GAQM GAQM Certifications CEH-001 Questions & Answers

• Question 371:

  Paul has just finished setting up his wireless network. He has enabled numerous security features such as changing the default SSID, enabling WPA encryption, and enabling MAC filtering on his wireless router. Paul notices that when he uses his wireless connection, the speed is sometimes 54 Mbps and sometimes it is only 24Mbps or less. Paul connects to his wireless router's management utility and notices that a machine with an unfamiliar name is connected through his wireless connection. Paul checks the router's logs and notices that the unfamiliar machine has the same MAC address as his laptop. What is Paul seeing here?

  A. MAC spoofing

  B. Macof

  C. ARP spoofing

  D. DNS spoofing

  Correct Answer: A

• Question 372:

  __________ is found in all versions of NTFS and is described as the ability to fork file data into existing files without affecting their functionality, size, or display to traditional file browsing utilities like dir or Windows Explorer

  A. Alternate Data Streams

  B. Merge Streams

  C. Steganography

  D. NetBIOS vulnerability

  Correct Answer: A

• Question 373:

  A company is legally liable for the content of email that is sent from its systems, regardless of whether the message was sent for private or business-related purposes. This could lead to prosecution for the sender and for the company's directors if, for example, outgoing email was found to contain material that was pornographic, racist, or likely to incite someone to commit an act of terrorism. You can always defend yourself by "ignorance of the law" clause.

  A. true

  B. false

  Correct Answer: B

• Question 374:

  Which of the following is considered an acceptable option when managing a risk?

  A. Reject the risk.

  B. Deny the risk.

  C. Mitigate the risk.

  D. Initiate the risk.

  Correct Answer: C

• Question 375:

  A person approaches a network administrator and wants advice on how to send encrypted email from home. The end user does not want to have to pay for any license fees or manage server services. Which of the following is the most secure encryption protocol that the network administrator should recommend?

  A. IP Security (IPSEC)

  B. Multipurpose Internet Mail Extensions (MIME)

  C. Pretty Good Privacy (PGP)

  D. Hyper Text Transfer Protocol with Secure Socket Layer (HTTPS)

  Correct Answer: C

• Question 376:

  Which of the following is optimized for confidential communications, such as bidirectional voice and video?

  A. RC4

  B. RC5

  C. MD4

  D. MD5

  Correct Answer: A

• Question 377:

  The use of alert thresholding in an IDS can reduce the volume of repeated alerts, but introduces which of the following vulnerabilities?

  A. An attacker, working slowly enough, can evade detection by the IDS.

  B. Network packets are dropped if the volume exceeds the threshold.

  C. Thresholding interferes with the IDS' ability to reassemble fragmented packets.

  D. The IDS will not distinguish among packets originating from different sources.

  Correct Answer: A

• Question 378:

  A company has hired a security administrator to maintain and administer Linux and Windows-based systems. Written in the nightly report file is the followinG.

  Firewall log files are at the expected value of 4 MB. The current time is 12am. Exactly two hours later the size has decreased considerably. Another hour goes by and the log files have shrunk in size again.

  Which of the following actions should the security administrator take?

  A. Log the event as suspicious activity and report this behavior to the incident response team immediately.

  B. Log the event as suspicious activity, call a manager, and report this as soon as possible.

  C. Run an anti-virus scan because it is likely the system is infected by malware.

  D. Log the event as suspicious activity, continue to investigate, and act according to the site's security policy.

  Correct Answer: D

• Question 379:

  A hacker is attempting to see which IP addresses are currently active on a network. Which NMAP switch would the hacker use?

  A. -sO

  B. -sP

  C. -sS

  D. -sU

  Correct Answer: B

• Question 380:

  At a Windows Server command prompt, which command could be used to list the running services?

  A. Sc query type= running

  B. Sc query \\servername

  C. Sc query

  D. Sc config

  Correct Answer: C