GAQM GAQM Certifications CEH-001 Questions & Answers

• Question 821:

  This attack technique is used when a Web application is vulnerable to an SQL Injection but the results of the Injection are not visible to the attacker.

  A. Unique SQL Injection

  B. Blind SQL Injection

  C. Generic SQL Injection

  D. Double SQL Injection

  Correct Answer: B

• Question 822:

  Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the cookie even while the session is invalid on the server. Why do you think this is possible?

  A. It works because encryption is performed at the application layer (single encryption key)

  B. The scenario is invalid as a secure cookie cannot be replayed

  C. It works because encryption is performed at the network layer (layer 1 encryption)

  D. Any cookie can be replayed irrespective of the session status

  Correct Answer: A

• Question 823:

  What does FIN in TCP flag define?

  A. Used to abort a TCP connection abruptly

  B. Used to close a TCP connection

  C. Used to acknowledge receipt of a previous packet or transmission

  D. Used to indicate the beginning of a TCP connection

  Correct Answer: B

• Question 824:

  What port number is used by Kerberos protocol?

  A. 88

  B. 44

  C. 487

  D. 419

  Correct Answer: A

• Question 825:

  Shayla is an IT security consultant, specializing in social engineering and external penetration tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense. Shayla has been given authority to perform any and all tests necessary to audit the company's network security.

  No employees for the company, other than the IT director, know about Shayla's work she will be doing. Shayla's first step is to obtain a list of employees through company website contact pages. Then she befriends a female employee of the company through an online chat website. After meeting with the female employee numerous times, Shayla is able to gain her trust and they become friends. One day, Shayla steals the employee's access badge and uses it to gain unauthorized access to the Treks Avionics offices.

  What type of insider threat would Shayla be considered?

  A. She would be considered an Insider Affiliate

  B. Because she does not have any legal access herself, Shayla would be considered an Outside Affiliate

  C. Shayla is an Insider Associate since she has befriended an actual employee

  D. Since Shayla obtained access with a legitimate company badge; she would be considered a Pure Insider

  Correct Answer: A

• Question 826:

  Which type of hacker represents the highest risk to your network?

  A. black hat hackers

  B. grey hat hackers

  C. disgruntled employees

  D. script kiddies

  Correct Answer: C

• Question 827:

  Your computer is infected by E-mail tracking and spying Trojan. This Trojan infects the computer with a single file - emos.sys

  Which step would you perform to detect this type of Trojan?

  

  A. Scan for suspicious startup programs using msconfig

  B. Scan for suspicious network activities using Wireshark

  C. Scan for suspicious device drivers in c:\windows\system32\drivers

  D. Scan for suspicious open ports using netstat

  Correct Answer: C

• Question 828:

  In the context of Trojans, what is the definition of a Wrapper?

  A. An encryption tool to protect the Trojan

  B. A tool used to bind the Trojan with a legitimate file

  C. A tool used to calculate bandwidth and CPU cycles wasted by the Trojan

  D. A tool used to encapsulate packets within a new header and footer

  Correct Answer: B

• Question 829:

  You just purchased the latest DELL computer, which comes pre-installed with Windows 7, McAfee antivirus software and a host of other applications. You want to connect Ethernet wire to your cable modem and start using the computer immediately. Windows is dangerously insecure when unpacked from the box, and there are a few things that you must do before you use it.

  A. New installation of Windows should be patched by installing the latest service packs and hotfixes

  B. Key applications such as Adobe Acrobat, Macromedia Flash, Java, Winzip etc., must have the latest security patches installed

  C. Install a personal firewall and lock down unused ports from connecting to your computer

  D. Install the latest signatures for Antivirus software

  E. Configure "Windows Update" to automatic

  F. Create a non-admin user with a complex password and logon to this account

  G. You can start using your computer as vendors such as DELL, HP and IBM would have already installed the latest service packs.

  Correct Answer:

• Question 830:

  You want to hide a secret.txt document inside c:\windows\system32\tcpip.dll kernel library using ADS streams. How will you accomplish this?

  A. copy secret.txt c:\windows\system32\tcpip.dll kernel>secret.txt

  B. copy secret.txt c:\windows\system32\tcpip.dll:secret.txt

  C. copy secret.txt c:\windows\system32\tcpip.dll |secret.txt

  D. copy secret.txt >< c:\windows\system32\tcpip.dll kernel secret.txt

  Correct Answer: B