312-50v12 Practice Test

Null sessions are un-authenticated connections (not using a username or password.) to an
NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on
your network?

A.

137 and 139

B.

137 and 443

C.

139 and 443

D.

139 and 445

What is a “Collision attack” in cryptography?

A.

Collision attacks try to get the public key

B.

Collision attacks try to break the hash into three parts to get the plaintext value

C.

Collision attacks try to break the hash into two parts, with the same bytes in each part to
get the private key

D.

Collision attacks try to find two inputs producing the same hash

Which of the following is a low-tech way of gaining unauthorized access to systems?

A.

Social Engineering

B.

Eavesdropping

C.

Scanning

D.

Sniffing

You are a Network Security Officer. You have two machines. The first machine
(192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi
syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is
not receiving the alert message from snort. You decide to run wireshark in the snort
machine to check if the messages are going to the kiwi syslog machine. What Wireshark
filter will show the connections from the snort machine to kiwi syslog machine?

A.

tcp.srcport= = 514 && ip.src= = 192.168.0.99

B.

tcp.srcport= = 514 && ip.src= = 192.168.150

C.

tcp.dstport= = 514 && ip.dst= = 192.168.0.99

D.

tcp.dstport= = 514 && ip.dst= = 192.168.0.150

Which of the following Linux commands will resolve a domain name into IP address?

A.

>host-t a hackeddomain.com

B.

>host-t ns hackeddomain.com

C.

>host -t soa hackeddomain.com

D.

>host -t AXFR hackeddomain.com