Free 312-50 Exam Braindumps (page: 53)

Page 52 of 191

What file system vulnerability does the following command take advantage of? type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe

  1. HFS
  2. ADS
  3. NTFS
  4. Backdoor access

Answer(s): B

Explanation:

ADS (or Alternate Data Streams) is a “feature” in the NTFS file system that makes it possible to hide information in alternate data streams in existing files. The file can have multiple data streams and the data streams are accessed by filename:stream.



Attackers can potentially intercept and modify unsigned SMB packets, modify the traffic and forward it so that the server might perform undesirable actions. Alternatively, the attacker could pose as the server or client after a legitimate authentication and gain unauthorized access to datA. Which of the following is NOT a means that can be used to minimize or protect against such an attack?

  1. Timestamps
  2. SMB Signing
  3. File permissions
  4. Sequence numbers monitoring

Answer(s): A,B,D



Which of the following steganography utilities exploits the nature of white space and allows the user to conceal information in these white spaces?

  1. Snow
  2. Gif-It-Up
  3. NiceText
  4. Image Hide

Answer(s): A

Explanation:

The program snow is used to conceal messages in ASCII text by appending whitespace to the end of lines. Because spaces and tabs are generally not visible in text viewers, the message is effectively hidden from casual observers. And if the built-in encryption is used, the message cannot be read even if it is detected.



______is found in all versions of NTFS and is described as the ability to fork file data into existing files without affecting their functionality, size, or display to traditional file browsing utilities like dir or Windows Explorer

  1. Steganography
  2. Merge Streams
  3. NetBIOS vulnerability
  4. Alternate Data Streams

Answer(s): D

Explanation:

ADS (or Alternate Data Streams) is a “feature” in the NTFS file system that makes it possible to hide information in alternate data streams in existing files. The file can have multiple data streams and the data streams are accessed by filename:stream.






Post your Comments and Discuss EC-Council 312-50 exam with other Community members:

312-50 Exam Discussions & Posts