Question 1

A pentester is using Metasploit to exploit an FTP server and pivot to a LAN. How will the pentester pivot using Metasploit?

Accepted Answer

A)  Issue the pivot exploit and set the meterpreter. 
B)  Reconfigure the network settings in the meterpreter. 
C)  Set the payload to propagate through the meterpreter. 
D)  Create a route statement in the meterpreter.

Question 2

What is the main difference between a "Normal" SQL Injection and a "Blind" SQL Injection vulnerability?

Accepted Answer

A)  The request to the web server is not visible to the administrator of the vulnerable application. 
B)  The attack is called "Blind" because, although the application properly filters user input, it is still vulnerable to code injection. 
C)  The successful attack does not show an error message to the administrator of the affected application. 
D)  The vulnerable application does not display errors with information about the injection results to the attacker.

Question 3

Which of the following defines the role of a root Certificate Authority (CA) in a Public Key Infrastructure (PKI)?

Accepted Answer

A)  The root CA is the recovery agent used to encrypt data when a user's certificate is lost. 
B)  The root CA stores the user's hash value for safekeeping. 
C)  The CA is the trusted root that issues certificates. 
D)  The root CA is used to encrypt email messages to prevent unintended disclosure of data.

Question 4

Identify the attack from the description below:

Accepted Answer

A)  User A sends an ARP request to a switch II. The switch broadcasts the ARP request in the network III. An attacker eavesdrops on the ARP request and responds by spoofing as a legitimate user IV. The attacker sends his MAC address to User A 
B)  MAC spoofing 
C)  ARP injection 
D)  ARP flooding 
E)  ARP poisoning

Question 5

A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP command: NMAP -n -sS -P0 -p 80 ***.***.**.** What type of scan is this?

Accepted Answer

A)  Quick scan 
B)  Intense scan 
C)  Stealth scan 
D)  Comprehensive scan

Question 6

In the OSI model, where does PPTP encryption take place?

Accepted Answer

A)  Transport layer 
B)  Application layer 
C)  Data link layer 
D)  Network layer

Question 7

Which of the following is optimized for confidential communications, such as bidirectional voice and video?

Accepted Answer

A)  RC4 
B)  RC5 
C)  MD4 
D)  MD5

Question 8

A hacker initiates so many invalid requests to a cloud network host that the host uses all its resources responding to invalid requests and ignores the legitimate requests. Identify the type of attack

Accepted Answer

A)  Denial of Service (DoS) attacks 
B)  Side Channel attacks 
C)  Man-in-the-middle cryptographic attacks 
D)  Authentication attacks

Question 9

Which of the following pre-engagement documents identifies the systems to be tested, types of tests, and the depth of the testing?

Accepted Answer

A)  Draft Report 
B)  Letter of Intent 
C)  Rule of Engagement 
D)  Authorization Letter

Question 10

What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?

Accepted Answer

A)  tcp.src == 25 and ip.host == 192.168.0.125 
B)  host 192.168.0.125:25 
C)  port 25 and host 192.168.0.125 
D)  tcp.port == 25 and ip.host == 192.168.0.125

Question 11

David is a penetration tester and he is attempting to extract password hashes from the Oracle database. Which of the following utilities should Dave employ in order to brute-force password hashes from Oracle databases?

Accepted Answer

A)  TNS 
B)  Orabf 
C)  Opwg 
D)  OAT

Question 12

Which of the following items of a computer system will an anti-virus program scan for viruses?

Accepted Answer

A)  Boot Sector 
B)  Deleted Files 
C)  Windows Process List 
D)  Password Protected Files

Question 13

Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?

Accepted Answer

A)  Sarbanes-Oxley Act (SOX) 
B)  Gramm-Leach-Bliley Act (GLB
A)  
C)  Fair and Accurate Credit Transactions Act (FACT
A)  
D)  Federal Information Security Management Act (FISM
A)

Question 14

Which type of penetration testing will require you to send the Internal Control Questionnaires (ICQ) to the client?

Accepted Answer

A)  White-box testing 
B)  Black-box testing 
C)  Blind testing 
D)  Unannounced testing

Question 15

Which of the following SQLMAP commands will allow you to test if a parameter in a target URL is vulnerable to SQL injection (injectable)?

Accepted Answer

A)  sqlmap -g "inurl:\".php?id=1\"" 
B)  sqlmap.py -l burp.log --scope="(www)?\.[target]\.(com | net | org)" 
C)  sqlmap -url [ Target URL ] 
D)  sqlmap -host [ Target URL ]

Question 16

Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?

Accepted Answer

A)  Teardrop 
B)  SYN flood 
C)  Smurf attack 
D)  Ping of death

Question 17

Christen is a renowned SQL penetration testing specialist in the US. A multinational ecommerce company hired him to check for vulnerabilities in the SQL database. Christen wanted to perform SQL penetration testing on the database by entering a massive amount of data to crash the web application of the company and discover coding errors that may lead to a SQL injection attack. Which of the following testing techniques is Christen using?

Accepted Answer

A)  Fuzz Testing 
B)  Stored Procedure Injection 
C)  Union Exploitation 
D)  Automated Exploitation

Exam 5: ECCouncil Computer Hacking Forensic Investigator