CEHv12: Certified Ethical Hacker Practice Questions Part 4

Why does a security analyst disable/remove ISAPI filters that are not needed?

John, a hacker, is attempting to break into a bank’s computer system. To conduct additional attacks, he has to know the operating system of that computer.
What procedure would be beneficial to him?

Firewalls are software or hardware devices that control and monitor traffic entering and exiting a target network based on a set of pre-defined rules.
SQL injection attacks can be protected by which of the following types of firewalls?

What would you type in if you wanted to use Nmap to execute a stealth scan?

You are Monitoring the Network of your Organization. You notice that

1. There are huge Outbound Connections from your Internal Network to External IPs.
2. Further investigation reveals that the external IP addresses have been blacklisted.
3. Some connections are Accepted, and some are Dropped.
4. It turns out to be a CnC communication.

Which one of the following solutions will you suggest?

If you are a Penetration Tester, this is for you. You have been given the task of scanning a server. You need to employ a scanning technique in which the TCP header is slipped into a large number of packets, making it impossible to determine what the packets are intended for.
Which of the following scanning techniques will you employ?

Sam is employed as a pen-tester at a company in Houston. He performs penetration testing on IDS to discover the many methods by which an attacker can get around the IDS. Sam sends a huge number of packets to the target IDS, which causes alarms, allowing Sam to mask the genuine traffic. What approach is Sam employing to elude IDS?

Before generating their hashes, which of the following password protection techniques adds a random string of characters to the password?

Which of the following jailbreaking methods gives user-level access but not iboot-level access?

When Vulnerability Scanners scan a network, what is their first step?

Which option would you choose if you simply wanted to scan a few ports using the Nmap tool instead of the normal scan?

Which one of the following Google advance search operators allows an attacker to restrict the results to those websites in the given domain?

Suppose you are the Network Administrator and receive a report that some websites are no longer accessible. You decide to investigate.
If you ping the servers, they are reachable. Then you type in the IP address and try it in the browser; it is available even then. However, when you try to access them using the URL, they are unavailable. What could be the issue?

Which type of SQL injection attack is being carried out if an attacker runs the command SELECT * FROM user WHERE name = ‘x’ AND userid IS NULL; —’?

Cross-site request forgery involves _______________.

The attacker uses which of the following cryptographic attack methods to conduct a series of interactive queries, selecting subsequent plaintexts based on information from prior encryptions?

According to the log below, what sentences are true?

What is the best method for fine-tuning security alerts?

When is external and internal penetration testing required by the Payment Card Industry Data Security Standard (PCI-DSS)?

Which of the following is an adaptive SQL injection testing technique for detecting coding problems by inputting large volumes of random data and analyzing the output changes?

Which of the following is the most effective anti-ransomware measure?

What tool would you choose if you need to handle network intrusion detection and prevention, act as a network sniffer, and record network activity?

Which of the following describes a conceptual difference between an anomaly-based IDS and a signature-based IDS?

When trying to access the TPNQM main site, certain TPNQM SA subscribers were diverted to a fraudulent site.
Alex, a system administrator at TPNQM SA, discovered TPNQM SA’s DNS Cache Poisoning. What should Anthony do in the face of such a threat??

The insecure direct object reference is a vulnerability in which the application does not check if the user has permission to access an internal object via its name or key.
Assume that the evil user Rob tries to gain access to the benign user Ned’s account. Which requests best exemplify an attempt to take advantage of a direct object reference vulnerability?

Which antenna is commonly used in communications for a frequency band of 10 MHz to VHF and UHF?

Identify the web application attack in which attackers inject client-side script into web pages viewed by other users by exploiting vulnerabilities in dynamically produced web pages.

Which of the following offers the most information about the system’s security posture to a security professional?

Anthony, a senior colleague, has sent you an email about a contract with one of the clients. You have been asked to accept the offer and do as complied.
After two days, Anthony denies ever sending you the email.
What do you need to “know” to verify whether Anthony sent the email?

Chandler works as a pen-tester for a New York-based IT firm. He employs a detection method in which the anti-virus executes the harmful software on a virtual machine to simulate CPU and memory activity as part of detecting viruses in the systems.
In this case, what kind of virus detection procedure did Chandler use?

Alice encrypts her information with her public key PK and stores it in the cloud. Which of the following attack scenarios puts her data’s privacy at risk?

Which IPsec component is responsible for protocol-level functions such as encrypting and decrypting packets?

Your company needs to implement a new web-based software package. The package necessitates three different servers, each of which must be accessible over the Internet. In terms of server placement, what is the appropriate architecture?

Anthony, a network administrator at BigUniversity, noticed that some students are using the wired network to connect their notebooks to the Internet. Numerous Ethernet ports are available on the university campus for professors and authorized visitors, but none for students.
When the IDS alerted him to malware activity in the network, he realized what was going on. What should Anthony do to avert this situation?

In your Zone, you have the SOA listed below.
Your auxiliary servers have been unable to communicate with your primary server in order to synchronize data. How long will secondary servers try to connect to the primary server before declaring the zone dead and ceasing to respond to queries?
ipad.college.edu, cikkye.edu, collegae.edu.SOA (200302028 3600 3600 604800 3600)

A risk management approach is implemented by a medium-sized healthcare IT company. Which of the five basic risk responses is NOT one of them?

You have been given the duty of doing a penetration test. While researching information, you come across an employee list on Google. You locate the receptionist’s email address and send her an email with her boss’s email address as the source address (boss@company). You request a pdf with information in this email. She reads your email and responds with a pdf that includes links. You replace the pdf links with your malicious links (which include malware) and send back the updated pdf with a message indicating the links are broken. She reads your email and clicks on the links, infecting her computer. You can now connect to the company’s network.
What method of testing did you employ?

What is the most typical way to exploit the vulnerability known as the “Bash Bug” or “ShellShock”?

Clients considering hiring you to want to view sample reports from past penetration tests.
What will be the next step that you will do next?

You are in charge of network security. You have two machines at your disposal. Snort is installed on the first system (192.168.0.99), and kiwi Syslog is installed on the second machine (192.168.0.150). When you do a network syn scan, you discover that kiwi Syslog is not receiving the snort alert message. You run Wireshark on the snort machine to see if the messages are being sent to the kiwi Syslog machine.
What Wireshark filter will display the connections between the snort and kiwi Syslog servers?

A security audit of the systems on a network must be undertaken to assess their compliance with security policies to stay in compliance with regulatory obligations. In such an audit, which of the following tools is most likely to be used?

Which of the following encryption levels does WPA2 utilize for wireless data encryption?

A penetration test is what you’re doing. You gained access with a buffer overflow hack and proceeded to look for interesting data, such as usernames and passwords in files. You discover a hidden folder containing the administrator’s bank account password and bitcoin account login information.
So, what are your options?

You have just been hired to conduct a pen test on a company that has recently been hacked on a massive scale. To completely remove risk, the CIO is concerned with minimizing threats and vulnerabilities.
When you are offered a job, what should be one of the first things you do?

Which of the following best describes LM Hash:
I – The maximum password length is 14 characters.
II – There are no differences in uppercase and lowercase letters.
III – The password is divided into two parts, each of which is seven bytes long.

Following a recent data breach, a regional bank engages your firm to conduct a security evaluation on its network. By compromising only one server, the attacker was able to obtain financial data from the bank.

What should one of your major recommendations to the bank be based on this information?

After the vulnerabilities have been classified and countermeasures have been applied, what term reflects the amount of risk that remains?

To join an 802.11 network, a new wireless client is configured. Many of the other clients on the network utilize the same hardware and software as this one. Although the client can see the network, it is unable to connect. The Wireless Access Point (WAP) does not react to the association requests issued by the wireless client, according to a wireless packet sniffer.
What could be the source of this issue?

An incident investigator requests a copy of all firewall, proxy server, and Intrusion Detection Systems (IDS) event logs from an organization’s network that has experienced a probable security breach. Many of the reported events do not match up when the investigator tries to correlate the information from all of the logs.
What is the most likely reason for this?

This 802.11 WEP and WPA-PSK key-cracking application can recover keys after capturing enough data packets. It uses the conventional FMS attack, as well as other enhancements like KoreK attacks and the PTW attack, to make the attack significantly faster than other WEP cracking tools.
Which of the tools listed below is being discussed?

Threat actors hack a carefully selected website by introducing an exploit, which results in malware infection, to launch an attack against targeted businesses and organizations. The attackers use exploits on well-known and trusted websites that their intended victims are likely to visit. These attacks are known to use zero-day exploits that target unpatched vulnerabilities, in addition to carefully selecting sites to hack. As a result, the targeted entities have little or no protection against these vulnerabilities.
In the scenario, what kind of attack is described?

You work for a retail company as a security analyst. You install a firewall and an intrusion detection system to secure the company’s network. Hackers, on the other hand, can attack the network. After more investigation, you discover that your IDS is incorrectly set up and thus unable to trigger alarms when required. What kind of alert does the IDS issue?

You are using NMAP to convert domain names to IP addresses in preparation for a later ping sweep. Which of the instructions below searches for IP addresses?

To see if a software program can accept a wide range of invalid input, automated testing can be used to generate invalid input at random and see if the program crashes.
What is the most often used term to describe this type of testing?

During a recent security assessment, you discovered one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.
What is the common name for this type of DNS configuration?

What are the advantages of doing an unannounced Penetration Test?

Which of these methods for storing backup tapes is the most secure?

Which of the following actions may an administrator take to ensure that a tape backup can be fully recovered?

A RAT has been installed on a host by an attacker. When a person types “www.MyPersonalBank.com” into their browser, the attacker intends to redirect them to a phishing site. What is the file that the attacker needs to change?

To deliver log messages to a log analysis tool located behind a firewall, which protocol and port number could be required?

The setup allows a wired or wireless network interface controller to send all traffic it receives to the Central Processing Unit (CPU) rather than just the frames intended for the controller.
Which of the following is the subject of the description?

An attacker gains access to a Web server’s database and displays the contents of the table containing all of the users’ names, passwords, and other data. This was accomplished by the attacker entering data into the Web site’s user login page that the software’s designers did not expect to be entered. What kind of software design challenge is this an example of?

A risk assessment includes which of the following elements?

Session splicing is an IDS evasion technique in which the attacker sends data to the target computer in many tiny packets, making it harder for the IDS to detect the attack signatures.
Session splicing attacks can be carried out with which tool?

You have successfully compromised a network PC and discovered a live server on the same network. You attempted to ping it but received no answer.
What is going on?

env x=`(){ :;};echo exploit` bash -c ‘cat /etc/passwd’
What is the Shellshock bash vulnerability attempting to do on a susceptible Linux host?

You have got physical access to a Windows 2008 R2 server with a disk drive that can be accessed. You are unable to guess the password when attempting to boot the server and log in. You have an Ubuntu 9.10 Linux Live CD in your toolkit; which Linux-based utility may alter any user’s password or activate disabled Windows accounts?

Which of the following is used to detect malicious attempts to get access to a system?

You must examine many plain-text firewall logs to assess network traffic. You are aware that regular expressions are required for quick and effective log searches.
Which command-line tool do you think you’ll use the most?

On a Windows 7 system, you are logged in as a local administrator and need to run the Computer Management Console from the command line.

Which command would you use if you were in this situation?

Jimmy is standing outside a facility’s security entrance. As an authorized employee badge in, he pretends to be having a stressful conversation on his cell phone. While still on the phone, Jimmy clutches the door as it closes.
So, what exactly happened?

When nation-state threat actors find vulnerabilities, they frequently hoard them until they are ready to launch a sophisticated attack. Because it exploited four different sorts of vulnerabilities, the Stuxnet attack was unprecedented.
What is the name of this attack style?

Your firm does penetration tests and security assessments for local small and medium-sized businesses. During a normal security check, you come across evidence that your client is involved in human trafficking.
So, what are your options?

When nation-state threat actors find vulnerabilities, they frequently hoard them until they are ready to launch a sophisticated attack. Because it exploited four different sorts of vulnerabilities, the Stuxnet attack was unprecedented.
What is the name of this attack style?

Which form of cryptography are PGP, SSL, and IKE examples of?

What does a firewall look for to prohibit packets from entering an organization through specific ports and applications?

Which method of cracking passwords takes the longest and requires the most effort?

A private firm hired you as a Certified Ethical Hacker to do an external security evaluation using penetration testing.
What document defines the nature of the testing and the infractions related to it and effectively protects both the organization’s interests and your liabilities as a tester?

It is a type of malware (malicious software) that crooks install on your computer to remotely lock it. This malware displays a warning message in the form of a pop-up window, a webpage, or an email from what appears to be an official authority. It informs you that your computer has been locked due to probable criminal actions and that you must pay a fee before you can access your data and programs.
Which of the terms below best describes the definition?

Your department has been awarded a contract to penetrate a company. Because the corporation wants the attack to be as realistic as possible, they have provided no information other than the corporate name.
What should be the initial step in a client’s security testing?

The formula of Risks = Threats x Vulnerabilities is _______.

The network administrator approaches you and informs you that during weekend hours, when the office is closed, the temperature on the internal wireless router increases by more than 20%. She asks you to look into the problem because she is too preoccupied with a huge conference to complete the assignment herself.
What tool can you use to see the network traffic the wireless router sends and receives?

Heartbleed was identified in 2014 and is known as CVE-2014-0160 in MITRE’s Common Vulnerabilities and Exposures (CVE) database. This flaw affects the OpenSSL implementation of the RFC6520-defined Transport Layer Security (TLS) protocols.
What kind of key does this issue leave exposed on the Internet, making it incredibly easy to exploit any vulnerable system?

Which of the following is a design pattern based on separate pieces of software giving application functionality to other applications as services?

Which law specifies the security and privacy measures that apply to Federal information systems and organizations?

Which of the following is SSL’s replacement?

You have access to a Linux server and want to ensure that any further outgoing traffic from this server is not detected by a Network-Based Intrusion Detection System (NIDS).
What is the most effective technique to avoid NIDS?

When testing a web application, using a proxy tool to save each request and response is quite handy. You can manually test each request and evaluate the response to detect vulnerabilities. Manually testing parameters and headers yield more exact findings than online vulnerability scanners.
What proxy tool can you use to identify web security flaws?

On the target website, an attacker modifies the profile information of a specific user (victim). The attacker uses this string to convert the victim’s profile to a text file, which is then sent to the attacker’s database.

What is the name of this form of attack (which can utilize HTTP GET or HTTP POST)?

Which of the following protocols was created expressly to convey event messages?

Which type of constraint is enforced by the “black box testing” methodology?

Which form of firewall assures that packets are part of the established session?

You are attempting to MITM in a meeting. Which protocol allows you to guess a sequence number?

You successfully opened a shell on a network server after successfully compromising it. You wanted to figure out which OS systems were on the network. However, when you use the nmap syntax below to fingerprint all machines in the network, it does not work ———
invictus@victim_server:~$ nmap -T4 -O 10.10.0.0/24
TCP/IP fingerprinting (for OS scan) xxxxxxx xxxxxx xxxxxxxxx. QUITTING!
What appears to be the issue?

Which of the techniques listed below can be used to fingerprint an operating system passively?

Which security strategy necessitates using different methods to defend IT systems against attacks?

NMAP -sn 192.168.11.200-215
Which of the following is accomplished by the NMAP command?

Which of the following terms best describes an entity or event that can negatively impact a system through unauthorized access, destruction, disclosure, denial of service, or data modification?

On a given host, a penetration tester performs a port scan. The tester discovered numerous ports open, which made determining the installed Operating System (OS) version difficult. Which of the following is most likely to be installed on the target system by the OS, based on the NMAP result? Starting NMAP 5.21 at 2011-03-15 11:06 NMAP scan report for 172.16.40.65 Host is up (1.00s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 80/tcp open http 139/tcp open netbios-ssn 515/tcp open 631/tcp open ipp 9100/tcp open MAC Address: 00:00:48:0D:EE:8

Which of the following statements is TRUE?