Ethical Hacking 9

Question 1

What is the ARP method of detecting a sniffer on the LAN?

Answer 1

ARP packets are transmitted with a nonbroadcast IP address, and any responding systems are suspected to be running a network sniffer.

Question 2

Which ARP poisoning tools can be used to sniff and analyze traffic generated by SSH? (Choose all that apply.)

Answer 2

Ettercap

Cain and Abel

Question 3

Your consulting company has been hired to secure a client’s network. Specifically, the client has asked that you determine hosts on the network that are using protocols vulnerable to sniffing that might compromise user account information. What protocols should you look for when sniffing the network?

Answer 3

telnet, SNMP, FTP

Question 4

You are currently connected to a switch and are attempting to capture all network traffic on the LAN. How can you force all traffic on this switched Ethernet network to become visible to your sniffing application?

Answer 4

Use ARP spoofing software and spoof the MAC address of the local gateway.

Overwhelm the network switch utilizing MAC address flooding, forcing it to broadcast all frames out all ports.

Question 5

Which method for sniffing the network causes traffic to pass through the wrong gateway because computers have the wrong MAC address for the gateway.

Answer 5

ARP spoofing

Question 6

Which of the DNS poisoning techniques involves an attacker using a Trojan to change the victim’s DNS server IP address to that of the attacker’s machine?

Answer 6

Internet DNS spoofing

Question 7

While capturing network traffic as part of a network audit, you discover an active telnet session that appears to be automated. What tool can you utilize to inject commands into this communication, possibly allowing you to gain access to a system?

Answer 7

Ettercap

Question 8

When using Snort to capture packets, which switch is used to specify which class of network packets has to be captured by IP address?

Answer 8

-h

Question 9

Whichattack works by broadcasting DHCP requests with spoofed MAC addresses?

Answer 9

DHCP starvation

Question 10

What WinDump command should you use to display output using IP addresses and actual TCP/IP sequence numbers?

Answer 10

windump -n -S

Question 11

In the 1992 movie “Sneakers”, a group of hackers collect trash from a target individual’s home for the purpose of gathering intelligence on the corporation the individual works for. What is this an example of?

Answer 11

dumpster diving

Question 12

Which method used to detect sniffing can identify a system operating in promiscuous mode by using a nonbroadcast IP address request?

Answer 12

ARP Method

Question 13

What protocols are most vulnerable to sniffing? (Choose three.)

Answer 13

SNMP, Telnet, HTTP

Question 14

A client has asked you to deploy software that will allow them to collect information about network packets, analyze the packets, and then generate reports regarding network traffic. They would like this information to be available via a web interface. What tool can you deploy?

Answer 14

ntop

Question 15

What statements regarding the different types of sniffing is accurate?

Answer 15

Most sniffing tools are suited primarily to sniff data in a hub environment, utilizing passive sniffing.

Active sniffing involves the injection of traffic designed to enable total traffic collection on a switched LAN.

Question 16

Your client has a switched LAN and would like to deploy additional countermeasures to ensure that sniffing is unlikely on this sensitive network. What steps can you take to ensure sniffing valuable data will be difficult, if not impossible?

Answer 16

Perform encryption of all network traffic between end systems.

Utilize a static MAC address entries for all sensitive servers, routers, and firewalls.

Question 17

You have been called in to investigate a network that is actively being attacked. Computers are receiving IP addresses outside the normal scope of the local DHCP server, and upon investigating the DHCP server, you discover that all the leases available are currently used. What has most likely occurred?

Answer 17

An attacker has filled the DHCP lease table with bogus MAC address entries, then used a rogue server to provide malicious default gateway and DNS server information to hosts on the network.

Question 18

What is another way that all network traffic can be captured in a switched network? (Choose all that apply.)

Answer 18

Port mirroring, Switched Port Analyzer (SPAN), Port monitoring

Question 19

Which lawful intercept component stores and processes traffic intercepted by the service provider?

Answer 19

Collection function

Question 20

Which device maintains a table keeping track of each computer’s MAC address, and the physical port on which that MAC address is connected?

Answer 20

switch