[Free] 2018(Jan) EnsurePass Dumpsleader ECCouncil EC0-350 Dumps with VCE and PDF 631-640

Ensurepass.com : Ensure you pass the IT Exams
2018 Jan ECCouncil Official New Released EC0-350
100% Free Download! 100% Pass Guaranteed!
http://www.EnsurePass.com/EC0-350.html

Ethical Hacking and Countermeasures V8

Question No: 631 – (Topic 7)

What happens when one experiences a ping of death?

  1. This is when an IP datagram is received with the “protocol” field in the IP header set to 1 (ICMP) and the “type” field in the ICMP header is set to 18 (Address Mask Reply).

  2. This is when an IP datagram is received with the “protocol” field in the IP header set to 1 (ICMP), the Last Fragment bit is set, and (IP offset ‘ 8) (IP data length) gt;65535.

    In other words, the IP offset (which represents the starting position of this fragment in the original packet, and which is in 8-byte units) plus the rest of the packet is greater than the maximum size for an IP packet.

  3. This is when an IP datagram is received with the “protocol” field in the IP header set to 1 (ICMP) and the source equal to destination address.

  4. This is when an the IP header is set to 1 (ICMP) and the “type” field in the ICMP header is set to 5 (Redirect).

Answer: B Explanation:

A hacker can send an IP packet to a vulnerable machine such that the lastfragment contains an offest where (IP offset *8) (IP data length)gt;65535.This means that when the packet is reassembled, its total length is largerthan the legal limit, causing buffer overruns in the machine#39;s OS (becousethe buffer sizes are defined only to accomodate the maximum allowed size ofthe packet based on RFC 791)…IDS can generally recongize such attacks bylooking for packet fragments that have the IP header#39;s protocol field set to1 (ICMP), the last bit set, and (IP offset *8) (IP data length)gt;65535quot; CCIE Professional Development Network Security Principles and Practices by Saadat Malik pg 414 quot;Ping of Deathquot; attacks cause systems to react in an unpredictable fashion when receiving oversized IP packets. TCP/IP allows for a maximum packet size of up to 65536 octets (1 octet = 8 bits of data), containing aminimum of 20 octets of IP header information and zero or more octets ofoptional information, with the rest of the packet being data. Ping of Deathattacks can cause crashing, freezing, and rebooting.

Question No: 632 – (Topic 7)

Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

  1. To determine who is the holder of the root account

  2. To perform a DoS

  3. To create needless SPAM

  4. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail

  5. To test for virus protection

Answer: D Explanation:

Sending a bogus email is one way to find out more about internal servers. Also, to gather additional IP addresses and learn how they treat mail.

Question No: 633 – (Topic 7)

You have the SOA presented below in your Zone. Your secondary servers have not been able to contact your primary server to synchronize information. How long will the secondary servers attempt to contact the primary server before it considers that zone is dead and stops responding to queries?

collegae.edu.SOA, cikkye.edu ipad.college.edu. (200302028 3600 3600 604800 3600)

  1. One day

  2. One hour

  3. One week

  4. One month

Answer: C Explanation:

The numbers represents the following values: 200302028; se = serial number

3600; ref = refresh = 1h 3600; ret = update retry = 1h 604800; ex = expiry = 1w

3600; min = minimum TTL = 1h

Question No: 634 – (Topic 7)

Exhibit:

Ensurepass 2018 PDF and VCE

The following is an entry captured by a network IDS.You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor. You figure that the attacker is attempting a buffer overflow attack. You also notice quot;/bin/shquot; in the ASCII part of the output. As an analyst what would you conclude about the attack?

  1. The buffer overflow attack has been neutralized by the IDS

  2. The attacker is creating a directory on the compromised machine

  3. The attacker is attempting a buffer overflow attack and has succeeded

  4. The attacker is attempting an exploit that launches a command-line shell

Answer: D

Explanation: This log entry shows a hacker using a buffer overflow to fill the data buffer and trying to insert the execution of /bin/sh into the executable code part of the thread. It is probably an existing exploit that is used, or a directed attack with a custom built buffer overflow with the “payload” that launches the command shell.

Question No: 635 – (Topic 7)

As a securing consultant, what are some of the things you would recommend to a company

to ensure DNS security? Select the best answers.

  1. Use the same machines for DNS and other applications

  2. Harden DNS servers

  3. Use split-horizon operation for DNS servers

  4. Restrict Zone transfers

  5. Have subnet diversity between DNS servers

Answer: B,C,D,E Explanation: Explanations:

A is not a correct answer as it is never recommended to use a DNS server for any other application. Hardening of the DNS servers makes them less vulnerable to attack. It is recommended to split internal and external DNS servers (called split-horizon operation). Zone transfers should only be accepted from authorized DNS servers.

By having DNS servers on different subnets, you may prevent both from going down, even if one of your networks goes down.

Question No: 636 – (Topic 7)

is a tool that can hide processes from the process list, can hide files, registry entries, and intercept keystrokes.

  1. Trojan

  2. RootKit

  3. DoS tool

  4. Scanner

  5. Backdoor

Answer: B

Explanation: Rootkits are tools that can hide processes from the process list, can hide files, registry entries, and intercept keystrokes.

Question No: 637 – (Topic 7)

Which DNS resource record can indicate how long any quot;DNS poisoningquot; could last?

  1. MX

  2. SOA

  3. NS

  4. TIMEOUT

Answer: B Explanation:

The SOA contains information of secondary servers, update intervals and expiration times.

Question No: 638 – (Topic 7)

Global deployment of RFC 2827 would help mitigate what classification of attack?

  1. Sniffing attack

  2. Denial of service attack

  3. Spoofing attack

  4. Reconnaissance attack

  5. Prot Scan attack

Answer: C Explanation:

RFC 2827 – Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing

Question No: 639 – (Topic 7)

Susan has attached to her company’s network. She has managed to synchronize her boss’s sessions with that of the file server. She then intercepted his traffic destined for the server, changed it the way she wanted to and then placed it on the server in his home directory. What kind of attack is Susan carrying on?

  1. A sniffing attack

  2. A spoofing attack

  3. A man in the middle attack

  4. A denial of service attack

Answer: C

Explanation: A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised.

Question No: 640 – (Topic 7)

Exhibit:

ettercap -NCLzs -quiet

What does the command in the exhibit do in “Ettercap”?

  1. This command will provide you the entire list of hosts in the LAN

  2. This command will check if someone is poisoning you and will report its IP.

  3. This command will detach from console and log all the collected passwords from the network to a file.

  4. This command broadcasts ping to scan the LAN instead of ARP request of all the subnet IPs.

Answer: C Explanation:

-N = NON interactive mode (without ncurses)

-C = collect all users and passwords

-L = if used with -C (collector) it creates a file with all the password sniffed in the session in the form quot;YYYYMMDD-collected-pass.logquot;

-z = start in silent mode (no arp storm on start up)

-s = IP BASED sniffing

-quiet = quot;demonizequot; ettercap. Useful if you want to log all data in background.

100% Ensurepass Free Download!
Download Free Demo:EC0-350 Demo PDF
100% Ensurepass Free Guaranteed!
EC0-350 Dumps

EnsurePass ExamCollection Testking
Lowest Price Guarantee Yes No No
Up-to-Dated Yes No No
Real Questions Yes No No
Explanation Yes No No
PDF VCE Yes No No
Free VCE Simulator Yes No No
Instant Download Yes No No

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.