Free EC-Council 312-50v13 Practice Exams - Page 5 of 29

Question #41

How does a denial-of-service attack work?

A . A hacker prevents a legitimate user (or group of users) from accessing a service
B . A hacker uses every character, word, or letter he or she can think of to defeat authentication
C . A hacker tries to decipher a password by using a system, which subsequently crashes the network
D . A hacker attempts to imitate a legitimate user by confusing a computer or even another person

Question #42

A security analyst is preparing to analyze a potentially malicious program believed to have infiltrated an organization’s network. To ensure the safety and integrity of the production environment, the analyst decided to use a sheep dip computer for the analysis.

Before initiating the analysis, what key step should the analyst take?

A . Run the potentially malicious program on the sheep dip computer to determine its behavior
B . Store the potentially malicious program on an external medium, such as a CD-ROM
C . Connect the sheep dip computer to the organization’s internal network
D . install the potentially malicious program on the sheep dip computer

Reveal Solution Hide Solution

Question #43

Bill is a network administrator. He wants to eliminate unencrypted traffic inside his company’s network. He decides to setup a SPAN port and capture all traffic to the datacenter. He immediately discovers unencrypted traffic in port UDP 161.

What protocol is this port using and how can he secure that traffic?

A . it is not necessary to perform any actions, as SNMP is not carrying important information.
B . SNMP and he should change it to SNMP V3
C . RPC and the best practice is to disable RPC completely
D . SNMP and he should change it to SNMP v2, which is encrypted

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

We have various articles already in our documentation for setting up SNMPv2 trap handling in Opsview, but SNMPv3 traps are a whole new ballgame. They can be quite confusing and complicated to set up the first time you go through the process, but when you understand what is going on, everything should make more sense.

SNMP has gone through several revisions to improve performance and security (version 1, 2c and 3). By default, it is a UDP port based protocol where communication is based on a ‘fire and forget’ methodology in which network packets are sent to another device, but there is no check for receipt of that packet (versus TCP port when a network packet must be acknowledged by the other end of the communication link).

There are two modes of operation with SNMP C get requests (or polling) where one device requests information from an SNMP enabled device on a regular basis (normally using UDP port 161), and traps where the SNMP enabled device sends a message to another device when an event occurs (normally using UDP port 162). The latter includes instances such as someone logging on, the device powering up or down, or a wide variety of other problems that would need this type of investigation.

This blog covers SNMPv3 traps, as polling and version 2c traps are covered elsewhere in our documentation.

SNMP traps

Since SNMP is primarily a UDP port based system, traps may be ‘lost’ when sending between devices; the sending device does not wait to see if the receiver got the trap. This means if the configuration on the sending device is wrong (using the wrong receiver IP address or port) or the receiver isn’t listening for traps or rejecting them out of hand due to misconfiguration, the sender will never know.

The SNMP v2c specification introduced the idea of splitting traps into two types; the original ‘hope it gets there’ trap and the newer ‘INFORM’ traps. Upon receipt of an INFORM, the receiver must send an acknowledgement back. If the sender doesn’t get the acknowledgement back, then it knows there is an existing problem and can log it for sysadmins to find when they interrogate the device.

Question #44

Tess King is using the nslookup command to craft queries to list all DNS information (such as Name Servers, host names, MX records, CNAME records, glue records (delegation for child Domains), zone serial number, TimeToLive (TTL) records, etc) for a Domain.

What do you think Tess King is trying to accomplish? Select the best answer.

A . A zone harvesting
B . A zone transfer
C . A zone update
D . A zone estimate

Reveal Solution Hide Solution

Question #45

A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack.

In the scenario described, which of the following steps should the analyst take next?

A . Carry out a passive wire sniffing operation using Internet packet sniffers
B . Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz
C . Perform a PRobability INfinite Chained Elements (PRINCE) attack
D . Request a service ticket for the service principal name of the target service account

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

A Kerberoasting attack is a technique that exploits the weak encryption of Kerberos service tickets to obtain the password hashes of service accounts that have a Service Principal Name (SPN) associated

with them. The attacker can then crack the hashes offline and use the plaintext passwords to impersonate the service accounts and access network resources.

A Kerberoasting attack follows these steps1:

The attacker impersonates a legitimate Active Directory user and authenticates to the Key Distribution Center (KDC) in the Active Directory environment. They then request a Ticket Granting Ticket (TGT) from the KDC to access network resources. The KDC complies because the attacker is impersonating a legitimate user.

The attacker enumerates the service accounts that have an SPN using tools like GetUserSPNs.py or PowerView. They then request a service ticket for each SPN from the KDC using their TGT. The KDC grants the service tickets, which are encrypted with the password hashes of the service accounts.

The attacker captures the service tickets and takes them offline. They then attempt to crack the password hashes using tools like Hashcat or John the Ripper. They can use various methods, such as brute force, dictionary, or hybrid attacks, to guess the passwords. Alternatively, they can use a PRINCE attack, which is a probabilistic password generation technique that combines common words, patterns, and transformations to generate likely passwords2.

Once the attacker obtains the plaintext passwords of the service accounts, they can use them to authenticate as the service accounts and access the network resources that they are authorized to.

Therefore, the next step that the analyst should take after obtaining a valid TGT is to request a service ticket for the SPN of the target service account. This will allow them to capture the service ticket and extract the password hash of the service account.

Reference: How to Perform Kerberoasting Attacks: The Ultimate Guide – StationX

PRINCE: PRobability INfinite Chained Elements

Question #45

A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack.

In the scenario described, which of the following steps should the analyst take next?

A . Carry out a passive wire sniffing operation using Internet packet sniffers
B . Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz
C . Perform a PRobability INfinite Chained Elements (PRINCE) attack
D . Request a service ticket for the service principal name of the target service account

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

A Kerberoasting attack is a technique that exploits the weak encryption of Kerberos service tickets to obtain the password hashes of service accounts that have a Service Principal Name (SPN) associated

with them. The attacker can then crack the hashes offline and use the plaintext passwords to impersonate the service accounts and access network resources.

A Kerberoasting attack follows these steps1:

The attacker impersonates a legitimate Active Directory user and authenticates to the Key Distribution Center (KDC) in the Active Directory environment. They then request a Ticket Granting Ticket (TGT) from the KDC to access network resources. The KDC complies because the attacker is impersonating a legitimate user.

The attacker enumerates the service accounts that have an SPN using tools like GetUserSPNs.py or PowerView. They then request a service ticket for each SPN from the KDC using their TGT. The KDC grants the service tickets, which are encrypted with the password hashes of the service accounts.

The attacker captures the service tickets and takes them offline. They then attempt to crack the password hashes using tools like Hashcat or John the Ripper. They can use various methods, such as brute force, dictionary, or hybrid attacks, to guess the passwords. Alternatively, they can use a PRINCE attack, which is a probabilistic password generation technique that combines common words, patterns, and transformations to generate likely passwords2.

Once the attacker obtains the plaintext passwords of the service accounts, they can use them to authenticate as the service accounts and access the network resources that they are authorized to.

Therefore, the next step that the analyst should take after obtaining a valid TGT is to request a service ticket for the SPN of the target service account. This will allow them to capture the service ticket and extract the password hash of the service account.

Reference: How to Perform Kerberoasting Attacks: The Ultimate Guide – StationX

PRINCE: PRobability INfinite Chained Elements

Question #47

Within the context of Computer Security, which of the following statements describes Social Engineering best?

A . Social Engineering is the act of publicly disclosing information
B . Social Engineering is the means put in place by human resource to perform time accounting
C . Social Engineering is the act of getting needed information from a person rather than breaking into a system
D . Social Engineering is a training program within sociology studies

Reveal Solution Hide Solution

Question #48

Which of the following is a command line packet analyzer similar to GUI-based Wireshark?

A . nessus
B . tcpdump
C . ethereal
D . jack the ripper

Reveal Solution Hide Solution

Question #49

Attacker Lauren has gained the credentials of an organization’s internal server system, and she was often logging in during irregular times to monitor the network activities. The organization was skeptical about the login times and appointed security professional Robert to determine the issue. Robert analyzed the compromised device to find incident details such as the type of attack, its severity, target, impact, method of propagation, and vulnerabilities exploited.

What is the incident handling and response (IH&R) phase, in which Robert has determined these issues?

A . Preparation
B . Eradication
C . Incident recording and assignment
D . Incident triage

Reveal Solution Hide Solution

Question #50

Joel, a professional hacker, targeted a company and identified the types of websites frequently visited by its employees. Using this information, he searched for possible loopholes in these websites and injected a malicious script that can redirect users from the web page and download malware onto a victim’s machine. Joel waits for the victim to access the infected web application so as to compromise the victim’s machine.

Which of the following techniques is used by Joel in the above scenario?

A . DNS rebinding attack
B . Clickjacking attack
C . MarioNet attack
D . Watering hole attack

Reveal Solution Hide Solution