GAQM CEH-001 Online Practice Questions and Exam Preparation

GAQM CEH-001 Online Questions & Answers

• Question 111:

  What is the main disadvantage of the scripting languages as opposed to compiled programming languages?

  A. Scripting languages are hard to learn.
  B. Scripting languages are not object-oriented.
  C. Scripting languages cannot be used to create graphical user interfaces.
  D. Scripting languages are slower because they require an interpreter to run the code.
  D. Scripting languages are slower because they require an interpreter to run the code.

• Question 112:

  The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company's external webserver, VPN concentrator, and DNS servers. What should the security team do to determine which alerts to check first?

  A. Investigate based on the maintenance schedule of the affected systems.
  B. Investigate based on the service level agreements of the systems.
  C. Investigate based on the potential effect of the incident.
  D. Investigate based on the order that the alerts arrived in.
  C. Investigate based on the potential effect of the incident.

• Question 113:

  Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an appropriate method?

  A. It is impossible to crack hashed user passwords unless the key used to encrypt them is obtained.
  B. If a user forgets the password, it can be easily retrieved using the hash key stored by administrators.
  C. Hashing is faster compared to more traditional encryption algorithms.
  D. Passwords stored using hashes are non-reversible, making finding the password much more difficult.
  D. Passwords stored using hashes are non-reversible, making finding the password much more difficult.

• Question 114:

  RC4 is known to be a good stream generator. RC4 is used within the WEP standard on wireless LAN. WEP is known to be insecure even if we are using a stream cipher that is known to be secured. What is the most likely cause behind this?

  A. There are some flaws in the implementation.
  B. There is no key management.
  C. The IV range is too small.
  D. All of the above.
  E. None of the above.
  D. All of the above.

• Question 115:

  What type of session hijacking attack is shown in the exhibit?

  

  A. Session Sniffing Attack
  B. Cross-site scripting Attack
  C. SQL Injection Attack
  D. Token sniffing Attack
  A. Session Sniffing Attack

• Question 116:

  What did the following commands determine?

  C: user2sid \earth guest

  S-1-5-21-343818398-789336058-1343024091-501 C:sid2user 5 21 343818398 789336058 1343024091 500 Name is Joe Domain is EARTH

  A. That the Joe account has a SID of 500
  B. These commands demonstrate that the guest account has NOT been disabled
  C. These commands demonstrate that the guest account has been disabled
  D. That the true administrator is Joe
  E. Issued alone, these commands prove nothing
  D. That the true administrator is Joe

• Question 117:

  What is the proper response for a NULL scan if the port is open?

  A. SYN
  B. ACK
  C. FIN
  D. PSH
  E. RST
  F. No response
  F. No response

• Question 118:

  While conducting a penetration test, the tester determines that there is a firewall between the tester's machine and the target machine. The firewall is only monitoring TCP handshaking of packets at the session layer of the OSI model. Which type of firewall is the tester trying to traverse?

  A. Packet filtering firewall
  B. Application-level firewall
  C. Circuit-level gateway firewall
  D. Stateful multilayer inspection firewall
  C. Circuit-level gateway firewall

• Question 119:

  A company has five different subnets: 192.168.1.0, 192.168.2.0, 192.168.3.0, 192.168.4.0 and 192.168.5.0. How can NMAP be used to scan these adjacent Class C networks?

  A. NMAP -P 192.168.1-5.
  B. NMAP -P 192.168.0.0/16
  C. NMAP -P 192.168.1.0, 2.0, 3.0, 4.0, 5.0
  D. NMAP -P 192.168.1/17
  A. NMAP -P 192.168.1-5.

• Question 120:

  Exhibit:

  ettercap CLzs --quiet

  What does the command in the exhibit do in "Ettercap"?

  A. This command will provide you the entire list of hosts in the LAN
  B. This command will check if someone is poisoning you and will report its IP.
  C. This command will detach from console and log all the collected passwords from the network to a file.
  D. This command broadcasts ping to scan the LAN instead of ARP request of all the subnet IPs.
  C. This command will detach from console and log all the collected passwords from the network to a file.