GAQM GAQM Certifications CEH-001 Questions & Answers

• Question 231:

  An attacker runs netcat tool to transfer a secret file between two hosts.

  Machine A: netcat -l -p 1234 < secretfile

  Machine B: netcat 192.168.3.4 > 1234

  He is worried about information being sniffed on the network. How would the attacker use netcat to encrypt the information before transmitting onto the wire?

  A. Machine A: netcat -l -p -s password 1234 < testfile Machine B: netcat 1234

  B. Machine A: netcat -l -e magickey -p 1234 < testfile Machine B: netcat 1234

  C. Machine A: netcat -l -p 1234 < testfile -pw password Machine B: netcat 1234 -pw password

  D. Use cryptcat instead of netcat

  Correct Answer: D

• Question 232:

  While examining audit logs, you discover that people are able to telnet into the SMTP server on port 25. You would like to block this, though you do not see any evidence of an attack or other wrong doing. However, you are concerned about affecting the normal functionality of the email server. From the following options choose how best you can achieve this objective?

  A. Block port 25 at the firewall.

  B. Shut off the SMTP service on the server.

  C. Force all connections to use a username and password.

  D. Switch from Windows Exchange to UNIX Sendmail.

  E. None of the above.

  Correct Answer: E

• Question 233:

  Which of the following are well know password-cracking programs?(Choose all that apply.

  A. L0phtcrack

  B. NetCat

  C. Jack the Ripper

  D. Netbus

  E. John the Ripper

  Correct Answer: AE

• Question 234:

  Password cracking programs reverse the hashing process to recover passwords.(True/False.

  A. True

  B. False

  Correct Answer: B

• Question 235:

  When discussing passwords, what is considered a brute force attack?

  A. You attempt every single possibility until you exhaust all possible combinations or discover the password

  B. You threaten to use the rubber hose on someone unless they reveal their password

  C. You load a dictionary of words into your cracking program

  D. You create hashes of a large number of words and compare it with the encrypted passwords

  E. You wait until the password expires

  Correct Answer: A

• Question 236:

  What do Trinoo, TFN2k, WinTrinoo, T-Sight, and Stracheldraht have in common?

  A. All are hacking tools developed by the legion of doom

  B. All are tools that can be used not only by hackers, but also security personnel

  C. All are DDOS tools

  D. All are tools that are only effective against Windows

  E. All are tools that are only effective against Linux

  Correct Answer: C

• Question 237:

  How can you determine if an LM hash you extracted contains a password that is less than 8 characters long?

  A. There is no way to tell because a hash cannot be reversed

  B. The right most portion of the hash is always the same

  C. The hash always starts with AB923D

  D. The left most portion of the hash is always the same

  E. A portion of the hash will be all 0's

  Correct Answer: B

• Question 238:

  What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?

  A. Copy the system files from a known good system

  B. Perform a trap and trace

  C. Delete the files and try to determine the source

  D. Reload from a previous backup

  E. Reload from known good media

  Correct Answer: E

• Question 239:

  This kind of password cracking method uses word lists in combination with numbers and special characters:

  A. Hybrid

  B. Linear

  C. Symmetric

  D. Brute Force

  Correct Answer: A

• Question 240:

  _________ is a tool that can hide processes from the process list, can hide files, registry entries, and intercept keystrokes.

  A. Trojan

  B. RootKit

  C. DoS tool

  D. Scanner

  E. Backdoor

  Correct Answer: B