Certified Ethical Hacker – CEH – 312-50 – Question244

You are logged in as a local admin on a Windows 7 system and you need to launch the Computer Management Console from command line.
Which command would you use?


A.
c:compmgmt.msc
B. c:services.msc
C. c:ncpa.cp
D. c:gpedit

Correct Answer: A

Explanation:

To start the Computer Management Console from command line just type compmgmt.msc /computer:computername in your run box or at the command line and it should automatically open the Computer Management console.
References: http://www.waynezim.com/tag/compmgmtmsc/

Certified Ethical Hacker – CEH – 312-50 – Question243

Which of the following statements is TRUE?


A.
Sniffers operate on Layer 2 of the OSI model
B. Sniffers operate on Layer 3 of the OSI model
C. Sniffers operate on both Layer 2 & Layer 3 of the OSI model.
D. Sniffers operate on the Layer 1 of the OSI model.

Correct Answer: A

Explanation:

The OSI layer 2 is where packet sniffers collect their data.
References: https://en.wikipedia.org/wiki/Ethernet_frame

Certified Ethical Hacker – CEH – 312-50 – Question242

You have compromised a server on a network and successfully opened a shell. You aimed to identify all operating systems running on the network. However, as you attempt to fingerprint all machines in the network using the nmap syntax below, it is not going through.

What seems to be wrong?


A.
OS Scan requires root privileges.
B. The nmap syntax is wrong.
C. This is a common behavior for a corrupted nmap application.
D. The outgoing TCP/IP fingerprinting is blocked by the host firewall.

Correct Answer: A

Explanation:

You requested a scan type which requires root privileges.
References: http://askubuntu.com/questions/433062/using-nmap-for-information-regarding-web-host

Certified Ethical Hacker – CEH – 312-50 – Question241

You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly.

What is the best nmap command you will use?


A.
nmap -T4 -F 10.10.0.0/24
B. nmap -T4 -r 10.10.1.0/24
C. nmap -T4 -O 10.10.0.0/24
D. nmap -T4 -q 10.10.0.0/24

Correct Answer: A

Explanation:

command = nmap -T4 -F
description = This scan is faster than a normal scan because it uses the aggressive timing template and scans fewer ports.

References: https://svn.nmap.org/nmap/zenmap/share/zenmap/config/scan_profile.usp

Certified Ethical Hacker – CEH – 312-50 – Question240

It is a kind of malware (malicious software) that criminals install on your computer so they can lock it from a remote location. This malware generates a pop-up window, webpage, or email warning from what looks like an official authority. It explains that your computer has been locked because of possible illegal activities on it and demands payment before you can access your files and programs again.

Which of the following terms best matches the definition?


A.
Ransomware
B. Adware
C. Spyware
D. Riskware

Correct Answer: A

Explanation:

Ransomware is a type of malware that can be covertly installed on a computer without knowledge or intention of the user that restricts access to the infected computer system in some way, and demands that the user pay a ransom to the malware operators to remove the restriction. Some forms of ransomware systematically encrypt files on the system’s hard drive, which become difficult or impossible to decrypt without paying the ransom for the encryption key, while some may simply lock the system and display messages intended to coax the user into paying. Ransomware typically propagates as a Trojan.

References: https://en.wikipedia.org/wiki/Ransomware

Certified Ethical Hacker – CEH – 312-50 – Question239

You have compromised a server and successfully gained a root access. You want to pivot and pass traffic undetected over the network and evade any possible Intrusion Detection System.
What is the best approach?


A.
Install Cryptcat and encrypt outgoing packets from this server.
B. Install and use Telnet to encrypt all outgoing traffic from this server.
C. Use Alternate Data Streams to hide the outgoing packets from this server.
D. Use HTTP so that all traffic can be routed via a browser, thus evading the internal Intrusion Detection Systems.

Correct Answer: A

Explanation:

Cryptcat enables us to communicate between two systems and encrypts the communication between them with twofish.
References: http://null-byte.wonderhowto.com/how-to/hack-like-pro-create-nearly-undetectable-backdoor-with-cryptcat-0149264/

Certified Ethical Hacker – CEH – 312-50 – Question238

A hacker has successfully infected an internet-facing server which he will then use to send junk mail, take part in coordinated attacks, or host junk email content.

Which sort of trojan infects this server?


A.
Botnet Trojan
B. Turtle Trojans
C. Banking Trojans
D. Ransomware Trojans

Correct Answer: A

Explanation:

In computer science, a zombie is a computer connected to the Internet that has been compromised by a hacker, computer virus or trojan horse and can be used to perform malicious tasks of one sort or another under remote direction. Botnets of zombie computers are often used to spread e-mail spam and launch denial-of-service attacks. Most owners of zombie computers are unaware that their system is being used in this way. Because the owner tends to be unaware, these computers are metaphorically compared to zombies. A coordinated DDoS attack by multiple botnet machines also resembles a zombie horde attack.

Incorrect Answers:

B: Turtle Trojans are about getting backdoor access to an intruder.
C: A Banker Trojan-horse (commonly called Banker Trojan) is a malicious program used in an attempt to obtain confidential information about customers and clients using online banking and payment systems.
D: Ransomware is a type of malware that can be covertly installed on a computer without knowledge or intention of the user that restricts access to the infected computer system in some way, and demands that the user pay a ransom to the malware operators to remove the restriction. Some forms of ransomware systematically encrypt files on the system’s hard drive, which become difficult or impossible to decrypt without paying the ransom for the encryption key, while some may simply lock the system and display messages intended to coax the user into paying. Ransomware typically propagates as a Trojan.

References: https://en.wikipedia.org/wiki/Botnet

Certified Ethical Hacker – CEH – 312-50 – Question237

It is a short-range wireless communication technology intended to replace the cables connecting portable of fixed devices while maintaining high levels of security. It allows mobile phones, computers and other devices to connect and communicate using a shortrange
wireless connection.

Which of the following terms best matches the definition?


A.
Bluetooth
B. Radio-Frequency Identification
C. WLAN
D. InfraRed

Correct Answer: A

Explanation:

Bluetooth is a standard for the short-range wireless interconnection of mobile phones, computers, and other electronic devices.

References: http://www.bbc.co.uk/webwise/guides/about-bluetooth

Certified Ethical Hacker – CEH – 312-50 – Question236

You have successfully gained access to your client's internal network and successfully comprised a Linux server which is part of the internal IP network. You want to know which Microsoft Windows workstations have file sharing enabled.

Which port would you see listening on these Windows machines in the network?


A.
445
B. 3389
C. 161
D. 1433

Correct Answer: A

Explanation:

The following ports are associated with file sharing and server message block (SMB) communications:
Microsoft file sharing SMB: User Datagram Protocol (UDP) ports from 135 through 139 and Transmission Control Protocol (TCP) ports from 135 through 139.

Direct-hosted SMB traffic without a network basic input/output system (NetBIOS): port 445 (TCP and UPD).
References: https://support.microsoft.com/en-us/kb/298804

Certified Ethical Hacker – CEH – 312-50 – Question235

Initiating an attack against targeted businesses and organizations, threat actors compromise a carefully selected website by inserting an exploit resulting in malware infection. The attackers run exploits on well-known and trusted sites likely to be visited by their targeted victims. Aside from carefully choosing sites to compromise, these attacks are known to incorporate zero-day exploits that target unpatched vulnerabilities. Thus, the targeted entities are left with little or no defense against these exploits.

What type of attack is outlined in the scenario?


A.
Watering Hole Attack
B. Heartbleed Attack
C. Shellshock Attack
D. Spear Phising Attack

Correct Answer: A

Explanation:

Watering Hole is a computer attack strategy, in which the victim is a particular group (organization, industry, or region). In this attack, the attacker guesses or observes which websites the group often uses and infects one or more of them with malware. Eventually, some member of the targeted group gets infected.

Incorrect Answers:

B: Heartbleed is a security bug disclosed in April 2014 in the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. Heartbleed may be exploited regardless of whether the party using a vulnerable OpenSSL instance for TLS is a server or a client. It results from improper input validation (due to a missing bounds check) in the implementation of the TLS heartbeat extension, thus the bug’s name derives from “heartbeat”.
C: Shellshock, also known as Bashdoor, is a family of security bugs in the widely used Unix Bash shell, the first of which was disclosed on 24 September 2014. Many Internet-facing services, such as some web server deployments, use Bash to process certain requests, allowing an attacker to cause vulnerable versions of Bash to execute arbitrary commands. This can allow an attacker to gain unauthorized access to a computer system.
D: Spear phishing is an email or electronic communications scam targeted towards a specific individual, organization or business.

References: https://en.wikipedia.org/wiki/Watering_Hole