GAQM CEH-001 Online Practice Questions and Exam Preparation

GAQM CEH-001 Online Questions & Answers

• Question 191:

  One of the better features of NetWare is the use of packet signature that includes cryptographic signatures. The packet signature mechanism has four levels from 0 to 3.

  In the list below which of the choices represent the level that forces NetWare to sign all packets?

  A. 0 (zero)
  B. 1
  C. 2
  D. 3
  D. 3

• Question 192:

  Which of the following is the primary objective of a rootkit?

  A. It opens a port to provide an unauthorized service
  B. It creates a buffer overflow
  C. It replaces legitimate programs
  D. It provides an undocumented opening in a program
  C. It replaces legitimate programs

• Question 193:

  Bob has set up three web servers on Windows Server 2008 IIS 7.0. Bob has followed all the recommendations for securing the operating system and IIS. These servers are going to run numerous e-commerce websites that are projected to bring in thousands of dollars a day. Bob is still concerned about the security of these servers because of the potential for financial loss. Bob has asked his company's firewall administrator to set the firewall to inspect all incoming traffic on ports 80 and 443 to ensure that no malicious data is getting into the network.

  Why will this not be possible?

  A. Firewalls cannot inspect traffic coming through port 443
  B. Firewalls can only inspect outbound traffic
  C. Firewalls cannot inspect traffic at all, they can only block or allow certain ports
  D. Firewalls cannot inspect traffic coming through port 80
  C. Firewalls cannot inspect traffic at all, they can only block or allow certain ports

• Question 194:

  Which of the following Netcat commands would be used to perform a UDP scan of the lower 1024 ports?

  A. Netcat -h -U
  B. Netcat -hU
  C. Netcat -sU -p 1-1024
  D. Netcat -u -v -w2 1-1024
  E. Netcat -sS -O target/1024
  D. Netcat -u -v -w2 1-1024

• Question 195:

  You are the security administrator for a large network. You want to prevent attackers from running any sort of traceroute into your DMZ and discover the internal structure of publicly accessible areas of the network. How can you achieve this?

  A. Block ICMP at the firewall.
  B. Block UDP at the firewall.
  C. Both A and B.
  D. There is no way to completely block doing a trace route into this area.
  D. There is no way to completely block doing a trace route into this area.

• Question 196:

  Which of the following techniques does a vulnerability scanner use in order to detect a vulnerability on a target service?

  A. Port scanning
  B. Banner grabbing
  C. Injecting arbitrary data
  D. Analyzing service response
  D. Analyzing service response

• Question 197:

  If an attacker's computer sends an IPID of 31400 to a zombie (Idle Scanning) computer on an open port, what will be the response?

  A. 31400
  B. 31402
  C. The zombie will not send a response
  D. 31401
  B. 31402

• Question 198:

  William has received a Chess game from someone in his computer programming class through email. William does not really know the person who sent the game very well, but decides to install the game anyway because he really likes Chess.

  

  After William installs the game, he plays it for a couple of hours. The next day, William plays the Chess game again and notices that his machine has begun to slow down. He brings up his Task Manager and sees the following programs running:

  

  What has William just installed?

  A. Zombie Zapper (ZoZ)
  B. Remote Access Trojan (RAT)
  C. Bot IRC Tunnel (BIT)
  D. Root Digger (RD)
  B. Remote Access Trojan (RAT)

• Question 199:

  A program that defends against a port scanner will attempt to:

  A. Sends back bogus data to the port scanner
  B. Log a violation and recommend use of security-auditing tools
  C. Limit access by the scanning system to publicly available ports only
  D. Update a firewall rule in real time to prevent the port scan from being completed
  D. Update a firewall rule in real time to prevent the port scan from being completed

• Question 200:

  What does an ICMP (Code 13) message normally indicates?

  A. It indicates that the destination host is unreachable
  B. It indicates to the host that the datagram which triggered the source quench message will need to be re-sent
  C. It indicates that the packet has been administratively dropped in transit
  D. It is a request to the host to cut back the rate at which it is sending traffic to the Internet destination
  C. It indicates that the packet has been administratively dropped in transit