Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CEH > Review Questions > Flashcards

Review Questions Flashcards

1
Q

What is/are the countermeasure(s) against MAC Flood and MAC Spoofing attacks?

A

1) port security
2) binding
3) ip source guard
4) dynamic ARP inspection (DAI)
5) ARP watch
6) ARP wall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Describe DHCP starvation attack and the countermeasures.

A

1) Exhausting the pool of IPs on a DHCP server

2) Port security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Describe Rouge DHCP attack and the countermeasures.

A

1) An unauthorized DHCP server on the network.

2) DHCP snooping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How do you evade IDS Signature detection and IDS anomaly detection?

A

Encryption and IP Fragmentation (also called Fragment scanning) evades Signature detection. Session splicing evades anomaly detection. Ex 1. timing channel. Ex 2 Timing template- setting in nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Anonymizers and proxies protect-privacy (security through obscurity) and__________________

A

Content filtering (data commands)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ARPWALL, ARPWatch, Private VLANs, Using Static ARP entries for servers, routers etc…helps you defend against______________

A

MAC spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Explain full open scan (connect scan).

A

Syn, syn-ack, ack, rst

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Explain half open scan

A

SYN, SYN-ACK, RST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Explain XMAS Scans

A

All flags (or PUF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NMAP Syntex Review

  • TCP Connect/Full open scan
  • Stealth Scan/half open
  • Xmas
  • FIN
  • Null
A
  • TCP Connect/Full open scan: completes 3-way handshake: -sT
  • Stealth Scan/half open: can spoof IP, bypasses firewall rules (Anti-spoof): -sS
  • Xmas: FIN, URG, PSH: -sX
  • FIN: FIN: -sF
  • Null: No flags: -sN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NMAP Syntex review

-Idle

A

Idle: You need a Zombie, to help you determine if a port is open/closed: -sI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Write the NMAP syntax for:

Network scan of the entire subnet of 192.168.10.0.

A

-nmap -sn 192.168.10.0 0/24
or
-nmap -p 192.168.10.0 0/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Write the NMAP syntax for:

Network scan all hosts from 192.168.10.200 to 192.168.10.250.

A

-nmap -sn 192.168.10.200-250

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

List the ICMP message types.

A

8-Echo request
0-Echo reply
3-Destination unreachable
11-TTL expired in transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe multi-factor authentication -types and examples

A 
Something you
-know
-have
-are
(2 or more)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Explain the differences between polymorphic (XOR’d) shellcode and Metamorphic virus.

A

Poly-algorithm doesn’t change, only the signature.

Met-both algorithm and signature change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe vulnerability scanning and what are the limitations.

A

Identifies vulnerabilities in a system

Detects only known vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the difference between auditing, vulnerability scanning and penetration testing?

A

Auditing-testing for compliance
Vulnerability testing-passive testing for vulnerability
Penetration testing-active testing for vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe the following SQL Injection commands

1) ‘
2) –
3) +
4) ||
5) UNION

A

1) used to test if a DB is susceptible to SQL injection
2) end of line or single line comments
3) concatenation operators
4) concatenation operators
5) joining multiple queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Describe the following SQL Injection commands

1) UPDATE
2) DROPTABLE
3) Xp_cmdshell
4) OPENROWSET

A

1) update a table
2) delete a table
3) spawns a command shell
4) makes offline copy of a database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Write a typical SQL Injection syntax.

A

blah’ or 1=1 –

If you know the admin

Admin’ –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Difference between session hijacking and spoofing

A

Session hijacking-taking over a active session

Spoofing-attacker doesn’t see results (goes to spoofed address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Difference between image steganography and SNOW.

A

Steganography-hides info in images

SNOW-hides info in white space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Difference between sparse infector, stealth and Macro viruses

A

Sparse infector-time trigger activated (Friday the 13th)
Stealth-hides between kernels and apps and intercepts system calls
Micro virus-targets office apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Difference between trojans, viruses and worms.
Trojans-require host file;can't self replicate/propagate Virus-requires host file;can self replicate/can't self propagate Worms-don't require host file;can self replicate/self propagate
26
Difference between phishing, spear phishing and whaling.
Phishing-soliciting mail to mass amounts of people Spear phishing-targeted attack Whaling-targeting upper level management
27
Describe firewalking and name some of the tools and techniques used for firewalking.
1) Tracert-used to gather IP addresses of firewalls and routers on target network 2) Ack-scan-to assess if the FW is stateful or non stateful (also use a UDP scan) 3) Ike scan tool- to find out if the FW is IPSec based or not 4) Scan for vendor specific ports 5) Banner grabbing
28
Describe session fixation attack
Takes advantage of fixed session IDs
29
How can you browse the internet anonymously?
TOR Proxy VPN HTTP tunneling
30
What are techniques of sniffing on the switch?
``` Port span MAC flood ARP poisoning DNS poisoning Manipulating proxy Rogue DHCP server ```
31
What is the default RID for a windows administrator account?
500
32
``` What are the number of bits for the following hashing algorithms? MD4 MD5 SHA-1 SHA2 ```
128. 32 characters 128 160. 40 characters 160
33
What is syskey used for and what key-length and type of encryption used for syskey?
It is used to encrypt the SAM file. It uses 128 bit RC4 encryption
34
FTP
Ports 20, 21
35
TFTP
Port 69
36
Syslog
Port 514
37
RDP
Port 3389
38
SSH
Port 22
39
SSL
Port 443
40
SMB over netbios
Port 139
41
SMB over TCP/IP
Port 445
42
Kerberos
Port 88
43
DNS zone transfer
Port 53 (TCP)
44
DNS lookup
Port 53 (UDP)
45
Network printing
Ports 515, 631, 9100
46
POP3
Port 110 (incoming mail)
47
SMTP
Port 25 (outgoing mail)
48
SNMP
Ports 161, 162
49
LDAP
Port 389
50
NTP
Port 123
51
IKE
Port 500
52
IMAP
Port 143 (incoming mail)
53
DHCP
Port 67, 68
54
What does the following command achieve? type trojan.exe c:\windows\system32\ping.exe:trojan.exe or copy
ADS alternate data streams (NTFS streams)
55
Describe the difference between simple SQL Injection and bling SQL Injection.
Simple-attacker sees results | Blind-attacker doesn't see results
56
Describe the difference between sniffing on a hub network vs switch network.
Sniffing hub-passive | Sniffing switch-active
57
Name the tool used for whitespace steganography and the type of encryption used by this tool.
SNOW | Ice encryption
58
Describe the 6 techniques of anti-spoofing
1) packets from outside have inside IP as source IP. 2) packets from inside have outside IP as source IP. 3) for packets from new network send test packets 4) TTL mismatch (huge difference in TTL) 5) IPID mismatch 6) exceeding the window size
59
Write the Wireshark filter syntax | All packets going to and from 10.10.1.1
ip.addr==10.10.1.1
60
Write the Wireshark filter syntax | All packets coming from 10.10.1.1
ip.src==10.10.1.1
61
Write the Wireshark filter syntax | All packets going to 10.10.1.1 destination port 80
ip.dst==10.10.1.1&&tcp.dstport==80
62
Write the Wireshark filter syntax | All packets with reset flags set
tcp.flags.reset==1
63
Write the Wireshark filter syntax | Search http text 'Wireshark'
tcp contains wireshark
64
What are html entities?
Substituting non-alphanumeric characters w/alphanumeric characters
65
Describe IDS/IPS.
IDS-detection | IPS-preventive
66
What are the two types of input validation? Identify the risk each one of those pose.
Data type-susceptible to injection attacks | Data boundary-susceptible to buffer overflow attacks
67
What does overwriting the EIP (Extended Instruction Pointer) mean?
``` Buffer overflow attack also Overwriting EIP Return pointer Return address Return registry ```
68
What is a canary word used for?
To detect if a buffer overflow has been attempted
69
How do you prevent google, yahoo and bing from accessing certain pages on the web server.
Robots.txt
70
Cain and Abel is a multipurpose tool-list some of the uses of this tool.
``` ARP poisoning tool Sniffing VOIP sniffing PW cracker WEP cracking ```
71
Describe the hybrid password attack technique.
A combination of dictionary and brute force attacks
72
What is the key length used by Diffie Hellman
1536
73
What is the key length used by RSA?
Min 1024, mostly 2048
74
What is the key length used by DES?
Total 64 | Actual 56
75
What is the key length used by 3DES?
Actual 168 | Effective 112
76
What is the key length used by AES?
Min 128 Protocol CCMP Algorithm Rijndael
77
Name the different tools used to verify integrity of system files and data files?
Tripwire, FCIV
78
Name the different tools (including Microsoft's own solution) used to verify authenticity of program files
MS-sigverif | Universal-bit9
79
Which of these systems inspects traffic vs blocks traffic?
IDS-blocks | IPS-inspects
80
Describe the difference between hardware and software key loggers and the detection methods for each.
SW-malicious if signatures re known | HW-imbedded visual inspection to detect, physical security to prevent
81
What is the difference between HW and SW disc encryption? What is Microsoft's?
HW-TPM, MBR is encrypted and provides whole disc encryption. SW-MBR encrypted-provided partial disc encryption. MS tool EFS (Encrypted File System)
82
Describe a SMURF attack
(TCP) pings broadcast network and spoofs source IP as the target
83
Describe a Fraggle attack.
(UDP) pings broadcast network and spoofs source IP as the target
84
Describe a Land attack
Takes advantage of the TCP 3 way handshake-SYN packet sent to target w/source and destination packets sent to target.
85
Describe a Teardrop attack
Sending overlapping fragments of data to target server which overwhelms and crashes.
86
Describe a SYN flood attack.
SYN packet sent to target w/source IP spoof to be non existent IPs
87
Describe a ping of death attack
Sending oversized ping packets to target.
88
What is the difference between XSS and CSRF?
XSS-embedding malicious links within web pages, emails, etc | CSRF-takes advantage of a dread authenticated session.
89
If the second half of an LM Hash contains a hash value of -AAD3B435B51404EE, it indicates that______________
The PW is 7 characters or less.
90
Describe the algorithm of RSA encryption.
Factorization of large prime numbers.
91
Symmetric encryption provides which of the following cryptographic objectives?
Confidentiality Integrity Authentication
92
Asymmetric encryption provides which of the following cryptographic objectives?
Confidentiality Integrity Authentication Non-repudiation
93
Digital signature provides which of the following cryptographic objectives?
Integrity Authentication Non-repudiation
94
With a digital signature the hash is encrypted with ______________
The senders private key
95
For authentication the hash/message is encrypted with_________
Bulk encryption
96
What are the disadvantage of Symmetric encryption?
``` Key management (not scaleable) Key distro (relies on out of band dustrobution) No non-repudiation ```
97
Which Wifi encryption uses 48 bit IV and 128 bit AES encryption?
WPA2 | WPA 128 bit TKIP
98
Why is WEP considered to be an inherently weak wifi encryption standard?
It uses a 24 bit IV and lacks randomization
99
Identify the hashing algorithms for the following Windows Authentication methods. LMHash NTLMv1 NTLMv2
LMHash-DES NTLMv1-MD4 NTLMv2-MD5
100
What happens to a switch when a CAM table is flooded?
It behaves like a hub.
101
What is the broadcast address for 180.160.172.0/22?
180.160.175.255
102
How do you secure SNMP?
Use version 3 Change default PWs for read and write Use group policies to disable anonymous access
103
What are the two methods of banner grabbing using Telnet?
GET / HTTP/1.0 | HEAD / HTTP/1.0
104
Is it possible to block all reconnaissance traffic completely? (Ping, tracert, DNS etc.)
No
105
List the truth table for XOR.
0+0=0 0+1=1 1+0=1 1+1=0
106
Identify the purpose/roles for | CSIRT
Compute Security Incident Response Team
107
Identify the purpose/roles of | OSSTMM.
Open Source Security Testing Methodology Manual: Non-profit entity which provides guidelines & controls for securing open source
108
Identify the purpose/roles of | OWASP
Open Web Application Security Project: non-profit entity which provides common web application flaws and how to fix them-also provides OWASP top ten. (Webgoat similar to badstore)
109
Describe: SOX PCI-DSS
SOX (Sarbanes-Oxley) enforces financial accountability | PCI-DSS (Payment Card Industry Data Security Standard) protects PII
110
List the different types of root kits.
``` Hyper visor Bios Kernel Boot loader Application Dll ```
111
What is the difference between Key Escrow and Recovery Agent?
Key Escrow: used for external issued certs. Private key is split into 2 or more parts and each part is given to a CA for safe keeping. Recovery Agent: used in internal PKI environment by nominating an account as the recovery agent.
112
Describe N-tier architecture in the following contexts- Infrastructure Architecture Application Architecture
``` Infrastructure: Network segregation/network segmentation where servers are logically grouped by function within each VLAN segment. Application: designing apps in a modular fashion where changes to one module doesn't impact other modules ```
113
What do the following tools have in common? | Brutus, John the Ripper, Cain and Abel, Kerbcrack, and Hydra
Password Crackers
114
Explain the following: Port security NAC/NAP EAP/802.1x
Port security: limits the number of MACs on each port/switch port NAC/NAP: Network Access Control/Network Access Protection - sets and enforces the baseline on systems connected to the network. EAP/802.1x: Extensible Authentication Protocol- gives you the strongest authentication
115
Describe the 3 methods of disabling LMHashes.
1) best- Using PWs greater than 14 characters (min 15 characters) 2) middle- use GPO to disable (most popular) 3) worst- edit registry to disable it
116
Name the 2 trust models and examples for each.
Hierarchical- PKI | Web of trust- PGP (transitive trust)
117
Describe the following: Shellshock Heartbleed Collision
Shellshock: A BASH (Born Again Shell) vul where an attacker takes advantage of lack of i put validation in CGI scripts to gain access to the shell of the system. Heartbleed: an open SSL vul which gives the attacker access to memory content (thus gain access to private key) Collision: when 2 different pieces of text produce the same hash value, it produces a collision (collision is a sign of weakness, hashing algorithms must be collision resistant)
118
Risk Management: identify the formula for: 1) SLE 2) ALE 3) Risk
1) SLE-Threat x Vul x Asset 2) ALE-Asset value x Exposure 3) Risk-Asset value x Exposure x Annualized Rate of Occurrence (ARO)
119
Write the Google search rule for locating .pdf files on www.cisco.com
Insite:www.cisco.com filetype:pdf
120
Which NMAP script will help test what methods, such as GET, PUT, POST etc, are allowed on a HTTP Server?
HTTP Methods
121
Netcat is a plaintext protocol-which equivalent tool can be used to have an encrypted Netcat like connection?
Cryptcat
122
What is the difference between Stateful Inspection FW AND WEb Application FW?
Stateful Inspection FW-enforces 3 way handshake and tracks state of connection (multilayer) Web Application FW- does deep packet inspection (application layer)
123
What is the difference between CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol)
CRL- public cert goes on CRL | OCSP- checks the CRL to see if cert is good or not
124
Describe the following tools 1) CHNTPW 2) Metagoofil 3) DIAMETER
1) CHNTPW: change password-a Linux tool to change Windows PWs 2) Metagoofil: tool used to scrape metadata off target 3) DIAMETER: Radius 2.0 - enhanced version of radius, provides better reliability (uses TCP) and mobility support

CEH (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions