312-50 Free Practice Test

- (Topic 3)
You are conducting an idlescan manually using HPING2. During the scanning process, you notice that almost every query increments the IPID- regardless of the port being queried. One or two of the queries cause the IPID to increment by more than one value. Which of he following options would be a possible reason?

1. A. Hping2 can’t be used for idlescanning
2. B. The Zombie you are using is not truly idle
3. C. These ports are actually open on the target system
4. D. A stateful inspection firewall is resetting your queries

Correct Answer: B
If the IPID increments more than one value that means that there has been network traffic between the queries so the zombie is not idle.

- (Topic 20)
In Buffer Overflow exploit, which of the following registers gets overwritten with return address of the exploit code?

1. A. EIP
2. B. ESP
3. C. EAP
4. D. EEP

Correct Answer: A
EIP is the instruction pointer which is a register, it points to your next command.

- (Topic 19)
Which of the following are potential attacks on cryptography? (Select 3)

1. A. One-Time-Pad Attack
2. B. Chosen-Ciphertext Attack
3. C. Man-in-the-Middle Attack
4. D. Known-Ciphertext Attack
5. E. Replay Attack

Correct Answer: BCE
A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst chooses a ciphertext and causes it to be decrypted with an unknown key. Specific forms of this attack are sometimes termed "lunchtime" or "midnight" attacks, referring to a scenario in which an attacker gains access to an unattended decryption machine. In cryptography, a man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised. The attacker must be able to observe and intercept messages going between the two victims. A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack).

- (Topic 11)
Take a look at the following attack on a Web Server using obstructed URL:
http://www.example.com/script.ext?template....././etc/passwd
The request is made up of:
✑ ../.././% = ../../../
✑ etc = etc
✑ / = /
✑ passwd = passwd
How would you protect information systems from these attacks?

1. A. Configure Web Server to deny requests involving Unicode characters.
2. B. Create rules in IDS to alert on strange Unicode requests.
3. C. Use SSL authentication on Web Servers.
4. D. Enable Active Scripts Detection at the firewall and routers.

Correct Answer: B
This is a typical Unicode attack. By configuring your IDS to trigger on strange Unicode requests you can protect your web-server from this type of attacks.

- (Topic 6)
What is a Trojan Horse?

1. A. A malicious program that captures your username and password
2. B. Malicious code masquerading as or replacing legitimate code
3. C. An unauthorized user who gains access to your user database and adds themselves as a user
4. D. A server that is to be sacrificed to all hacking attempts in order to log and monitor the hacking activity

Correct Answer: B
A Trojan Horse is an apparently useful and innocent program containing additional hidden code which allows the unauthorized collection, exploitation, falsification, or destruction of data.