GAQM GAQM Certifications CEH-001 Questions & Answers

• Question 91:

  Joe Hacker is going wardriving. He is going to use PrismStumbler and wants it to go to a GPS mapping software application. What is the recommended and well- known GPS mapping package that would interface with PrismStumbler?

  Select the best answer.

  A. GPSDrive

  B. GPSMap

  C. WinPcap

  D. Microsoft Mappoint

  Correct Answer: A

• Question 92:

  Virus Scrubbers and other malware detection program can only detect items that they are aware of. Which of the following tools would allow you to detect unauthorized changes or modifications of binary files on your system by unknown malware?

  A. System integrity verification tools

  B. Anti-Virus Software

  C. A properly configured gateway

  D. There is no way of finding out until a new updated signature file is released

  Correct Answer: A

• Question 93:

  What are the main drawbacks for anti-virus software?

  A. AV software is difficult to keep up to the current revisions.

  B. AV software can detect viruses but can take no action.

  C. AV software is signature driven so new exploits are not detected.

  D. It's relatively easy for an attacker to change the anatomy of an attack to bypass AV systems

  E. AV software isn't available on all major operating systems platforms.

  F. AV software is very machine (hardware) dependent.

  Correct Answer: C

• Question 94:

  What is the best means of prevention against viruses?

  A. Assign read only permission to all files on your system.

  B. Remove any external devices such as floppy and USB connectors.

  C. Install a rootkit detection tool.

  D. Install and update anti-virus scanner.

  Correct Answer: D

• Question 95:

  Melissa is a virus that attacks Microsoft Windows platforms.

  To which category does this virus belong?

  A. Polymorphic

  B. Boot Sector infector

  C. System

  D. Macro

  Correct Answer: D

• Question 96:

  Why do you need to capture five to ten million packets in order to crack WEP with AirSnort?

  A. All IVs are vulnerable to attack

  B. Air Snort uses a cache of packets

  C. Air Snort implements the FMS attack and only encrypted packets are counted

  D. A majority of weak IVs transmitted by access points and wireless cards are not filtered by contemporary wireless manufacturers

  Correct Answer: C

• Question 97:

  Sally is a network admin for a small company. She was asked to install wireless accesspoints in the building. In looking at the specifications for the access-points, she sees that all of them offer WEP. Which of these are true about WEP?

  Select the best answer.

  A. Stands for Wireless Encryption Protocol

  B. It makes a WLAN as secure as a LAN

  C. Stands for Wired Equivalent Privacy

  D. It offers end to end security

  Correct Answer: C

• Question 98:

  Derek has stumbled upon a wireless network and wants to assess its security. However, he does not find enough traffic for a good capture. He intends to use AirSnort on the captured traffic to crack the WEP key and does not know the IP address range or the AP. How can he generate traffic on the network so that he can capture enough packets to crack the WEP key?

  A. Use any ARP requests found in the capture

  B. Derek can use a session replay on the packets captured

  C. Derek can use KisMAC as it needs two USB devices to generate traffic

  D. Use Ettercap to discover the gateway and ICMP ping flood tool to generate traffic

  Correct Answer: D

• Question 99:

  Matthew re-injects a captured wireless packet back onto the network. He does this hundreds of times within a second. The packet is correctly encrypted and Matthew assumes it is an ARP request packet. The wireless host responds with a stream of responses, all individually encrypted with different IVs. What is this attack most appropriately called?

  A. Spoof attack

  B. Replay attack

  C. Injection attack

  D. Rebound attack

  Correct Answer: B

• Question 100:

  In order to attack a wireless network, you put up an access point and override the signal of the real access point. As users send authentication data, you are able to capture it. What kind of attack is this?

  A. WEP attack

  B. Drive by hacking

  C. Rogue access point attack

  D. Unauthorized access point attack

  Correct Answer: C