Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH > Incorrect Answers > Flashcards

Incorrect Answers Flashcards

1
Q

What is a Cavity Virus?

A

A cavity virus attempts to install itself inside of the file it is infecting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an Insider Affiliate

A

Somebody who is contracted to work for the company and through social engineering gains access from an actual employee.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does Set type=ns do?

A

It uses nslookup to query Domain Name Service (DNS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does this command do? >host -t a hackeddomain.com

A

Looks for IP addresses. Perameter -t a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is this image?

A

The Hacker first attempted logins with suspected user names, then used SQL Injection to gain access to valid bank login IDs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In Buffer Overflow exploit, which of the following registers gets overwritten with return address of the exploit code?

A

EIP - EIP is a register in x86 architectures (32bit). It holds the “Extended Instruction Pointer” for the stack. In other words, it tells the computer where to go next to execute the next command and controls the flow of a program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Splint is a source code analyzer that is capable of detecting a _____

A

Buffer Overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Attackers craft malicious probe packets and scan for services such as HTTP over SSL (HTTPS), SMTP over SSL (SMPTS) and IMAP over SSL (IMAPS) to detect honeypots in a network. Which of the following condition shows the presence of a honeypot?

A

Ports show a particular service running but deny a three-way handshake connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is this 0xFFFFFFFFFFFF

A

A destination MAC address of a broadcast frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following is a characteristic of Public Key Infrastructure (PKI)?

A

Public-key cryptosystems distribute public-keys within digital signatures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How will you stop web spiders from crawling certain directories on your website?

A

Place robots.txt file in the root of your website with listing of directories that you don’t want to be crawled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you ensure if the e-mail is authentic and sent from fedex.com?

A

Verify the digital signature attached with the mail, the fake mail will not have Digital ID at all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is true about ICMP flood

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do you defend against DHCP Starvation attack?

A

Enable DHCP snooping on the switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A covert channel is a channel that:

A

transfers information over, within a computer system, or network that is outside of the security policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Trojan horse attacks pose one of the most serious threats to computer security. Which are the easiest and most convincing ways to infect a computer?

A

Legitimate “shrink-wrapped” software packaged by a disgruntled employee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following types of firewalls ensures that the packets are part of the established session?

A

Stateful inspection firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Enumeration is defined as the process of extracting user names, machine names, network resources, shares, and services from a system. Which of the following command can be used in UNIX environment to enumerate the shared directories on a machine?

A

showmount

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In the context of Trojans, what is the definition of a Wrapper?

A

A tool used to bind the Trojan with a legitimate file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

You have several plain-text firewall logs that you must review to evaluate network traffic. You know that in order to do fast, efficient searches of the logs you must use regular expressions. Which command-line utility are you most likely to use?

A

Grep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator’s Computer to update the router configuration. What type of an alert is this?

A

False Positive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Firewall implementation and design for an enterprise can be a daunting task. Choices made early in the design process can have far-reaching security implications for years to come. Which of the following firewall architecture is designed to host servers that offer public services?

A

Screened subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?

A

tcp.port eq 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Bob finished a C programming course and created a small C application to monitor the network traffic and produce alerts when any origin sends “many” IP packets, based on the average number of packets sent by all origins and using some thresholds. In concept, the solution developed by Bob is actually:

A

Just a network monitoring tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Port scanning can be used as part of a technical assessment to determine network vulnerabilities. The TCP XMAS scan is used to identify listening ports on the targeted system. If a scanned port is open, what happens?

A

The port will send a SYN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which of the following scan only works if the operating system’s TCP/IP implementation is based on RFC 793?

A

NULL Scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Enumeration is defined as the process of extracting user names, machine names, network resources, shares, and services from a system. Which of the following command can be used in UNIX environment to enumerate the shared directories on a machine?

A

showmount

28
Q

Which of the following is considered the best way to protect Personally Identifiable Information (PII) from Web application vulnerabilities?

A

Use encrypted communications protocols to transmit PII

29
Q

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named “nc.” The FTP server’s access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server’s software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port. What kind of vulnerability must be present to make this remote attack possible?

A

Directory traversal

30
Q

Splint is a source code analyzer that is capable of detecting a ______

A

Buffer Overflow

31
Q

What is the least important information when you analyze a public IP address in a security alert?

A

ARP Address Resolution Protocol

32
Q

You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address was blacklisted just before the alert. You are staring an investigation to roughly analyze the severity of the situation. Which of the following is appropriate to analyze?

A

Internet Firewall/Proxy log

33
Q

Which tool allows analysts and pen testers to examine links between data using graphs and link analysis?

A

Maltego

34
Q

Which is the first step followed by Vulnerability Scanners for scanning a network?

A

Checking if the remote host is alive

35
Q

You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. – 192.168.8.0/24. What command you would use?

A

wireshark –capture –local –masked 192.168.8.0 –range 24

36
Q

Firewalls are categorized into two; namely hardware firewall and software firewall. Identify the correct statement for a software firewall.

A

Software firewall is placed between the normal application and the networking components of the operating system

37
Q

Steganography is a technique of hiding a secret message within an ordinary message and extracting it at the destination to maintain confidentiality of data. Which of the following steganography technique embed secret message in the frequency domain of a signal?

Answers

A

Transform domain techniques

38
Q

OpenSSL on Linux servers includes a command line tool for testing TLS. What is the name of the tool and the correct syntax to connect to a web server?

A

openssl s_client –connect www.website.com:443

39
Q

You need a tool that can do network intrusion prevention and intrusion detection, function as a network sniffer, and record network activity. What tool would you most likely select?

A

Snort

40
Q

A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd. How can he use it?

A

The password file does not contain the passwords themselves.

41
Q

What does a firewall check to prevent particular ports and applications from getting packets into an organization?

A

Transport layer port numbers and application layer headers

BB

42
Q

During a black-box pen test you attempt to pass IRC traffic (Internet Relay Chat) over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic?

A

Application

43
Q

Which of the following act in the united states officially crimalised the transmition of unsolicitated commercial email (SMAPM)

A

2004 CANSPAM Act

44
Q

What is the step after footrpinting?

A

Scanning

45
Q

What is LACNIC

A

A directory where you can find IP addresses.

46
Q

In Ping what does -f -l mean?

A
  • f = Do not fragment
  • l Payload size
47
Q

In the C++ Object-oriented programming language, which of these situations can result in a buffer overflow?

A

When a program returns an incorrect output

48
Q

What’s stack smashing?

A

A buffer overflow that overwrites the return address

49
Q

You are attempting to man-in-the-middle a session. Which protocol will allow you to guess a sequence number?

A

TCP

50
Q

Steganography is a technique of hiding a secret message within an ordinary message and extracting it at the destination to maintain confidentiality of data. Which of the following steganography technique embed secret message in the frequency domain of a signal?

A

Transform Domain Techniques

51
Q

Which of these is the best defense against a buffer overflow attack?

A

Write Secure Code

52
Q

Which Port is NETBios?

A

137

53
Q

What systems might night respond to xmas scan?

A

Windows Server, Cisco.

54
Q

Which ICMP message types are used for destination unreachables?

A

3

55
Q

how many blocks in LM Hash

A

7 blocks

56
Q

WHat are the phases of system hacking

A

Gaining Access

Escelation of Privalge

Execute applications

Maintain Access

Clear tracks

page 164

57
Q

Where are hashes stored on microsoft

A

SAM file - system 32 /

config,

58
Q

What hash algrythem does LM hash and NTLM hash use

A

MD4

59
Q

What encryption algorythem does LM and NTLM Hash use

A

LM = DES 56bit

NTLM

= Triple 3DES - 112 bit

60
Q

What tool can you use to crack hashes

A

hashkiller.co.uk

hashsuite

61
Q

WHat are dif types of hacking

A

Non Electronic

Active Online Attacks

Passive Online Attacks

Offline Attacks

62
Q

Types of root kits

A

pg 193

63
Q

What is SynStealth also known as

A

Half Open scan

64
Q

What protocoal would be used to guess sequance number

A

TCP

65
Q

Encrypted message cycle with PKI

A

Create a hash of message, Encrypt hash with private key, Encrypt message iwth Recipients public key.

66
Q

Where are failed log in attempts logged in Linux

A

btmp

67
Q

What is a layer 3 limited broadcast address

A

255.255.255.255

CEH (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions