Quiz
CEH
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (200)
1Which of the following statements regarding ethical hacking is incorrect?
- AEthical hackers should never use tools or methods that have the potential of exploiting vulnerabilities in an organization’s systems.
- BTesting should be remotely performed offsite.
- CAn organization should use ethical hackers who do not sell vendor hardware/software or other consulting services.
- DEthical hacking should not involve writing to or modifying the target systems.
2First thing you do every office day is to check your email inbox. One morning, you received an email from your best friend and the subject line is quite strange. What should you do?
- ADelete the email and pretend nothing happened.
- BForward the message to your supervisor and ask for her opinion on how to handle the situation.
- CForward the message to your company’s security response team and permanently delete the message from your computer.
- DReply to the sender and ask them for more information about the message contents.
3Bob received this text message on his mobile phone: ““Hello, this is Scott Smelby from the Yahoo Bank. Kindly contact me for a vital transaction on: scottsmelby@yahoo.com””. Which statement below is true?
- AThis is probably a legitimate message as it comes from a respectable organization.
- BBob should write to scottsmelby@yahoo.com to verify the identity of Scott.
- CThis is a scam as everybody can get a @yahoo address, not the Yahoo customer service employees.
- DThis is a scam because Bob does not know Scott.
4In many states sending spam is illegal. Thus, the spammers have techniques to try and ensure that no one knows they sent the spam out to thousands of users at a time. Which of the following best describes what spammers use to hide the origin of these types of e-mails?
- AA blacklist of companies that have their mail server relays configured to allow traffic only to their specific domain name.
- BMail relaying, which is a technique of bouncing e-mail from internal to external mail servers continuously.
- CA blacklist of companies that have their mail server relays configured to be wide open.
- DTools that will reconfigure a mail server’s relay component to send the e-mail back to the spammers occasionally.
5Bob, your senior colleague, has sent you a mail regarding a deal with one of the clients. You are requested to accept the offer and you oblige. After 2 days, Bob denies that he had ever sent a mail. What do you want to know to prove yourself that it was Bob who had send a mail
- AIntegrity
- BConfidentiality
- CAuthentication
- DNon-repudiation
6An IT security engineer notices that the company’s web server is currently being hacked. What should the engineer do next?
- AUnplug the network connection on the company’s web server.
- BDetermine the origin of the attack and launch a counterattack.
- CRecord as much information as possible from the attack.
- DPerform a system restart on the company’s web server.
7A security consultant is trying to bid on a large contract that involves penetration testing and reporting. The company accepting bids wants proof of work so the consultant prints out several audits that have been performed. Which of the following is likely to occur as a result?
- AThe consultant will ask for money on the bid because of great work.
- BThe consultant may expose vulnerabilities of other companies.
- CThe company accepting bids will want the same type of format of testing.
- DThe company accepting bids will hire the consultant because of the great work performed.
8What is the most secure way to mitigate the theft of corporate information from a laptop that was left in a hotel room?
- ABack up everything on the laptop and store the backup in a safe place
- BUse a strong logon password to the operating system
- CEncrypt the data on the hard drive
- DSet a BIOS password
9A hacker is an intelligent individual with excellent computer skills that grant them the ability to explore a computer’s software and hardware without the owner’s permission. Their intention can either be to simply gain knowledge or to illegally make changes. Which of the following class of hacker refers to individual who work both offensively and defensively at various times?
- AGray Hat
- BBlack Hat
- CWhite Hat
- DSuicide Hacker
10Nation-state threat actors often discover vulnerabilities and hold on to them until they want to launch a sophisticated attack. The Stuxnet attack was an unprecedented style of attack because it used four types of vulnerability. What is this style of attack called?
- Azero-day
- Bzero-hour
- Czero-sum
- Dno-day
11A newly discovered flaw in a software application would be considered which kind of security vulnerability?
- AInput validation flaw
- BHTTP header injection vulnerability
- C0-day vulnerability
- DTime-to-check to time-to-use flaw
12An IT employee got a call from one of our best customers. The caller wanted to know about the company’s network infrastructure, systems, and team. New opportunities of integration are in sight for both company and customer. What should this employee do?
- ASince the company’s policy is all about Customer Service, he/she will provide information.
- BDisregarding the call, the employee should hang up.
- CThe employee should not provide any information without previous management authorization.
- DThe employees can not provide any information; but, anyway, he/she will provide the name of the person in charge.
13A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should he do?
- AIgnore it.
- BTry to sell the information to a well-paying party on the dark web.
- CExploit the vulnerability without harming the web site owner so that attention be drawn to the problem.
- DNotify the web site owner so that corrective action be taken as soon as possible to patch the vulnerability.
14To reduce the attack surface of a system, administrators should perform which of the following processes to remove unnecessary software, services, and insecure configuration settings?
- AHarvesting
- BWindowing
- CHardening
- DStealthing
15An unauthorized individual enters a building following an employee through the employee entrance after the lunch rush. What type of breach has the individual just performed?
- AAnnounced
- BPiggybacking
- CReverse Social Engineering
- DTailgating
16Jimmy is standing outside a secure entrance to a facility. He is pretending to having a tense conversation on his cell phone as an authorized employee badges in. Jimmy, while still on the phone, grabs the door as it begins to close. What just happened?
- AMasquerading
- BWhaling
- CPhishing
- DTailgating (Piggybacking)
17It is an entity or event with the potential to adversely impact a system through unauthorized access, destruction, disclosure, denial of service or modification of data.
Which of the following terms best matches the definition?- AThreat
- BAttack
- CVulnerability
- DRisk
18A certified ethical hacker (CEH) is approached by a friend who believes her husband is cheating. She offers to pay to break into her husband’s email account in order to find proof so she can take him to court. What is the ethical response?
- ASay no; the friend is not the owner of the account.
- BSay yes; the friend needs help to gather evidence.
- CSay yes; do the job for free.
- DSay no; make sure that the friend knows the risk she’s asking the CEH to take.
19A computer technician is using a new version of a word processing software package when it is discovered that a special sequence of characters causes the entire computer to crash. The technician researches the bug and discovers that no one else experienced the problem. What is the appropriate next step?
- AIgnore the problem completely and let someone else deal with it.
- BCreate a document that will crash the computer when opened and send it to friends.
- CFind an underground bulletin board and attempt to sell the bug to the highest bidder.
- DNotify the vendor of the bug and do not disclose it until the vendor gets a chance to issue a fix.
20While you were gathering information as part of security assessments for one of your clients, you were able to gather data that show your client is involved with fraudulent activities. What should you do?
- AImmediately stop work and contact the proper legal authorities
- BIgnore the data and continue the assessment until completed as agreed
- CConfront the client in a respectful manner and ask her about the data
- DCopy the data to removable media and keep it in case you need it
21A consultant has been hired by the V.P. of a large financial organization to assess the company’s security posture. During the security testing, the consultant comes across child pornography on the V.P.’s computer.
What is the consultant’s obligation to the financial organization?- ASay nothing and continue with the security testing.
- BStop work immediately and contact the authorities.
- CDelete the pornography, say nothing, and continue security testing.
- DBring the discovery to the financial organization’s human resource department.
22Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved in human trafficking.
What should you do?- AImmediately stop work and contact the proper legal authorities
- BConfront the client in a respectful manner and ask her about the data
- CCopy the data to removable media and keep it in case you need it
- DIgnore the data and continue the assessment until completed as agreed
23A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying. What actions should the CEH take?
- AThreaten to publish the penetration test results if not paid.
- BFollow proper legal procedures against the company to request payment.
- CTell other customers of the financial problems with payments from this company.
- DExploit some of the vulnerabilities found on the company webserver to deface it.
24An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk assessments. A friend recently started a company and asks the hacker to perform a penetration test and vulnerability assessment of the new company as a favor. What should the hacker’s next step be before starting work on this job?
- AStart by foot printing the network and mapping out a plan of attack.
- BAsk the employer for authorization to perform the work outside the company.
- CBegin the reconnaissance phase with passive information gathering and then move into active information gathering.
- DUse social engineering techniques on the friend’s employees to help identify areas that may be susceptible to attack.
25Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is the best protection that will work for her?
- ABIOS password
- BPassword protected files
- CHidden folders
- DFull disk encryption
26Backing up data is a security must. However, it also has certain level of risks when mishandled. Which of the following is the greatest threat posed by backups?
- AA backup is the source of Malware or illicit information
- BA backup is incomplete because no verification was performed
- CA backup is unavailable during disaster recovery
- DAn unencrypted backup can be misplaced or stolen
27A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system. What is the first step that the bank should take before enabling the audit feature?
- APerform a cost/benefit analysis of the audit feature
- BDetermine the impact of enabling the audit feature
- CPerform a vulnerability scan of the system
- DAllocate funds for staffing of audit log review
28Low humidity in a data center can cause which of the following problems?
- AHeat
- BCorrosion
- CStatic electricity
- DAirborne contamination
29Which of the following examples best represents a logical or technical control?
- ASecurity tokens
- BHeating and air conditioning
- CSmoke and fire alarms
- DCorporate security policy
30What is one thing a tester can do to ensure that the software is trusted and is not changing or tampering with critical data on the back end of a system it is loaded on?
- AProper testing
- BSecure coding principles
- CSystems security and architecture review
- DAnalysis of interrupts within the software
31What would you type on the Windows command line in order to launch the Computer Management Console provided that you are logged in as an admin?
- Ac:\\compmgmt.msc
- Bc:\\gpedit
- Cc:\\ncpa.cpl
- Dc:\\services.msc
32If you are to determine the attack surface of an organization, which of the following security operations is the BEST thing to do?
- ARunning a network scan to detect network services in the corporate DMZ
- BReviewing the need for a security clearance for each employee
- CUsing configuration management to determine when and where to apply security patches
- DTraining employees on the security policy regarding social engineering
33A big company, who wanted to test their security infrastructure, wants to hire elite pen testers like you. During the interview, they asked you to show sample reports from previous penetration tests. What should you do?
- AShare reports, after NDA is signed
- BShare full reports, not redacted
- CDecline but, provide references
- DShare full reports with redactions
34Your next door neighbor, that you do not get along with, is having issues with their network, so he yells to his spouse the network’s SSID and password and you hear them both clearly. What do you do with this information?
- ANothing, but suggest to him to change the network’s SSID and password.
- BSell his SSID and password to friends that come to your house, so it doesn’t slow down your network.
- CLog onto to his network, after all it’s his fault that you can get in.
- DOnly use his network when you have large downloads so you don’t tax your own network.
35What network security concept requires multiple layers of security controls to be placed throughout an IT infrastructure, which improves the security posture of an organization to defend against malicious attacks or potential vulnerabilities?
- ASecurity through obscurity
- BHost-Based Intrusion Detection System
- CDefense in depth
- DNetwork-Based Intrusion Detection System
36You are performing a penetration test. You achieved access via a buffer overflow exploit and you proceed to find interesting data, such as files with usernames and passwords. You find a hidden folder that has the administrator’s bank account password and login information for the administrator’s bitcoin account.
What should you do?- ATransfer money from the administrator’s account to another account.
- BDo not report it and continue the penetration test.
- CDo not transfer the money but steal the bitcoins.
- DReport immediately to the administrator.
37Scenario:
1. Victim opens the attacker’s web site.
2. Attacker sets up a web site which contains interesting and attractive content like ‘Do you want to make $1000 in a day?’.
3. Victim clicks to the interesting and attractive content url.
4. Attacker creates a transparent ‘iframe’ in front of the url which victim attempt to click, so victim thinks that he/she clicks to the ‘Do you want to make $1000 in a day?’ url but actually he/she clicks to the content or url that exists in the transparent ‘iframe’ which is setup by the attacker. What is the name of the attack which is mentioned in the scenario?- AHTTP Parameter Pollution (Manipulating query parameters on URL)
- BHTML Injection (Control input point to inject arbitrary HTML code into vulnerable page)
- CSession Fixation (Hijack valid user session, allows one person to fixate another person session ID)
- DClickJacking Attack (UI redress attack when user is tricked to click on something)
38Which type of security feature stops vehicles from crashing through the doors of a building?
- ATurnstile
- BBollards
- CMantraps
- DReceptionist
39During a security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?
- AIdentify and evaluate existing practices
- BCreate a procedures document
- CConduct compliance testing
- DTerminate the audit
40Which of the following is an advantage of utilizing security testing methodologies to conduct a security audit?
- AThey provide a repeatable framework.
- BAnyone can run the command line scripts.
- CThey are available at low cost.
- DThey are subject to government regulation.
41Which of the following can the administrator do to verify that a tape backup can be recovered in its entirety?
- ARestore a random file.
- BPerform a full restore.
- CRead the first 512 bytes of the tape.
- DRead the last 512 bytes of the tape.
42Knowing the nature of backup tapes, which of the following is the MOST RECOMMENDED way of storing backup tapes?
- AIn a cool dry environment
- BInside the data center for faster retrieval in a fireproof safe
- CIn a climate controlled facility offsite
- DOn a different floor in the same building
43Security Policy is a definition of what it means to be secure for a system, organization or other entity. For Information Technologies, there are sub-policies like; Computer Security Policy, Information Protection Policy, Information Security Policy, Network Security Policy, Physical Security Policy, Remote Access Policy, User Account Policy. What is main theme of the sub-policies for Information Technologies?
- AAuthenticity, Confidentiality, Integrity
- BConfidentiality, Integrity, Availability
- CAvailability, Non-repudiation, Confidentiality
- DAuthenticity, Integrity, Non-repudiation
44An enterprise recently moved to a new office and the new neighborhood is a little risky. The CEO wants to monitor the physical perimeter and the entrance doors 24 hours. What is the best option to do this job?
- AUse fences in the entrance doors.
- BInstall a CCTV with cameras pointing to the entrance doors and the street.
- CUse an IDS in the entrance doors and install some of them near the corners.
- DUse lights in all the entrance doors and along the company’s perimeter.
45If executives are found liable for not properly protecting their company’s assets and information systems, what type of law would apply in this situation?
- ACommon
- BCivil
- CInternational
- DCriminal
46Which type of security document is written with specific step-by-step details?
- AProcess
- BProcedure
- CPolicy
- DParadigm
47A security policy will be more accepted by employees if it is consistent and has the support of
- Acoworkers
- Bexecutive management
- Cthe security officer
- Da supervisor
48Which of the following is a detective control?
- ASmart card authentication
- BSecurity policy
- CAudit trail
- DContinuity of operations plan
49Which of the following is a preventive control?
- ASmart card authentication
- BSecurity policy
- CAudit trail
- DContinuity of operations plan
50A Network Administrator was recently promoted to Chief Security Officer at a local university. One of employee’s new responsibilities is to manage the implementation of an RFID card access system to a new server room on campus. The server room will house student enrollment information that is securely backed up to an off-site location.
During a meeting with an outside consultant, the Chief Security Officer explains that he is concerned that the existing security controls have not been designed properly. Currently, the Network Administrator is responsible for approving and issuing RFID card access to the server room, as well as reviewing the electronic access logs on a weekly basis.
Which of the following is an issue with the situation?- ASegregation of duties
- BUndue influence
- CLack of experience
- DInadequate disaster recovery plan
51A company has hired a security administrator to maintain and administer Linux and Windows-based systems.
Written in the nightly report file is the following:
Firewall log files are at the expected value of 4 MB. The current time is 12am. Exactly two hours later the size has decreased considerably. Another hour goes by and the log files have shrunk in size again.
Which of the following actions should the security administrator take?- ALog the event as suspicious activity and report this behavior to the incident response team immediately.
- BLog the event as suspicious activity, call a manager, and report this as soon as possible.
- CRun an anti-virus scan because it is likely the system is infected by malware.
- DLog the event as suspicious activity, continue to investigate, and act according to the site’s security policy.
52The precaution of prohibiting employees from bringing personal computing devices into a facility is what type of security control?
- APhysical
- BProcedural
- CTechnical
- DCompliance
53Which of the following business challenges could be solved by using a vulnerability scanner?
- AAuditors want to discover if all systems are following a standard naming convention.
- BA web server was compromised and management needs to know if any further systems were compromised.
- CThere is an emergency need to remove administrator access from multiple machines for an employee that quit.
- DThere is a monthly requirement to test corporate compliance with host application usage and security policies.
54How can a policy help improve an employee’s security awareness?
- ABy implementing written security procedures, enabling employee security training, and promoting the benefits of security
- BBy using informal networks of communication, establishing secret passing procedures, and immediately terminating employees
- CBy sharing security secrets with employees, enabling employees to share secrets, and establishing a consultative help line
- DBy decreasing an employee’s vacation time, addressing ad-hoc employment clauses, and ensuring that managers know employee strengths
55Due to a slowdown of normal network operations, IT department decided to monitor internet traffic for all of the employees. From a legal stand point, what would be troublesome to take this kind of measure?
- AAll of the employees would stop normal work activities
- BIT department would be telling employees who the boss is
- CNot informing the employees that they are going to be monitored could be an invasion of privacy.
- DThe network could still experience traffic slow down.
56Craig received a report of all the computers on the network that showed all the missing patches and weak passwords. What type of software generated this report?
- Aa port scanner
- Ba vulnerability scanner
- Ca virus scanner
- Da malware scanner
57Which of the following processes evaluates the adherence of an organization to its stated security policy?
- AVulnerability assessment
- BPenetration testing
- CRisk assessment
- DSecurity auditing
58The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company’s external webserver, VPN concentrator, and DNS servers. What should the security team do to determine which alerts to check first?
- AInvestigate based on the maintenance schedule of the affected systems.
- BInvestigate based on the service level agreements of the systems.
- CInvestigate based on the potential effect of the incident.
- DInvestigate based on the order that the alerts arrived in.
59As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing.
What document describes the specifics of the testing, the associated violations, and essentially protects both the organization’s interest and your liabilities as a tester?- AProject Scope
- BRules of Engagement
- CService Level Agreement
- DNon-Disclosure Agreement
60In an internal security audit, the white hat hacker gains control over a user account and attempts to acquire access to another account’s confidential files and information. How can he achieve this?
- APort Scanning
- BHacking Active Directory
- CPrivilege Escalation
- DShoulder-Surfing
61Least privilege is a security concept that requires that a user is
- Alimited to those functions required to do the job.
- Bgiven root or administrative privileges.
- Ctrusted to keep all data and access to that data under their sole control.
- Dgiven privileges equal to everyone else in the department.
62When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?
- AA bottom-up approach
- BA top-down approach
- CA senior creation approach
- DAn IT assurance approach
63Defining rules, collaborating human workforce, creating a backup plan, and testing the plans are within what phase of the Incident Handling Process?
- APreparation phase
- BContainment phase
- CRecovery phase
- DIdentification phase
64What is the term coined for logging, recording and resolving events in a company?
- AInternal Procedure
- BSecurity Policy
- CIncident Management Process
- DMetrics
65Describes the specifics of the testing, the associated violations, and essentially protects both the bank’s interest and your liabilities as a tester?
- AService Level Agreement
- BNon-Disclosure Agreement
- CTerms of Engagement
- DProject Scope
66Which initial procedure should an ethical hacker perform after being brought into an organization?
- ABegin security testing.
- BTurn over deliverables.
- CSign a formal contract with non-disclosure.
- DAssess what the organization is trying to protect.
67Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?
- ARegulatory compliance
- BPeer review
- CChange management
- DPenetration testing
68How do employers protect assets with security policies pertaining to employee surveillance activities?
- AEmployers promote monitoring activities of employees as long as the employees demonstrate trustworthiness.
- BEmployers use informal verbal communication channels to explain employee monitoring activities to employees.
- CEmployers use network surveillance to monitor employee email traffic, network access, and to record employee keystrokes.
- DEmployers provide employees written statements that clearly discuss the boundaries of monitoring activities and consequences.
69Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?
- ASarbanes-Oxley Act (SOX)
- BGramm-Leach-Bliley Act (GLBA)
- CFair and Accurate Credit Transactions Act (FACTA)
- DFederal Information Security Management Act (FISMA)
70It has been reported to you that someone has caused an information spillage on their computer. You go to the computer, disconnect it from the network, remove the keyboard and mouse, and power it down. What step in incident handling did you just complete?
- AContainment (Keeping something harmful under control)
- BEradication (Removing cause of incident)
- CRecovery (Restoration, back to normal)
- DDiscovery
71Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?
- AIncident response services to any user, company, government agency, or organization in partnership with the Department of Homeland Security
- BMaintenance of the nation’s Internet infrastructure, builds out new Internet infrastructure, and decommissions old Internet infrastructure
- CRegistration of critical penetration testing for the Department of Homeland Security and public and private sectors
- DMeasurement of key vulnerability assessments on behalf of the Department of Defense (DOD) and State Department, as well as private sectors
72Which of the following is a primary service of the U.S. Computer Security Incident Response Team (CSIRT)?
- ACSIRT provides an incident response service to enable a reliable and trusted single point of contact for reporting computer security incidents worldwide.
- BCSIRT provides a computer security surveillance service to supply a government with important intelligence information on individuals travelling abroad.
- CCSIRT provides a penetration testing service to support exception reporting on incidents worldwide by individuals and multi-national corporations.
- DCSIRT provides a vulnerability assessment service to assist law enforcement agencies with profiling an individual’s property or company’s asset.
73What are the three types of compliance that the Open Source Security Testing Methodology Manual (OSSTMM) recognizes?
- ALegal, performance, audit
- BAudit, standards based, regulatory
- CContractual, regulatory, industry
- DLegislative, contractual, standards based
74 Under the “Post-attack Phase and Activities”, it is the responsibility of the tester to restore the systems to a pretest state.
Which of the following activities should not be included in this phase?
I. Removing all files uploaded on the system
II. Cleaning all registry entries
III. Mapping of network state
IV. Removing all tools and maintaining backdoor for reporting- AIII
- BIV
- CIII and IV
- DAll should be included
75It is a regulation that has a set of guidelines, which should be adhered to by anyone who handles any electronic medical data. These guidelines stipulate that all medical practices must ensure that all necessary measures are in place while saving, accessing, and sharing any electronic medical data to keep patient data secure.
Which of the following regulations best matches the description?- ACOBIT
- BFISMA
- CISO/IEC 27002
- DHIPAA
76Which of the following act requires employers standard national numbers to identify them on standard transactions
- APCI-DSS
- BHIPAA
- CDMCA
- DSOX
77Which of the following tools would be the best choice for achieving compliance with PCI Requirement 11?
- ATruecrypt
- BSub7
- CNessus
- DClamwin
78Security and privacy of/on information systems are two entities that requires lawful regulations. Which of the following regulations defines security and privacy controls for Federal information systems and organizations?
- ANIST SP 800-53
- BPCI-DSS
- CEU Safe Harbor
- DHIPAA
79International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining
- Aguidelines and practices for security controls.
- Bfinancial soundness and business viability metrics.
- Cstandard best practice for configuration management.
- Dcontract agreement writing standards.
80What is the name of the international standard that establishes a baseline level of confidence in the security functionality of IT products by providing a set of requirements for evaluation?
- ABlue Book
- BISO 26029
- CCommon Criteria
- DThe Wassenaar Agreement
81Which of the following guidelines or standards is associated with the credit card industry?
- AControl Objectives for Information and Related Technology (COBIT)
- BSarbanes-Oxley Act (SOX)
- CHealth Insurance Portability and Accountability Act (HIPAA)
- DPayment Card Industry Data Security Standards (PCI DSS)
82This international organization regulates billions of transactions daily and provides security guidelines to protect personally identifiable information (PII). These security controls provide a baseline and prevent low-level hackers sometimes known as script kiddies from causing a data breach. Which of the following organizations is being described?
- APayment Card Industry (PCI)
- BCenter for Disease Control (CDC)
- CInstitute of Electrical and Electronics Engineers (IEEE)
- DInternational Security Industry Organization (ISIO)
83What is not a PCI compliance recommendation?
- ALimit access to card holder data to as few individuals as possible.
- BUse encryption to protect all transmission of card holder data over any public network.
- CRotate employees handling credit card transactions on a yearly basis to different departments.
- DUse a firewall between the public network and the payment card data.
84When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?
- AAt least twice a year and after any significant infrastructure or application upgrade or modification
- BAt least once a year and after any significant infrastructure or application upgrade or modification
- CAt least once every two years and after any significant infrastructure or application upgrade or modification
- DAt least once every three years and after any significant infrastructure or application upgrade or modification
85Which of the following is NOT an ideal choice for biometric controls?
- AIris patterns
- BFingerprints
- CHeight and weight
- DVoice
86What are the three types of authentication?
- ASomething you: know, remember, prove
- BSomething you: have, know, are
- CSomething you: show, prove, are
- DSomething you: show, have, prove
87By using a smart card and pin, you are using a two-factor authentication that satisfies
- ASomething you know and something you are
- BSomething you have and something you know
- CSomething you have and something you are
- DSomething you are and something you remember
88Which of the following is an example of two factor authentication?
- APIN Number and Birth Date
- BUsername and Password
- CDigital Certificate and Hardware Token
- DFingerprint and Smartcard ID
89Which set of access control solutions implements two-factor authentication?
- AUSB token and PIN
- BFingerprint scanner and retina scanner
- CPassword and PIN
- DAccount and password
90Bob learned that his username and password for a popular game has been compromised. He contacts the company and resets all the information. The company suggests he use two-factor authentication, which option below offers that?
- AA new username and password
- BDisable his username and use just a fingerprint scanner.
- CHis username and a stronger password
- DA fingerprint scanner and his username and password
91Todd has been asked by the security officer to purchase a counter-based authentication system. Which of the following best describes this type of system?
- AA biometric system that bases authentication decisions on behavioral attributes.
- Bbiometric system that bases authentication decisions on physical attributes.
- CAn authentication system that creates one-time passwords that are encrypted with secret keys.
- DAn authentication system that uses passphrases that are converted into virtual passwords.
92Which of the following is optimized for confidential communications, such as bidirectional voice and video?
- ARC4
- BRC5
- CMD$
- DMD5
93Which type of scan measures a person’s external features through a digital video camera?
- AIris scan
- BRetinal scan
- CFacial recognition scan
- DSignature kinetics scan
94Which type of scan is used on the eye to measure the layer of blood vessels?
- AFacial recognition scan
- BRetinal scan
- CIris scan
- DSignature kinetics scan
95What is the main reason the use of a stored biometric is vulnerable to an attack?
- AThe digital representation of the biometric might not be unique, even if the physical characteristic is unique.
- BAuthentication using a stored biometric compares a copy to a copy instead of the original to a copy.
- CA stored biometric is no longer “something you are” and instead becomes “something you have”.
- DA stored biometric can be stolen and used by an attacker to impersonate the individual identified by the biometric.
96What is the best defense against privilege escalation vulnerability?
- APatch systems regularly and upgrade interactive login privileges at the system administrator level.
- BRun administrator and applications on least privileges and use a content registry for tracking.
- CRun services with least privileged accounts and implement multi-factor authentication and authorization.
- DReview user roles and administrator privileges for maximum utilization of automation services.
97Which access control mechanism allows for multiple systems to use a central authentication server (CAS) that permits users to authenticate once and gain access to multiple systems?
- ARole Based Access Control (RBAC)
- BDiscretionary Access Control (DAC)
- CWindows authentication
- DSingle sign-on
98When purchasing a biometric system, one of the considerations that should be reviewed is the processing speed. Which of the following best describes what it is meant by processing?
- AThe amount of time it takes to convert biometric data into a template on a smart card.
- BThe amount of time and resources that are necessary to maintain a biometric system.
- CThe amount of time it takes to be either accepted or rejected form when an individual provides Identification and authentication information.
- DHow long it takes to setup individual user accounts.
99A large mobile telephony and data network operator has a data that houses network elements. These are essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS systems. What is the best security policy concerning this setup?
- ANetwork elements must be hardened with user ids and strong passwords. Regular security tests and audits should be performed.
- BAs long as the physical access to the network elements is restricted, there is no need for additional measures.
- CThere is no need for specific security measures on the network elements as long as firewalls and IPSsystems exist.
- DThe operator knows that attacks and down time are inevitable and should have a backup site.
100A company recently hired your team of Ethical Hackers to test the security of their network systems. The company wants to have the attack be as realistic as possible. They did not provide any information besides the name of their company. What phase of security testing would your team jump in right away?
- AScanning
- BReconnaissance
- CEscalation
- DEnumeration
101Passive reconnaissance involves collecting information through which of the following?
- ASocial Engineering
- BNetwork traffic sniffing
- CMan in the middle attacks
- DPublicly accessible sources
102Which results will be returned with the following Google search query? site:target.com -site:Marketing.target.com accounting
- AResults from matches on the site marketing.target.com that are in the domain target.com but do not include the word accounting
- BResults for matches on target.com and Marketing.target.com that include the word “accounting”
- CResults matching “accounting” in domain target.com but not on the site Marketing.target.com
- DResults matching all words in the query
103Which one of the following Google advanced search operators allows an attacker to restrict the results to those websites in the given domain
- A[site:]
- B[cache:]
- C[link:]
- D[inurl:]
104This phase will increase the odds of success in later phases of the penetration test. It is also the very first step in Information Gathering, and it will tell you what the “landscape” looks like. Which of the following is the most important phase of ethical hacking wherein you need to spend considerable amount of time?
- AGaining access
- BEscalating privileges
- CNetwork mapping
- DFootprinting
105In which phase of the ethical hacking process can Google hacking be employed? This is a technique that involves manipulating a search string with specific operators to search for vulnerabilities. Example:
allintitle: root passwd- AMaintaining Access
- BGaining Access
- CRecon
- DScanning and Enumeration
106When you are collecting information to perform a data analysis, Google commands are very useful to find sensitive information and files. These files may contain information about passwords, system functions, or documentation.
What command will help you to search files using Google as a search engine?- Asite: target.com filetype:xls username password email
- Binurl: target.com filename:xls username password email
- Cdomain: target.com archive:xls username password email
- Dsite: target.com file:xls username password email
107What tool should you use when you need to analyze extracted metadata from files you collected when you were in the initial stage of penetration test (information gathering)?
- AArmitage (GUI that visualizes targets and recommends exploits)
- BDimitry (Deepmagic Information Gathering Tool)
- CMetagoofil
- Dcdpsnarf (extract information from CDP packets)
108What is the way to decide how a packet will move from an untrusted outside host to a protected inside that is behind a firewall, which permits the hacker to determine which ports are open and if the packets can pass through the packet-filtering of the firewall.
- AFirewalking
- BSession hijacking
- CMitM Attack
- DNetwork sniffing
109Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results?
TCP port 21 – no response
TCP port 22 – no response
TCP port 23 – Time-to-live exceeded- AThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target host.
- B. The lack of response from ports 21 and 22 indicate that those services are not running on the destination server.
- CThe scan on port 23 passed through the filtering device. This indicates that port 23 was not blocked at the firewall.
- DThe scan on port 23 was able to make a connection to the destination host prompting the firewall to respond with a TTL error.
110A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank’s DNS servers, reading news articles online about the bank, watching what times the bank employees come into work and leave from work, searching the bank’s job postings (paying special attention to IT related jobs), and visiting the local dumpster for the bank’s corporate office. What phase of the penetration test is the tester currently in?
- AInformation reporting
- BVulnerability assessment
- CActive information gathering
- DPassive information gathering
111A Security Engineer at a medium-sized accounting firm has been tasked with discovering how much information can be obtained from the firm’s public facing web servers. The engineer decides to start by using netcat to port 80. The engineer receives this output: HTTP/1.1 200 OK
Server: Microsoft-IIS/6
Expires: Tue, 17 Jan 2011 01:41:33 GMT
Date: Mon, 16 Jan 2011 01:41:33 GMT
Content-Type: text/html
Accept-Ranges: bytes
Last-Modified: Wed, 28 Dec 2010 15:32:21 GMT
ETag: “b0aac0542e25c31:89d”
Content-Length: 7369
Which of the following is an example of what the engineer performed?- ABanner grabbing
- BCross-site scripting
- CSQL injection
- DWhois database query
112An attacker tries to do banner grabbing on a remote web server and executes the following command.
$ nmap -sV host.domain.com -p 80
He gets the following output.
Starting Nmap 6.47 ( http://nmap.org ) at 2014-12-08 19:10 EST
Nmap scan report for host.domain.com (108.61.158.211)
Host is up (0.032s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd
Service detection performed. Please report any incorrect results at http://nmap.org/submit/.Nmap done: 1 IP address (1 host up) scanned in 6.42 seconds
What did the hacker accomplish?- Anmap can’t retrieve the version number of any running remote service.
- BThe hacker successfully completed the banner grabbing.
- CThe hacker should’ve used nmap -O host.domain.com.
- DThe hacker failed to do banner grabbing as he didn’t get the version of the Apache web server.
113Which of the following open source tools would be the best choice to scan a network for potential targets?
- ANmap
- BNikto
- CCain
- DJohn the Ripper
114 Which of the following resources does NMAP need to be used as a basic vulnerability scanner covering several vectors like SMB, HTTP and FTP?
- AMetasploit scripting engine
- BNessus scripting engine
- CNMAP scripting engine
- DSAINT scripting engine
115You are using NMAP to resolve domain names into IP addresses for a ping sweep later.
Which of the following commands looks for IP addresses?- A>host -t a hackeddomain.com
- B>host -t soa hackeddomain.com
- C>host -t ns hackeddomain.com
- D>host -t AXFR hackeddomain.com
116Which of the following is an NMAP script that could help detect HTTP Methods such as GET, POST, HEAD, PUT, DELETE, TRACE?
- Ahttp-git
- Bhttp-headers
- Chttp enum
- Dhttp-methods
117You’re doing an internal security audit and you want to find out what ports are open on all the servers. What is the best way to find out?
- AScan servers with Nmap
- BPhysically go to each server
- CScan servers with MBSA
- DTelnet to every port on each server
118NMAP -sn 192.168.11.200-215
The NMAP command above performs which of the following?- AA ping scan
- BA trace sweep
- CAn operating system detect
- DA port scan
119If you want to only scan fewer ports than the default scan using Nmap tool, which option would you use?
- A-r
- B-F
- C-sP
- D-P
120Port scanning can be used as part of a technical assessment to determine network vulnerabilities. The TCP XMAS scan is used to identify listening ports on the targeted system. While doing a technical assessment to determine network vulnerabilities, you used the TCP XMAS scan. What would be the response of all open ports?
- AThe port will send an ACK
- BThe port will send a SYN
- CThe port will ignore the packets
- DThe port will send an RST
121 An attacker scans a host with the below command. Which three flags are set
# nmap -sX host.domain.com- AThis is Xmas scan. SYN and ACK flags are set.
- BThis is SYN scan. SYN flag is set.
- CThis is Xmas scan. URG, PUSH and FIN are set.
- DThis is ACK scan. ACK flag is set.
122Which of the following will perform an Xmas scan using NMAP? (sX means Xmas)
- Anmap -sA 192.168.1.254 (ACK Scan)
- Bnmap -sP 192.168.1.254 (Ping scan)
- Cnmap -sX 192.168.1.254
- Dnmap -sV 192.168.1.254 (Version detection)
123What is the best Nmap command to use when you want to list all devices in the same network quickly after you successfully identified a server whose IP address is 10.10.0.5?
- Anmap -T4 -F 10.10.0.0/24
- Bnmap -T4 -q 10.10.0.0/24
- Cnmap -T4 -O 10.10.0.0/24
- Dnmap -T4 -r 10.10.1.0/24
124Which Nmap option would you use if you were not concerned about being detected and wanted to perform a very fast scan?
- A-A
- B-O
- C-T5
- D-T0
125A security engineer is attempting to map a company’s internal network. The engineer enters in the following NMAP command:
NMAP –n –sS –P0 –p 80 ***.***.**.**
What type of scan is this?- AQuick scan
- BIntense scan
- CStealth scan
- DComprehensive scan
126A hacker is attempting to see which IP addresses are currently active on a network. Which NMAP switch would the hacker use?
- A–sO
- B-sP
- C-sS
- D-sU
127A hacker is attempting to see which ports have been left open on a network. Which NMAP switch would the hacker use?
- A-sO
- B-sP
- C-sS
- D-sU
128Which of the following parameters enables NMAP’s operating system detection feature?
- A-sV
- B-oS
- C-sR
- D-O
129What results will the following command yield: ‘NMAP -sS -O -p 123-153 192.168.100.3’?
- AA stealth scan, opening port 123 and 153
- BA stealth scan, checking open ports 123 to 153
- CA stealth scan, checking all open ports excluding ports 123 to 153
- DA stealth scan, determine operating system, and scanning ports 123 to 153
130Which NMAP command combination would let a tester scan every TCP port from a class C network that is blocking ICMP with fingerprinting and service detection?
- ANMAP -PN -A -O -sS 192.168.2.0/24
- BNMAP -P0 -A -O -p1-65535 192.168.0/24
- CNMAP -P0 -A -sT -p0-65535 192.168.0/16
- DNMAP -PN -O -sS -p 1-1024 192.168.0/8
131Which of the following Nmap commands will produce the following output?
Output: Starting Nmap 6.47 (http://nmap.org ) at 2015-05-26 12:50 EDT
Nmap scan report for 192.168.1.1
Host is up (0.00042s latency).
Not shown: 65530 open|filtered ports, 65529 filtered ports
PORT STATE SERVICE
111/tcp open rpcbind
999/tcp open garcon
1017/tcp open unknown
1021/tcp open exp1
1023/tcp open netvenuechat
2049/tcp open nfs
17501/tcp open unknown
111/udp open rpcbind
123/udp open ntp
137/udp open netbios-ns
2049/udp open nfs
5353/udp open zeroconf
17501/udp open|filtered unknown
51857/udp open|filtered unknown
54358/udp open|filtered unknown
56228/udp open|filtered unknown
57598/udp open|filtered unknown
59488/udp open|filtered unknown
60027/udp open|filtered unknown- Anmap -sN -Ps -T4 192.168.1.1
- Bnmap -sT -sX -Pn -p 1-65535 192.168.1.1
- Cnmap -sS -Pn 192.168.1.1
- Dnmap -sS -sU -Pn -p 1-65535 192.168.1.1
132Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by the network’s IDS?
- ATiming options to slow the speed that the port scan is conducted
- BFingerprinting to identify which operating systems are running on the network
- CICMP ping sweep to determine which hosts on the network are not available
- DTraceroute to control the path of the packets sent during the scan
133Emil uses nmap to scan two hosts using this command.
nmap -sS -T4 -O 192.168.99.1 192.168.99.7
He receives this output:Nmap scan report for 192.168.99.1
Host is up (0.00082s latency).
Not shown: 994 filtered ports
PORT STATE SERVICE
21/tcp open ftp
23/tcp open telnet
53/tcp open domain
80/tcp open http
161/tcp closed snmp
MAC Address: B0:75:D5:33:57:74 (ZTE)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 – 2.6.33
Network Distance: 1 hop
Nmap scan report for 192.168.99.7
Host is up (0.000047s latency).
All 1000 scanned ports on 192.168.99.7 are closed
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops
What is his conclusion?- AHost 192.168.99.7 is an iPad.
- BHe performed a SYN scan and OS scan on hosts 192.168.99.1 and 192.168.99.7.
- CHost 192.168.99.1 is the host that he launched the scan from.
- DHost 192.168.99.7 is down.
134Which of the following tools will scan a network to perform vulnerability checks and compliance auditing?
- ANMAP
- BMetasploit
- CNessus
- DBeEF
135Your company was hired by a small healthcare provider to perform a technical assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer?
- AUse a scan tool like Nessus
- BUse the built-in Windows Update tool
- CCheck MITRE.org for the latest list of CVE findings
- DCreate a disk image of a clean Windows installation
136On a Linux device, which of the following commands will start the Nessus client in the background so that the Nessus server can be configured?
- Anessus +
- Bnessus *s
- Cnessus &
- Dnessus -d
137Which of the following settings enables Nessus to detect when it is sending too many packets and the network pipe is approaching capacity?
- ANetstat WMI Scan
- BSilent Dependencies
- CConsider unscanned ports as closed
- DReduce parallel connections on congestion
138You want to analyze packets on your wireless network. Which program would you use?
- AWireshark with Airpcap
- BAirsnort with Airpcap
- CWireshark with Winpcap
- DEthereal with Winpcap
139In Wireshark, the packet bytes panes show the data of the current packet in which format?
- ADecimal
- BASCII only
- CHexadecimal
- DBinary
140The network administrator contacts you and tells you that she noticed the temperature on the internal wireless router increases by more than 20% during weekend hours when the office was closed. She asks you to investigate the issue because she is busy dealing with a big conference and she doesn’t have time to perform the task.
What tool can you use to view the network traffic being sent and received by the wireless router?- AWireshark
- BNessus
- CNetcat
- DNetstat
141Which of the following problems can be solved by using Wireshark?
- ATracking version changes of source code
- BChecking creation dates on all webpages on a server
- CResetting the administrator password on multiple systems
- DTroubleshooting communication resets between two systems
142When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?
- ANetwork tap
- BLayer 3 switch
- CNetwork bridge
- DApplication firewall
143You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What wireshark filter will show the connections from the snort machine to kiwi syslog machine?
- Atcp.dstport==514 && ip.dst==192.168.0.150
- Btcp.srcport==514 && ip.src==192.168.0.99
- Ctcp.dstport==514 && ip.dst==192.168.0.0/16
- Dtcp.srcport==514 && ip.src==192.168.150
144What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?
- Atcp.src == 25 and ip.host == 192.168.0.125
- Bhost 192.168.0.125:25
- Cport 25 and host 192.168.0.125
- Dtcp.port == 25 and ip.host == 192.168.0.125
145As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?
- Arequest smtp 25
- Btcp.port eq 25
- Csmtp port
- Dtcp.contains port 25
146Which of the following is considered an exploit framework and has the ability to perform automated attacks on services, ports, applications and unpatched security flaws in a computer system?
- AMaltego
- BMetasploit
- CNessus
- DWireshark
147Which Metasploit Framework tool can help penetration tester for evading Anti-virus Systems?
- Amsfpayload
- Bmsfcli
- Cmsfencode
- Dmsfd
148A pentester is using Metasploit to exploit an FTP server and pivot to a LAN. How will the pentester pivot using Metasploit?
- AIssue the pivot exploit and set the meterpreter.
- BReconfigure the network settings in the meterpreter.
- CSet the payload to propagate through the meterpreter.
- DCreate a route statement in the meterpreter.
149The establishment of a TCP connection involves a negotiation called 3 way handshake. What type of message sends the client to the server in order to begin this negotiation?
- ARST
- BACK
- CSYN-ACK
- DSYN
150What is the correct process for the TCP three-way handshake connection establishment and connection termination?
- AConnection Establishment: FIN, ACK-FIN, ACK
Connection Termination: SYN, SYN-ACK, ACK - BConnection Establishment: SYN, SYN-ACK, ACK
Connection Termination: ACK, ACK-SYN, SYN - CConnection Establishment: ACK, ACK-SYN, SYN
Connection Termination: FIN, ACK-FIN, ACK - DConnection Establishment: SYN, SYN-ACK, ACK
Connection Termination: FIN, ACK-FIN, ACK
- AConnection Establishment: FIN, ACK-FIN, ACK
151You have several plain-text firewall logs that you must review to evaluate network traffic. You know that in order to do fast, efficient searches of the logs you must use regular expressions. Which command-line utility are you most likely to use?
- AGrep
- BNotepad
- CMS Excel
- DRelational Database
152TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. Which of the following tools can be used for passive OS fingerprinting?
- Anmap
- Bping
- Ctracert
- Dtcpdump
153Which of the following is a command line packet analyzer similar to GUI-based Wireshark?
- Atcpdump
- Bnessus
- Cetherea
- DJack the Ripper
154Which technical characteristic do Ethereal/Wireshark, TCPDump, and Snort have in common?
- AThey are written in Java.
- BThey send alerts to security monitors.
- CThey use the same packet analysis engine.
- DThey use the same packet capture utility.
155Pentest results indicate that voice over IP traffic is traversing a network. Which of the following tools will decode a packet capture and extract the voice conversations?
- ACain
- BJohn the Ripper
- CNikto
- DHping
156Which of the following scanning tools is specifically designed to find potential exploits in Microsoft Windows products?
- AMicrosoft Security Baseline Analyzer
- BRetina
- CCore Impact
- DMicrosoft Baseline Security Analyzer
157ICMP ping and ping sweeps are used to check for active systems and to check
- Aif ICMP ping traverses a firewall.
- Bthe route that the ICMP ping took.
- Cthe location of the switchport in relation to the ICMP ping.
- Dthe number of hops an ICMP ping takes to reach a destination.
158An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses. In which order should he perform these steps?
- AThe sequence does not matter. Both steps have to be performed against all hosts.
- BFirst the port scan to identify interesting services and then the ping sweep to find hosts responding to icmp echo requests.
- CFirst the ping sweep to identify live hosts and then the port scan on the live hosts. This way he saves time.
- DThe port scan alone is adequate. This way he saves time.
159If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TCP?
- ATCP ping
- BTraceroute
- CBroadcast ping
- DHping
160You want to do an ICMP scan on a remote computer using hping2. What is the proper syntax?
- Ahping2 host.domain.com
- Bhping2 –set-ICMP host.domain.com
- Chping2 -i host.domain.com
- Dhping2 -1 host.domain.com
161Which of the following scanning method splits the TCP header into several packets and makes it difficult for packet filters to detect the purpose of the packet?
- AACK flag probe scanning
- BIPID scanning
- CSYNFIN scanning using IP fragments
- DICMP Echo scanning
162Which is the first step followed by Vulnerability Scanners for scanning a network?
- AFirewall detection
- BChecking if the remote host is alive
- COS Detection
- DTCP UDP Port scanning
163The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:
Time:Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:17 Port:21 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:19 Port:22 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:21 Port:23 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:22 Port:25 Source:192.168.1.103 Destination:192.168.1.106
Protocol:TCP
Time:Mar 13 17:30:23 Port:80 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:30 Port:443 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
What type of activity has been logged?- APort scan targeting 192.168.1.106
- BTeardrop attack targeting 192.168.1.106
- CDenial of service attack targeting 192.168.1.103
- DPort scan targeting 192.168.1.103
164Suppose you’ve gained access to your client’s hybrid network. On which port should you listen to in order to know which Microsoft Windows workstations has its file sharing enabled?
- A1433
- B161
- C445
- D3389
165You perform a scan of your company’s network and discover that TCP port 123 is open. What services by default run on TCP port 123?
- ADNS
- BPOP3
- CNTP
- DTelnet
166Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?
- AUDP 123
- BUDP 541
- CUDP 514
- DUDP 415
167Identify the UDP port that Network Time Protocol (NTP) uses as its primary means of communication?
- A113
- B123
- C161
- D69
168An NMAP scan of a server shows port 25 is open. What risk could this pose?
- AOpen printer sharing
- BWeb portal data leak
- CClear text authentication
- DActive mail relay
169An NMAP scan of a server shows port 69 is open. What risk could this pose?
- AUnauthenticated access
- BWeak SSL version
- CCleartext login
- DWeb portal data leak
170A penetration tester is conducting a port scan on a specific host. The tester found several ports opened that were confusing in concluding the Operating System (OS) version installed. Considering the NMAP result below, which of the following is likely to be installed on the target machine by the OS?
Starting NMAP 5.21 at 2011-03-15 11:06
NMAP scan report for 172.16.40.65
Host is up (1.00s latency).
Not shown: 993 closed ports
PORT STATE SERVICE 21/tcp open
ftp 23/tcp open
telnet 80/tcp open
http 139/tcp open
netbios-ssn 515/tcp open
631/tcp open
ipp 9100/tcp open
MAC Address: 00:00:48:0D:EE:8- AThe host is likely a printer.
- BThe host is likely a Windows machine.
- CThe host is likely a Linux machine.
- DThe host is likely a router.
171From the two screenshots below, which of the following is occurring?
First one:
1 [10.0.0.253]# nmap -sP 10.0.0.0/24
2
3 Starting Nmap
5 Host 10.0.0.1 appears to be up.
6 MAC Address: 00:09:5B:29:FD:96 (Netgear)
7 Host 10.0.0.2 appears to be up.
8 MAC Address: 00:0F:B5:96:38:5D (Netgear)
9 Host 10.0.0.4 appears to be up.
10 Host 10.0.0.5 appears to be up.
11 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.)
12 Nmap finished: 256 IP addresses (4 hosts up) scanned in 5.399 seconds
Second one:
1 [10.0.0.252]# nmap -sO 10.0.0.2
2
3 Starting Nmap 4.01 at 2006-07-14 12:56 BST
4 Interesting protocols on 10.0.0.2:
5 (The 251 protocols scanned but not shown below are
6 in state: closed)
7 PROTOCOL STATE SERVICE
8 1 open icmp
9 2 open|filtered igmp
10 6 open tcp
11 17 open udp
12 255 open|filtered unknown
13
14 Nmap finished: 1 IP address (1 host up) scanned in
15 1.259 seconds- A10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
- B10.0.0.253 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.
- C10.0.0.2 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
- D10.0.0.252 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.
172Based on the below log, which of the following sentences are true?
Mar 1, 2016, 7:33:28 AM 10.240.250.23 – 54373 10.249.253.15 – 22 tcp_ip- AApplication is SSH and 10.240.250.23 is the server and 10.249.253.15 is the client.
- BSSH communications are encrypted it’s impossible to know who is the client or the server.
- CApplication is FTP and 10.240.250.23 is the client and 10.249.253.15 is the server.
- DApplication is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server.
173A company has five different subnets: 192.168.1.0, 192.168.2.0, 192.168.3.0, 192.168.4.0 and 192.168.5.0. How can NMAP be used to scan these adjacent Class C networks?
- ANMAP -P 192.168.1-5*
- BNMAP -P 192.168.0.0/16 (B can work too)
- CNMAP -P 192.168.1.0, 2.0, 3.0, 4.0, 5.0
- DNMAP -P 192.168.1/17
174What is the broadcast address for the subnet 190.86.168.0/22?
- A190.86.168.255
- B190.86.255.255
- C190.86.171.255
- D190.86.169.255
175While checking the settings on the internet browser, a technician finds that the proxy server settings have been checked and a computer is trying to use itself as a proxy server. What specific octet within the subnet does the technician see?
- A10.10.10.10
- B127.0.0.1
- C192.168.1.1
- D192.168.168.168
176You are an Ethical Hacker who is auditing the ABC company. When you verify the NOC one of the machines has 2 connections, one wired and the other wireless. When you verify the configuration of this Windows system you find two static routes.
route add 10.0.0.0 mask 255.0.0.0 10.0.0.1
route add 0.0.0.0 mask 255.0.0.0 199.168.0.1
What is the main purpose of those static routes?- ABoth static routes indicate that the traffic is external with different gateway.
- BThe first static route indicates that the internal traffic will use an external gateway and the second static route indicates that the traffic will be rerouted.
- CBoth static routes indicate that the traffic is internal with different gateway.
- DThe first static route indicates that the internal addresses are using the internal gateway and the second static route indicates that all the traffic that is not internal must go to an external gateway.
177The network in ABC company is using the network address 192.168.1.64 with mask 255.255.255.192. In the network the servers are in the addresses 192.168.1.122, 192.168.1.123 and 192.168.1.124.
An attacker is trying to find those servers but he cannot see them in his scanning. The command he is using is:
nmap 192.168.1.64/28
Why he cannot see the servers?- AHe needs to add the command “”ip address”” just before the IP address
- BHe is scanning from 192.168.1.64 to 192.168.1.78 because of the mask /28 and the servers are not in that range
- CThe network must be down and the nmap command and IP address are ok
- DHe needs to change the address to 192.168.1.0 with the same mask
178You’ve just gained root access to a Centos 6 server after days of trying. What tool should you use to maintain access?
- ADisable Key Services
- BCreate User Account
- CDownload and Install Netcat
- DDisable IPTables
179A company has publicly hosted web applications and an internal Intranet protected by a firewall. Which technique will help protect against enumeration?
- AReject all invalid email received via SMTP.
- BAllow full DNS zone transfers.
- CRemove A records for internal hosts.
- DEnable null session pipes.
180Which of the following tools is used by pen testers and analysts specifically to analyze links between data using link analysis and graphs?
- AMetasploit
- BWireshark
- CMaltego
- DCain & Abel
181Which of the following tools is used to analyze the files produced by several packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?
- Atcptrace
- Btcptraceroute
- CNessus
- DOpenVAS
182What is the outcome of the comm”nc -l -p 2222 | nc 10.1.0.43 1234″?
- ANetcat will listen on the 10.1.0.43 interface for 1234 seconds on port 2222.
- BNetcat will listen on port 2222 and output anything received to a remote connection on 10.1.0.43 port 1234.
- CNetcat will listen for a connection from 10.1.0.43 on port 1234 and output anything received to port 2222.
- DNetcat will listen on port 2222 and then output anything received to local interface 10.1.0.43.
183Look at the following output. What did the hacker accomplish?
; <<>> DiG 9.7.-P1 <<>> axfr domam.com @192.168.1.105
;; global options: +cmd
domain.com. 3600 IN SOA srv1.domain.com. hostsrv1.domain.com. 131 900 600 86400 3600
domain.com. 600 IN A 192.168.1.102
domain.com. 600 IN A 192.168.1.105
domain.com. 3600 IN NS srv1.domain.com.
domain.com. 3600 IN NS srv2.domain.com.
vpn.domain.com. 3600 IN A 192.168.1.1
server.domain.com. 3600 IN A 192.168.1.3
office.domain.com. 3600 IN A 192.168.1.4
remote.domain.com. 3600 IN A 192.168. 1.48
support.domain.com. 3600 IN A 192.168.1.47
ns1.domain.com. 3600 IN A 192.168.1.41
ns2.domain.com. 3600 IN A 192.168.1.42
ns3.domain.com. 3600 IN A 192.168.1.34
ns4.domain.com. 3600 IN A 192.168.1.45
srv1.domain.com. 3600 IN A 192.168.1.102
srv2.domain.com. 1200 IN A 192.168.1.105
domain.com. 3600 INSOA srv1.domain.com. hostsrv1.domain.com. 131 900 600 86400 3600;; Query time: 269 msec
;; SERVER: 192.168.1.105#53(192.168.1.105)
;; WHEN: Sun Aug 11 20:07:59 2013
;; XFR size: 65 records (messages 65, bytes 4501)- AThe hacker used whois to gather publicly available records for the domain.
- BThe hacker used the “fierce” tool to brute force the list of available domains.
- CThe hacker listed DNS records on his own domain.
- DThe hacker successfully transferred the zone and enumerated the hosts.
184Which command lets a tester enumerate alive systems in a class C network via ICMP using native Windows tools?
- Aping 192.168.2.
- Bping 192.168.2.255
- Cfor %V in (1 1 255) do PING 192.168.2.%V
- Dfor /L %V in (1 1 254) do PING -n 1 192.168.2.%V | FIND /I “Reply”
185During a penetration test, a tester finds a target that is running MS SQL 2000 with default credentials. The tester assumes that the service is running with Local System account. How can this weakness be exploited to access the system?
- AUsing the Metasploit psexec module setting the SA / Admin credential
- BInvoking the stored procedure xp_shell to spawn a Windows command shell
- CInvoking the stored procedure cmd_shell to spawn a Windows command shell
- DInvoking the stored procedure xp_cmdshell to spawn a Windows command shell
186Which of the following techniques will identify if computer files have been changed?
- ANetwork sniffing
- BPermission sets
- CIntegrity checking hashes
- DFirewall alerts
187Which specific element of security testing is being assured by using hash?
- AAuthentication
- BIntegrity
- CConfidentiality
- DAvailability
188The company ABC recently contract a new accountant. The accountant will be working with the financial statements. Those financial statements need to be approved by the CFO and then they will be sent to the accountant but the CFO is worried because he wants to be sure that the information sent to the accountant was not modified once he approved it. What of the following options can be useful to ensure the integrity of the data?
- AThe CFO can use a hash algorithm in the document once he approved the financial statements
- BThe document can be sent to the accountant using an exclusive USB for that document
- CThe financial statements can be sent twice, one by email and the other delivered in USB and the accountant can compare both to be sure is the same document
- DThe CFO can use an excel file with a password
189Which of the following is a hashing algorithm?
- AMD5
- BPGP
- CDES
- DROT13
190LM hash is a compromised password hashing function. Which of the following parameters describe LM Hash:?
I – The maximum password length is 14 characters.
II – There are no distinctions between uppercase and lowercase.
III – It’s a simple algorithm, so 10,000,000 hashes can be generated per second.- AI
- BI, II and III
- CII
- DI and II
191What statement is true regarding LM hashes?
- ALM hashes consist in 48 hexadecimal characters.
- BLM hashes are based on AES128 cryptographic standard.
- CUppercase characters in the password are converted to lowercase.
- DLM hashes are not generated when the password length exceeds 15 characters.
192In cryptanalysis and computer security, ‘pass the hash’ is a hacking technique that allows an attacker to authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a user’s password, instead of requiring the associated plaintext password as is normally the case. Metasploit Framework has a module for this technique: psexec. The psexec module is often used by penetration testers to obtain access to a given system that you already know the credentials for. It was written by sysinternals and has been integrated within the framework. Often as penetration testers, successfully gain access to a system through some exploit, use meterpreter to grab the passwords or other methods like fgdump, pwdump, or cachedump and then utilize rainbow tables to crack those hash values. Which of the following is true hash type and sort order that is using in the psexec module’s smbpass’?
- ANT:LM
- BLM:NT
- CLM:NTLM
- DNTLM:LM
193What attack is used to crack passwords by using a precomputed table of hashed passwords?
- ABrute Force Attack
- BHybrid Attack
- CRainbow Table Attack
- DDictionary Attack
194A company is using Windows Server 2003 for its Active Directory (AD). What is the most efficient way to crack the passwords for the AD users?
- APerform a dictionary attack.
- BPerform a brute force attack.
- CPerform an attack with a rainbow table.
- DPerform a hybrid attack.
195Which method of password cracking takes the most time and effort?
- ABrute force
- BDictionary attack
- CRainbow tables
- DShoulder surfing
196How can rainbow tables be defeated?
- APassword salting
- BLockout accounts under brute force password cracking attempts
- CAll uppercase character passwords
- DUse of non-dictionary words
197 A computer science student needs to fill some information into a secured Adobe PDF job application that was received from a prospective employer. Instead of requesting a new document that allowed the forms to be completed, the student decides to write a script that pulls passwords from a list of commonly used passwords to try against the secured PDF until the correct password is found or the list is exhausted. Which cryptography attack is the student attempting?
- ASession hijacking
- BMan-in-the-middle attack
- CBrute-force attack
- DDictionary attack
198You have gained physical access to a Windows 2008 R2 server, which has an accessible disc drive. When you attempt to boot the server and log in, you are unable to guess the password. In your toolkit, you have an Ubuntu 9.10 Linux LiveCD. Which Linux-based tool can change any user’s password or activate disabled Windows accounts?
- ACain & Abel
- BSET
- CJohn the Ripper
- DCHNTPW
199A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd. How can he use it?
- AHe can open it and read the user ids and corresponding passwords.
- BThe password file does not contain the passwords themselves.
- CHe cannot read it because it is encrypted.
- DThe file reveals the passwords to the root user only.
200John the Ripper is a technical assessment tool used to test the weakness of which of the following?
- AFirewall rulesets
- BFile permissions
- CPasswords
- DUsernames
Information
- Description
- Quiz on CEH, created by L V on 15/05/2019.
- Author
- L V
- Language
- English
- Views
- 0
- Rating
- No ratings yet Rate this quiz