PASS4TEST

IT

IT Certification Guaranteed, The Easy Way!

1 / 4



Exam : 312-50v8



Title :




Vendors : ECCouncil


Version : DEMO










Certified Ethical Hacker v8
IT Certification Guaranteed, The Easy Way!
2 / 4
NO.1 A security analyst in an insurance company is assigned to test a new web application that will
be
used by clients to help them choose and apply for an insurance plan. The analyst discovers that
the application is developed in ASP scripting language and it uses MSSQL as a database
backend. The analyst locates the application's search form and introduces the following code in
the search input fielD.
IMG SRC=vbscript:msgbox("Vulnerable");> originalAttribute="SRC"
originalPath="vbscript:msgbox("Vulnerable");>"
When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable".
Which web applications vulnerability did the analyst discover?
A. Cross-site request forgery
B. Command injection
C. Cross-site scripting
D. SQL injection
Answer: C

NO.2 Bart is looking for a Windows NT/2000/XP command-line tool that can be used to assign,
display,
or modify ACLs (access control lists) to files or folders and also one that can be used within batch
files.
Which of the following tools can be used for that purpose? (Choose the best answer)
A. PERM.exe
B. CACLS.exe
C. CLACS.exe
D. NTPERM.exe
Answer: B

NO.3 Which of the following is an automated vulnerability assessment tool?
A. Whack a Mole
B. Nmap
C. Nessus
D. Kismet
E. Jill32
Answer: C

NO.4 Harold is the senior security analyst for a small state agency in New York. He has no other
security professionals that work under him, so he has to do all the security-related tasks for the
agency. Coming from a computer hardware background, Harold does not have a lot of experience
with security methodologies and technologies, but he was the only one who applied for the
position. Harold is currently trying to run a Sniffer on the agency's network to get an idea of what
kind of traffic is being passed around, but the program he is using does not seem to be capturing
anything. He pours through the Sniffer's manual, but cannot find anything that directly relates to
his problem. Harold decides to ask the network administrator if he has any thoughts on the
problem. Harold is told that the Sniffer was not working because the agency's network is a
IT Certification Guaranteed, The Easy Way!
3 / 4
switched network, which cannot be sniffed by some programs without some tweaking. What
technique could Harold use to sniff his agency's switched network?
A. ARP spoof the default gateway
B. Conduct MiTM against the switch
C. Launch smurf attack against the switch
D. Flood the switch with ICMP packets
Answer: A

NO.5 You are the CIO for Avantes Finance International, a global finance company based in Geneva.
You are responsible for network functions and logical security throughout the entire corporation.
Your company has over 250 servers running Windows Server, 5000 workstations running
Windows Vista, and 200 mobile users working from laptops on Windows 7.
Last week, 10 of your company's laptops were stolen from salesmen while at a conference in
Amsterdam. These laptops contained proprietary company information. While doing damage
assessment on the possible public relations nightmare this may become, a news story leaks about
the stolen laptops and also that sensitive information from those computers was posted to a blog
online.
What built-in Windows feature could you have implemented to protect the sensitive information on
these laptops?
A. You should have used 3DES which is built into Windows
B. If you would have implemented Pretty Good Privacy (PGP) which is built into Windows,the
sensitive information on the laptops would not have leaked out
C. You should have utilized the built-in feature of Distributed File System (DFS) to protect the
sensitive information on the laptops
D. You could have implemented Encrypted File System (EFS) to encrypt the sensitive files on the
laptops
Answer: D

NO.6 WEP is used on 802.11 networks, what was it designed for?
A. WEP is designed to provide a wireless local area network (WLAN) with a level of security and
privacy comparable to what it usually expected of a wired LAN.
B. WEP is designed to provide strong encryption to a wireless local area network (WLAN) with a
lever of integrity and privacy adequate for sensible but unclassified information.
C. WEP is designed to provide a wireless local area network (WLAN) with a level of availability
and privacy comparable to what is usually expected of a wired LAN.
D. WEOP is designed to provide a wireless local area network (WLAN) with a level of privacy
comparable to what it usually expected of a wired LAN.
Answer: A

NO.7 You just purchased the latest DELL computer, which comes pre-installed with Windows 7,
McAfee antivirus software and a host of other applications. You want to connect Ethernet wire to
your cable modem and start using the computer immediately. Windows is dangerously insecure
when unpacked from the box, and there are a few things that you must do before you use it.
A. New installation of Windows should be patched by installing the latest service packs and
IT Certification Guaranteed, The Easy Way!
4 / 4
hotfixes
B. Key applications such as Adobe Acrobat,Macromedia Flash,Java,Winzip etc.,must have the
latest security patches installed
C. Install a personal firewall and lock down unused ports from connecting to your computer
D. Install the latest signatures for Antivirus software
E. Configure "Windows Update" to automatic
F. Create a non-admin user with a complex password and logon to this account
G. You can start using your computer as vendors such as DELL,HP and IBM would have already
installed the latest service packs.
Answer: A,C,D,E,F