Test
CEH 2
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (50)
1Attackers send an ACK probe packet with random sequence number, no response means port is filtered (Stateful firewall is present) and RST response means the port is not filtered. What type of Port Scanning is this?
- ARSTflagscanning
- BFINflagscanning
- CSYN flag scanning
- DACKflagscanning
2Which port, when configured on a switch receives a copy of every packet that passes through it?
- AR-DUPEPort
- BMIRRORport
- CSPAN port
- DPORTMON
3What is the IV key size used in WPA2?
- A32
- B24
- C16
- D48
- E128
4What is the default Password Hash Algorithm used by NTLMv2?
- AMD4
- Bdes
- Csha-1
- Dmd5
5
Frederickson Security Consultants is currently conducting a security audit on the networks of Hawthorn Enterprises, a contractor for the Department of Defense. Since Hawthorn Enterprises conducts business daily with the federal government, they must abide by very stringent security policies. Frederickson is testing all of Hawthorn's physical and logical security measures including biometrics, passwords, and permissions. The federal government requires that all users must utilize random, non-dictionary passwords that must take at least 30 days to crack. Frederickson has confirmed that all Hawthorn employees use a random password generator for their network passwords. The Frederickson consultants have saved off numerous SAM files from Hawthorn's servers using Pwdump6 and are going to try and crack the network passwords. What method of attack is best suited to crack these passwords in the shortest amount of time?- ABruteforceattack
- BBirthdayattack
- CDictionaryattack
- DBrute service attack
6You want to know whether a packet filter is in front of 192.168.1.10. Pings to 192.168.1.10 don't get answered. A basic nmap scan of 192.168.1.10 seems to hang without returning any information. What should you do next?
- ARunNULLTCPhping2against192.168.1.10
- BRunnmapXMASscanagainst192.168.1.10
- CThe firewall is blocking all the scans to 192.168.1.10
- DUse NetScan Tools Pro to conduct the scan
7Blane is a network security analyst for his company. From an outside IP, Blane performs an XMAS scan using Nmap. Almost every port scanned does not illicit a response. What can he infer from this kind of response?
- ATheseportsareopenbecausetheydonotillicitaresponse.
- BHecantellthattheseportsareinstealthmode.
- CIf a port does not respond to an XMAS scan using NMAP, that port is closed.
- DThe scan was not performed correctly using NMAP since all ports, no matter what their state, will illicit some sort of response from an XMAS scan.
8in TCP communications there are 8 flags; FIN, SYN, RST, PSH, ACK, URG, ECE, CWR. These flags have decimal numbers assigned to them:
FIN = 1 SYN = 2 RST = 4 PSH = 8 ACK = 16 URG = 32 ECE = 64 CWR =128
Example: To calculate SYN/ACK flag decimal value, add 2 (which is the decimal value of the SYN flag) to 16 (which is the decimal value of the ACK flag), so the result would be 18. Based on the above calculation, what is the decimal value for XMAS scan?- A23
- B24
- C41
- D64
9A simple compiler technique used by programmers is to add a terminator 'canary word' containing four letters NULL (0x00), CR (0x0d), LF (0x0a) and EOF (0xff) so that most string operations are terminated. If the canary word has been altered when the function returns, and the program responds by emitting an intruder alert into syslog, and then halts what does it indicate?
- AAbufferoverflowattackhasbeenattempted
- BAbufferoverflowattackhasalreadyoccurred
- CA firewall has been breached and this is logged
- DAn intrusion detection system has been triggered
- EThesystemhascrashed
10Neil is closely monitoring his firewall rules and logs on a regular basis. Some of the users have complained
to Neil that there are a few employees who are visiting offensive web site during work hours, without any consideration for others. Neil knows that he has an up-to-date content filtering system and such access should not be authorized. What type of technique might be used by these offenders to access the Internet without restriction?- ATheyareusingUDPthatisalwaysauthorizedatthefirewall
- BTheyareusingHTTPtunnelingsoftwarethatallowsthemtocommunicatewithprotocolsinawayitwas not intended
- CThey have been able to compromise the firewall, modify the rules, and give themselves proper access
- DThey are using an older version of Internet Explorer that allow them to bypass the proxy server
11Bob is going to perform an active session hijack against Brownies Inc. He has found a target that allows session oriented connections (Telnet) and performs the sequence prediction on the target operating system. He manages to find an active session due to the high level of traffic on the network. What is Bob supposed to do next?
- ATake over the session
- BReversesequenceprediction
- CGuess the sequence numbers
- DTake one of the parties offline
12"Testing the network using the same methodologies and tools employed by attackers" Identify the correct terminology that defines the above statement.
- AVulnerabilityScanning
- BPenetration T esting
- CSecurityPolicyImplementation
- DDesigning Network Security
13Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?
- ATheswitcheswilldropintohubmodeiftheARPcacheissuccessfullyflooded.
- BIftheARPcacheisflooded,theswitcheswilldropintopixmodemakingitlesssusceptibletoattacks.
- CDepending on the switch manufacturer, the device will either delete every entry in its ARP cache or reroute packets to the nearest switch.
- DThe switches will route all traffic to the broadcast address created collisions.
14You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c
What is the hexadecimal value of NOP instruction?- A0x60
- B0x80
- C0x70
- D0x90
15The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below:
You are hired to conduct security testing on their network. You successfully brute-force the SNMP community string using a SNMP crack tool. The access-list configured at the router prevents you from establishing a successful connection. You want to retrieve the Cisco configuration from the router. How would you proceed?- AUsetheCisco'sTFTPdefaultpasswordtoconnectanddownloadtheconfigurationfile
- BRunanetworksnifferandcapturethereturnedtrafficwiththeconfigurationfilefromtherouter
- CRun Generic Routing Encapsulation (GRE) tunneling protocol from your computer to the router masking your IP address
- DSend a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0
16Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a session with his computer. How can Fred accomplish this?
- AFredcanaccomplishthisbysendinganIPpacketwiththeRST/SINbitandthesourceaddressofhis computer.
- BHecansendanIPpacketwiththeSYNbitandthesourceaddressofhiscomputer.
- CFred can send an IP packet with the ACK bit set to zero and the source address of the switch.
- DFred can send an IP packet to the switch with the ACK bit and the source address of his machine.
17Within the context of Computer Security, which of the following statements describes Social Engineering best?
- ASocialEngineeringistheactofpubliclydisclosinginformation
- BSocialEngineeringisthemeansputinplacebyhumanresourcetoperformtimeaccounting
- CSocial Engineering is the act of getting needed information from a person rather than breaking into a system
- DSocial Engineering is a training program within sociology studies
18In Trojan terminology, what is a covert channel?
- AAchannelthattransfersinformationwithinacomputersystemornetworkinawaythatviolatesthe security policy
- BAlegitimatecommunicationpathwithinacomputersystemornetworkfortransferofdata
- CIt is a kernel operation that hides boot processes and services to mask detection
- DIt is Reverse tunneling technique that uses HTTPS protocol instead of HTTP protocol to establish connections
19When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK. How would an attacker exploit this design by launching TCP SYN attack?
- AAttackergeneratesTCPSYNpacketswithrandomdestinationaddressestowardsavictimhost
- BAttackerfloodsTCPSYNpacketswithrandomsourceaddressestowardsavictimhost
- CAttacker generates TCP ACK packets with random source addresses towards a victim host
- DAttacker generates TCP RST packets with random source addresses towards a victim host
20Every company needs a formal written document which spells out to employees precisely what they are allowed to use the company's systems for, what is prohibited, and what will happen to them if they break the rules. Two printed copies of the policy should be given to every employee as soon as possible after they join the organization. The employee should be asked to sign one copy, which should be safely filed by the company. No one should be allowed to use the company's computer systems until they have signed the policy in acceptance of its terms. What is this document called?
- AInformationAuditPolicy(IAP)
- BInformationSecurityPolicy(ISP)
- CPenetration Testing Policy (PTP)
- DCompanyCompliancePolicy(CCP)
21Which type of sniffing technique is generally referred as MiTM attack?
- APasswordSniffing
- BARPPoisoning
- CMac Flooding
- DDHCP Sniffing
22Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch.
In MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC addresses to physical ports. What happens when the CAM table becomes full?- ASwitchthenactsashubbybroadcastingpacketstoallmachinesonthenetwork
- BTheCAMoverflowtablewillcausetheswitchtocrashcausingDenialofService
- CThe switch replaces outgoing frame switch factory default MAC address of FF:FF:FF:FF:FF:FF
- DEvery packet is dropped and the switch sends out SNMP alerts to the IDS port
23
You are trying to break into a highly classified top-secret mainframe computer with highest security system in place at Merclyn Barley Bank located in Los Angeles. You know that conventional hacking doesn't work in this case, because organizations such as banks are generally tight and secure when it comes to protecting their systems. In other words you are trying to penetrate an otherwise impenetrable system. How would you proceed?- ALookfor"zero-day"exploitsatvariousundergroundhackerwebsitesinRussiaandChinaandbuythe necessary exploits from these hackers and target the bank's network
- BTrytohangaroundthelocalpubsorrestaurantsnearthebank,gettalkingtoapoorly-paidor disgruntled employee, and offer them money if they'll abuse their access privileges by providing you with sensitive information
- CLaunch DDOS attacks against Merclyn Barley Bank's routers and firewall systems using 100, 000 or more "zombies" and "bots"
- DTry to conduct Man-in-the-Middle (MiTM) attack and divert the network traffic going to the Merclyn Barley Bank's Webserver to that of your machine using DNS Cache Poisoning techniques
24Buffer X in an Accounting application module for Brownies Inc. can contain 200 characters. The programmer makes an assumption that 200 characters are more than enough. Because there were no proper boundary checks being conducted, Bob decided to insert 400 characters into the 200-character buffer. (Overflows the buffer). Below is the code snippet:
how can you protect/fix the problem of your application as shown above?- ABecausethecounterstartswith0,wewouldstopwhenthecounterislessthan200
- BBecausethecounterstartswith0,wewouldstopwhenthecounterismorethan200
- CAdd a separate statement to signify that if we have written less than 200 characters to the buffer, the stack should stop because it cannot hold any more data
- DAdd a separate statement to signify that if we have written 200 characters to the buffer, the stack should stop because it cannot hold any more data
25Which of the following encryption is NOT based on block cipher?
- ADES
- BBlowfish
- CAES(Rijndael)
- DRC4
26Michael is a junior security analyst working for the National Security Agency (NSA) working primarily on breaking terrorist encrypted messages. The NSA has a number of methods they use to decipher encrypted messages including Government Access to Keys (GAK) and inside informants. The NSA holds secret backdoor keys to many of the encryption algorithms used on the Internet. The problem for the NSA, and Michael, is that terrorist organizations are starting to use custom-built algorithms or obscure algorithms purchased from corrupt governments. For this reason, Michael and other security analysts like him have been forced to find different methods of deciphering terrorist messages. One method that Michael thought of using was to hide malicious code inside seemingly harmless programs. Michael first monitors sites and
bulletin boards used by known terrorists, and then he is able to glean email addresses to some of these suspected terrorists. Michael then inserts a stealth keylogger into a mapping program file readme.txt and then sends that as an attachment to the terrorist. This keylogger takes screenshots every 2 minutes and also logs all keyboard activity into a hidden file on the terrorist's computer. Then, the keylogger emails those files to Michael twice a day with a built in SMTP server. What technique has Michael used to disguise this keylogging software?- ASteganography
- BWrapping
- Cads
- DHidden Channels
27Which definition below best describes a covert channel?
- AAserverprogramusingaportthatisnotwellknown
- BMakinguseofaprotocolinawayitwasnotintendedtobeused
- CIt is the multiplexing taking place on a communication link
- DIt is one of the weak channels used by WEP that makes it insecure
28Joseph has just been hired on to a contractor company of the Department of Defense as their Senior Security Analyst. Joseph has been instructed on the company's strict security policies that have been implemented, and the policies that have yet to be put in place. Per the Department of Defense, all DoD users and the users of their contractors must use two-factor authentication to access their networks. Joseph has been delegated the task of researching and implementing the best two-factor authentication
method for his company. Joseph's supervisor has told him that they would like to use some type of hardware device in tandem with a security or identifying pin number. Joseph's company has already researched using smart cards and all the resources needed to implement them, but found the smart cards to not be cost effective. What type of device should Joseph use for two-factor authentication?- ABiometricdevice
- BOTP
- CProximitycards
- DSecuritytoken
29Identify SQL injection attack from the HTTP requests shown below:
- Ahttp://www.myserver.c0m/search.asp? lname=smith%27%3bupdate%20usertable%20set%20passwd%3d%27hAx0r%27%3b--%00
- Bhttp://www.myserver.c0m/script.php?mydata=%3cscript%20src=%22
- Chttp%3a%2f%2fwww.yourserver.c0m%2fbadscript.js%22%3e%3c%2fscript%3e
- Dhttp://www.victim.com/example accountnumber=67891&creditamount=999999999
30To see how some of the hosts on your network react, Winston sends out SYN packets to an IP range. A number of IPs respond with a SYN/ACK response. Before the connection is established he sends RST packets to those hosts to stop the session. Winston has done this to see how his intrusion detection system will log the traffic. What type of scan is Winston attempting here?
- AWinstonisattemptingtofindlivehostsonyourcompany'snetworkbyusinganXMASscan.
- BHeisutilizingaSYNscantofindlivehoststhatarelisteningonyournetwork.
- CThis type of scan he is using is called a NULL scan.
- DHe is using a half-open scan to find live hosts on your network.
31John runs a Web server, IDS and firewall on his network. Recently his Web server has been under constant hacking attacks. He looks up the IDS log files and sees no intrusion attempts but the Web server constantly locks up and needs rebooting due to various brute force and buffer overflow attacks but still the IDS alerts no intrusion whatsoever. John becomes suspicious and views the Firewall logs and he notices huge SSL connections constantly hitting his Web server. Hackers have been using the encrypted HTTPS protocol to send exploits to the Web server and that was the reason the IDS did not detect the intrusions. How would John protect his network from these types of attacks?
- AInstallaproxyserverandterminateSSLattheproxy
- BEnabletheIDStofilterencryptedHTTPStraffic
- CInstall a hardware SSL "accelerator" and terminate SSL at this layer
- DEnable the Firewall to filter encrypted HTTPS traffic
32NTP allows you to set the clocks on your systems very accurately, to within 100ms and sometimes-even 10ms. Knowing the exact time is extremely important for enterprise security. Various security protocols depend on an accurate source of time information in order to prevent "playback" attacks. These protocols tag their communications with the current time, to prevent attackers from replaying the same communications, e.g., a login/password interaction or even an entire communication, at a later date. One can circumvent this tagging, if the clock can be set back to the time the communication was recorded. An attacker attempts to try corrupting the clocks on devices on your network. You run Wireshark to detect the NTP traffic to see if there are any irregularities on the network. What port number you should enable in Wireshark display filter to view NTP packets?
- ATCPPort124
- BUDPPort125
- CUDP Port 123
- DTCP Port 126
33Bill is a security analyst for his company. All the switches used in the company's office are Cisco switches. Bill wants to make sure all switches are safe from ARP poisoning. How can Bill accomplish this?
- ABillcanusethecommand:ipdhcpsnooping.
- BBillcanusethecommand:noipsnoop.
- CBill could use the command: ip arp no flood
- DHe could use the command: ip arp no snoop.
34You generate MD5 128-bit hash on all files and folders on your computer to keep a baseline check for security reasons?
What is the length of the MD5 hash?- A32character
- B64byte
- C48 char
- D128 kb
35Which type of password cracking technique works like dictionary attack but adds some numbers and symbols to the words from the dictionary and tries to crack the password?
- ADictionaryattack
- BBruteforcingattack
- CHybrid attack
- DSyllable attack
- ERule-basedattack
36What do you call a pre-computed hash?
- ASuntables
- BAppletables
- CRainbow tables
- DMoon tables
37
The SNMP Read-Only Community String is like a password. The string is sent along with each SNMP Get- Request and allows (or denies) access to a device. Most network vendors ship their equipment with a default password of "public". This is the so-called "default public community string". How would you keep intruders from getting sensitive information regarding the network devices using SNMP? (Select 2 answers)- AEnableSNMPv3whichencryptsusername/passwordauthentication
- BUseyourcompanynameasthepubliccommunitystringreplacingthedefault'public'
- CEnable IP filtering to limit access to SNMP device
- DThe default configuration provided by device vendors is highly secure and you don't need to change anything
38You are writing security policy that hardens and prevents Footprinting attempt by Hackers. Which of the
following countermeasures will NOT be effective against this attack?- AConfigure routers to restrict the responses to Footprinting requests
- BConfigure Web Servers to avoid information leakage and disable unwanted protocols
- CLock the ports with suitable Firewall configuration
- DUse an IDS that can be configured to refuse suspicious traffic and pick up Footprinting patterns
- EEvaluate the information before publishing it on the Website/Intranet
- FMonitor every employee computer with Spy cameras, keyloggers and spy on them
- GPerform Footprinting techniques and remove any sensitive information found on DMZ sites
- HPrevent search engines from caching a Webpage and use anonymous registration services
- IDisable directory and use split-DNS
39Hayden is the network security administrator for her company, a large finance firm based in Miami. Hayden
just returned from a security conference in Las Vegas where they talked about all kinds of old and new
security threats; many of which she did not know of. Hayden is worried about the current security state of
her company's network so she decides to start scanning the network from an external IP address. To see
how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs
responds with a SYN/ACK response. Before the connection is established she sends RST packets to those
hosts to stop the session. She does this to see how her intrusion detection system will log the traffic. What
type of scan is Hayden attempting here?- AHayden is attempting to find live hosts on her company's network by using an XMAS scan
- BShe is utilizing a SYN scan to find live hosts that are listening on her network
- CThe type of scan, she is using is called a NULL scan
- DHayden is using a half-open scan to find live hosts on her network
40Web servers are often the most targeted and attacked hosts on organizations' networks. Attackers may
exploit software bugs in the Web server, underlying operating system, or active content to gain
unauthorized access.
Identify the correct statement related to the above Web Server installation?- ALack of proper security policy, procedures and maintenance
- BBugs in server software, OS and web applications
- CInstalling the server with default settings
- DUnpatched security flaws in the server software, OS and applications
41If an attacker's computer sends an IPID of 24333 to a zombie (Idle Scanning) computer on a closed port,
what will be the response?- AThe zombie computer will respond with an IPID of 24334
- BThe zombie computer will respond with an IPID of 24333
- CThe zombie computer will not send a response
- DThe zombie computer will respond with an IPID of 24335
42Jacob is looking through a traffic log that was captured using Wireshark. Jacob has come across what
appears to be SYN requests to an internal computer from a spoofed IP address. What is Jacob seeing
here?- AJacob is seeing a Smurf attack.
- BJacob is seeing a SYN flood.
- CHe is seeing a SYN/ACK attack
- DHe has found evidence of an ACK flood.
43Which of the following Registry location does a Trojan add entries to make it persistent on Windows 7?
(Select 2 answers)- AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\System32\CurrentVersion\ Run
- CHKEY_CURRENT_USER\Software\Microsoft\Windows\System32\CurrentVersion\Run
- DHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
44Perimeter testing means determining exactly what your firewall blocks and what it allows. To conduct a
good test, you can spoof source IP addresses and source ports. Which of the following command results in
packets that will appear to originate from the system at 10.8.8.8? Such a packet is useful for determining
whether the firewall is allowing random packets in or out of your network.- Ahping3 -T 10.8.8.8 -S netbios -c 2 -p 80
- Bhping3 -Y 10.8.8.8 -S windows -c 2 -p 80
- Chping3 -O 10.8.8.8 -S server -c 2 -p 80
- Dhping3 -a 10.8.8.8 -S springfield -c 2 -p 80
45Keystroke logging is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert
manner so that the person using the keyboard is unaware that their actions are being monitored.
How will you defend against hardware keyloggers when using public computers and Internet Kiosks?
(Select 4 answers)- AAlternate between typing the login credentials and typing characters somewhere else in the focus
window - BType a wrong password first, later type the correct password on the login page defeating the keylogger
recording - CType a password beginning with the last letter and then using the mouse to move the cursor for each
subsequent letter. - DThe next key typed replaces selected text portion. E.g. if the password is "secret", one could type "s", then some dummy keys "asdfsd". Then these dummies could be selected with mouse, and next character from the password "e" is typed, which replaces the dummies "asdfsd"
- AAlternate between typing the login credentials and typing characters somewhere else in the focus
46Lauren is performing a network audit for her entire company. The entire network is comprised of around
500 computers. Lauren starts an ICMP ping sweep by sending one IP packet to the broadcast address of
the network, but only receives responses from around five hosts. Why did this ping sweep only produce a
few responses?- AOnly Windows systems will reply to this scan
- BA switched network will not respond to packets sent to the broadcast address.
- COnly Linux and Unix-like (Non-Windows) systems will reply to this scan
- DOnly servers will reply to this scan
47Wayne is the senior security analyst for his company. Wayne is examining some traffic logs on a server and
came across some inconsistencies. Wayne finds some IP packets from a computer purporting to be on the
internal network. The packets originate from 192.168.12.35 with a TTL of 15. The server replied to this computer and received a response from 192.168.12.35 with a TTL of 21. What can Wayne infer from this traffic log?- AThe initial traffic from 192.168.12.35 was being spoofed.
- BThe traffic from 192.168.12.25 is from a Linux computer
- CThe TTL of 21 means that the client computer is on wireless
- DThe client computer at 192.168.12.35 is a zombie computer.
48What type of port scan is shown below?
- AIdle Scan
- BWindows Scan
- CXMAS Scan
- DSYN Stealth Scan
49How do you defend against ARP Poisoning attack? (Select 2 answers)
- AEnable DHCP Snooping Binding Table
- BRestrict ARP Duplicates
- CEnable Dynamic ARP Inspection
- DEnable MAC snooping Table
50You are the security administrator for a large network. You want to prevent attackers from running any sort
of traceroute into your DMZ and discovering the internal structure of publicly accessible areas of the
network. How can you achieve this?- AThere is no way to completely block tracerouting into this area
- BBlock UDP at the firewall
- CBlock TCP at the firewall
- DBlock ICMP at the firewall
Información
- Descripción
- Informática y Comunicaciones Test sobre CEH 2, creado por ma elideth avila el 28/03/2017.
- Autor
- ma elideth avila
- Idioma
- Español
- Visitas
- 3
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test