312-50v11

312-50v11 practice questions, page 4 of 16, with answer review and explanations.

Question 16

Which of the following tools performs comprehensive tests against web servers, including dangerous files and CGIs?

  1. Nikto
  2. John the Ripper
  3. Dsniff
  4. Snort

Question 17

An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events do not match up. What is the most likely cause?

  1. The network devices are not all synchronized.
  2. Proper chain of custody was not observed while collecting the logs.
  3. The attacker altered or erased events from the logs.
  4. The security breach was a false positive.

Question 18

DNS cache snooping is a process of determining if the specified resource address is present in the DNS cache records. It may be useful during the examination of the network to determine what software update resources are used, thus discovering what software is installed. What command is used to determine if the entry is present in DNS cache?

  1. nslookup -fullrecursive update.antivirus.com
  2. dnsnooping -rt update.antivirus.com
  3. nslookup -norecursive update.antivirus.com
  4. dns --snoop update.antivirus.com

Question 19

Which of the following is an extremely common IDS evasion technique in the web world?

  1. Spyware
  2. Subnetting
  3. Unicode Characters
  4. Port Knocking

Question 20

John the Ripper is a technical assessment tool used to test the weakness of which of the following?

  1. Passwords
  2. File permissions
  3. Firewall rulesets
  4. Usernames