GAQM CEH-001 Online Practice Questions and Exam Preparation

GAQM CEH-001 Online Questions & Answers

• Question 571:

  What is the proper response for a X-MAS scan if the port is closed?

  A. SYN
  B. ACK
  C. FIN
  D. PSH
  E. RST
  F. No response
  E. RST

• Question 572:

  Which type of antenna is used in wireless communication?

  A. Omnidirectional
  B. Parabolic
  C. Uni-directional
  D. Bi-directional
  A. Omnidirectional

• Question 573:

  Bob is acknowledged as a hacker of repute and is popular among visitors of "underground" sites. Bob is willing to share his knowledge with those who are willing to learn, and many have expressed their interest in learning from him. However, this knowledge has a risk associated with it, as it can be used for malevolent attacks as well.

  In this context, what would be the most affective method to bridge the knowledge gap between the "black" hats or crackers and the "white" hats or computer security professionals? (Choose the test answer)

  A. Educate everyone with books, articles and training on risk analysis, vulnerabilities and safeguards.
  B. Hire more computer security monitoring personnel to monitor computer systems and networks.
  C. Make obtaining either a computer security certification or accreditation easier to achieve so more individuals feel that they are a part of something larger than life.
  D. Train more National Guard and reservist in the art of computer security to help out in times of emergency or crises.
  A. Educate everyone with books, articles and training on risk analysis, vulnerabilities and safeguards.

• Question 574:

  How do you defend against ARP Spoofing? Select three.

  A. Use ARPWALL system and block ARP spoofing attacks
  B. Tune IDS Sensors to look for large amount of ARP traffic on local subnets
  C. Use private VLANS
  D. Place static ARP entries on servers, workstation and routers
  A. Use ARPWALL system and block ARP spoofing attacks
  C. Use private VLANS
  D. Place static ARP entries on servers, workstation and routers

• Question 575:

  How does traceroute map the route a packet travels from point A to point B?

  A. Uses a TCP timestamp packet that will elicit a time exceeded in transit message
  B. Manipulates the value of the time to live (TTL) within packet to elicit a time exceeded in transit message
  C. Uses a protocol that will be rejected by gateways on its way to the destination
  D. Manipulates the flags within packets to force gateways into generating error messages
  B. Manipulates the value of the time to live (TTL) within packet to elicit a time exceeded in transit message

• Question 576:

  Which of the following is a hardware requirement that either an IDS/IPS system or a proxy server must have in order to properly function?

  A. Fast processor to help with network traffic analysis
  B. They must be dual-homed
  C. Similar RAM requirements
  D. Fast network interface cards
  B. They must be dual-homed

• Question 577:

  Which type of scan does NOT open a full TCP connection?

  A. Stealth Scan
  B. XMAS Scan
  C. Null Scan
  D. FIN Scan
  A. Stealth Scan

• Question 578:

  David is a security administrator working in Boston. David has been asked by the office's manager to block all POP3 traffic at the firewall because he believes employees are spending too much time reading personal email. How can David block POP3 at the firewall?

  A. David can block port 125 at the firewall.
  B. David can block all EHLO requests that originate from inside the office.
  C. David can stop POP3 traffic by blocking all HELO requests that originate from inside the office.
  D. David can block port 110 to block all POP3 traffic.
  D. David can block port 110 to block all POP3 traffic.

• Question 579:

  Most cases of insider abuse can be traced to individuals who are introverted, incapable of dealing with stress or conflict, and frustrated with their job, office politics, and lack of respect or promotion. Disgruntled employees may pass company secrets and intellectual property to competitors for monitory benefits.

  Here are some of the symptoms of a disgruntled employee:

  A. Frequently leaves work early, arrive late or call in sick
  B. Spends time surfing the Internet or on the phone
  C. Responds in a confrontational, angry, or overly aggressive way to simple requests or comments
  D. Always negative; finds fault with everything These disgruntled employees are the biggest threat to enterprise security. How do you deal with these threats? (Select 2 answers)
  E. Limit access to the applications they can run on their desktop computers and enforce strict work hour rules
  F. By implementing Virtualization technology from the desktop to the data centre, organizations can isolate different environments with varying levels of access and security to various employees
  G. Organizations must ensure that their corporate data is centrally managed and delivered to users just and when needed
  H. Limit Internet access, e-mail communications, access to social networking sites and job hunting portals
  B. Spends time surfing the Internet or on the phone
  C. Responds in a confrontational, angry, or overly aggressive way to simple requests or comments

• Question 580:

  Snort has been used to capture packets on the network. On studying the packets, the penetration tester finds it to be abnormal. If you were the penetration tester, why would you find this abnormal?

  05/20-17:0645.061034 192.160.13.4:31337 --> 172.16.1.101:1

  TCP TTL:44 TOS:0x10 ID:242

  ***FRP** Seq:0xA1D95 Ack:0x53 Win: 0x400

  What is odd about this attack? (Choose the most appropriate statement)

  A. This is not a spoofed packet as the IP stack has increasing numbers for the three flags.
  B. This is back orifice activity as the scan comes from port 31337.
  C. The attacker wants to avoid creating a sub-carrier connection that is not normally valid.
  D. There packets were created by a tool; they were not created by a standard IP stack.
  B. This is back orifice activity as the scan comes from port 31337.