Question 1

Which command line switch would be used in NMAP to perform operating system detection?

Accepted Answer

A)  -OS 
B)  -sO 
C)  -sP 
D)  -O 
A)  -OS 
B)  -sO 
C)  -sP 
D)  -O

Question 2

What is the outcome of the comm"nc -l -p 2222 | nc 10.1.0.43 1234"?

Accepted Answer

A)  Netcat will listen on the 10.1.0.43 interface for 1234 seconds on port 2222. 
B)  Netcat will listen on port 2222 and output anything received to a remote connection on 10.1.0.43 port 1234. 
C)  Netcat will listen for a connection from 10.1.0.43 on port 1234 and output anything received to port 2222. 
D)  Netcat will listen on port 2222 and then output anything received to local interface 10.1.0.43. 
A)  Netcat will listen on the 10.1.0.43 interface for 1234 seconds on port 2222. 
B)  Netcat will listen on port 2222 and output anything received to a remote connection on 10.1.0.43 port 1234. 
C)  Netcat will listen for a connection from 10.1.0.43 on port 1234 and output anything received to port 2222. 
D)  Netcat will listen on port 2222 and then output anything received to local interface 10.1.0.43.

Question 3

While auditing a web application for vulnerabilities, Donald uses Burp proxy and modifies the get requests as below: http://www.example.com/GET/process.php./../../../../../../../../etc/password What is Donald trying to achieve?

Accepted Answer

A)  Donald is modifying process.php file to extract /etc/password file 
B)  Donald is trying directory traversal to extract /etc/password file 
C)  Donald is trying SQL injection to extract the contents of /etc/password file 
D)  Donald is trying to upload /etc/password file to the web server root folder 
A)  Donald is modifying process.php file to extract /etc/password file 
B)  Donald is trying directory traversal to extract /etc/password file 
C)  Donald is trying SQL injection to extract the contents of /etc/password file 
D)  Donald is trying to upload /etc/password file to the web server root folder

Question 4

Nick is a penetration tester in Stanbiz Ltd. As a part of his duty, he was analyzing the network traffic by using various filters in the Wireshark tool. While sniffing the network traffic, he used "tcp.port==1433" Wireshark filter for acquiring a specific database related information since port number 1433 is the default port of that specific target database. Which of the following databases Nick is targeting in his test?

Accepted Answer

A)  PostgreSQL 
B)  Oracle 
C)  MySQL 
D)  Microsoft SQL Server 
A)  PostgreSQL 
B)  Oracle 
C)  MySQL 
D)  Microsoft SQL Server

Question 5

An attacker sniffs encrypted traffic from the network and is subsequently able to decrypt it. The attacker can now use which cryptanalytic technique to attempt to discover the encryption key?

Accepted Answer

A)  Birthday attack 
B)  Plaintext attack 
C)  Meet in the middle attack 
D)  Chosen ciphertext attack 
A)  Birthday attack 
B)  Plaintext attack 
C)  Meet in the middle attack 
D)  Chosen ciphertext attack

Question 6

Which of the following acts provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information?

Accepted Answer

A)  PCI-DSS 
B)  SOX 
C)  HIPAA 
D)  GLBA 
A)  PCI-DSS 
B)  SOX 
C)  HIPAA 
D)  GLBA

Question 7

In delivering penetration testing report, which of the following steps should NOT be followed?

Accepted Answer

A)  Always send the report by email or CD-ROM 
B)  Always deliver the report to approved stakeholders in the company in person 
C)  Always ask for a signed acknowledgment after submitting the report 
D)  Report must be presented in a PDF format, unless requested otherwise 
A)  Always send the report by email or CD-ROM 
B)  Always deliver the report to approved stakeholders in the company in person 
C)  Always ask for a signed acknowledgment after submitting the report 
D)  Report must be presented in a PDF format, unless requested otherwise

Question 8

Russel, a penetration tester after performing the penetration testing, wants to create a report so that he can provide details of the testing process and findings of the vulnerabilities to the management. Russel employs the commonly available vulnerability scoring framework called Common Vulnerability Scoring System (CVSS) v3.0 ratings for grading the severity and risk level of identified vulnerabilities in the report. For a specific SMB-based vulnerability, Russel assigned a score of 8.7. What is the level of risk or level of severity of the SMB vulnerability as per CVSS v3.0 for the assigned score?

Accepted Answer

A)  Critical 
B)  Low 
C)  Medium 
D)  High 
A)  Critical 
B)  Low 
C)  Medium 
D)  High

Question 9

Which of the following techniques does a vulnerability scanner use in order to detect a vulnerability on a target service?

Accepted Answer

A)  Port scanning 
B)  Banner grabbing 
C)  Injecting arbitrary data 
D)  Analyzing service response 
A)  Port scanning 
B)  Banner grabbing 
C)  Injecting arbitrary data 
D)  Analyzing service response

Question 10

Frank is a senior security analyst at Roger Data Systems Inc. The company asked him to perform a database penetration test on its client network to determine whether the database is vulnerable to attacks or not. The client did not reveal any information about the database they are using. As a pen tester Frank knows that each database runs on its own default port. So he started database port scanning using the Nmap tool and tried different commands using default port numbers and succeeded with the following command. nmap -sU -p 1521 <client ip-address> Identify the database used by the company?

Accepted Answer

A)  MySQL 
B)  Microsoft SQL Server 
C)  SQLite 
D)  Oracle 
A)  MySQL 
B)  Microsoft SQL Server 
C)  SQLite 
D)  Oracle

Question 11

Which of the following parameters enables NMAP's operating system detection feature?

Accepted Answer

A)  NMAP -sV 
B)  NMAP -oS 
C)  NMAP -sR 
D)  NMAP -O 
A)  NMAP -sV 
B)  NMAP -oS 
C)  NMAP -sR 
D)  NMAP -O

Question 12

The penetration testers are required to follow predefined standard frameworks in making penetration testing reporting formats. Which of the following standards does NOT follow the commonly used methodologies in penetration testing?

Accepted Answer

A)  National Institute of Standards and Technology (NIST) 
B)  Information Systems Security Assessment Framework (ISSAF) 
C)  Open Web Application Security Project (OWASP) 
D)  American Society for Testing Materials (ASTM) 
A)  National Institute of Standards and Technology (NIST) 
B)  Information Systems Security Assessment Framework (ISSAF) 
C)  Open Web Application Security Project (OWASP) 
D)  American Society for Testing Materials (ASTM)

Question 13

Which of the following is a symmetric cryptographic standard?

Accepted Answer

A)  DSA 
B)  PKI 
C)  RSA 
D)  3DES 
A)  DSA 
B)  PKI 
C)  RSA 
D)  3DES

Question 14

How do employers protect assets with security policies pertaining to employee surveillance activities?

Accepted Answer

A)  Employers promote monitoring activities of employees as long as the employees demonstrate trustworthiness. 
B)  Employers use informal verbal communication channels to explain employee monitoring activities to employees. 
C)  Employers use network surveillance to monitor employee email traffic, network access, and to record employee keystrokes. 
D)  Employers provide employees written statements that clearly discuss the boundaries of monitoring activities and consequences. 
A)  Employers promote monitoring activities of employees as long as the employees demonstrate trustworthiness. 
B)  Employers use informal verbal communication channels to explain employee monitoring activities to employees. 
C)  Employers use network surveillance to monitor employee email traffic, network access, and to record employee keystrokes. 
D)  Employers provide employees written statements that clearly discuss the boundaries of monitoring activities and consequences.

Question 15

Which solution can be used to emulate computer services, such as mail and ftp, and to capture information related to logins or actions?

Accepted Answer

A)  Firewall 
B)  Honeypot 
C)  Core server 
D)  Layer 4 switch 
A)  Firewall 
B)  Honeypot 
C)  Core server 
D)  Layer 4 switch

Question 16

A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters.  What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?

Accepted Answer

A) if (billingAddress = 50) {update field} else exit B) if (billingAddress != 50) {update field} else exit C) if (billingAddress >= 50) {update field} else exit D) if (billingAddress <= 50) {update field} else exit A) if (billingAddress = 50) {update field} else exit B) if (billingAddress != 50) {update field} else exit C) if (billingAddress >= 50) {update field} else exit D) if (billingAddress <= 50) {update field} else exit

Question 17

Which of the following identifies the three modes in which Snort can be configured to run?

Accepted Answer

A)  Sniffer, Packet Logger, and Network Intrusion Detection System 
B)  Sniffer, Network Intrusion Detection System, and Host Intrusion Detection System 
C)  Sniffer, Host Intrusion Prevention System, and Network Intrusion Prevention System 
D)  Sniffer, Packet Logger, and Host Intrusion Prevention System 
A)  Sniffer, Packet Logger, and Network Intrusion Detection System 
B)  Sniffer, Network Intrusion Detection System, and Host Intrusion Detection System 
C)  Sniffer, Host Intrusion Prevention System, and Network Intrusion Prevention System 
D)  Sniffer, Packet Logger, and Host Intrusion Prevention System

Question 18

Jack, a network engineer, is working on an IPv6 implementation for one of his clients. He deployed IPv6 on IPv4 networks using a mechanism where a node can choose from IPv6 or IPv4 based on the DNS value. This makes the network resources work simpler. What kind of technique did Jack use?

Accepted Answer

A)  Dual stacks 
B)  Filtering 
C)  Translation 
D)  Tunneling 
A)  Dual stacks 
B)  Filtering 
C)  Translation 
D)  Tunneling

Question 19

This phase will increase the odds of success in later phases of the penetration test. It is also the very first step in Information Gathering, and it will tell you what the "landscape" looks like. What is the most important phase of ethical hacking in which you need to spend a considerable amount of time?

Accepted Answer

A)  escalating privileges 
B)  network mapping 
C)  gaining access 
D)  footprinting 
A)  escalating privileges 
B)  network mapping 
C)  gaining access 
D)  footprinting

Question 20

Smith, a pen tester, has been hired to analyze the security posture of an organization and is trying to find the operating systems used in the network using Wireshark. What can be inferred about selected packet in the Wireshark screenshot below?

Accepted Answer

A)  The machine with IP 10.0.0.10 is running on Linux 
B)  The machine with IP 10.0.0.12 is running on Linux 
C)  The machine with IP 10.0.0.12 is running on Windows 
D)  The machine with IP10.0.0.10 is running on Windows 
A)  The machine with IP 10.0.0.10 is running on Linux 
B)  The machine with IP 10.0.0.12 is running on Linux 
C)  The machine with IP 10.0.0.12 is running on Windows 
D)  The machine with IP10.0.0.10 is running on Windows

Which command line switch would be used in NMAP to perform operating system detection?

What is the outcome of the comm"nc -l -p 2222 | nc 10.1.0.43 1234"?

While auditing a web application for vulnerabilities, Donald uses Burp proxy and modifies the get requests as below: http://www.example.com/GET/process.php./../../../../../../../../etc/password What is Donald trying to achieve?

An attacker sniffs encrypted traffic from the network and is subsequently able to decrypt it. The attacker can now use which cryptanalytic technique to attempt to discover the encryption key?

Which of the following acts provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information?

In delivering penetration testing report, which of the following steps should NOT be followed?

Which of the following techniques does a vulnerability scanner use in order to detect a vulnerability on a target service?

Which of the following parameters enables NMAP's operating system detection feature?

The penetration testers are required to follow predefined standard frameworks in making penetration testing reporting formats. Which of the following standards does NOT follow the commonly used methodologies in penetration testing?

Which of the following is a symmetric cryptographic standard?

How do employers protect assets with security policies pertaining to employee surveillance activities?

Which solution can be used to emulate computer services, such as mail and ftp, and to capture information related to logins or actions?

A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters. What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?

Which of the following identifies the three modes in which Snort can be configured to run?

Jack, a network engineer, is working on an IPv6 implementation for one of his clients. He deployed IPv6 on IPv4 networks using a mechanism where a node can choose from IPv6 or IPv4 based on the DNS value. This makes the network resources work simpler. What kind of technique did Jack use?

Smith, a pen tester, has been hired to analyze the security posture of an organization and is trying to find the operating systems used in the network using Wireshark. What can be inferred about selected packet in the Wireshark screenshot below?

EC-Council Certified Incident Handler

Certified Network Defender

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

EC-Council Certified Security Analyst

Filters

Exam 5: ECCouncil Computer Hacking Forensic Investigator

Which command line switch would be used in NMAP to perform operating system detection?

What is the outcome of the comm"nc -l -p 2222 | nc 10.1.0.43 1234"?

While auditing a web application for vulnerabilities, Donald uses Burp proxy and modifies the get requests as below: http://www.example.com/GET/process.php./../../../../../../../../etc/password What is Donald trying to achieve?

An attacker sniffs encrypted traffic from the network and is subsequently able to decrypt it. The attacker can now use which cryptanalytic technique to attempt to discover the encryption key?

Which of the following acts provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information?

In delivering penetration testing report, which of the following steps should NOT be followed?

Which of the following techniques does a vulnerability scanner use in order to detect a vulnerability on a target service?

Which of the following parameters enables NMAP's operating system detection feature?

The penetration testers are required to follow predefined standard frameworks in making penetration testing reporting formats. Which of the following standards does NOT follow the commonly used methodologies in penetration testing?

Which of the following is a symmetric cryptographic standard?

How do employers protect assets with security policies pertaining to employee surveillance activities?

Which solution can be used to emulate computer services, such as mail and ftp, and to capture information related to logins or actions?

Which of the following identifies the three modes in which Snort can be configured to run?

Jack, a network engineer, is working on an IPv6 implementation for one of his clients. He deployed IPv6 on IPv4 networks using a mechanism where a node can choose from IPv6 or IPv4 based on the DNS value. This makes the network resources work simpler. What kind of technique did Jack use?

Smith, a pen tester, has been hired to analyze the security posture of an organization and is trying to find the operating systems used in the network using Wireshark. What can be inferred about selected packet in the Wireshark screenshot below?

EC-Council Certified Incident Handler

Certified Network Defender

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

EC-Council Certified Security Analyst

Filters