最新のEC0-350問題集で試験を準備する

EC-COUNCIL EC0-350 試験概要:

EC-COUNCIL EC0-350 試験シラバストピック:

EC-COUNCIL Ethical hacking and countermeasures 認定 EC0-350 試験問題：

1. What are two types of ICMP code used when using the ping command?

A) It uses types 13 and 14.
B) It uses types 0 and 8.
C) The ping command does not use ICMP but uses UDP.
D) It uses types 15 and 17.

2. Global deployment of RFC 2827 would help mitigate what classification of attack?

A) Prot Scan attack
B) Reconnaissance attack
C) Sniffing attack
D) Spoofing attack
E) Denial of service attack

3. John is the network administrator of XSECURITY systems. His network was recently compromised. He analyzes the log files to investigate the attack. Take a look at the following Linux log file snippet. The hacker compromised and "owned" a Linux machine. What is the hacker trying to accomplish here?

A) The hacker is planting a rootkit
B) The hacker is running a buffer overflow exploit to lock down the system
C) The hacker is attempting to compromise more machines on the network
D) The hacker is trying to cover his tracks

4. How do you defend against Privilege Escalation?

A) Restrict the interactive logon privileges
B) Use encryption to protect sensitive data
C) Allow security settings of IE to zero or Low
D) Run users and applications on the least privileges
E) Run services as unprivileged accounts

5. Basically, there are two approaches to network intrusion detection: signature detection, and anomaly detection. The signature detection approach utilizes well-known signatures for network traffic to identify potentially malicious traffic. The anomaly detection approach utilizes a previous history of network traffic to search for patterns that are abnormal, which would indicate an intrusion. How can an attacker disguise his buffer overflow attack signature such that there is a greater probability of his attack going undetected by the IDS?

A) He can use a dynamic return address to overwrite the correct value in the target machine computer memory
B) He can use polymorphic shell code-with a tool such as ADMmutate - to change the signature of his exploit as seen by a network IDS
C) He can use a shellcode that will perform a reverse telnet back to his machine
D) He can chain NOOP instructions into a NOOP "sled" that advances the processor's instruction pointer to a random place of choice

質問と回答：