Clive has been hired to perform a Black-Box test by one of his clients.How much information will Clive obtain from the client before commencing his test?
Answer(s): C
Penetration tests can be conducted in one of two ways: black-box (with no prior knowledge the infrastructure to be tested) or white-box (with complete knowledge of the infrastructure to be tested). As you might expect, there are conflicting opinions about this choice and the value that either approach will bring to a project.
Scanning for services is an easy job for Bob as there are so many tools available from the Internet. In order for him to check the vulnerability of company, he went through a few scanners that are currently available. Here are the scanners that he uses:Axent’s NetRecon (http://www.axent.com)SARA, by Advanced Research Organization (http://www-arc.com/sara) VLAD the Scanner, by Razor (http://razor.bindview.com/tools/)However, there are many other alternative ways to make sure that the services that have been scanned will be more accurate and detailed for Bob.What would be the best method to accurately identify the services running on a victim host?
Answer(s): B
By running a telnet connection to the open ports you will receive banners that tells you what service is answering on that specific port.
Jim is having no luck performing a penetration test in company’s network. He is running the tests from home and has downloaded every security scanner that he could lay his hands on. Despite knowing the IP range of all the systems, and the exact network configuration, Jim is unable to get any useful results.Why is Jim having these problems?
Answer(s): D
The Security scanners available online are often to “outdated” to perform a live pentest against a victim.
You have just received an assignment for an assessment at a company site. Company's management is concerned about external threat and wants to take appropriate steps to insure security is in place. Anyway the management is also worried about possible threats coming from inside the site, specifically from employees belonging to different Departments. What kind of assessment will you be performing ?
Internal Testing is also referred to as Gray-box testing.
What does black box testing mean?
Black box testing is conducted when you have no knowledge of the environment. It is more time consuming and expensive.
Post your Comments and Discuss EC-Council 312-50 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50 content, but please register or login to continue.