Quiz
CEH V11
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (63)
1Sharia has detected an attack on her company web server. In this attack,
the message body is sent quite slowly. What best describes this attack?- ASlowloris
- BHTTP post
- CSmurf
- DPDoS
2Todd is concerned about DoS attacks against his network. He is particularly
worried about attacks that used malformed ICMP packets. What type
of attack is Todd concerned about?- APoD
- BTeardrop
- CPDoS
- DSmurf
3How does SPI help mitigate DoS?
- ABy detecting anomalies in the stream such as too many SYN packets
from the same IP source - BBy blocking fake IP addresses and sending their traffic to a black hole
- CBy carefully examining each packet and tracing back its origin
- DBy encrypting traffic, preventing many attacks
- ABy detecting anomalies in the stream such as too many SYN packets
4Objetivo Para el examen CEH, debe ser capaz de describir completamente cada uno de los
ataques discutidos en esta sección. Vale la pena tu tiempo para memorizar estos ataques.- ATrue
- BFalse
5Answer these questions. The answers follow the last question. If you cannot answer
these questions correctly, consider reading this section again until you can.- Aaccess-list access-list-number {deny | permit} tcp any destination
destination-wildcard - Bip tcp Intercept list access-list-number
- Caccess-list access-list-number intercept-enable
- Dip tcp Intercept-enable
- Aaccess-list access-list-number {deny | permit} tcp any destination
6Which attack is based on an ICMP (Internet Control Message Protocol) packet
sent to the broadcast address of the network?- ATeardrop attack
- BSlowloris attack
- CSmurf attack
- DPDoS attack
7What is the most effective countermeasure for registration DoS attacks?
- AUsing an SPI firewall
- BUsing Cisco configuration
- CUsing CAPTCHA
- DEncrypting traffic
8What type of session hijacking begins with the attacker attempting to get
the user to authenticate to the target server, using a session ID prechosen
by the attacker?- AMan-in-the-browser
- BMan-in-the-middle
- CSession replay
- DSession fixation
9Mohanned has discovered malware on a machine. This malware has an
interface like a web browser library and appears to be intercepting browser
calls. What type of attack is this?- ATrojan horse
- BSession fixation
- CMan-in-the-middle
- DMan-in-the-browser
10Gerard, who is a web developer, is concerned about session hijacking and
is using the HTTPOnly flag. What does this flag do?- APermits only HTTP and not HTTPS
- BOnly allows cookies to be accessed via HTTP
- CPrevents scripts running on the client
- DLogs all HTTP request queries and nothing else
11▶▶ Active: In active session hijacking, the attacker identifies an active session
and takes over that session.
▶▶ Passive: In passive hijacking, the attacker just sniffs the traffic. This is not
true session hijacking but is identified as passive session hijacking by the
CEH exam.- ATrue
- BFalse
121. Sniff the traffic going to the target so you can learn about how sessions
are handled. This involves using a packet sniffer such as Wireshark
or tcpdump (discussed in Chapter 2, “Enumeration and Vulnerability
Scanning”)
to see what is being sent between a client and a server.
2. Monitor the traffic to determine if you can predict the next valid
sequence number or session ID.
3. Break the connection to the legitimate client.
4. Take over the session, posing as that client using a session and/or
sequence ID that will appear legitimate to the target server.
5. Perform command injection, or inject packets into the target server- ATrue
- BFalse
13Specific Session Hijacking Methods:
There are a number of mechanisms for getting a session token in order to take
over a session. If data is unencrypted, you may be able to derive this information
through packet sniffing. Or if the target uses a simple session ID, such as
a date/time stamp, it is easy to predict the next session ID. However, there are
other methods, as described in the following subsections.- ATrue
- BFalse
14There are other tools that can accomplish similar tasks:
- AOWASP ZAP: A tool often touted as a website vulnerability scanner,
which also allows you to intercept and alter packets, available at - BWebSploit Framework: A tool explicitly designed for man-in-the-middle
attacks, available at https://sourceforge.net/projects/websploit/ - CBettercap: A tool that is also useful for Bluetooth hacking, available at
https://www.bettercap.org - DDroidSheep: A session hijacking tool that runs on Android, available at
https://droidsheep.info - EDroidSniff: An Android tool designed for security scanning that can also
be used for man-in-the-middle attacks, available at https://github.com/
evozi/DroidSniff
- AOWASP ZAP: A tool often touted as a website vulnerability scanner,
15John is logged into his company web portal using a secure session. However, he
is simultaneously logged into a site that he did not realize has been compromised.
What attack might John be vulnerable to?- ACross-site scripting
- BCross-site request forgery
- CMan-in-the-middle
- DSession fixation
16What is the key aspect of RST hijacking?
- ASpoofing RST packets from the client to reset the session
- BSpoofing RST packets to pretend to be the client
- CIntercepting RST packets
- DBlocking RST packets to force the session to stay active
17What is the basis of a CRIME attack?
- AFlaws in TLS compression
- BFlaws in gzip compression
- CFlaws in TLS authentication nonces
- DFlaws in cryptographic key generation
18Which of the following statements best describes a white-hat hacker?
- ASecurity professional
- BFormer black hat
- CFormer grey hat
- DMalicious hacker
19A security audit performed on the internal network of an organization by the network administration is also known as
- AGrey-box testing
- BBlack-box testing
- CWhite-box testing
- DActive testing
- EPassive testing
20What is the first phase of hacking?
- AAttack
- BMaintaining access
- CGaining access
- DReconnaissance
- EScanning
21What type of ethical hack tests access to the physical infrastructure?
- AInternal network
- BRemote network
- CExternal network
- DPhysical access
22 The security, functionality, and ease of use triangle illustrates which concept?
- AAs security increases, functionality and ease of use increase.
- BAs security decreases, functionality and ease of use increase.
- CAs security decreases, functionality and ease of use decrease.
- DSecurity does not affect functionality and ease of use.
23Which type of hacker represents the highest risk to your network?
- ADisgruntled employees
- BBlack-hat hackers
- CGrey-hat hackers
- DScript kiddies
24What are the three phases of a security evaluation plan? (Choose three answers.)
- AConduct Security Evaluation
- BPreparation
- CConclusion
- DFinal
- EReconnaissance
- FDesign Security
- GVulnerability Assessment
25Hacking for a cause is called
- AActive hacking
- BHacktivism
- CActivism
- DBlack-hat hacking
26 Which federal law is most commonly used to prosecute hackers?
- ATitle 12
- BTitle 18
- CTitle 20
- DTitle 2
27When a hacker attempts to attack a host via the Internet it is known as what type of attack?
- ARemote attack
- BPhysical access
- CLocal access
- DInternal attack
28Which are the four regional Internet registries?
- AAPNIC, PICNIC, NANIC, RIPE NCC
- BAPNIC, MOSTNIC, ARIN, RIPE NCC
- CAPNIC, PICNIC, NANIC, ARIN
- DAPNIC, LACNIC, ARIN, RIPE NCC
29Which of the following is a tool for performing footprinting undetected?
- AWhois search
- BTraceroute
- CPing sweep
- DHost scanning
30Which of the following tools are used for footprinting?
- AWhois
- BSam Spade
- CNMAP
- DSuperScan
- ENslookup
31What is the next step to be performed after footprinting?
- AScanning
- BEnumeration
- CSystem hacking
- DActive information gathering
32Which are good sources of information about a company or its employees? (Choose all that apply.)
- ANewsgroups
- BJob postings
- CCompany website
- DPress releases
33How does traceroute work?
- AIt uses an ICMP destination-unreachable message to elicit the name of a router.
- BIt sends a specially crafted IP packet to a router to locate the number of hops from the sender to the destination network.
- CIt uses a protocol that will be rejected by the gateway to determine the location.
- DIt uses the TTL value in an ICMP message to determine the number of hops from the sender to the router.
34What is footprinting?
- AMeasuring the shoe size of an ethical hacker
- BAccumulation of data by gathering information on a target
- CScanning a target network to detect operating system types
- DMapping the physical layout of a target’s network
35Nslookup can be used to gather information regarding which of the following?
- AHost names and IP addresses
- BWhois information
- CDNS server locations
- DName server types and operating systems
36Which of the following is a type of social engineering?
- AShoulder surfing
- BUser identification
- CSystem monitoring
- DFace-to-face communication
37 Which is an example of social engineering?
- AA user who holds open the front door of an office for a potential hacker
- BCalling a help desk and convincing them to reset a password for a user account
- CInstalling a hardware keylogger on a victim’s system to capture passwords
- DAccessing a database with a cracked password
38What is the best way to prevent a social-engineering attack?
- AInstalling a firewall to prevent port scans
- BConfiguring an IDS to detect intrusion attempts
- CIncreasing the number of help-desk personnel
- DEmployee training and education
39Which of the following is the best example of reverse social engineering?
- AA hacker pretends to be a person of authority in order to get a user to give them information.
- BA help-desk employee pretends to be a person of authority
- CA hacker tries to get a user to change their password.
- DA user changes their password.
40Using pop-up windows to get a user to give out information is which type of social engineering attack?
- AHuman-based
- BComputer-based
- CNontechnical
- DCoercive
41What is it called when a hacker pretends to be a valid user on the system?
- AImpersonation
- BThird-person authorization
- CHelp desk
- DValid user
42What is the best reason to implement a security policy?
- AIt increases security
- BIt makes security harder to enforce.
- CIt removes the employee’s responsibility to make judgments
- DIt decreases security.
43Faking a website for the purpose of getting a user’s password and username is which type of social engineering attack?
- AHuman-based
- BComputer-based
- CWeb-based
- DUser-based
44Dumpster diving can be considered which type of social engineering attack?
- AHuman-based
- BComputer-based
- CPhysical access
- DPaper-based
45 What port number does HTTPS use?
- A443
- B80
- C53
- D21
46What is war dialing used for?
- ATesting firewall security
- BTesting remote access system security
- CConfiguring a proxy filtering gateway
- DConfiguring a firewall
47Banner grabbing is an example of what?
- APassive operating system fingerprinting
- BActive operating system fingerprinting
- CFootprinting
- DApplication analysis
48What are the three types of scanning?
- APort, network, and vulnerability
- BPort, network, and services
- CGrey, black, and white hat
- DServer, client, and network
49 What is the main problem with using only ICMP queries for scanning?
- AThe port is not always available
- BThe protocol is unreliable
- CSystems may not respond because of a firewall.
- DSystems may not have the service running.
50 What does the TCP RST command do?
- AStarts a TCP connection
- BRestores the connection to a previous state
- CFinishes a TCP connections
- DResets the TCP connection
51 What is the proper sequence of a TCP connection?
- ASYN-SYN ACK-ACK
- BSYN-ACK-FIN
- CSYN-SYNACK-ACK
- DSYN-PSH-ACK
52A packet with all flags set is which type of scan?
- AFull Open
- BSyn scan
- CXMAS
- DTCP connect
53 What is the proper command to perform and NMAP SYN scan every 5 minutes?
- Anmap -ss – paranoid
- Bnmap -Ss -paranoid
- Cnmap -Ss -fast
- Dnamp -Ss -sneaky
54In order to prevent a hacker from using SMB session hijacking, which TCP and UDP ports would you block at the firewall?
- A167 and 137
- B80 and 23
- C139 and 445
- D1277 and 1270
55 Why would an attacker want to perform a scan on port 137?
- ATo locate the FTP service on the target host
- BTo check for file and print sharing on Windows systems
- CTo discover proxy servers on a network
- DTo discover a target system with the NetBIOS null session vulnerability
56SNMP is a protocol used to manage network infrastructure devices. What is the SNMP read/write community name used for?
- AViewing the configuration information
- BChanging the configuration information
- CMonitoring the device for errors
- DControlling the SNMP management station
57Why would the network security team be concerned about ports 135–139 being open on a system?
- ASMB is enabled, and the system is susceptible to null sessions.
- BSMB is not enabled, and the system is susceptible to null sessions.
- CWindows RPC is enabled, and the system is susceptible to Windows DCOM remote sessions
- DWindows RPC is not enabled, and the system is susceptible to Windows DCOM remote sessions.
58Which step comes after enumerating users in the CEH hacking cycle?
- ACrack password
- BEscalate privileges
- CScanning
- DCovering tracks
59What is enumeration?
- AIdentifying active systems on the network
- BCracking passwords
- CIdentifying users and machine names
- DIdentifying routers and firewalls
60What is a command-line tool used to look up a username from a SID?
- AUsertoSID
- BUserenum
- CSID2User
- DGetacct
61Which tool can be used to perform a DNS zone transfer on Windows?
- Anslookup
- BDNSlookup
- Cwhois
- Dipconfig
62What is a null session?
- AConnecting to a system with the administrator username and password
- BConnecting to a system with the admin username and password
- CConnecting to a system with a random username and password
- DConnecting to a system with no username and password
63What is a countermeasure for SNMP enumeration?
- ARemove the SNMP agent from the device.
- BShut down ports 135 and 139 at the firewall.
- CShut down ports 80 and 443 at the firewall.
- DEnable SNMP read-only security on the agent device.
Information
- Description
- certificación hacking ético CEH v11 Quiz on CEH V11, created by Ainat Mus on 21/06/2022.
- Author
- Ainat Mus
- Language
- Español
- Views
- 9
- Tags
- Rating
- No ratings yet Rate this quiz