QUESTION: 45

An attacker is attempting to telnet into a corporation’s system in the DMZ. The attacker doesn’t want to get caught and is spoofing his IP address. After numerous tries he remains unsuccessful in connecting to the system. The attacker rechecks that the target system is actually listening on Port 23 and he verifies it with both nmap and hping2. He is still unable to connect to the target system.
What is the most probable reason?

The firewall is blocking port 23 to that system.
He cannot spoof his IP and successfully use TCP.
He needs to use an automated tool to telnet in.
He is attacking an operating system that does not reply to telnet even when open.

Answer(s): B

Explanation:

Spoofing your IP will only work if you don’t need to get an answer from the target system. In this case the answer (login prompt) from the telnet session will be sent to the “real” location of the IP address that you are showing as the connection initiator.

Reveal Solution Next Question

QUESTION: 46

You are scanning into the target network for the first time. You find very few conventional ports open. When you attempt to perform traditional service identification by connecting to the open ports, it yields either unreliable or no results. You are unsure of which protocols are being used. You need to discover as many different protocols as possible.
Which kind of scan would you use to achieve this? (Choose the best answer)

Nessus scan with TCP based pings.
Nmap scan with the –sP (Ping scan) switch.
Netcat scan with the –u –e switches.
Nmap with the –sO (Raw IP packets) switch.

Answer(s): D

Explanation:

Running Nmap with the –sO switch will do a IP Protocol Scan. The IP protocol scan is a bit different than the other nmap scans. The IP protocol scan is searching for additional IP protocols in use by the remote station, such as ICMP, TCP, and UDP. If a router is scanned, additional IP protocols such as EGP or IGP may be identified.

Reveal Solution Next Question

QUESTION: 47

What are twp types of ICMP code used when using the ping command?

It uses types 0 and 8.
It uses types 13 and 14.
It uses types 15 and 17.
The ping command does not use ICMP but uses UDP.

Answer(s): A

Explanation:

ICMP Type 0 = Echo Reply, ICMP Type 8 = Echo

Reveal Solution Next Question

QUESTION: 48

You are having problems while retrieving results after performing port scanning during internal testing. You verify that there are no security devices between you and the target system. When both stealth and connect scanning do not work, you decide to perform a NULL scan with NMAP. The first few systems scanned shows all ports open.
Which one of the following statements is probably true?

The systems have all ports open.
The systems are running a host based IDS.
The systems are web servers.
The systems are running Windows.

Answer(s): D

Explanation:

The null scan turns off all flags, creating a lack of TCP flags that should never occur in the real world. If the port is closed, a RST frame should be returned and a null scan to an open port results in no response. Unfortunately, Microsoft (like usual) decided to completely ignore the standard and do things their own way. Thus, this scan type will not work against systems running Windows as they choose not to response at all. This is a good way to distinguish that the system being scanned is running Microsoft Windows.

Reveal Solution Next Question

Free 312-50 Exam Braindumps (page: 12)

QUESTION: 45

Explanation:

QUESTION: 46

Explanation:

QUESTION: 47

Explanation:

QUESTION: 48

Explanation: