Free Access to EC-COUNCIL.312-38.v2022-07-14.q122 with Valid Practice Test (Page 10)

Question 41

John works as an Ethical Hacker for www.company.com Inc. He wants to find out the ports that are open in www.company.com's server using a port scanner. However, he does not want to establish a full TCP connection. Which of the following scanning techniques will he use to accomplish this task?

A.TCP SYN
B.Xmas tree
C.TCP SYN/ACK
D.TCP FIN

Correct Answer: A

According to the scenario, John does not want to establish a full TCP connection. Therefore, he will use the TCP SYN scanning technique. TCP SYN scanning is also known as half-open scanning because in this type of scanning, a full TCP connection is never opened. The steps of TCP SYN scanning are as follows: 1.The attacker sends a SYN packet to the target port. 2.If the port is open, the attacker receives the SYN/ACK message. 3.Now the attacker breaks the connection by sending an RST packet. 4.If the RST packet is received, it indicates that the port is closed. This type of scanning is hard to trace because the attacker never establishes a full 3-way handshake connection and most sites do not create a log of incomplete TCP connections. Answer option C is incorrect. In TCP SYN/ACK scanning, an attacker sends a SYN/ACK packet to the target port. If the port is closed, the victim assumes that this packet was mistakenly sent by the attacker, and sends the RST packet to the attacker. If the port is open, the SYN/ACK packet will be ignored and the port will drop the packet. TCP SYN/ACK scanning is stealth scanning, but some intrusion detection systems can detect TCP SYN/ACK scanning. Answer option D is incorrect. TCP FIN scanning is a type of stealth scanning through which the attacker sends a FIN packet to the target port. If the port is closed, the victim assumes that this packet was sent mistakenly by the attacker and sends the RST packet to the attacker. If the port is open, the FIN packet will be ignored and the port will drop that packet. TCP FIN scanning is useful only for identifying ports of non-Windows operating systems because Windows operating systems send only RST packets irrespective of whether the port is open or closed. Answer option B is incorrect. Xmas Tree scanning is just the opposite of null scanning. In Xmas Tree scanning, all packets are turned on. If the target port is open, the service running on the target port discards the packets without any reply. According to RFC 793, if the port is closed, the remote system replies with the RST packet. Active monitoring of all incoming packets can help system network administrators detect an Xmas Tree scan.

Question 42

CORRECT TEXT
Fill in the blank with the appropriate term. A _______________device is used for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits.

Question 43

Which of the following tools is a free laptop tracker that helps in tracking a user's laptop in case it gets stolen?

A.SAINT
B.Adeona
C.Snort
D.Nessus

Correct Answer: B

Adeona is a free laptop tracker that helps in tracking a user's laptop in case it gets stolen. All it takes is to
install the Adeona software client on the user's laptop, pick a password, and make it run in the background. If
at one point, the user's laptop gets stolen and is connected to the Internet, the Adeona software sends the
criminal's IP address. Using the Adeona Recovery, the IP address can then be retrieved. Knowing the IP
address helps in tracking the geographical location of the stolen device.
Answer option D is incorrect. Nessus is proprietary comprehensive vulnerability scanning software. It is free of
charge for personal use in a non-enterprise environment. Its goal is to detect potential vulnerabilities on tested
systems. It is capable of checking various types of vulnerabilities, some of which are as follows: Vulnerabilities
that allow a remote cracker to control or access sensitive data on a system Misconfiguration (e.g. open mail
relay, missing patches, etc), Default passwords, a few common passwords, and blank/absent passwords on
some system accounts. Nessus can also call Hydra (an external tool) to launch a dictionary attack. Denials of
service against the TCP/IP stack by using mangled packets
Answer option A is incorrect. SAINT stands for System Administrator's Integrated Network Tool. It is computer
software used for scanning computer networks for security vulnerabilities, and exploiting found vulnerabilities.
The SAINT scanner screens every live system on a network for TCP and UDP services. For each service it
finds running, it launches a set of probes designed to detect anything that could allow an attacker to gain
unauthorized access, create a denial-of-service, or gain sensitive information about the network.
Answer option C is incorrect. Snort is an open source network intrusion detection system. The Snort
application analyzes network traffic in realtime mode. It performs packet sniffing, packet logging, protocol
analysis, and a content search to detect a variety of potential attacks.

Question 44

You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below:

What is the IP address of the sender of this email?

A.209.191.91.180
B.141.1.1.1
C.172.16.10.90
D.216.168.54.25

Question 45

Which of the following layers of the OSI model provides physical addressing?

A.Data link layer
B.Application layer
C.Network layer
D.Physical layer

Question 41

Question 42

Question 43

Question 44

Question 45

Download PDF File