EC-COUNCIL 312-50v10 real exam prep : Certified Ethical Hacker Exam (CEH v10)

An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk assessments. A friend recently started a company and asks the hacker to perform a penetration test and vulnerability assessment of the new company as a favor. What should the hacker's next step be before starting work on this job?

• A. Begin the reconnaissance phase with passive information gathering and then move into active information gathering.
• B. Ask the employer for authorization to perform the work outside the company.
• C. Use social engineering techniques on the friend's employees to help identify areas that may be susceptible to attack.
• D. Start by foot printing the network and mapping out a plan of attack.

Which access control mechanism allows for multiple systems to use a central authentication server (CAS) that permits users to authenticate once and gain access to multiple systems?

• A. Windows authentication
• B. Role Based Access Control (RBAC)
• C. Discretionary Access Control (DAC)
• D. Single sign-on

You have retrieved the raw hash values from a Windows 2000 Domain Controller. Using social engineering, you come to know that they are enforcing strong passwords. You understand that all users are required to use passwords that are at least 8 characters in length. All passwords must also use 3 of the 4 following categories:
lower case letters, capital letters, numbers and special characters. With your existing knowledge of users, likely user account names and the possibility that they will choose the easiest passwords possible, what would be the fastest type of password cracking attack you can run against these hash values and still get results?

• A. Hybrid Attack
• B. Dictionary Attack
• C. Online Attack
• D. Brute Force Attack

Which of the following is a form of penetration testing that relies heavily on human interaction and often involves tricking people into breaking normal security procedures?

• A. Tailgating
• B. Piggybacking
• C. Eavesdropping
• D. Social Engineering

Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.
What should you do?

• A. Copy the data to removable media and keep it in case you need it.
• B. Immediately stop work and contact the proper legal authorities.
• C. Ignore the data and continue the assessment until completed as agreed.
• D. Confront the client in a respectful manner and ask her about the data.