Exam 5: ECCouncil Computer Hacking Forensic Investigator

A technician is resolving an issue where a computer is unable to connect to the Internet using a wireless access point. The computer is able to transfer files locally to other machines, but cannot successfully reach the Internet. When the technician examines the IP address and default gateway they are both on the 192.168.1.0/24. Which of the following has occurred?

Linson, an employee in Skitac Ltd., notices a USB flash drive on the pavement of the company. Before he could hand it over to the security guard, he tries to check it out. He connects it with an OTG to his mobile phone and finds some of his favorite music playlists and games. He tries to download them into his mobile, but very lately he came to know that he has been attacked and some of his sensitive financial information was exposed to attackers. What type of attacks did Linson face?

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results?                 TCP port 21 - no response        TCP port 22 - no response        TCP port 23 - Time-to-live exceeded

What is one thing a tester can do to ensure that the software is trusted and is not changing or tampering with critical data on the back end of a system it is loaded on?

You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What wireshark filter will show the connections from the snort machine to kiwi syslog machine?

What is the name of the international standard that establishes a baseline level of confidence in the security functionality of IT products by providing a set of requirements for evaluation?

A company firewall engineer has configured a new DMZ to allow public systems to be located away from the internal network. The engineer has three security zones set: Untrust (Internet) - (Remote network = 217.77.88.0/24) DMZ (DMZ) - (11.12.13.0/24) Trust (Intranet) - (192.168.0.0/24) The engineer wants to configure remote desktop access from a fixed IP on the remote network to a remote desktop server in the DMZ. Which rule would best fit this requirement?

Which of the following settings enables Nessus to detect when it is sending too many packets and the network pipe is approaching capacity?

Dale is a network admin working in Zero Faults Inc. Recently the company's network was compromised and is experiencing very unusual traffic. Dale checks for the problem that compromised the network. He performed a penetration test on the network's IDS and identified that an attacker sent spoofed packets to a broadcast address in the network. Which of the following attacks compromised the network?

Which of the following problems can be solved by using Wireshark?

Smart cards use which protocol to transfer the certificate in a secure manner?

Which of the following is a hashing algorithm?

Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an appropriate method?

A botnet can be managed through which of the following?

Peter is working on a pen testing assignment. During the reconnaissance phase, Peter discovered that the client's SYSLOG systems are taken off for four hours on the second Saturday of every month for maintenance. He wants to analyze the client's web pages for sensitive information without triggering their logging mechanism. There are hundreds of pages on the client's website and it is difficult to analyze all the information in just four hours. What will Peter do to analyze all the web pages in a stealthy manner?

A security administrator notices that the log file of the company`s webserver contains suspicious entries:       Based on source code analysis, the analyst concludes that the login.php script is vulnerable to

Martin works as a professional Ethical Hacker and Penetration Tester. He is an ESCA certified professional and was following the LPT methodology to perform the penetration testing. He is assigned a project for information gathering on a client's network. He started penetration testing and was trying to find out the company's internal URLs, (mostly by trial and error), looking for any information about the different departments and business units. Martin was unable to find any information. What should Martin do to get the information he needs?

Which of the following is a primary service of the U.S. Computer Security Incident Response Team (CSIRT)?

An employee is trying to access the internal website of his company. When he opened a webpage, he received an error message notifying "Proxy Authentication Required." He approached the IT department in the company and reported the issue. The IT staff explained him that this is an HTTP error indicating that the server is unable to process the request due to lack of appropriate client's authentication credentials for a proxy server that is processing the requests between the clients and the server. Identify the HTTP error code corresponding to the above error message received by the employee?

What is a successful method for protecting a router from potential smurf attacks?