The Rebirth Guide To CEH-001 Practice Test

NEW QUESTION 1

What sequence of packets is sent during the initial TCP three-way handshake?

• A. SYN, SYN-ACK, ACK
• B. SYN, URG, ACK
• C. SYN, ACK, SYN-ACK
• D. FIN, FIN-ACK, ACK

Answer: A

NEW QUESTION 2

You are trying to hijack a telnet session from a victim machine with IP address 10.0.0.5 to Cisco router at 10.0.0.1. You sniff the traffic and attempt to predict the sequence and acknowledgement numbers to successfully hijack the telnet session.
Here is the captured data in tcpdump.

What are the next sequence and acknowledgement numbers that the router will send to the victim machine?

• A. Sequence number: 82980070 Acknowledgement number: 17768885A.
• B. Sequence number: 17768729 Acknowledgement number: 82980070B.
• C. Sequence number: 87000070 Acknowledgement number: 85320085C.
• D. Sequence number: 82980010 Acknowledgement number: 17768885D.

Answer: A

NEW QUESTION 3

In which part of OSI layer, ARP Poisoning occurs?

• A. Transport Layer
• B. Datalink Layer
• C. Physical Layer
• D. Application layer

Answer: B

NEW QUESTION 4

A security engineer has been asked to deploy a secure remote access solution that will allow employees to connect to the company’s internal network. Which of the following can be implemented to minimize the opportunity for the man-in-the-middle attack to occur?

• A. SSL
• B. Mutual authentication
• C. IPSec
• D. Static IP addresses

Answer: C

NEW QUESTION 5

Which of the following guidelines or standards is associated with the credit card industry?

• A. Control Objectives for Information and Related Technology (COBIT)
• B. Sarbanes-Oxley Act (SOX)
• C. Health Insurance Portability and Accountability Act (HIPAA)
• D. Payment Card Industry Data Security Standards (PCI DSS)

Answer: D

NEW QUESTION 6

Which of the following wireless technologies can be detected by NetStumbler? (Select all that apply)

• A. 802.11b
• B. 802.11e
• C. 802.11a
• D. 802.11g
• E. 802.11

Answer: ACD

Explanation:
If you check the website, cards for all three (A, B, G) are supported. See: http://www.stumbler.net/

NEW QUESTION 7

Bank of Timbuktu is a medium-sized, regional financial institution in Timbuktu. The bank has deployed a new Internet-accessible Web application recently. Customers can access their account balances, transfer money between accounts, pay bills and conduct online financial business using a Web browser.
John Stevens is in charge of information security at Bank of Timbuktu. After one month in production, several customers have complained about the Internet enabled banking application. Strangely, the account balances of many of the bank's customers had been changed! However, money hasn't been removed from the bank; instead, money was transferred between accounts. Given this attack profile, John Stevens reviewed the Web application's logs and found the following entries:

What kind of attack did the Hacker attempt to carry out at the bank?

• A. Brute force attack in which the Hacker attempted guessing login ID and password from password cracking tools.
• B. The Hacker attempted Session hijacking, in which the Hacker opened an account with the bank, then logged in to receive a session ID, guessed the next ID and took over Jason's session.
• C. The Hacker used a generator module to pass results to the Web server and exploited Web application CGI vulnerability.
• D. The Hacker first attempted logins with suspected user names, then used SQL Injection to gain access to valid bank login IDs.

Answer: D

NEW QUESTION 8

There is a WEP encrypted wireless access point (AP) with no clients connected. In order to crack the WEP key, a fake authentication needs to be performed. What information is needed when performing fake authentication to an AP? (Choose two.)

• A. The IP address of the AP
• B. The MAC address of the AP
• C. The SSID of the wireless network
• D. A failed authentication packet

Answer: BC

NEW QUESTION 9

While probing an organization you discover that they have a wireless network. From your attempts to connect to the WLAN you determine that they have deployed MAC filtering by using ACL on the access points. What would be the easiest way to circumvent and communicate on the WLAN?

• A. Attempt to crack the WEP key using Airsnort.
• B. Attempt to brute force the access point and update or delete the MAC ACL.
• C. Steel a client computer and use it to access the wireless network.
• D. Sniff traffic if the WLAN and spoof your MAC address to one that you captured.

Answer: D

Explanation:
The easiest way to gain access to the WLAN would be to spoof your MAC address to one that already exists on the network.

NEW QUESTION 10

Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?

• A. Incident response services to any user, company, government agency, or organization in partnership with the Department of Homeland Security
• B. Maintenance of the nation’s Internet infrastructure, builds out new Internet infrastructure, and decommissions old Internet infrastructure
• C. Registration of critical penetration testing for the Department of Homeland Security and public and private sectors
• D. Measurement of key vulnerability assessments on behalf of the Department of Defense (DOD) and State Department, as well as private sectors

Answer: A

NEW QUESTION 11

Where should a security tester be looking for information that could be used by an attacker against an organization? (Select all that apply)

• A. CHAT rooms
• B. WHOIS database
• C. News groups
• D. Web sites
• E. Search engines
• F. Organization’s own web site

Answer: ABCDEF

Explanation:
A Security tester should search for information everywhere that he/she can access. You never know where you find that small piece of information that could penetrate a strong defense.

NEW QUESTION 12

ETHER: Destination address : 0000BA5EBA11 ETHER: Source address :

An employee wants to defeat detection by a network-based IDS application. He does not want to attack the system containing the IDS application. Which of the following strategies can be used to defeat detection by a network-based IDS application?

• A. Create a SYN flood
• B. Create a network tunnel
• C. Create multiple false positives
• D. Create a ping flood

Answer: B

Explanation:
Certain types of encryption presents challenges to network-based intrusion detection and may leave the IDS blind to certain attacks, where a host-based IDS analyzes the data after it has been decrypted.

NEW QUESTION 13

What is the best means of prevention against viruses?

• A. Assign read only permission to all files on your system.
• B. Remove any external devices such as floppy and USB connectors.
• C. Install a rootkit detection tool.
• D. Install and update anti-virus scanner.

Answer: D

Explanation:
Although virus scanners only can find already known viruses this is still the best defense, together with users that are informed about risks with the internet.

NEW QUESTION 14

You are the security administrator for a large network. You want to prevent attackers from running any sort of traceroute into your DMZ and discover the internal structure of publicly accessible areas of the network.
How can you achieve this?

• A. Block ICMP at the firewall.
• B. Block UDP at the firewall.
• C. Both A and B.
• D. There is no way to completely block doing a trace route into this area.

Answer: D

Explanation:
When you run a traceroute to a target network address, you send a UDP packet with one time to live (TTL) to the target address. The first router this packet hits decreases the TTL to 0 and rejects the packet. Now the TTL for the packet is expired. The router sends back an ICMP message type 11 (Exceeded) code 0 (TTL--Exceeded) packet to your system with a source address. Your system displays the round-trip time for that first hop and sends out the next UDP packet with a TTL of 2.
This process continues until you receive an ICMP message type 3 (Unreachable) code 3 (Port--Unreachable) from the destination system. Traceroute is completed when your machine receives a Port-Unreachable message.
If you receive a message with three asterisks [* * *] during the traceroute, a router in the path doesn't return ICMP messages. Traceroute will continue to send UDP packets until the destination is reached or the maximum number of hops is exceeded.

NEW QUESTION 15

Which of the following is a client-server tool utilized to evade firewall inspection?

• A. tcp-over-dns
• B. kismet
• C. nikto
• D. hping

Answer: A

NEW QUESTION 16

Windump is the windows port of the famous TCPDump packet sniffer available on a variety of platforms. In order to use this tool on the Windows platform you must install a packet capture library.
What is the name of this library?

• A. NTPCAP
• B. LibPCAP
• C. WinPCAP
• D. PCAP

Answer: C

Explanation:
WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.

NEW QUESTION 17

Smart cards use which protocol to transfer the certificate in a secure manner?

• A. Extensible Authentication Protocol (EAP)
• B. Point to Point Protocol (PPP)
• C. Point to Point Tunneling Protocol (PPTP)
• D. Layer 2 Tunneling Protocol (L2TP)

Answer: A

NEW QUESTION 18

What is the proper response for a X-MAS scan if the port is closed?

• A. SYN
• B. ACK
• C. FIN
• D. PSH
• E. RST
• F. No response

Answer: E

Explanation:
Closed ports respond to a X-MAS scan with a RST.

NEW QUESTION 19

The following is a sample of output from a penetration tester's machine targeting a machine with the IP address of 192.168.1.106:

What is most likely taking place?

• A. Ping sweep of the 192.168.1.106 network
• B. Remote service brute force attempt
• C. Port scan of 192.168.1.106
• D. Denial of service attack on 192.168.1.106

Answer: B

NEW QUESTION 20

What makes web application vulnerabilities so aggravating? (Choose two)

• A. They can be launched through an authorized port.
• B. A firewall will not stop them.
• C. They exist only on the Linux platform.
• D. They are detectable by most leading antivirus software.

Answer: AB

Explanation:
As the vulnerabilities exists on a web server, incoming traffic on port 80 will probably be allowed and no firewall rules will stop the attack.

NEW QUESTION 21

A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniff the SMB exchanges which carry user logons. The user is plugged into a hub with 23 other systems. However, he is unable to capture any logons though he knows that other users are logging in.
What do you think is the most likely reason behind this?

• A. There is a NIDS present on that segment.
• B. Kerberos is preventing it.
• C. Windows logons cannot be sniffed.
• D. L0phtcrack only sniffs logons to web servers.

Answer: B

Explanation:
In a Windows 2000 network using Kerberos you normally use pre-
authentication and the user password never leaves the local machine so it is never exposed to the network so it should not be able to be sniffed.

NEW QUESTION 22

This tool is widely used for ARP Poisoning attack. Name the tool.

• A. Cain and Able
• B. Beat Infector
• C. Poison Ivy
• D. Webarp Infector

Answer: A

NEW QUESTION 23

Stephanie works as a records clerk in a large office building in downtown Chicago. On Monday, she went to a mandatory security awareness class (Security5) put on by her company's IT department. During the class, the IT department informed all employees that everyone's Internet activity was thenceforth going to be monitored.
Stephanie is worried that her Internet activity might give her supervisor reason to write her up, or worse get her fired. Stephanie's daily work duties only consume about four hours of her time, so she usually spends the rest of the day surfing the web. Stephanie really enjoys surfing the Internet but definitely does not want to get fired for it.
What should Stephanie use so that she does not get in trouble for surfing the Internet?

• A. Stealth IE
• B. Stealth Anonymizer
• C. Stealth Firefox
• D. Cookie Disabler

Answer: B

NEW QUESTION 24

Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an appropriate method?

• A. It is impossible to crack hashed user passwords unless the key used to encrypt them is obtained.
• B. If a user forgets the password, it can be easily retrieved using the hash key stored by administrators.
• C. Hashing is faster compared to more traditional encryption algorithms.
• D. Passwords stored using hashes are non-reversible, making finding the password much more difficult.

Answer: D

NEW QUESTION 25

What is War Dialing?

• A. War dialing involves the use of a program in conjunction with a modem to penetrate the modem/PBX-based systems
• B. War dialing is a vulnerability scanning technique that penetrates Firewalls
• C. It is a social engineering technique that uses Phone calls to trick victims
• D. Involves IDS Scanning Fragments to bypass Internet filters and stateful Firewalls

Answer: A

NEW QUESTION 26

The SNMP Read-Only Community String is like a password. The string is sent along with each SNMP Get-Request and allows (or denies) access to a device. Most network vendors ship their equipment with a default password of "public". This is the so-called "default public community string". How would you keep intruders from getting sensitive information regarding the network devices using SNMP? (Select 2 answers)

• A. Enable SNMPv3 which encrypts username/password authentication
• B. Use your company name as the public community string replacing the default 'public'
• C. Enable IP filtering to limit access to SNMP device
• D. The default configuration provided by device vendors is highly secure and you don't need to change anything

Answer: AC

NEW QUESTION 27

John wishes to install a new application onto his Windows 2000 server. He wants to ensure that any application he uses has not been Trojaned. What can he do to help ensure this?

• A. Compare the file's MD5 signature with the one published on the distribution media
• B. Obtain the application via SSL
• C. Compare the file's virus signature with the one published on the distribution media
• D. Obtain the application from a CD-ROM disc

Answer: A

Explanation:
MD5 was developed by Professor Ronald L. Rivest of MIT. What it does, to quote the executive summary of rfc1321, is:
[The MD5 algorithm] takes as input a message of arbitrary length and produces as output a 128-bit "fingerprint" or "message digest" of the input. It is conjectured that it is computationally infeasible to produce two messages having the same message digest, or
to produce any message having a given prespecified target message digest. The MD5 algorithm is intended for digital signature applications, where a large file must be "compressed" in a secure manner before being encrypted with a private (secret) key under a public-key cryptosystem such as RSA.
In essence, MD5 is a way to verify data integrity, and is much more reliable than checksum and many other commonly used methods.

NEW QUESTION 28

Fingerprinting an Operating System helps a cracker because:

• A. It defines exactly what software you have installed
• B. It opens a security-delayed window based on the port being scanned
• C. It doesn't depend on the patches that have been applied to fix existing security holes
• D. It informs the cracker of which vulnerabilities he may be able to exploit on your system

Answer: D

Explanation:
When a cracker knows what OS and Services you use he also knows which exploits might work on your system. If he would have to try all possible exploits for all possible Operating Systems and Services it would take too long time and the possibility of being detected increases.

NEW QUESTION 29

During a penetration test, a tester finds a target that is running MS SQL 2000 with default credentials. The tester assumes that the service is running with Local System account. How can this weakness be exploited to access the system?

• A. Using the Metasploit psexec module setting the SA / Admin credential
• B. Invoking the stored procedure xp_shell to spawn a Windows command shell
• C. Invoking the stored procedure cmd_shell to spawn a Windows command shell
• D. Invoking the stored procedure xp_cmdshell to spawn a Windows command shell

Answer: D

NEW QUESTION 30

This kind of attack will let you assume a users identity at a dynamically generated web page or site:

• A. SQL Injection
• B. Cross Site Scripting
• C. Session Hijacking
• D. Zone Transfer

Answer: B

Explanation:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such code include HTML code and client-side scripts. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy.

NEW QUESTION 31
......