GAQM CEH-001 Online Practice Questions and Exam Preparation

GAQM CEH-001 Online Questions & Answers

• Question 21:

  During the intelligence gathering phase of a penetration test, you come across a press release by a security products vendor stating that they have signed a multi- million dollar agreement with the company you are targeting. The contract was for vulnerability assessment tools and network based IDS systems. While researching on that particular brand of IDS you notice that its default installation allows it to perform sniffing and attack analysis on one NIC and caters to its management and reporting on another NIC. The sniffing interface is completely unbound from the TCP/IP stack by default. Assuming the defaults were used, how can you detect these sniffing interfaces?

  A. Use a ping flood against the IP of the sniffing NIC and look for latency in the responses.
  B. Send your attack traffic and look for it to be dropped by the IDS.
  C. Set your IP to that of the IDS and look for it as it attempts to knock your computer off the network.
  D. The sniffing interface cannot be detected.
  D. The sniffing interface cannot be detected.

• Question 22:

  What do you conclude from the nmap results below? Staring nmap V. 3.10ALPHA0 (www.insecure.org/map/) (The 1592 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 25/tcp open smtp 80/tcp open http 443/tcp open https Remote operating system guess: Too many signatures match the reliability guess the OS. Nmap run completed ?1 IP address (1 host up) scanned in 91.66 seconds

  A. The system is a Windows Domain Controller.
  B. The system is not firewalled.
  C. The system is not running Linux or Solaris.
  D. The system is not properly patched.
  B. The system is not firewalled.

• Question 23:

  Bill has successfully executed a buffer overflow against a Windows IIS web server. He has been able to spawn an interactive shell and plans to deface the main web page. He first attempts to use the "Echo" command to simply overwrite index.html and remains unsuccessful. He then attempts to delete the page and achieves no progress. Finally, he tries to overwrite it with another page again in vain.

  What is the probable cause of Bill's problem?

  A. The system is a honeypot.
  B. There is a problem with the shell and he needs to run the attack again.
  C. You cannot use a buffer overflow to deface a web page.
  D. The HTML file has permissions of ready only.
  D. The HTML file has permissions of ready only.

• Question 24:

  _____________ is a type of symmetric-key encryption algorithm that transforms a fixed- length block of plaintext (unencrypted text) data into a block of ciphertext (encrypted text) data of the same length.

  A. Stream Cipher
  B. Block Cipher
  C. Bit Cipher
  D. Hash Cipher
  B. Block Cipher

• Question 25:

  The traditional traceroute sends out ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets take to reach the destination.

  The problem is that with the widespread use of firewalls on the Internet today, many of the packets that traceroute sends out end up being filtered, making it impossible to completely trace the path to the destination.

  

  How would you overcome the Firewall restriction on ICMP ECHO packets?

  A. Firewalls will permit inbound TCP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
  B. Firewalls will permit inbound UDP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
  C. Firewalls will permit inbound UDP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
  D. Do not use traceroute command to determine the path packets take to reach the destination instead use the custom hacking tool JOHNTHETRACER and run with the command
  E. \> JOHNTHETRACER www.eccouncil.org -F -evade
  A. Firewalls will permit inbound TCP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.

• Question 26:

  In order to attack a wireless network, you put up an access point and override the signal of the real access point. As users send authentication data, you are able to capture it. What kind of attack is this?

  A. Rouge access point attack
  B. Unauthorized access point attack
  C. War Chalking
  D. WEP attack
  A. Rouge access point attack

• Question 27:

  When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's computer to update the router configuration. What type of an alert is this?

  A. False positive
  B. False negative
  C. True positve
  D. True negative
  A. False positive

• Question 28:

  Which of the following problems can be solved by using Wireshark?

  A. Tracking version changes of source code
  B. Checking creation dates on all webpages on a server
  C. Resetting the administrator password on multiple systems
  D. Troubleshooting communication resets between two systems
  D. Troubleshooting communication resets between two systems

• Question 29:

  A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying. What actions should the CEH take?

  A. Threaten to publish the penetration test results if not paid.
  B. Follow proper legal procedures against the company to request payment.
  C. Tell other customers of the financial problems with payments from this company.
  D. Exploit some of the vulnerabilities found on the company webserver to deface it.
  B. Follow proper legal procedures against the company to request payment.

• Question 30:

  A zone file consists of which of the following Resource Records (RRs)?

  A. DNS, NS, AXFR, and MX records
  B. DNS, NS, PTR, and MX records
  C. SOA, NS, AXFR, and MX records
  D. SOA, NS, A, and MX records
  D. SOA, NS, A, and MX records