Free EC0-350 Exam Braindumps
Ethical Hacking and Countermeasures Question 9 (page: 38)

Updated On: 10-Feb-2026

Theresa is an IT security analyst working for the United Kingdom Internet Crimes Bureau in London. Theresa has been assigned to the software piracy division which focuses on taking down individual and organized groups that distribute copyrighted software illegally. Theresa and her division have been responsible for taking down over 2, 000 FTP sites hosting copyrighted software. Theresa's supervisor now wants her to focus on finding and taking down websites that host illegal pirated software. What are these sights called that Theresa has been tasked with taking down?

  1. These sites that host illegal copyrighted software are called Warez sites
  2. These sites that Theresa has been tasked to take down are called uTorrent sites
  3. These websites are referred to as Dark Web sites
  4. Websites that host illegal pirated versions of software are called Back Door sites

Answer(s): A

Explanation:

The Warez scene, often referred to as The Scene (often capitalized) is a term of self-reference used by a community that specializes
in the underground distribution of pirated content, typically software but increasingly including movies and music.



Which of the following wireless technologies can be detected by NetStumbler? (Select all that apply)

  1. 802.11b
  2. 802.11e
  3. 802.11a
  4. 802.11g
  5. 802.11

Answer(s): A,C,D

Explanation:

If you check the website, cards for all three (A, B, G) are supported.
See: http://www.stumbler.net/



Which are true statements concerning the BugBear and Pretty Park worms?
Select the best answers.

  1. Both programs use email to do their work.
  2. Pretty Park propagates via network shares and email
  3. BugBear propagates via network shares and email
  4. Pretty Park tries to connect to an IRC server to send your personal passwords.
  5. Pretty Park can terminate anti-virus applications that might be running to bypass them.

Answer(s): A,C,D

Explanation:

Both Pretty Park and BugBear use email to spread. Pretty Park cannot propagate via network shares, only email. BugBear propagates via network shares and email. It also terminates anti-virus applications and acts as a backdoor server for someone to get into the infected machine. Pretty Park tries to connect to an IRC server to send your personal passwords and all sorts of other information it retrieves from your PC.
Pretty Park cannot terminate anti-virus applications. However, BugBear can terminate AV software so that it can bypass them.



Neil monitors his firewall rules and log files closely on a regular basis. Some of the users have complained to Neil that there are a few employees who are visiting offensive web sites during work hours, without consideration for others. Neil knows that he has an updated content filtering system and that such access should not be authorized.
What type of technique might be used by these offenders to access the Internet without restriction?

  1. They are using UDP which is always authorized at the firewall.
  2. They are using tunneling software which allows them to communicate with protocols in a way it was not intended.
  3. They have been able to compromise the firewall, modify the rules, and give themselves proper access.
  4. They are using an older version of Internet Explorer that allows them to bypass the proxy server.

Answer(s): B

Explanation:

This can be accomplished by, for example, tunneling the http traffic over SSH if you have a SSH server answering to your connection, you enable dynamic forwarding in the ssh client and configure Internet Explorer to use a SOCKS Proxy for network traffic.



John is discussing security with Jane. Jane had mentioned to John earlier that she suspects an LKM has been installed on her server. She believes this is the reason that the server has been acting erratically lately. LKM stands for Loadable Kernel Module.
What does this mean in the context of Linux Security?

  1. Loadable Kernel Modules are a mechanism for adding functionality to a file system without requiring a kernel recompilation.
  2. Loadable Kernel Modules are a mechanism for adding functionality to an operating-system kernel after it has been recompiled and the system rebooted.
  3. Loadable Kernel Modules are a mechanism for adding auditing to an operating-system kernel without requiring a kernel recompilation.
  4. Loadable Kernel Modules are a mechanism for adding functionality to an operating-system kernel without requiring a kernel recompilation.

Answer(s): D

Explanation:

Loadable Kernel Modules, or LKM, are object files that contain code to extend the running kernel, or so-called base kernel, without the need of a kernel recompilation. Operating systems other than Linux, such as BSD systems, also provide support for LKM's. However, the Linux kernel generally makes far greater and more versatile use of LKM's than other systems. LKM's are typically used to add support for new hardware, filesystems or for adding system calls. When the functionality provided by an LKM is no longer required, it can be unloaded, freeing memory.



Viewing page 38 of 153
Viewing questions 186 - 190 out of 878 questions


Post your Comments and Discuss EC-Council EC0-350 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!