EC-COUNCIL EC0-350 問題集

質問 1：
How many bits encryption does SHA-1 use?
A. 160 bits
B. 256 bits
C. 64 bits
D. 128 bits
正解：A

質問 2：
What is the name of the software tool used to crack a single account on Netware Servers using a dictionary attack?
A. GetCrack
B. CrackNov
C. NPWCrack
D. NovCrack
E. NWPCrack
正解：E
解説: (Topexam メンバーにのみ表示されます)

質問 3：
The SYN flood attack sends TCP connections requests faster than a machine can process them.
Attacker creates a random source address for each packet
SYN flag set in each packet is a request to open a new connection to the server from the spoofed IP address Victim responds to spoofed IP address, then waits for confirmation that never arrives (timeout wait is about 3 minutes) Victim's connection table fills up waiting for replies and ignores new connections Legitimate users are ignored and will not be able to access the server How do you protect your network against SYN Flood attacks?
A. SYN cookies. Instead of allocating a record, send a SYN-ACK with a carefully constructed sequence number generated as a hash of the clients IP address, port number, and other information. When the client responds with a normal ACK, that special sequence number will be included, which the server then verifies. Thus, the server first allocates memory on the third packet of the handshake, not the first.
B. Micro Blocks. Instead of allocating a complete connection, simply allocate a micro record of 16-bytes for the incoming SYN object
C. Stack Tweaking. TCP stacks can be tweaked in order to reduce the effect of SYN floods. Reduce the timeout before a stack frees up the memory allocated for a connection
D. RST cookies - The server sends a wrong SYN/ACK back to the client. The client should then generate a RST packet telling the server that something is wrong. At this point, the server knows the client is valid and will now accept incoming connections from that client normally
E. Check the incoming packet's IP address with the SPAM database on the Internet and enable the filter using ACLs at the Firewall
正解：A,B,C,D

質問 4：
Which of the following wireless technologies can be detected by NetStumbler? (Select all that apply)
A. 802.11a
B. 802.11e
C. 802.11
D. 802.11b
E. 802.11g
正解：A,D,E
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Symmetric encryption algorithms are known to be fast but present great challenges on the key management side. Asymmetric encryption algorithms are slow but allow communication with a remote host without having to transfer a key out of band or in person. If we combine the strength of both crypto systems where we use the symmetric algorithm to encrypt the bulk of the data and then use the asymmetric encryption system to encrypt the symmetric key, what would this type of usage be known as?
A. Asymmetric system
B. Hybrid system
C. Combined system
D. Symmetric system
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Which of the following type of scanning utilizes automated process of proactively identifying vulnerabilities of the computing systems present on a network?
A. External Scanning
B. Port Scanning
C. Vulnerability Scanning
D. Single Scanning
正解：C

質問 7：
Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?
A. Teardrop
B. Ping of death
C. Smurf attack
D. SYN flood
正解：A

質問 8：
Maintaining a secure Web server requires constant effort, resources, and vigilance from an organization. Securely administering a Web server on a daily basis is an essential aspect of Web server security.
Maintaining the security of a Web server will usually involve the following steps:
1. Configuring, protecting, and analyzing log files
2. Backing up critical information frequently
3. Maintaining a protected authoritative copy of the organization's Web content
4. Establishing and following procedures for recovering from compromise
5. Testing and applying patches in a timely manner
6. Testing security periodically.
In which step would you engage a forensic investigator?
A. 2
B. 3
C. 4
D. 6
E. 1
F. 5
正解：C

質問 9：
BankerFox is a Trojan that is designed to steal users' banking data related to certain banking entities.
When they access any website of the affected banks through the vulnerable Firefox 3.5 browser, the Trojan is activated and logs the information entered by the user. All the information entered in that website will be logged by the Trojan and transmitted to the attacker's machine using covert channel.
BankerFox does not spread automatically using its own means. It needs an attacking user's intervention in order to reach the affected computer.

What is the most efficient way an attacker located in remote location to infect this banking Trojan on a victim's machine?
A. Custom packaging - the attacker can create a custom Trojan horse that mimics the appearance of a program that is unique to that particular computer
B. Physical access - the attacker can simply copy a Trojan horse to a victim's hard disk infecting the machine via Firefox add-on extensions
C. Custom packaging - the attacker can create a custom Trojan horse that mimics the appearance of a program that is unique to that particular computer
D. Downloading software from a website? An attacker can offer free software, such as shareware programs and pirated mp3 files
E. Custom packaging - the attacker can create a custom Trojan horse that mimics the appearance of a program that is unique to that particular computer
正解：D