ECCouncil 312-50 Test Dumps

B.   

 Rebecca should make a recommendation to upgrade the Linux kernel promptly

B.   

 Cygwin is a free Unix subsystem that runs on top of Windows

Explanation: Cygwin is a Linux-like environment for Windows. It consists of two parts:
A DLL (cygwin1.dll) which acts as a Linux API emulation layer providing substantial Linux
API functionality.
A collection of tools which provide Linux look and feel.
The Cygwin DLL works with all non-beta, non "release candidate", ix86 32 bit versions of
Windows since Windows 95, with the exception of Windows CE.

D.   

Loadable Kernel Modules are a mechanism for adding functionality to an operatingsystem
kernel without requiring a kernel recompilation.

Explanation: Loadable Kernel Modules, or LKM, are object files that contain code to
extend the running kernel, or so-called base kernel, without the need of a kernel
recompilation. Operating systems other than Linux, such as BSD systems, also provide
support for LKM's. However, the Linux kernel generally makes far greater and more
versatile use of LKM's than other systems. LKM's are typically used to add support for new
hardware, filesystems or for adding system calls. When the functionality provided by an
LKM is no longer required, it can be unloaded, freeing memory.

C.   

Replace original ifconfig utility with the rootkit version of ifconfig hiding Promiscuous
information being displayed on the console.

Explanation: The normal way to hide these rogue programs running on systems is the use
crafted commands like ifconfig and ls.

B.   

 To deny the Telnet connection

Explanation:

-t, -table
This option specifies the packet matching table which the command should operate on. If
the kernel is configured with automatic module loading, an attempt will be made to load the
appropriate module for that table if it is not already there.
The tables are as follows: filter This is the default table, and contains the built-in chains
INPUT (for packets coming into the box itself), FORWARD (for packets being routed
through the box), and OUTPUT (for locally-generated packets). nat This table is consulted
when a packet which is creates a new connection is encountered. It consists of three builtins:
PREROUTING (for altering packets as soon as they come in), OUTPUT (for altering
locally-generated packets before routing), and POSTROUTING (for altering packets as
they are about to go out). mangle This table is used for specialized packet alteration. It has
two built-in chains: PREROUTING (for altering incoming packets before routing) and
OUTPUT (for altering locally-generated packets before routing).
-A, -append
Append one or more rules to the end of the selected chain. When the source and/or
destination names resolve to more than one address, a rule will be added for each possible
address combination.
-p, -protocol [!] protocol
The protocol of the rule or of the packet to check. The specified protocol can be one of tcp,
udp, icmp, or all, or it can be a numeric value, representing one of these protocols or a
different one. Also a protocol name from /etc/protocols is allowed. A "!" argument before
the protocol inverts the test. The number zero is equivalent to all. Protocol all will match
with all protocols and is taken as default when this option is omitted. All may not be used in combination with the check command.
-destination-port [!] [port[:port]]
Destination port or port range specification. The flag -dport is an alias for this option.
-j, -jump target
This specifies the target of the rule; ie. what to do if the packet matches it. The target can
be a user-defined chain (not the one this rule is in), one of the special builtin targets which
decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If
this option is omitted in a rule, then matching the rule will have no effect on the packet's
fate, but the counters on the rule will be incremented.

A.   

Opens up a telnet listener that requires no username or password.

Explanation:
The script being depicted is in perl (both msadc.pl and the script their using as a wrapper) -
- $port, $your, $user, $pass, $host are variables that hold the port # of a DNS server, an IP,
username, and FTP password. $host is set to argument variable 0 (which means the string
typed directly after the command). Essentially what happens is it connects to an FTP
server and downloads nc.exe (the TCP/IP swiss-army knife - netcat) and uses nc to open
a TCP port spawning cmd.exe (cmd.exe is the Win32 DOS shell on NT/2000/2003/XP),
cmd.exe when spawned requires NO username or password and has the permissions of
the username it is being executed as (probably guest in this instance, although it could be
administrator). The #'s in the script means the text following is a comment, notice the last
line in particular, if the # was removed the script would spawn a connection to itself, the
host system it was running on.

C.   

 System Integrity Verifier (SIV)

Explanation: System Integrity Verifiers like Tripwire aids system administrators and users
in monitoring a designated set of files for any changes. Used with system files on a regular
(e.g., daily) basis, Tripwire can notify system administrators of corrupted or tampered files,
so damage control measures can be taken in a timely manner.

A.   

The services are protected by TCP wrappers

Explanation: Explanation: TCP Wrapper is a host-based network ACL system, used to
filter network access to Internet protocol services run on (Unix-like) operating systems such
as Linux or BSD. It allows host or subnetwork IP addresses, names and/or ident query
replies, to be used as tokens on which to filter for access control purposes.

B.   

Configure rules using ipchains.

Explanation: ipchains is a free software based firewall for Linux. It is a rewrite of Linux's
previous IPv4 firewalling code, ipfwadm. In Linux 2.2, ipchains is required to administer the
IP packet filters. ipchains was written because the older IPv4 firewall code used in Linux 2.0 did not work with IP fragments and didn't allow for specification of protocols other than
TCP, UDP, and ICMP.

B.   

Iptables

Explanation: Explanations:
Ipchains was improved over ipfwadm with its chaining mechanism so that it can have
multiple rulesets. However, it isn't the latest version of a free Linux firewall. Iptables
replaced ipchains and is the latest of the free Linux firewall tools. Any Checkpoint firewall is
not going to meet Jason's desire to have a free firewall. Ipfwadm is used to build Linux
firewall rules prior to 2.2.0. It is a outdated version.