Free 312-50 Exam Braindumps (page: 44)

Page 43 of 191

A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it?
Select the best answers.

  1. Use port security on his switches.
  2. Use a tool like ARPwatch to monitor for strange ARP activity.
  3. Use a firewall between all LAN segments.
  4. If you have a small network, use static ARP entries.
  5. Use only static IP addresses on all PC's.

Answer(s): A,B,D

Explanation:

By using port security on his switches, the switches will only allow the first MAC address that is connected to the switch to use that port, thus preventing ARP spoofing. ARPWatch is a tool that monitors for strange ARP activity. This may help identify ARP spoofing when it happens. Using firewalls between all LAN segments is possible and may help, but is usually pretty unrealistic. On a very small network, static ARP entries are a possibility. However, on a large network, this is not an realistic option. ARP spoofing doesn't have anything to do with static or dynamic IP addresses. Thus, this option won't help you.



Peter, a Network Administrator, has come to you looking for advice on a tool that would help him perform SNMP enquires over the network. Which of these tools would do the SNMP enumeration he is looking for?
Select the best answers.

  1. SNMPUtil
  2. SNScan
  3. SNMPScan
  4. Solarwinds IP Network Browser
  5. NMap

Answer(s): A,B,D

Explanation:

SNMPUtil is a SNMP enumeration utility that is a part of the Windows 2000 resource kit. With SNMPUtil, you can retrieve all sort of valuable information through SNMP. SNScan is a SNMP network scanner by Foundstone. It does SNMP scanning to find open SNMP ports. Solarwinds IP Network Browser is a SNMP enumeration tool with a graphical tree-view of the remote machine's SNMP data.



SNMP is a protocol used to query hosts, servers and devices about performance or health status datA. Hackers have used this protocol for a long time to gather great amount of information about remote hosts. Which of the following features makes this possible?

  1. It is susceptible to sniffing
  2. It uses TCP as the underlying protocol
  3. It is used by ALL devices on the market
  4. It uses a community string sent as clear text

Answer(s): A,D

Explanation:

SNMP uses UDP, not TCP, and even though many devices uses SNMP not ALL devices use it and it can be disabled on most of the devices that does use it. However SNMP is susceptible to sniffing and the community string (which can be said acts as a password) is sent in clear text.



Jonathan being a keen administrator has followed all of the best practices he could find on securing his Windows Server. He renamed the Administrator account to a new name that can’t be easily guessed but there remain people who attempt to compromise his newly renamed administrator account. How can a remote attacker decipher the name of the administrator account if it has been renamed?

  1. The attacker guessed the new name
  2. The attacker used the user2sid program
  3. The attacker used to sid2user program
  4. The attacker used NMAP with the V option

Answer(s): C

Explanation:

User2sid.exe can retrieve a SID from the SAM (Security Accounts Manager) from the local or a remote machine Sid2user.exe can then be used to retrieve the names of all the user accounts and more. These utilities do not exploit a bug but call the functions LookupAccountName and LookupAccountSid respectively. What is more these can be called against a remote machine without providing logon credentials save those needed for a null session connection.






Post your Comments and Discuss EC-Council 312-50 exam with other Community members:

312-50 Discussions & Posts