GAQM GAQM Certifications CEH-001 Questions & Answers

• Question 191:

  Which of the following display filters will you enable in Ethereal to view the three-way handshake for a connection from host 192.168.0.1?

  A. ip == 192.168.0.1 and tcp.syn

  B. ip.addr = 192.168.0.1 and syn = 1

  C. ip.addr==192.168.0.1 and tcp.flags.syn

  D. ip.equals 192.168.0.1 and syn.equals on

  Correct Answer: C

• Question 192:

  When Jason moves a file via NFS over the company's network, you want to grab a copy of it by sniffing. Which of the following tool accomplishes this?

  A. macof

  B. webspy

  C. filesnarf

  D. nfscopy

  Correct Answer: C

• Question 193:

  Which of the following is not considered to be a part of active sniffing?

  A. MAC Flooding

  B. ARP Spoofing

  C. SMAC Fueling

  D. MAC Duplicating

  Correct Answer: C

• Question 194:

  ARP poisoning is achieved in _____ steps

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: B

• Question 195:

  How would you describe a simple yet very effective mechanism for sending and receiving unauthorized information or data between machines without alerting any firewalls and IDS's on a network?

  A. Covert Channel

  B. Crafted Channel

  C. Bounce Channel

  D. Deceptive Channel

  Correct Answer: A

• Question 196:

  Ethereal works best on ____________.

  A. Switched networks

  B. Linux platforms

  C. Networks using hubs

  D. Windows platforms

  E. LAN's

  Correct Answer: C

• Question 197:

  The follows is an email header. What address is that of the true originator of the message?

  

  A. 19.25.19.10

  B. 51.32.123.21

  C. 168.150.84.123

  D. 215.52.220.122

  E. 8.10.2/8.10.2

  Correct Answer: C

• Question 198:

  A remote user tries to login to a secure network using Telnet, but accidently types in an invalid user name or password. Which responses would NOT be preferred by an experienced Security Manager? (multiple answer)

  A. Invalid Username

  B. Invalid Password

  C. Authentication Failure

  D. Login Attempt Failed

  E. Access Denied

  Correct Answer: AB

• Question 199:

  A POP3 client contacts the POP3 server:

  A. To send mail

  B. To receive mail

  C. to send and receive mail

  D. to get the address to send mail to

  E. initiate a UDP SMTP connection to read mail

  Correct Answer: B

• Question 200:

  Samantha was hired to perform an internal security test of XYZ. She quickly realized that all networks are making use of switches instead of traditional hubs. This greatly limits her ability to gather information through network sniffing. Which of the following techniques can she use to gather information from the switched network or to disable some of the traffic isolation features of the switch? (Choose two)

  A. Ethernet Zapping

  B. MAC Flooding

  C. Sniffing in promiscuous mode

  D. ARP Spoofing

  Correct Answer: BD