GAQM CEH-001 Online Practice Questions and Exam Preparation

GAQM CEH-001 Online Questions & Answers

• Question 411:

  Derek has stumbled upon a wireless network and wants to assess its security. However, he does not find enough traffic for a good capture. He intends to use AirSnort on the captured traffic to crack the WEP key and does not know the IP address range or the AP. How can he generate traffic on the network so that he can capture enough packets to crack the WEP key?

  A. Use any ARP requests found in the capture
  B. Derek can use a session replay on the packets captured
  C. Derek can use KisMAC as it needs two USB devices to generate traffic
  D. Use Ettercap to discover the gateway and ICMP ping flood tool to generate traffic
  D. Use Ettercap to discover the gateway and ICMP ping flood tool to generate traffic

• Question 412:

  What type of attack is shown in the following diagram?

  

  A. Man-in-the-Middle (MiTM) Attack
  B. Session Hijacking Attack
  C. SSL Spoofing Attack
  D. Identity Stealing Attack
  A. Man-in-the-Middle (MiTM) Attack

• Question 413:

  When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is

  A. OWASP is for web applications and OSSTMM does not include web applications.
  B. OSSTMM is gray box testing and OWASP is black box testing.
  C. OWASP addresses controls and OSSTMM does not.
  D. OSSTMM addresses controls and OWASP does not.
  D. OSSTMM addresses controls and OWASP does not.

• Question 414:

  You ping a target IP to check if the host is up. You do not get a response. You suspect ICMP is blocked at the firewall. Next you use hping2 tool to ping the target host and you get a response. Why does the host respond to hping2 and not ping packet?

  

  A. Ping packets cannot bypass firewalls
  B. You must use ping 10.2.3.4 switch
  C. Hping2 uses stealth TCP packets to connect
  D. Hping2 uses TCP instead of ICMP by default
  D. Hping2 uses TCP instead of ICMP by default

• Question 415:

  Which of the following describes the characteristics of a Boot Sector Virus?

  A. Moves the MBR to another location on the RAM and copies itself to the original location of the MBR
  B. Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR
  C. Modifies directory table entries so that directory entries point to the virus code instead of the actual program
  D. Overwrites the original MBR and only executes the new virus code
  B. Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR

• Question 416:

  Which of the following best describes session key creation in SSL?

  A. It is created by the server after verifying theuser's identity
  B. It is created by the server upon connection by the client
  C. It is created by the client from the server's public key
  D. It is created by the client after verifying the server's identity
  D. It is created by the client after verifying the server's identity

• Question 417:

  John is using a special tool on his Linux platform that has a signature database and is therefore able to detect hundred of vulnerabilities in UNIX, Windows, and commonly-used web CGI scripts. Additionally, the database detects DDoS zombies and Trojans. What would be the name of this multifunctional tool?

  A. nmap
  B. hping
  C. nessus
  D. make
  C. nessus

• Question 418:

  A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system. What is the first step that the bank should take before enabling the audit feature?

  A. Perform a vulnerability scan of the system.
  B. Determine the impact of enabling the audit feature.
  C. Perform a cost/benefit analysis of the audit feature.
  D. Allocate funds for staffing of audit log review.
  B. Determine the impact of enabling the audit feature.

• Question 419:

  One advantage of an application-level firewall is the ability to

  A. filter packets at the network level.
  B. filter specific commands, such as http:post.
  C. retain state information for each packet.
  D. monitor tcp handshaking.
  B. filter specific commands, such as http:post.

• Question 420:

  Exhibit

  

  (Note: the student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)

  Snort has been used to capture packets on the network. On studying the packets, the penetration tester finds it to be abnormal. If you were the penetration tester, why would you find this abnormal?

  What is odd about this attack? Choose the best answer.

  A. This is not a spoofed packet as the IP stack has increasing numbers for the three flags.
  B. This is back orifice activity as the scan comes form port 31337.
  C. The attacker wants to avoid creating a sub-carries connection that is not normally valid.
  D. These packets were crafted by a tool, they were not created by a standard IP stack.
  B. This is back orifice activity as the scan comes form port 31337.