Discuss EC-Council 312-50 Exam Topic 2 Question 12

Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp's lobby. He checks his current SID, which is S-1-5-21-1223352397-1872883824-861252104-501. What needs to happen before Matthew has full administrator access?

AHe must perform privilege escalation.

BHe needs to disable antivirus protection.

CHe needs to gain physical access.

DHe already has admin privileges, as shown by the ''501'' at the end of the SID.

Suggested Answer: A

Get Premium 312-50 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

15 comments · newest first

Anjelica 12 months ago

Disabling antivirus might help, but not the main step here.

Merrilee 12 months ago

I doubt he has full access yet, privilege escalation is key.

Krystal 12 months ago

Wait, isn't "501" admin already?

Julianna 1 year ago

Totally agree, that's the way to go!

Daren 1 year ago

He must perform privilege escalation.

Dawne 1 year ago

I thought disabling antivirus was important, but maybe that's not the main step here. It seems like he needs to escalate privileges first.

Hyun 1 year ago

I feel like this question is similar to one we practiced where we had to escalate privileges after gaining initial access.

Tenesha 1 year ago

I'm not entirely sure, but I remember something about the "501" indicating a user account, not necessarily admin access.

Herminia 1 year ago

I think he needs to perform privilege escalation since the SID shows he might not have admin rights yet.

Frederic 1 year ago

Hmm, I'm a bit unsure about this one. I know Ansible and Puppet are used for automation, but I'm not sure which specific benefits they provide. I'll have to think this through carefully.

Florinda 1 year ago

Avoid A for sure - that's way too accusatory and will make him defensive immediately.

Judy 1 year ago

This seems straightforward, but I want to make sure I'm not missing anything.

Trinidad 1 year ago

This is a good test of my understanding of routing. I'll carefully review the routing table and the destination IP to determine the appropriate path.

Maia 1 year ago

I'm feeling confident about this one. The route command is definitely the way to go for viewing the local routing table. And I think netstat is also a good option, since it can provide some additional routing-related information. I'll mark those two.

Adelle 1 year ago

I thought Cisco Firepower handled more of the in-network threats, but I'm second-guessing whether it could help with remote users even when not on VPN.

EC-Council 312-50 Exam - Topic 2 Question 12 Discussion