EC-COUNCIL EC0-350 問題集

質問 1：
One of the effective DoS/DDoS countermeasures is 'Throttling'. Which statement correctly defines this term?
A. Replicating servers that can provide additional failsafe protection
B. Providers can increase the bandwidth on critical connections to prevent them from going down in the event of an attack
C. Load balance each server in a multiple-server architecture
D. Set up routers that access a server with logic to adjust incoming traffic to levels that will be safe for the server to process
正解：D

質問 2：
Most NIDS systems operate in layer 2 of the OSI model. These systems feed raw traffic into a detection engine and rely on the pattern matching and/or statistical analysis to determine what is malicious. Packets are not processed by the host's TCP/IP stack allowing the NIDS to analyze traffic the host would otherwise discard. Which of the following tools allows an attacker to intentionally craft packets to confuse pattern-matching NIDS systems, while still being correctly assembled by the host TCP/IP stack to render the attack payload?
A. Fragroute
B. Tcpdump
C. Defrag
D. Tcpfrag
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Lori was performing an audit of her company's internal Sharepoint pages when she came across the following codE. What is the purpose of this code?

A. This code snippet will send a message to a server at 192.154.124.55 whenever the "escape" key is pressed.
B. This bit of JavaScript code will place a specific image on every page of the RSS feed.
C. This JavaScript code will use a Web Bug to send information back to another server.
D. This code will log all keystrokes.
正解：D

質問 4：
XSS attacks occur on Web pages that do not perform appropriate bounds checking on data entered by users. Characters like < > that mark the beginning/end of a tag should be converted into HTML entities.


What is the correct code when converted to html entities?
A. Option B

B. Option C

C. Option A

D. Option D

正解：D

質問 5：
Which of the following identifies the three modes in which Snort can be configured to run?
A. Sniffer, Host Intrusion Prevention System, and Network Intrusion Prevention System
B. Sniffer, Network Intrusion Detection System, and Host Intrusion Detection System
C. Sniffer, Packet Logger, and Host Intrusion Prevention System
D. Sniffer, Packet Logger, and Network Intrusion Detection System
正解：D

質問 6：
You have just installed a new Linux file server at your office. This server is going to be used by several individuals in the organization, and unauthorized personnel must not be able to modify any data.
What kind of program can you use to track changes to files on the server?
A. Linux IP Chains
B. Network Based IDS (NIDS)
C. System Integrity Verifier (SIV)
D. Personal Firewall
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You are gathering competitive intelligence on an organization. You notice that they have jobs listed on a few Internet job-hunting sites. There are two jobs for network and system administrators. How can this help you in foot printing the organization?
A. To learn about the IP range used by the target network
B. To identify the number of employees working for the company
C. To learn about the operating systems, services and applications used on the network
D. To test the limits of the corporate security policy enforced in the company
正解：C

質問 8：
What is the expected result of the following exploit?

A. Opens up a telnet listener that requires no username or password.
B. Create a FTP server with write permissions enabled.
C. Creates an account with a user name of Anonymous and a password of [email protected].
D. Creates a share called "sasfile" on the target system.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 9：
The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The file Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below:

What can you infer from the exploit given?
A. The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port.
B. There are two attackers on the system - johna2k and haxedj00.
C. It is a local exploit where the attacker logs in using username johna2k.
D. The attack is a remote exploit and the hacker downloads three files.
正解：D