Quiz
CEH 3
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (60)
1After a client sends a connection request (SYN) packet to the server, the server will respond (SYN-ACK)
with a sequence number of its choosing, which then must be acknowledged (ACK) by the client. This
sequence number is predictable; the attack connects to a service first with its own IP address, records the
sequence number chosen, and then opens a second connection from a forged IP address. The attack
doesn't see the SYN-ACK (or any other packet) from the server, but can guess the correct responses. If the
source IP address is used for authentication, then the attacker can use the one-sided communication to
break into the server. What attacks can you successfully launch against a server using the above
technique?- ADenial of Service attacks
- BSession Hijacking attacks
- CWeb page defacement attacks
- DIP spoofing attacks
2Which of the following represent weak password? (Select 2 answers)
- APasswords that contain letters, special characters, and numbers ExamplE. ap1$%##f@52
- BPasswords that contain only numbers ExamplE. 23698217
- CPasswords that contain only special characters ExamplE. &*#@!(%)
- DPasswords that contain letters and numbers ExamplE. meerdfget123
- EPasswords that contain only letters ExamplE. QWERTYKLRTY
- FPasswords that contain only special characters and numbers ExamplE. 123@$45
- GPasswords that contain only letters and special characters ExamplE. bob@&ba
- HPasswords that contain Uppercase/Lowercase from a dictionary list ExamplE. OrAnGe
3Harold just got home from working at Henderson LLC where he works as an IT technician. He was able to
get off early because they were not too busy. When he walks into his home office, he notices his teenage
daughter on the computer, apparently chatting with someone online. As soon as she hears Harold enter the
room, she closes all her windows and tries to act like she was playing a game. When Harold asks her what
she was doing, she acts very nervous and does not give him a straight answer. Harold is very concerned
because he does not want his daughter to fall victim to online predators and the sort. Harold doesn't
necessarily want to install any programs that will restrict the sites his daughter goes to, because he doesn't
want to alert her to his trying to figure out what she is doing. Harold wants to use some kind of program that
will track her activities online, and send Harold an email of her activity once a day so he can see what she
has been up to. What kind of software could Harold use to accomplish this?- AInstall hardware Keylogger on her computer
- BInstall screen capturing Spyware on her computer
- CEnable Remote Desktop on her computer
- DInstall VNC on her computer
4You are performing a port scan with nmap. You are in hurry and conducting the scans at the fastest possible speed. However, you don't want to sacrifice reliability for speed. If stealth is not an issue, what type of scan should you run to get very reliable results?
- AStealth scan
- BConnectscan
- CFragmented packet scan
- DXMAS scan
5Blane is a security analyst for a law firm. One of the lawyers needs to send out an email to a client but he
wants to know if the email is forwarded on to any other recipients. The client is explicitly asked not to re- send the email since that would be a violation of the lawyer's and client's agreement for this particular case. What can Blane use to accomplish this?- AHe can use a split-DNS service to ensure the email is not forwarded on
- BA service such as HTTrack would accomplish this
- CBlane could use MetaGoofil tracking tool.
- DBlane can use a service such as ReadNotify tracking tool.
6You ping a target IP to check if the host is up. You do not get a response. You suspect ICMP is blocked at the firewall. Next you use hping2 tool to ping the target host and you get a response. Why does the host respond to hping2 and not ping packet?
- APing packets can not by pass firewalls
- BYou must use ping10.2.3.4 switch
- CHping2 uses stealth TCP packets to connect
- DHping2 uses TCP instead of ICMP by default
7You want to perform advanced SQL Injection attack against a vulnerable website. You are unable to perform command shell hacks on this server. What must be enabled in SQL Server to launch these attacks?
- ASystem services
- BEXEC masteraccess
- Cxp_cmdshell
- DRDC
8Kevin is an IT security analyst working for Emerson Time Makers, a watch manufacturing company in Miami. Kevin and his girlfriend Katy recently broke up after a big fight. Kevin believes that she was seeing another person. Kevin, who has an online email account that he uses for most of his mail, knows that Katy has an account with that same company. Kevin logs into his email account online and gets the following URL after successfully logged in:
http://www.youremailhere.com/mail.asp?mailbox=Kevin&Smith=121%22 Kevin changes the URL
to: http://www.youremailhere.com/mail.asp?mailbox=Katy&Sanchez=121%22 Kevin is trying to access her email account to see if he can find out any information. What is Kevin attempting here to gain access to Katy's mailbox?- AThis type of attempt is called URL obfuscation when someone manually changes a URLtotry and gain unauthorized access
- BBy changing the mailbox's name in the URL, Kevin is attempting directory transversal
- CKevin is trying to utilize query string manipulation to gain access to her email account
- DHe is attempting a path-string attack to gain access to her mailbox
9An attacker is attempting to telnet into a corporation's system in the DMZ. The attacker doesn't want to get caught and is spoofing his IP address. After numerous tries he remains unsuccessful in connecting to the system. The attacker rechecks that the target system is actually listening on Port 23 and he verifies it with both nmap and hping2. He is still unable to connect to the target system. What could be the reason?
- AThe firewall is blocking port 23 to that system
- BHe needs to use an automated tool to telnet in
- CHe cannot spoof his IP and successfully use TCP
- DHe is attacking an operating system that does not reply to telnet even when open
10If an attacker's computer sends an IPID of 31400 to a zombie (Idle Scanning) computer on an open port,
what will be the response?- A31400
- B31402
- CThe zombie will not send a response
- D31401
11Trojan horse attacks pose one of the most serious threats to computer security. The image below shows different ways a Trojan can get into a system. Which are the easiest and most convincing ways to infect a computer?
- AIRC(InternetRelayChat)
- BLegitimate"shrink-wrapped"softwarepackagedbyadisgruntledemployee
- CNetBIOS (File Sharing)
- DDownloading files, games and screensavers from Internet sites
12The traditional traceroute sends out ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets take to reach the destination.
The problem is that with the widespread use of firewalls on the Internet today, many of the packets that traceroute sends out end up being filtered, making it impossible to completely trace the path to the destination.
How would you overcome the Firewall restriction on ICMP ECHO packets?- AFirewalls will permit in bound TCP packets to specific ports that hosts sitting behindt he firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
- BFirewalls will permit inbound UDP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
- CDo not use traceroute command to determine the path packets take to reach the destination instead use the custom hacking tool JOHNTHETRACER and run with the command
- D\>JOHNTHETRACERwww.eccouncil.org-F-evade
13Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall. From the following signature, what will Snort look for in the payload of the suspected packets?
alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG. "BACKDOOR SIG - SubSseven 22";flags: A +; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids, 485;) alert- AThe payload of 485 is what this Snort signature will look for.
- BSnort will look for 0d0a5b52504c5d3030320d0a in the payload
- CPackets that contain the payload of BACKDOOR SIG - SubSseven 22 will be flagged.
- DFrom this snort signature, packets with HOME_NET 27374 in the payload will be flagged.
14What type of port scan is represented here.
syn (port 80) -->
syn + ack <--
rst -->- AStealthScan
- BFullScan
- CXMAS Scan
- DFIN Scan
15One way to defeat a multi-level security solution is to leak data via
- Aabypassregulator.
- Bsteganography.
- Ca covert channel.
- Dasymmetric routing.
16On a Linux device, which of the following commands will start the Nessus client in the background so that the Nessus server can be configured?
- Anessus+
- Bnessus*s
- Cnessus &
- Dnessus -d
17A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP commanD.
NMAP n sS P0 p 80 ***.***.**.**
What type of scan is this?- AQuick scan
- BIntensescan
- CStealth scan
- DComprehensive scan
18Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?
- AIncident response services to any user, company, government agency, or organization in partnership with the Department of Homeland Security
- BMaintenance of the nation's Internet infrastructure, buildsoutnew Internet infrastructure, and decommissions old Internet infrastructure
- CRegistration of critical penetration testing for the Department of Homeland Security and public and private sectors
- DMeasurement of key vulnerability assessments on behalf of the Department of Defense (DOD) and State Department, as well as private sectors
19Which of the following are valid types of rootkits? (Choose three.)
- AHypervisorlevel
- BNetwork level
- CKernel level
- DApplication level
- EPhysicallevel
- FDataaccesslevel
20In order to show improvement of security over time, what must be developed?
- AReports
- BTesting tools
- CMetrics
- DTaxonomy of vulnerabilities
21In the software security development life cyle process, threat modeling occurs in which phase?
- ADesign
- BRequirements
- CVerification
- DImplementation
22Which of the following items of a computer system will an anti-virus program scan for viruses?
- ABootSector
- BDeletedFiles
- CWindows Process List
- DPassword Protected Files
23A computer science student needs to fill some information into a secured Adobe PDF job application that was received from a prospective employer. Instead of requesting a new document that allowed the forms to be completed, the student decides to write a script that pulls passwords from a list of commonly used passwords to try against the secured PDF until the correct password is found or the list is exhausted.
Which cryptography attack is the student attempting?- AMan-in-the-middleattack
- BBrute-forceattack
- CDictionaryattack
- DSession hijacking
24A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network?
- AFraggle
- BMACFlood
- CSmurf
- DTear Drop
25Which of the following conditions must be given to allow a tester to exploit a Cross-Site Request Forgery (CSRF) vulnerable web application?
- AThe victim user must open the malicious link with an Internet Explorer priortoversion8.
- BThe session cookies generated by the application do not have the HttpOnlyflagset.
- CThe victim user must open the malicious link with a Firefox prior to version 3.
- DThe web application should not use random tokens.
26During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?
- AThe tester must capture the WPA2 authentication handshake and then crackit.
- BThe tester must use the tool in SSIDertocrackitusingtheESSIDofthenetwork.
- CThe tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
- DThe tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key.
27
A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a user from the IT department had a dial-out modem installed. Which security policy must the security analyst check to see if dial-out modems are allowed?- AFirewall-managementpolicy
- BAcceptable-usepolicy
- CRemote-access policy
- DPermissive policy
28A company is using Windows Server 2003 for its Active Directory (AD). What is the most efficient way to crack the passwords for the AD users?
- APerformadictionaryattack.
- BPerformabruteforceattack.
- CPerform an attack with a rainbow table.
- DPerform a hybrid attack.
29During a penetration test, the tester conducts an ACK scan using NMAP against the external interface of the DMZ firewall. NMAP reports that port 80 is unfiltered. Based on this response, which type of packet inspection is the firewall conducting?
- AHost
- BStateful
- CStateless
- DApplication
30Which of the following types of firewall inspects only header information in network traffic?
- APacketfilter
- BStatefulinspection
- CCircuit-level gateway
- Dapplication-levelgateway
31An attacker sniffs encrypted traffic from the network and is subsequently able to decrypt it. The attacker can now use which cryptanalytic technique to attempt to discover the encryption key?
- ABirthdayattack
- BPlaintextattack
- CMeet in the middle attack
- DChosen ciphertext attack
32Which of the following describes a component of Public Key Infrastructure (PKI) where a copy of a private key is stored to provide third-party access and to facilitate recovery operations?
- AKeyregistry
- BRecoveryagent
- CDirectory
- DKeyescrow
33Which of the following processes evaluates the adherence of an organization to its stated security policy?
- AVulnerabilityassessment
- BPenetrationtesting
- CRisk assessment
- DSecurityauditing
34Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an appropriate method?
- AItisimpossibletocrackhasheduserpasswordsunlessthekeyusedtoencryptthemisobtained.
- BIfauserforgetsthepassword,itcanbeeasilyretrievedusingthehashkeystoredbyadministrators.
- CHashing is faster compared to more traditional encryption algorithms.
- DPasswords stored using hashes are non-reversible, making finding the password much more difficult.
35Which of the following are password cracking tools? (Choose three.)
- ABTCrack
- BJohntheRipper
- CKerbCrack
- DNikto
- ECainandAbel
- FHavij
36Which of the following techniques can be used to mitigate the risk of an on-site attacker from connecting to an unused network port and gaining full access to the network? (Choose three.)
- APortSecurity
- BIPSecEncryption
- Cnetwork Admission Control (NAC)
- D802.1q Port Based Authentication
- E802.1xPortBasedAuthentication
- FIntrusionDetectionSystem(IDS)
37Which tool can be used to silently copy files from USB devices?
- AUSBGrabber
- BUSBDumper
- CUSB Sniffer
- DUSB Snoopy
38How can a rootkit bypass Windows 7 operating system's kernel mode, code signing policy?
- ADefeatingthescannerfromdetectinganycodechangeatthekernel
- BReplacingpatchsystemcallswithitsownversionthathidestherootkit(attacker's)actions
- CPerforming common services for the application process and replacing real applications with fake ones
- DAttaching itself to the master boot record in a hard drive and changing the machine's boot sequence/ options
39How is sniffing broadly categorized?
- AActiveandpassive
- BBroadcastandunicast
- CUnmanaged and managed
- DFiltered and unfiltered
40The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company's external webserver, VPN concentrator, and DNS servers. What should the security team do to determine which alerts to check first?
- AInvestigatebasedonthemaintenancescheduleoftheaffectedsystems.
- BInvestigatebasedontheservicelevelagreementsofthesystems.
- CInvestigate based on the potential effect of the incident.
- DInvestigate based on the order that the alerts arrived in.
41Which of the following scanning tools is specifically designed to find potential exploits in Microsoft Windows products?
- AMicrosoftSecurityBaselineAnalyzer
- BRetina
- CCore Impact
- DMicrosoft Baseline Security Analyzer
42A security consultant is trying to bid on a large contract that involves penetration testing and reporting. The company accepting bids wants proof of work so the consultant prints out several audits that have been performed. Which of the following is likely to occur as a result?
- ATheconsultantwillaskformoneyonthebidbecauseofgreatwork.
- BTheconsultantmayexposevulnerabilitiesofothercompanies.
- CThe company accepting bids will want the same type of format of testing.
- DThe company accepting bids will hire the consultant because of the great work performed.
43Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering policy, procedure design, and implementation?
- APenetrationtesting
- BSocialengineering
- CVulnerabilityscanning
- DAccess control list reviews
44When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?
- ANetwork tap
- BLayer3switch
- CNetwork bridge
- DApplication firewall
45Which of the following programs is usually targeted at Microsoft Office products?
- APolymorphicvirus
- BMultipartvirus
- CMacro virus
- DStealth virus
46Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?
- ARegulatorycompliance
- BPeerreview
- CChange management
- DPenetration testing
47Data hiding analysis can be useful in
- Adeterminingthelevelofencryptionusedtoencryptthedata.
- Bdetectingandrecoveringdatathatmayindicateknowledge,ownershiporintent.
- Cidentifying the amount of central processing unit (cpu) usage over time to process the data.
- Dpreventing a denial of service attack on a set of enterprise servers to prevent users from accessing the data.
48When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is
- AOWASPisforwebapplicationsandOSSTMMdoesnotincludewebapplications.
- BOSSTMMisgrayboxtestingandOWASPisblackboxtesting.
- COWASP addresses controls and OSSTMM does not.
- DOSSTMM addresses controls and OWASP does not.
49Which of the following is a protocol that is prone to a man-in-the-middle (MITM) attack and maps a 32-bit address to a 48-bit address?
- AICPM
- BARP
- CRARP
- DICMP
50Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by the network's IDS?
- ATimingoptionstoslowthespeedthattheportscanisconducted
- BFingerprintingtoidentifywhichoperatingsystemsarerunningonthenetwork
- CICMP ping sweep to determine which hosts on the network are not available
- DTraceroute to control the path of the packets sent during the scan
51Which NMAP command combination would let a tester scan every TCP port from a class C network that is blocking ICMP with fingerprinting and service detection?
- ANMAP-PN-A-O-sS192.168.2.0/24
- BNMAP-P0-A-O-p1-65535192.168.0/24
- CNMAP -P0 -A -sT -p0-65535 192.168.0/16
- DNMAP -PN -O -sS -p 1-1024 192.168.0/8
52Which command lets a tester enumerate alive systems in a class C network via ICMP using native Windows tools?
- Aping192.168.2.
- Bping192.168.2.255
- Cfor %V in (1 1 255) do PING 192.168.2.%V
- Dfor /L %V in (1 1 254) do PING -n 1 192.168.2.%V | FIND /I "Reply"
53What is the purpose of conducting security assessments on network resources?
- ADocumentation
- BValidation
- CImplementation
- DManagement
54A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news articles online about the bank, watching what times the bank employees come into work and leave from work, searching the bank's job postings (paying special attention to IT related jobs), and visiting the local dumpster for the bank's corporate office. What phase of the penetration test is the tester currently in?
- AInformationreporting
- BVulnerabilityassessment
- CActive information gathering
- DPassive information gathering
55What statement is true regarding LM hashes?
- ALMhashesconsistin48hexadecimalcharacters.
- BLMhashesarebasedonAES128cryptographicstandard.
- CUppercase characters in the password are converted to lowercase.
- DLM hashes are not generated when the password length exceeds 15 characters.
56What is a successful method for protecting a router from potential smurf attacks?
- APlacingtherouterinbroadcastmode
- BEnablingportforwardingontherouter
- CInstalling the router outside of the network's firewall
- DDisabling the router from accepting broadcast ping messages
57Which of the following is a detective control?
- ASmartcardauthentication
- BSecuritypolicy
- CAudit trail
- DContinuity of operations plan
58A penetration tester is attempting to scan an internal corporate network from the internet without alerting the border sensor. Which is the most efficient technique should the tester consider using?
- AspoofinganIPaddress
- BTunnelingscanoverSSH
- CTunneling over high port numbers
- DScanning using fragmented IP packets
59A circuit level gateway works at which of the following layers of the OSI Model?
- ALayer5-Application
- BLayer 4 TCP
- CLayer 3 Internet protocol
- DLayer 2 Data link
60Which of the following lists are valid data-gathering activities associated with a risk assessment?
- AThreatidentification,vulnerabilityidentification,controlanalysis
- BThreatidentification,responseidentification,mitigationidentification
- CAttack profile, defense profile, loss profile
- DSystem profile, vulnerability identification, security determination
Information
- Description
- Informática y Comunicaciones Quiz on CEH 3, created by ma elideth avila on 28/03/2017.
- Author
- ma elideth avila
- Language
- Español
- Views
- 3
- Tags
- Rating
- No ratings yet Rate this quiz