CEH-001 Online Practice Questions and Answers

Shayla is an IT security consultant, specializing in social engineering and external penetration tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense. Shayla has been given authority to perform any and all tests necessary to audit the company's network security.

No employees for the company, other than the IT director, know about Shayla's work she will be doing. Shayla's first step is to obtain a list of employees through company website contact pages. Then she befriends a female employee of the company through an online chat website. After meeting with the female employee numerous times, Shayla is able to gain her trust and they become friends. One day, Shayla steals the employee's access badge and uses it to gain unauthorized access to the Treks Avionics offices.

What type of insider threat would Shayla be considered?

A. She would be considered an Insider Affiliate

B. Because she does not have any legal access herself, Shayla would be considered an Outside Affiliate

C. Shayla is an Insider Associate since she has befriended an actual employee

D. Since Shayla obtained access with a legitimate company badge; she would be considered a Pure Insider

TCP packets transmitted in either direction after the initial three-way handshake will have which of the following bit set?

A. SYN flag

B. ACK flag

C. FIN flag

D. XMAS flag

Jacob is looking through a traffic log that was captured using Wireshark. Jacob has come across what appears to be SYN requests to an internal computer from a spoofed IP address. What is Jacob seeing here?

A. Jacob is seeing a Smurf attack.

B. Jacob is seeing a SYN flood.

C. He is seeing a SYN/ACK attack.

D. He has found evidence of an ACK flood.

Which of the following items is unique to the N-tier architecture method of designing software applications?

A. Application layers can be separated, allowing each layer to be upgraded independently from other layers.

B. It is compatible with various databases including Access, Oracle, and SQL.

C. Data security is tied into each layer and must be updated for all layers when any upgrade is performed.

D. Application layers can be written in C, ASP.NET, or Delphi without any performance loss.

A botnet can be managed through which of the following?

A. IRC

B. E-Mail

C. Linkedin and Facebook

D. A vulnerable FTP server

A technician is resolving an issue where a computer is unable to connect to the Internet using a wireless access point. The computer is able to transfer files locally to other machines, but cannot successfully reach the Internet. When the technician examines the IP address and default gateway they are both on the 192.168.1.0/24. Which of the following has occurred?

A. The gateway is not routing to a public IP address.

B. The computer is using an invalid IP address.

C. The gateway and the computer are not on the same network.

D. The computer is not using a private IP address.

If an e-commerce site was put into a live environment and the programmers failed to remove the secret entry point that was used during the application development, what is this secret entry point known as?

A. SDLC process

B. Honey pot

C. SQL injection

D. Trap door

A hacker is attempting to see which IP addresses are currently active on a network. Which NMAP switch would the hacker use?

A. -sO

B. -sP

C. -sS

D. -sU

In the context of password security, a simple dictionary attack involves loading a dictionary file (a text file full of dictionary words) into a cracking application such as L0phtCrack or John the Ripper, and running it against user accounts located by the application. The larger the word and word fragment selection, the more effective the dictionary attack is. The brute force method is the most inclusive, although slow. It usually tries every possible letter and number combination in its automated exploration.

If you would use both brute force and dictionary methods combined together to have variation of words, what would you call such an attack?

A. Full Blown

B. Thorough

C. Hybrid

D. BruteDics

In the context of Windows Security, what is a 'null' user?

A. A user that has no skills

B. An account that has been suspended by the admin

C. A pseudo account that has no username and password

D. A pseudo account that was created for security administration purpose

A file integrity program such as Tripwire protects against Trojan horse attacks by:

A. Automatically deleting Trojan horse programs

B. Rejecting packets generated by Trojan horse programs

C. Using programming hooks to inform the kernel of Trojan horse behavior

D. Helping you catch unexpected changes to a system utility file that might indicate it had been replaced by a Trojan horse

When Jason moves a file via NFS over the company's network, you want to grab a copy of it by sniffing. Which of the following tool accomplishes this?

A. macof

B. webspy

C. filesnarf

D. nfscopy

To scan a host downstream from a security gateway, Firewalking:

A. Sends a UDP-based packet that it knows will be blocked by the firewall to determine how specifically the firewall responds to such packets

B. Uses the TTL function to send packets with a TTL value set to expire one hop past the identified security gateway

C. Sends an ICMP ''administratively prohibited'' packet to determine if the gateway will drop the packet without comment.

D. Assesses the security rules that relate to the target system before it sends packets to any hops on the route to the gateway

Eric notices repeated probes to port 1080. He learns that the protocol being used is designed to allow a host outside of a firewall to connect transparently and securely through the firewall. He wonders if his firewall has been breached. What would be your inference?

A. Eric network has been penetrated by a firewall breach

B. The attacker is using the ICMP protocol to have a covert channel

C. Eric has a Wingate package providing FTP redirection on his network

D. Somebody is using SOCKS on the network to communicate through the firewall

Symmetric encryption algorithms are known to be fast but present great challenges on the key management side. Asymmetric encryption algorithms are slow but allow communication with a remote host without having to transfer a key out of band or in person. If we combine the strength of both crypto systems where we use the symmetric algorithm to encrypt the bulk of the data and then use the asymmetric encryption system to encrypt the symmetric key, what would this type of usage be known as?

A. Symmetric system

B. Combined system

C. Hybrid system

D. Asymmetric system