Question 1

Which of the following guidelines or standards is associated with the credit card industry?

Accepted Answer

The Payment Card Industry Data Security Standards (PCI DSS) are specifically designed to protect credit card information and ensure secure transactions in the credit card industry.

Question 2

Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering policy, procedure design, and implementation?

Accepted Answer

Penetration testing provides a thorough and comprehensive assessment by simulating real-world attacks, testing policies, procedures, and implementations, thus offering a better return on IT security investment.

Question 3

An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk assessments. A friend recently started a company and asks the hacker to perform a penetration test and vulnerability assessment of the new company as a favor.  What should the hacker's next step be before starting work on this job?

Accepted Answer

The hacker should obtain authorization from their employer to ensure there is no conflict of interest or breach of contract before performing work outside the company.

Question 4

A common cryptographical tool is the use of XOR. XOR the following binary values: 10110001 00111010

Accepted Answer

XOR operation between two binary values is done bit by bit. If both bits are the same, the result is 0. If both bits are different, the result is 1.1011000100111010--------10001011

Question 5

Which of the following tools would be the best choice for achieving compliance with PCI Requirement 11?

Accepted Answer

Nessus is a widely used vulnerability scanner that can help organizations identify and address security vulnerabilities, which is essential for achieving compliance with PCI Requirement 11.

Question 6

When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?

Accepted Answer

PCI-DSS requires organizations to perform external and internal penetration testing at least once a year and after any significant upgrade or modification to ensure the security of cardholder data.

Question 7

How can a policy help improve an employee's security awareness?

Accepted Answer

Implementing written security procedures, enabling employee security training, and promoting the benefits of security are effective ways to improve an employee's security awareness.

Question 8

An attacker has installed a RAT on a host. The attacker wants to ensure that when a user attempts to go to "www.MyPersonalBank.com", that the user is directed to a phishing site. Which file does the attacker need to modify?

Accepted Answer

The attacker would modify the "Hosts" file to redirect the user from "www.MyPersonalBank.com" to a phishing site by mapping the domain name to a different IP address.

Question 9

Using Windows CMD, how would an attacker list all the shares to which the current user context has access?

Accepted Answer

The answer of Using Windows CMD, how would an attacker...

Question 10

Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?

Accepted Answer

The Sarbanes-Oxley Act (SOX) requires the CEO and CFO to certify the accuracy and completeness of financial reports to enhance corporate responsibility and financial disclosures.

Question 11

After trying multiple exploits, you've gained root access to a Centos 6 server. To ensure you maintain access, what would you do first?

Accepted Answer

Creating a user account with root privileges ensures persistent access to the server even if other security measures are restored or updated.

Question 12

env x=`(){ :;};echo exploit` bash -c 'cat /etc/passwd' What is the Shellshock bash vulnerability attempting to do on an vulnerable Linux host?

Accepted Answer

The Shellshock vulnerability allows an attacker to execute arbitrary commands. In this case, it attempts to display the contents of the /etc/passwd file.

Question 13

Which type of security document is written with specific step-by-step details?

Accepted Answer

A procedure is a document that provides specific step-by-step details on how to perform a task.

Question 14

Which of the following is the successor of SSL?

Accepted Answer

TLS (Transport Layer Security) is the successor to SSL (Secure Sockets Layer) and is used to secure communications over a computer network.

Question 15

You've gained physical access to a Windows 2008 R2 server which has an accessible disc drive. When you attempt to boot the server and log in, you are unable to guess the password. In your tool kit you have an Ubuntu 9.10 Linux LiveCD. Which Linux based tool has the ability to change any user's password or to activate disabled Windows accounts?

Accepted Answer

CHNTPW (Change NT Password) is a Linux-based tool that can be used to reset or change passwords on Windows systems, including activating disabled accounts.

Question 16

Your team has won a contract to infiltrate an organization. The company wants to have the attack be as realistic as possible; therefore, they did not provide any information besides the company name. What should be the first step in security testing the client?

Accepted Answer

Reconnaissance is the first step in security testing, where you gather as much information as possible about the target organization to understand its structure, systems, and potential vulnerabilities.

Question 17

International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining

Accepted Answer

ISO 27002 provides guidelines and practices for implementing security controls within an information security management system (ISMS).

Question 18

You are attempting to man-in-the-middle a session. Which protocol will allow you to guess a sequence number?

Accepted Answer

TCP uses sequence numbers to ensure data is received in order and can be guessed or predicted in certain circumstances, making it susceptible to man-in-the-middle attacks.

Question 19

Which initial procedure should an ethical hacker perform after being brought into an organization?

Accepted Answer

Signing a formal contract with a non-disclosure agreement is crucial to ensure legal protection and clarify the scope of work before any security testing begins.

Question 20

A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying.  What actions should the CEH take?

Accepted Answer

The CEH should follow proper legal procedures to request payment, as this is the ethical and lawful way to handle the situation.

Exam 5: ECCouncil Computer Hacking Forensic Investigator