GAQM GAQM Certifications CEH-001 Questions & Answers

• Question 551:

  Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?

  A. Regulatory compliance

  B. Peer review

  C. Change management

  D. Penetration testing

  Correct Answer: C

• Question 552:

  Data hiding analysis can be useful in

  A. determining the level of encryption used to encrypt the data.

  B. detecting and recovering data that may indicate knowledge, ownership or intent.

  C. identifying the amount of central processing unit (cpu) usage over time to process the data.

  D. preventing a denial of service attack on a set of enterprise servers to prevent users from accessing the data.

  Correct Answer: B

• Question 553:

  What is the main difference between a "Normal" SQL Injection and a "Blind" SQL Injection vulnerability?

  A. The request to the web server is not visible to the administrator of the vulnerable application.

  B. The attack is called "Blind" because, although the application properly filters user input, it is still vulnerable to code injection.

  C. The successful attack does not show an error message to the administrator of the affected application.

  D. The vulnerable application does not display errors with information about the injection results to the attacker.

  Correct Answer: D

• Question 554:

  How does an operating system protect the passwords used for account logins?

  A. The operating system performs a one-way hash of the passwords.

  B. The operating system stores the passwords in a secret file that users cannot find.

  C. The operating system encrypts the passwords, and decrypts them when needed.

  D. The operating system stores all passwords in a protected segment of non-volatile memory.

  Correct Answer: A

• Question 555:

  Which of the following programs is usually targeted at Microsoft Office products?

  A. Polymorphic virus

  B. Multipart virus

  C. Macro virus

  D. Stealth virus

  Correct Answer: C

• Question 556:

  When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?

  A. Network tap

  B. Layer 3 switch

  C. Network bridge

  D. Application firewall

  Correct Answer: A

• Question 557:

  What is the outcome of the comm"nc -l -p 2222 | nc 10.1.0.43 1234"?

  A. Netcat will listen on the 10.1.0.43 interface for 1234 seconds on port 2222.

  B. Netcat will listen on port 2222 and output anything received to a remote connection on 10.1.0.43 port 1234.

  C. Netcat will listen for a connection from 10.1.0.43 on port 1234 and output anything received to port 2222.

  D. Netcat will listen on port 2222 and then output anything received to local interface 10.1.0.43.

  Correct Answer: B

• Question 558:

  For messages sent through an insecure channel, a properly implemented digital signature gives the receiver reason to believe the message was sent by the claimed sender. While using a digital signature, the message digest is encrypted with which key?

  A. Sender's public key

  B. Receiver's private key

  C. Receiver's public key

  D. Sender's private key

  Correct Answer: D

• Question 559:

  Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering policy, procedure design, and implementation?

  A. Penetration testing

  B. Social engineering

  C. Vulnerability scanning

  D. Access control list reviews

  Correct Answer: A

• Question 560:

  A penetration tester is conducting a port scan on a specific host. The tester found several ports opened that were confusing in concluding the Operating System (OS) version installed. Considering the NMAP result below, which of the following is likely to be installed on the target machine by the OS? Starting NMAP 5.21 at 2011-03-15 11:06 NMAP scan report for 172.16.40.65 Host is up (1.00s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 80/tcp open http 139/tcp open netbios-ssn 515/tcp open 631/tcp open ipp 9100/tcp open MAC Address: 00:00:48:0D:EE:89

  A. The host is likely a Windows machine.

  B. The host is likely a Linux machine.

  C. The host is likely a router.

  D. The host is likely a printer.

  Correct Answer: D