GAQM CEH-001 Online Practice Questions and Exam Preparation

GAQM CEH-001 Online Questions & Answers

• Question 761:

  The use of alert thresholding in an IDS can reduce the volume of repeated alerts, but introduces which of the following vulnerabilities?

  A. An attacker, working slowly enough, can evade detection by the IDS.
  B. Network packets are dropped if the volume exceeds the threshold.
  C. Thresholding interferes with the IDS' ability to reassemble fragmented packets.
  D. The IDS will not distinguish among packets originating from different sources.
  A. An attacker, working slowly enough, can evade detection by the IDS.

• Question 762:

  When discussing passwords, what is considered a brute force attack?

  A. You attempt every single possibility until you exhaust all possible combinations or discover the password
  B. You threaten to use the rubber hose on someone unless they reveal their password
  C. You load a dictionary of words into your cracking program
  D. You create hashes of a large number of words and compare it with the encrypted passwords
  E. You wait until the password expires
  A. You attempt every single possibility until you exhaust all possible combinations or discover the password

• Question 763:

  A XYZ security System Administrator is reviewing the network system log files.

  He notes the following:

  Network log files are at 5 MB at 12:00 noon. At 14:00 hours, the log files at 3 MB.

  What should he assume has happened and what should he do about the situation?

  A. He should contact the attacker's ISP as soon as possible and have the connection disconnected.
  B. He should log the event as suspicious activity, continue to investigate, and take further steps according to site security policy.
  C. He should log the file size, and archive the information, because the router crashed.
  D. He should run a file system check, because the Syslog server has a self correcting file system problem.
  E. He should disconnect from the Internet discontinue any further unauthorized use, because an attack has taken place.
  B. He should log the event as suspicious activity, continue to investigate, and take further steps according to site security policy.

• Question 764:

  Which of the following attacks takes best advantage of an existing authenticated connection?

  A. Spoofing
  B. Session Hijacking
  C. Password Sniffing
  D. Password Guessing
  B. Session Hijacking

• Question 765:

  What is the broadcast address for the subnet 190.86.168.0/22?

  A. 190.86.168.255
  B. 190.86.255.255
  C. 190.86.171.255
  D. 190.86.169.255
  C. 190.86.171.255

• Question 766:

  Which port, when configured on a switch receives a copy of every packet that passes through it?

  

  A. R-DUPE Port
  B. MIRROR port
  C. SPAN port
  D. PORTMON
  C. SPAN port

• Question 767:

  What flags are set in a X-MAS scan?(Choose all that apply.

  A. SYN
  B. ACK
  C. FIN
  D. PSH
  E. RST
  F. URG
  C. FIN
  D. PSH
  F. URG

• Question 768:

  Which of the following is a common Service Oriented Architecture (SOA) vulnerability?

  A. Cross-site scripting
  B. SQL injection
  C. VPath injection
  D. XML denial of service issues
  D. XML denial of service issues

• Question 769:

  Lee is using Wireshark to log traffic on his network. He notices a number of packets being directed to an internal IP from an outside IP where the packets are ICMP and their size is around 65, 536 bytes. What is Lee seeing here?

  A. Lee is seeing activity indicative of a Smurf attack.
  B. Most likely, the ICMP packets are being sent in this manner to attempt IP spoofing.
  C. Lee is seeing a Ping of death attack.
  D. This is not unusual traffic, ICMP packets can be of any size.
  C. Lee is seeing a Ping of death attack.

• Question 770:

  Cyber Criminals have long employed the tactic of masking their true identity. In IP spoofing, an attacker gains unauthorized access to a computer or a network by making it appear that a malicious message has come from a trusted machine, by "spoofing" the IP address of that machine.

  How would you detect IP spoofing?

  A. Check the IPID of the spoofed packet and compare it with TLC checksum. If the numbers match then it is spoofed packet
  B. Probe a SYN Scan on the claimed host and look for a response SYN/FIN packet, if the connection completes then it is a spoofed packet
  C. Turn on 'Enable Spoofed IP Detection' in Wireshark, you will see a flag tick if the packet is spoofed
  D. Sending a packet to the claimed host will result in a reply. If the TTL in the reply is not the same as the packet being checked then it is a spoofed packet
  D. Sending a packet to the claimed host will result in a reply. If the TTL in the reply is not the same as the packet being checked then it is a spoofed packet