Quiz
CEHv9 Chapter 9
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (13)
1Which of the following doesn’t define a method of transmitting data that violates a security policy?
- ABackdoor channel
- BSession hijacking
- CCovert channel
- DOvert channel
2Which virus type is only executed when a specific condition is met?
- ASparse infector
- BMultipartite
- CMetamorphic
- DCavity
3Which of the following propagates without human interaction?
- ATrojan
- BWorm
- CVirus
- DMITM
4Which of the following don’t use ICMP in the attack? (Choose two.)
- ASYN flood
- BPing of Death
- CSmurf
- DPeer to peer
5Which of the following is not a recommended step in recovering from a malware infection?
- ADelete system restore points.
- BBack up the hard drive.
- CRemove the system from the network.
- DReinstall from original media.
6Which of the following is a recommendation to protect against session hijacking? (Choose two.)
- AUse only nonroutable protocols.
- BUse unpredictable sequence numbers.
- CUse a file verification application, such as Tripwire.
- DUse a good password policy.
- EImplement ICMP throughout the environment.
7Which of the following attacks an already-authenticated connection?
- ASmurf
- BDenial of service
- CSession hijacking
- DPhishing
8How does Tripwire (and programs like it) help against Trojan attacks?
- ATripwire is an AV application that quarantines and removes malware immediately.
- BTripwire is an AV application that quarantines and removes malware after a scan.
- CTripwire is a file-integrity-checking application that rejects malware packets intended for the kernel.
- DTripwire is a file-integrity-checking application that notifies you when a system file has been altered, potentially indicating malware.
9Which of the following DoS categories consume all available bandwidth for the system or service?
- AFragmentation attacks
- BVolumetric attacks
- CApplication attacks
- DTCP state-exhaustion attacks
10During a TCP data exchange, the client has offered a sequence number of 100, and the server has offered 500. During acknowledgments, the packet shows 101 and 501, respectively, as the agreed-upon sequence numbers. With a window size of 5, which sequence numbers would the server willingly accept as part of this session?
- A102 through 104
- B102 through 501
- C102 through 502
- DAnything above 501
11Which of the following is the proper syntax on Windows systems for spawning a command shell on port 56 using Netcat?
- Anc -r 56 -c cmd.exe
- Bnc -p 56 -o cmd.exe
- Cnc -L 56 -t -e cmd.exe
- Dnc -port 56 -s -o cmd.exe
12Which of the following best describes a DRDoS?
- AMultiple intermediary machines send the attack at the behest of the attacker.
- BThe attacker sends thousands upon thousands of SYN packets to the machine with a false source IP address.
- CThe attacker sends thousands of SYN packets to the target but never responds to any of the return SYN/ACK packets.
- DThe attack involves sending a large number of garbled IP fragments with overlapping, oversized payloads to the target machine.
13Which of the following best describes a teardrop attack?
- AThe attacker sends a packet with the same source and destination address.
- BThe attacker sends several overlapping, extremely large IP fragments.
- CThe attacker sends UDP Echo packets with a spoofed address.
- DThe attacker uses ICMP broadcast to DoS targets.
Information
- Description
- CEH Security
- Author
- Paul Anstall
- Language
- English
- Views
- 141
- Tags
- Rating
- No ratings yet Rate this quiz