microsoft Security Baseline Analyzer
B) Retina
C) Core Impact
D) Microsoft Baseline Security Analyzer

Question 29

When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's computer to update the router configuration. What type of an alert is this?

A) False positive
B) False negative
C) True positve
D) True negative

Question 30

How can telnet be used to fingerprint a web server?

A) telnet webserverAddress 80 HEAD / HTTP/1.0
B) PUT / HTTP/1.0
C) HEAD / HTTP/2.0
D) PUT / HTTP/2.0

Question 31

What is the main reason the use of a stored biometric is vulnerable to an attack?

A) The digital representation of the biometric might not be unique, even if the physical characteristic is unique.
B) Authentication using a stored biometric compares a copy to a copy instead of the original to a copy.
C) A stored biometric is no longer "something you are" and instead becomes "something you have".
D) A stored biometric can be stolen and used by an attacker to impersonate the individual identified by the biometric.

Question 32

Which property ensures that a hash function will not produce the same hashed value for two different messages?

A) Collision resistance
B) Bit length
C) Key strength
D) Entropy

Question 33

A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company`s building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area. Which type of attack did the consultant perform?

A) Man trap
B) Tailgating
C) Shoulder surfing
D) Social engineering

Question 34

When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?

A) A bottom-up approach
B) A top-down approach
C) A senior creation approach
D) An IT assurance approach

Question 35

What is the name of the international standard that establishes a baseline level of confidence in the security functionality of IT products by providing a set of requirements for evaluation?

A) Blue Book
B) ISO 26029
C) Common Criteria
D) The Wassenaar Agreement

Question 36

A security consultant is trying to bid on a large contract that involves penetration testing and reporting. The company accepting bids wants proof of work so the consultant prints out several audits that have been performed. Which of the following is likely to occur as a result?

A) The consultant will ask for money on the bid because of great work.
B) The consultant may expose vulnerabilities of other companies.
C) The company accepting bids will want the same type of format of testing.
D) The company accepting bids will hire the consultant because of the great work performed.

Question 37

A security consultant decides to use multiple layers of anti-virus defense, such as end user desktop anti-virus and E-mail gateway.  This approach can be used to mitigate which kind of attack?

A) Forensic attack
B) ARP spoofing attack
C) Social engineering attack
D) Scanning attack

Question 38

Which type of scan is used on the eye to measure the layer of blood vessels?

A) Facial recognition scan
B) Retinal scan
C) Iris scan
D) Signature kinetics scan

Question 39

During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?

A) The tester must capture the WPA2 authentication handshake and then crack it.
B) The tester must use the tool inSSIDer to crack it using the ESSID of the network.
C) The tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
D) The tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key.

Question 40

Which type of antenna is used in wireless communication?

A) Omnidirectional
B) Parabolic
C) Uni-directional
D) Bi-directional

Question 41

A network administrator received an administrative alert at 3:00 a.m. from the intrusion detection system. The alert was generated because a large number of packets were coming into the network over ports 20 and 21. During analysis, there were no signs of attack on the FTP servers. How should the administrator classify this situation?

A) True negatives
B) False negatives
C) True positives
D) False positives

Question 42

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results?                 TCP port 21 - no response        TCP port 22 - no response        TCP port 23 - Time-to-live exceeded

A) The firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target host.
B) The lack of response from ports 21 and 22 indicate that those services are not running on the destination server.
C) The scan on port 23 passed through the filtering device. This indicates that port 23 was not blocked at the firewall.
D) The scan on port 23 was able to make a connection to the destination host prompting the firewall to respond with a TTL error.

Question 43

Which of the following is an example of an asymmetric encryption implementation?

A) SHA1
B) PGP
C) 3DES
D) MD5

Question 44

A hacker is attempting to use nslookup to query Domain Name Service (DNS). The hacker uses the nslookup interactive mode for the search. Which command should the hacker type into the command shell to request the appropriate records?

A) Locate type=ns
B) Request type=ns
C) Set type=ns
D) Transfer type=ns

Question 45

Which of the following is a strong post designed to stop a car?

A) Gate
B) Fence
C) Bollard
D) Reinforced rebar

Question 46

During a penetration test, the tester conducts an ACK scan using NMAP against the external interface of the DMZ firewall. NMAP reports that port 80 is unfiltered. Based on this response, which type of packet inspection is the firewall conducting?

A) Host
B) Stateful
C) Stateless
D) Application

Question 47

A pentester gains access to a Windows application server and needs to determine the settings of the built-in Windows firewall. Which command would be used?

A) Netsh firewall show config
B) WMIC firewall show config
C) Net firewall show config
D) Ipconfig firewall show config

Question 48

Which of the following types of firewall inspects only header information in network traffic?

A) Packet filter
B) Stateful inspection
C) Circuit-level gateway
D) Application-level gateway

Question 49

Which of the following techniques does a vulnerability scanner use in order to detect a vulnerability on a target service?

A) Port scanning
B) Banner grabbing
C) Injecting arbitrary data
D) Analyzing service response

Question 50

What is the most secure way to mitigate the theft of corporate information from a laptop that was left in a hotel room?

A) Set a BIOS password.
B) Encrypt the data on the hard drive.
C) Use a strong logon password to the operating system.
D) Back up everything on the laptop and store the backup in a safe place.

Question 51

During a penetration test, a tester finds a target that is running MS SQL 2000 with default credentials.  The tester assumes that the service is running with Local System account. How can this weakness be exploited to access the system?

A) Using the Metasploit psexec module setting the SA / Admin credential
B) Invoking the stored procedure xp_shell to spawn a Windows command shell
C) Invoking the stored procedure cmd_shell to spawn a Windows command shell
D) Invoking the stored procedure xp_cmdshell to spawn a Windows command shell

Question 52

Which command line switch would be used in NMAP to perform operating system detection?

A) -OS
B) -sO
C) -sP
D) -O

Question 53

The precaution of prohibiting employees from bringing personal computing devices into a facility is what type of security control?

A) Physical
B) Procedural
C) Technical
D) Compliance

Question 54

Which of the following conditions must be given to allow a tester to exploit a Cross-Site Request Forgery (CSRF) vulnerable web application?

A) The victim user must open the malicious link with an Internet Explorer prior to version 8.
B) The session cookies generated by the application do not have the HttpOnly flag set.
C) The victim user must open the malicious link with a Firefox prior to version 3.
D) The web application should not use random tokens.

Question 55

Which of the following cryptography attack methods is usually performed without the use of a computer?

A) Ciphertext-only attack
B) Chosen key attack
C) Rubber hose attack
D) Rainbow table attack

Question 56

One way to defeat a multi-level security solution is to leak data via

A) a bypass regulator.
B) steganography.
C) a covert channel.
D) asymmetric routing.

Question 57

What is the main difference between a "Normal" SQL Injection and a "Blind" SQL Injection vulnerability?

A) The request to the web server is not visible to the administrator of the vulnerable application.
B) The attack is called "Blind" because, although the application properly filters user input, it is still vulnerable to code injection.
C) The successful attack does not show an error message to the administrator of the affected application.
D) The vulnerable application does not display errors with information about the injection results to the attacker.

Question 58

In the software security development life cyle process, threat modeling occurs in which phase?

A) Design
B) Requirements
C) Verification
D) Implementation

Question 59

A Network Administrator was recently promoted to Chief Security Officer at a local university. One of employee's new responsibilities is to manage the implementation of an RFID card access system to a new server room on campus. The server room will house student enrollment information that is securely backed up to an off-site location. During a meeting with an outside consultant, the Chief Security Officer explains that he is concerned that the existing security controls have not been designed properly. Currently, the Network Administrator is responsible for approving and issuing RFID card access to the server room, as well as reviewing the electronic access logs on a weekly basis. Which of the following is an issue with the situation?

A) Segregation of duties
B) Undue influence
C) Lack of experience
D) Inadequate disaster recovery plan

Question 60

A hacker was able to sniff packets on a company's wireless network. The following information was discovered: The Key             10110010 01001011 The Cyphertext   01100101 01011010 Using the Exlcusive OR, what was the original message?

A) 00101000 11101110
B) 11010111 00010001
C) 00001101 10100100
D) 11110010 01011011

Question 61

Which tool would be used to collect wireless packet data?

A) NetStumbler
B) John the Ripper
C) Nessus
D) Netcat

Question 62

Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?

A) UDP 123
B) UDP 541
C) UDP 514
D) UDP 415

Question 63

On a Linux device, which of the following commands will start the Nessus client in the background so that the Nessus server can be configured?

A) nessus +
B) nessus *s
C) nessus &
D) nessus -d

Question 64

What is the best defense against privilege escalation vulnerability?

A) Patch systems regularly and upgrade interactive login privileges at the system administrator level.
B) Run administrator and applications on least privileges and use a content registry for tracking.
C) Run services with least privileged accounts and implement multi-factor authentication and authorization.
D) Review user roles and administrator privileges for maximum utilization of automation services.

Question 65

A tester has been hired to do a web application security test. The tester notices that the site is dynamic and must make use of a back end database. In order for the tester to see if SQL injection is possible, what is the first character that the tester should use to attempt breaking a valid SQL request?

A) Semicolon
B) Single quote
C) Exclamation mark
D) Double quote

Question 66

Which of the following programming languages is most vulnerable to buffer overflow attacks?

A) Perl
B) C++
C) Python
D) Java

Question 67

Which tool is used to automate SQL injections and exploit a database by forcing a given web application to connect to another database controlled by a hacker?

A) DataThief
B) NetCat
C) Cain and Abel
D) SQLInjector

Question 68

Smart cards use which protocol to transfer the certificate in a secure manner?

A) Extensible Authentication Protocol (EAP)
B) Point to Point Protocol (PPP)
C) Point to Point Tunneling Protocol (PPTP)
D) Layer 2 Tunneling Protocol (L2TP)

Question 69

What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?

A) tcp.src == 25 and ip.host == 192.168.0.125
B) host 192.168.0.125:25
C) port 25 and host 192.168.0.125
D) tcp.port == 25 and ip.host == 192.168.0.125

Question 70

When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?

A) Network tap
B) Layer 3 switch
C) Network bridge
D) Application firewall

Question 71

Which of the following problems can be solved by using Wireshark?

A) Tracking version changes of source code
B) Checking creation dates on all webpages on a server
C) Resetting the administrator password on multiple systems
D) Troubleshooting communication resets between two systems

Question 72

How can a rootkit bypass Windows 7 operating system's kernel mode, code signing policy?

A) Defeating the scanner from detecting any code change at the kernel
B) Replacing patch system calls with its own version that hides the rootkit (attacker's) actions
C) Performing common services for the application process and replacing real applications with fake ones
D) Attaching itself to the master boot record in a hard drive and changing the machine's boot sequence/options

Question 73

Which of the following tools will scan a network to perform vulnerability checks and compliance auditing?

A) NMAP
B) Metasploit
C) Nessus
D) BeEF

Question 74

Which of the following is a hashing algorithm?

A) MD5
B) PGP
C) DES
D) ROT13

Question 75

Which of the following items of a computer system will an anti-virus program scan for viruses?

A) Boot Sector
B) Deleted Files
C) Windows Process List
D) Password Protected Files

Question 76

Which of the following is a client-server tool utilized to evade firewall inspection?

A) tcp-over-dns
B) kismet
C) nikto
D) hping

Question 77

Which of the following identifies the three modes in which Snort can be configured to run?

A) Sniffer, Packet Logger, and Network Intrusion Detection System
B) Sniffer, Network Intrusion Detection System, and Host Intrusion Detection System
C) Sniffer, Host Intrusion Prevention System, and Network Intrusion Prevention System
D) Sniffer, Packet Logger, and Host Intrusion Prevention System

Question 78

What is the outcome of the comm"nc -l -p 2222 | nc 10.1.0.43 1234"?

A) Netcat will listen on the 10.1.0.43 interface for 1234 seconds on port 2222.
B) Netcat will listen on port 2222 and output anything received to a remote connection on 10.1.0.43 port 1234.
C) Netcat will listen for a connection from 10.1.0.43 on port 1234 and output anything received to port 2222.
D) Netcat will listen on port 2222 and then output anything received to local interface 10.1.0.43.

Question 79

A pentester is using Metasploit to exploit an FTP server and pivot to a LAN. How will the pentester pivot using Metasploit?

A) Issue the pivot exploit and set the meterpreter.
B) Reconfigure the network settings in the meterpreter.
C) Set the payload to propagate through the meterpreter.
D) Create a route statement in the meterpreter.

Question 80

A hacker searches in Google for filetype:pcf to find Cisco VPN config files. Those files may contain connectivity passwords that can be decoded with which of the following?

A) Cupp
B) Nessus
C) Cain and Abel
D) John The Ripper Pro