Eccouncil 312-50 Exam - Topic 2 Question 12 Discussion

Actual exam question for Eccouncil's 312-50 exam

Question #: 12
Topic #: 2

Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp's lobby. He checks his current SID, which is S-1-5-21-1223352397-1872883824-861252104-501. What needs to happen before Matthew has full administrator access?

AHe must perform privilege escalation.

BHe needs to disable antivirus protection.

CHe needs to gain physical access.

DHe already has admin privileges, as shown by the ''501'' at the end of the SID.

Show Suggested Answer

Suggested Answer: A

by Arlene at May 05, 2022, 09:28 PM

Limited Time Offer

25%

Off

Get Premium 312-50 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Anjelica

4 months ago

Disabling antivirus might help, but not the main step here.

upvoted 0 times

...

Merrilee

4 months ago

I doubt he has full access yet, privilege escalation is key.

upvoted 0 times

...

Krystal

4 months ago

Wait, isn't "501" admin already?

upvoted 0 times

...

Julianna

4 months ago

Totally agree, that's the way to go!

upvoted 0 times

...

Daren

5 months ago

He must perform privilege escalation.

upvoted 0 times

...

Dawne

5 months ago

I thought disabling antivirus was important, but maybe that's not the main step here. It seems like he needs to escalate privileges first.

upvoted 0 times

...

Hyun

5 months ago

I feel like this question is similar to one we practiced where we had to escalate privileges after gaining initial access.

upvoted 0 times

...

Tenesha

5 months ago

I'm not entirely sure, but I remember something about the "501" indicating a user account, not necessarily admin access.

upvoted 0 times

...

Herminia

5 months ago

I think he needs to perform privilege escalation since the SID shows he might not have admin rights yet.

upvoted 0 times

...

Frederic

5 months ago

Hmm, I'm a bit unsure about this one. I know Ansible and Puppet are used for automation, but I'm not sure which specific benefits they provide. I'll have to think this through carefully.

upvoted 0 times

...

Florinda

5 months ago

Avoid A for sure - that's way too accusatory and will make him defensive immediately.

upvoted 0 times

...

Judy

5 months ago

This seems straightforward, but I want to make sure I'm not missing anything.

upvoted 0 times

...

Trinidad

5 months ago

This is a good test of my understanding of routing. I'll carefully review the routing table and the destination IP to determine the appropriate path.

upvoted 0 times

...

Maia

5 months ago

I'm feeling confident about this one. The route command is definitely the way to go for viewing the local routing table. And I think netstat is also a good option, since it can provide some additional routing-related information. I'll mark those two.

upvoted 0 times

...

Adelle

5 months ago

I thought Cisco Firepower handled more of the in-network threats, but I'm second-guessing whether it could help with remote users even when not on VPN.

upvoted 0 times

...