After studying the following log entries, how many user IDs can you identify that the attacker has tampered with? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd 3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd 4. touch -acmr /etc /etc/X11/applnk/Internet/.etc 5. passwd nobody -d 6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash 7. passwd dns -d 8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd 9. touch -acmr /etc/X11/applnk/Internet/.etc /etc
Answer(s): C
Passwd is the command used to modify a user password and it has been used together with the usernames nobody and dns.
Theresa is the chief information security officer for her company, a large shipping company based out of New York City. In the past, Theresa and her IT employees manually checked the status of client computers on the network to see if they had the most recent Microsoft updates. Now that the company has added over 100 more clients to accommodate new departments, Theresa must find some kind of tool to see whether the clients are up-to-date or not. Theresa decides to use Qfecheck to monitor all client computers. When Theresa runs the tool, she is repeatedly told that the software does not have the proper permissions to scan. Theresa is worried that the operating system hardening that she performs on all clients is keeping the software from scanning the necessary registry keys on the client computers.What registry key permission should Theresa check to ensure that Qfecheck runs properly?
Answer(s): B
Qfecheck check the registry HKLM\Software\Microsoft\Updates
MX record priority increases as the number increases.(True/False.
The highest priority MX record has the lowest number.
This kind of password cracking method uses word lists in combination with numbers and special characters:
Answer(s): A
A Hybrid (or Hybrid Dictionary) Attack uses a word list that it modifies slightly to find passwords that are almost from a dictionary (like St0pid)
You receive an email with the following message:Hello Steve, We are having technical difficulty in restoring user database record after the recent blackout. Your account data is corrupted. Please logon to the SuperEmailServices.com and change your password.http://www.supermailservices.com@0xde.0xad.0xbe.0xef/support/logon.htmIf you do not reset your password within 7 days, your account will be permanently disabled locking you out from our e-mail services.Sincerely, Technical SupportSuperEmailServicesFrom this e-mail you suspect that this message was sent by some hacker since you have been using their e-mail services for the last 2 years and they have never sent out an e-mail such as this. You also observe the URL in the message and confirm your suspicion about 0xde.0xad.0xbde.0xef which looks like hexadecimal numbers. You immediately enter the following at Windows 2000 command prompt:Ping 0xde.0xad.0xbe.0xefYou get a response with a valid IP address.What is the obstructed IP address in the e-mail URL?
0x stands for hexadecimal and DE=222, AD=173, BE=190 and EF=239
Post your Comments and Discuss EC-Council EC0-350 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the EC0-350 content, but please register or login to continue.