CEH-CL_Set_2

132 ( Topic 4) Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e- mails from company B. How do you prevent DNS spoofing? (Select the Best

.) A. Install DNS logger and track vulnerable packets B. Disable DNS timeouts C. Install DNS Anti-spoofing D. Disable DNS Zone Transfer Answer : C Explanation: Explantion: Implement DNS Anit-Spoofing measures to prevent DNS Cache Pollution to occur.

136 ( Topic 4) Drag the application to match with its correct description. Exhibit:

:

145 ( Topic 4) Bob is acknowledged as a hacker of repute and is popular among visitors of underground sites. Bob is willing to share his knowledge with those who are willing to learn, and many have expressed their interest in learning from him. However, this knowledge has a risk associated with it, as it can be used for malevolent attacks as well. In this context, what would be the most affective method to bridge the knowledge gap between the black hats or crackers and the white hats or computer security professionals? (Choose the test answer) A. Educate everyone with books, articles and training on risk analysis, vulnerabilities and safeguards. B. Hire more computer security monitoring personnel to monitor computer systems and networks. C. Make obtaining either a computer security certification or accreditation easier to achieve so more individuals feel that they are a part of something larger than life. D. Train more National Guard and reservist in the art of computer security to help out in times of emergency or crises.

: A Explanation: Bridging the gap would consist of educating the white hats and the black hats equally so that their knowledge is relatively the same. Using books, articles, the internet, and professional training seminars is a way of completing this goal.

122 ( Topic 3) You are concerned that someone running PortSentry could block your scans, and you decide to slow your scans so that no one detects them. Which of the following commands will help you achieve this? A. nmap -sS -PT -PI -O -T1 <ip address> B. nmap -sO -PT -O -C5 <ip address> C. nmap -sF -PT -PI -O <ip address> D. nmap -sF -P0 -O <ip address>

: A Explanation: -T[0-5]: Set timing template (higher is faster)

141 ( Topic 4) Which of the following represents the initial two commands that an IRC client sends to join an IRC network? A. USER, NICK B. LOGIN, NICK C. USER, PASS D. LOGIN, USER

: A Explanation: A "PASS" command is not required for either client or server connection to be registered, but it must precede the server message or the latter of the NICK/USER combination. (RFC 1459)

183 ( Topic 5) This kind of password cracking method uses word lists in combination with numbers and special characters: A. Hybrid B. Linear C. Symmetric D. Brute Force

: A Explanation: A Hybrid (or Hybrid Dictionary) Attack uses a word list that it modifies slightly to find passwords that are almost from a dictionary (like St0pid)

153 ( Topic 4) What is a NULL scan? A. A scan in which all flags are turned off B. A scan in which certain flags are off C. A scan in which all flags are on D. A scan in which the packet size is set to zero E. A scan with a illegal packet size

: A Explanation: A null scan has all flags turned off.

198 ( Topic 5) LAN Manager passwords are concatenated to 14 bytes and split in half. The two halves are hashed individually. If the password is 7 characters or less, than the second half of the hash is always: A. 0xAAD3B435B51404EE B. 0xAAD3B435B51404AA C. 0xAAD3B435B51404BB D. 0xAAD3B435B51404CC

: A Explanation: A problem with LM stems from the total lack of salting or cipher block chaining in the hashing process. To hash a password the first 7 bytes of it are transformed into an 8 byte odd parity DES key. This key is used to encrypt the 8 byte string "KGS!@". Same thing happens with the second part of the password. This lack of salting creates two interesting consequences. Obviously this means the password is always stored in the same way, and just begs for a typical lookup table attack. The other consequence is that it is easy to tell if a password is bigger than 7 bytes in size. If not, the last 7 bytes will all be null and will result in a constant DES hash of 0xAAD3B435B51404EE.

182 ( Topic 5) Travis works primarily from home as a medical transcriptions. He just bought a brand new Dual Core Pentium Computer with over 3 GB of RAM. He uses voice recognition software is processor intensive, which is why he bought the new computer. Travis frequently has to get on the Internet to do research on what he is working on. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Travis uses antivirus software, anti-spyware software and always keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Travis computer is even more noticeable slow. Every once in awhile, Travis also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Travis is really worried about his computer because he spent a lot of money on it and he depends on it to work. Travis scans his through Windows Explorer and check out the file system, folder by folder to see if there is anything he can find. He spends over four hours pouring over the files and folders and cant find anything but before he gives up, he notices that his computer only has about 10 GB of free space available. Since has drive is a 200 GB hard drive, Travis thinks this is very odd. Travis downloads Space Monger and adds up the sizes for all the folders and files on his computer. According to his calculations, he should have around 150 GB of free space. What is mostly likely the cause of Travis problems? A. Travis's Computer is infected with stealth kernel level rootkit B. Travi's Computer is infected with Stealth Torjan Virus C. Travis's Computer is infected with Self-Replication Worm that fills the hard disk space D. Logic Bomb's triggered at random times creating hidden data consuming junk files

: A Explanation: A rootkit can take full control of a system. A rootkit's only purpose is to hide files, network connections, memory addresses, or registry entries from other programs used by system administrators to detect intended or unintended special privilege accesses to the computer resources.

185 ( Topic 5) _____ is the process of converting something from one representation to the simplest form. It deals with the way in which systems convert data from one form to another. A. Canonicalization B. Character Mapping C. Character Encoding D. UCS transformation formats

: A Explanation: Canonicalization (abbreviated c14n) is the process of converting data that has more than one possible representation into a "standard" canonical representation. This can be done to compare different representations for equivalence, to count the number of distinct data structures (e.g., in combinatorics), to improve the efficiency of various algorithms by eliminating repeated calculations, or to make it possible to impose a meaningful sorting order.

115 ( Topic 3) Paula works as the primary help desk contact for her company. Paula has just received a call from a user reporting that his computer just displayed a Blue Screen of Death screen and he ca no longer work. Paula walks over to the users computer and sees the Blue Screen of Death screen. The users computer is running Windows XP, but the Blue screen looks like a familiar one that Paula had seen a Windows 2000 Computers periodically. The user said he stepped away from his computer for only 15 minutes and when he got back, the Blue Screen was there. Paula also noticed that the hard drive activity light was flashing meaning that the computer was processing some thing. Paula knew this should not be the case since the computer should be completely frozen during a Blue screen. She checks the network IDS live log entries and notices numerous nmap scan alerts. What is Paula seeing happen on this computer? A. Paula's Network was scanned using FloppyScan B. Paula's Netwrok was scanned using Dumpsec C. There was IRQ conflict in Paula's PC D. Tool like Nessus will cause BSOD

: A Explanation: Floppyscan is a dangerous hacking tool which can be used to portscan a system using a floppy disk Bootsup mini Linux Displays Blue screen of death screen Port scans the network using NMAP Send the results by e-mail to a remote server.

126 ( Topic 3) The FIN flag is set and sent from host A to host B when host A has no more data to transmit (Closing a TCP connection). This flag releases the connection resources. However, host A can continue to receive data as long as the SYN sequence number of transmitted packets from host B are lower than the packet segment containing the set FIN flag. A. True B. False

: A Explanation: For sequence number purposes, the SYN is considered to occur before the first actual data octet of the segment in which it occurs, while the FIN is considered to occur after the last actual data octet in a segment in which it occurs. So packets receiving out of order will still be accepted.

119 ( Topic 3) Lori has just been tasked by her supervisor conduct vulnerability scan on the corporate network. She has been instructed to perform a very thorough test of the network to ensure that there are no security holes on any of the machines. Loris company does not own any commercial scanning products, so she decides to download a free one off the Internet. Lori has never done a vulnerability scan before, so she is unsure of some of the settings available in the software she downloaded. One of the option is to choose which ports that can be scanned. Lori wants to do exactly what her boos has told her, but she does not know ports should be scanned. If Lori is supposed to scan all known TCP ports, how many ports should she select in the software? A. 65536 B. 1024 C. 1025 D. Lori should not scan TCP ports, only UDP ports

: A Explanation: In both TCP and UDP, each packet header will specify a source port and a destination port, each of which is a 16-bit unsigned integer (i.e. ranging from 0 to 65535).

113 ( Topic 3) John has performed a scan of the web server with NMAP but did not gather enough information to accurately identify which operating system is running on the remote host. How could you use a web server to help in identifying the OS that is being used? A. Telnet to an Open port and grab the banner B. Connect to the web server with an FTP client C. Connect to the web server with a browser and look at the web page D. Telnet to port 8080 on the web server and look at the default page code

: A Explanation: Most Web servers politely identify themselves and the OS to anyone who asks.

177 ( Topic 5) Michael is the security administrator for the for ABC company. Michael has been charged with strengthening the companys security policies, including its password policies. Due to certain legacy applications. Michael was only able to enforce a password group policy in Active Directory with a minimum of 10 characters. He has informed the companys employes, however that the new password policy requires that everyone must have complex passwords with at least 14 characters. Michael wants to ensure that everyone is using complex passwords that meet the new security policy requirements. Michael has just logged on to one of the networks domain controllers and is about to run the following command: What will this command accomplish? A. Dumps SAM password hashes to pwd.txt B. Password history file is piped to pwd.txt C. Dumps Active Directory password hashes to pwd.txt D. Internet cache file is piped to pwd.txt

: A Explanation: Pwdump is a hack tool that is used to grab Windows password hashes from a remote Windows computer. Pwdump > pwd.txt will redirect the output from pwdump to a text file named pwd.txt

123 ( Topic 3) You are scanning into the target network for the first time. You find very few conventional ports open. When you attempt to perform traditional service identification by connecting to the open ports, it yields either unreliable or no results. You are unsure of what protocols are being used. You need to discover as many different protocols as possible. Which kind of scan would you use to do this? A. Nmap with the -sO (Raw IP packets) switch B. Nessus scan with TCP based pings C. Nmap scan with the -sP (Ping scan) switch D. Netcat scan with the -u -e switches

: A Explanation: Running Nmap with the sO switch will do a IP Protocol Scan. The IP protocol scan is a bit different than the other nmap scans. The IP protocol scan is searching for additional IP protocols in use by the remote station, such as ICMP, TCP, and UDP. If a router is scanned, additional IP protocols such as EGP or IGP may be identified.

110 ( Topic 3) Which type of scan does not open a full TCP connection? A. Stealth Scan B. XMAS Scan C. Null Scan D. FIN Scan

: A Explanation: Stealth Scan: Instead of completing the full TCP three-way-handshake a full connection is not made. A SYN packet is sent to the system and if a SYN/ACK packet is received it is assumed that the port on the system is active. In that case a RST/ACK will be sent which will determined the listening state the system is in. If a RST/ACK packet is received, it is assumed that the port on the system is not active.

130 ( Topic 4) SNMP is a connectionless protocol that uses UDP instead of TCP packets? (True or False) A. True B. False

: A Explanation: TCP and UDP provide transport services. But UDP was preferred. This is due to TCP characteristics, it is a complicate protocol and it consume to many memory and CPU resources. Where as UDP is easy to build and run. Into devices (repeaters and modems) vendors have built simple version of IP and UDP.

166 ( Topic 4) What does FIN in TCP flag define? A. Used to close a TCP connection B. Used to abort a TCP connection abruptly C. Used to indicate the beginning of a TCP connection D. Used to acknowledge receipt of a previous packet or transmission

: A Explanation: The FIN flag stands for the word FINished. This flag is used to tear down the virtual connections created using the previous flag (SYN), so because of this reason, the FIN flag always appears when the last packets are exchanged between a connection.

129 ( Topic 4) Maurine is working as a security consultant for Hinklemeir Associate. She has asked the Systems Administrator to create a group policy that would not allow null sessions on the network. The Systems Administrator is fresh out of college and has never heard of null sessions and does not know what they are used for. Maurine is trying to explain to the Systems Administrator that hackers will try to create a null session when footprinting the network. Why would an attacker try to create a null session with a computer on a network? A. Enumerate users shares B. Install a backdoor for later attacks C. Escalate his/her privileges on the target server D. To create a user with administrative privileges for later use

: A Explanation: The Null Session is often referred to as the "Holy Grail" of Windows hacking. Listed as the number 5 windows vulnerability on the SANS/FBI Top 20 list, Null Sessions take advantage of flaws in the CIFS/SMB (Common Internet File System/Server Messaging Block) architecture. You can establish a Null Session with a Windows (NT/2000/XP) host by logging on with a null user name and password. Using these null connections allows you to gather the following information from the host: - List of users and groups - List of machines - List of shares - Users and host SID' (Security Identifiers)

152 ( Topic 4) One of your team members has asked you to analyze the following SOA record. What is the version? Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400. A. 200303028 B. 3600 C. 604800 D. 2400 E. 60 F. 4800

: A Explanation: The SOA starts with the format of YYYYMMDDVV where VV is the version.

196 ( Topic 5) Which of the following steganography utilities exploits the nature of white space and allows the user to conceal information in these white spaces? A. Snow B. Gif-It-Up C. NiceText D. Image Hide

: A Explanation: The program snow is used to conceal messages in ASCII text by appending whitespace to the end of lines. Because spaces and tabs are generally not visible in text viewers, the message is effectively hidden from casual observers. And if the built-in encryption is used, the message cannot be read even if it is detected.

124 ( Topic 3) Which of the following Nmap commands would be used to perform a stack fingerprinting? A. Nmap -O -p80 <host(s.> B. Nmap -hU -Q<host(s.> C. Nmap -sT -p <host(s.> D. Nmap -u -o -w2 <host> E. Nmap -sS -0p target

: A Explanation: This option activates remote host identification via TCP/IP fingerprinting. In other words, it uses a bunch of techniques to detect subtlety in the underlying operating system network stack of the computers you are scanning. It uses this information to create a "fingerprint" which it compares with its database of known OS fingerprints (the nmap-os- fingerprints file. to decide what type of system you are scanning.

170 ( Topic 4) Jess the hacker runs L0phtCracks built-in sniffer utility which grabs SMB password hashes and stores them for offline cracking. Once cracked, these passwords can provide easy access to whatever network resources the user account has access to. But Jess is not picking up hashed from the network. Why? A. The network protocol is configured to use SMB Signing. B. The physical network wire is on fibre optic cable. C. The network protocol is configured to use IPSEC. D. L0phtCrack SMB filtering only works through Switches and not Hubs.

: A Explanation: To protect against SMB session hijacking, NT supports a cryptographic integrity mechanism, SMB Signing, to prevent active network taps from interjecting themselves into an already established session.

144 ( Topic 4) Under what conditions does a secondary name server request a zone transfer from a primary name server? A. When a primary SOA is higher that a secondary SOA B. When a secondary SOA is higher that a primary SOA C. When a primary name server has had its service restarted D. When a secondary name server has had its service restarted E. When the TTL falls to zero

: A Explanation: Understanding DNS is critical to meeting the requirements of the CEH. When the serial number that is within the SOA record of the primary server is higher than the Serial number within the SOA record of the secondary DNS server, a zone transfer will take place.

131 ( Topic 4) A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers. A. Use port security on his switches. B. Use a tool like ARPwatch to monitor for strange ARP activity. C. Use a firewall between all LAN segments. D. If you have a small network, use static ARP entries. E. Use only static IP addresses on all PC's.

: A,B,D Explanation: Explanations: By using port security on his switches, the switches will only allow the first MAC address that is connected to the switch to use that port, thus preventing ARP spoofing. ARPWatch is a tool that monitors for strange ARP activity. This may help identify ARP spoofing when it happens. Using firewalls between all LAN segments is possible and may help, but is usually pretty unrealistic. On a very small network, static ARP entries are a possibility. However, on a large network, this is not an realistic option. ARP spoofing doesn't have anything to do with static or dynamic IP addresses. Thus, this option won't help you.

134 ( Topic 4) Peter, a Network Administrator, has come to you looking for advice on a tool that would help him perform SNMP enquires over the network. Which of these tools would do the SNMP enumeration he is looking for? Select the best answers. A. SNMPUtil B. SNScan C. SNMPScan D. Solarwinds IP Network Browser E. NMap

: A,B,D Explanation: Explanations: SNMPUtil is a SNMP enumeration utility that is a part of the Windows 2000 resource kit. With SNMPUtil, you can retrieve all sort of valuable information through SNMP. SNScan is a SNMP network scanner by Foundstone. It does SNMP scanning to find open SNMP ports. Solarwinds IP Network Browser is a SNMP enumeration tool with a graphical tree-view of the remote machine's SNMP data.

165 ( Topic 4) Which of the following tools can be used to perform a zone transfer? A. NSLookup B. Finger C. Dig D. Sam Spade E. Host F. Netcat G. Neotrace

: A,C,D,E Explanation: There are a number of tools that can be used to perform a zone transfer. Some of these include: NSLookup, Host, Dig, and Sam Spade.

184 ( Topic 5) One of your junior administrator is concerned with Windows LM hashes and password cracking. In your discussion with them, which of the following are true statements that you would point out? Select the best answers. A. John the Ripper can be used to crack a variety of passwords, but one limitation is that the output doesn't show if the password is upper or lower case. B. BY using NTLMV1, you have implemented an effective countermeasure to password cracking. C. SYSKEY is an effective countermeasure. D. If a Windows LM password is 7 characters or less, the hash will be passed with the following characters, in HEX- 00112233445566778899. E. Enforcing Windows complex passwords is an effective countermeasure.

: A,C,E Explanation: Explanations: John the Ripper can be used to crack a variety of passwords, but one limitation is that the output doesn't show if the password is upper or lower case. John the Ripper is a very effective password cracker. It can crack passwords for many different types of operating systems. However, one limitation is that the output doesn't show if the password is upper or lower case. BY using NTLMV1, you have implemented an effective countermeasure to password cracking. NTLM Version 2 (NTLMV2) is a good countermeasure to LM password cracking (and therefore a correct answer). To do this, set Windows 9x and NT systems to "send NTLMv2 responses only". SYSKEY is an effective countermeasure. It uses 128 bit encryption on the local copy of the Windows SAM. If a Windows LM password is 7 characters or less, the has will be passed with the following characters: 0xAAD3B435B51404EE Enforcing Windows complex passwords is an effective countermeasure to password cracking. Complex passwords are- greater than 6 characters and have any 3 of the following 4 items: upper case, lower case, special characters, and numbers.

160 ( Topic 4) Which of the following statements about a zone transfer correct?(Choose three. A. A zone transfer is accomplished with the DNS B. A zone transfer is accomplished with the nslookup service C. A zone transfer passes all zone information that a DNS server maintains D. A zone transfer passes all zone information that a nslookup server maintains E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections F. Zone transfers cannot occur on the Internet

: A,C,E Explanation: Securing DNS servers should be a priority of the organization. Hackers obtaining DNS information can discover a wealth of information about an organization. This information can be used to further exploit the network.

102 ( Topic 3) Jack is conducting a port scan of a target network. He knows that his target network has a web server and that a mail server is up and running. Jack has been sweeping the network but has not been able to get any responses from the remote target. Check all of the following that could be a likely cause of the lack of response? A. The host might be down B. UDP is filtered by a gateway C. ICMP is filtered by a gateway D. The TCP window Size does not match E. The destination network might be down F. The packet TTL value is too low and can't reach the target

: A,C,E,F Explanation: Wrong answers is B and D as sweeping a network uses ICMP

176 ( Topic 4) SNMP is a protocol used to query hosts, servers and devices about performance or health status data. Hackers have used this protocol for a long time to gather great amount of information about remote hosts. Which of the following features makes this possible? A. It is susceptible to sniffing B. It uses TCP as the underlying protocol C. It is used by ALL devices on the market D. It uses a community string sent as clear text

: A,D Explanation: SNMP uses UDP, not TCP, and even though many devices uses SNMP not ALL devices use it and it can be disabled on most of the devices that does use it. However SNMP is susceptible to sniffing and the community string (which can be said acts as a password) is sent in clear text. Topic 5, System Hacking -

104 ( Topic 3) A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information? A. The packets were sent by a worm spoofing the IP addresses of 47 infected sites B. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system C. All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number D. 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0

: B

175 ( Topic 4) A. A server program using a port that is not well known. B. Making use of a protocol in a way it is not intended to be used. C. It is the multiplexing taking place on a communication link. D. It is one of the weak channels used by WEP which makes it insecure.

: B Explanation: A covert channel is described as: "any communication channel that can be exploited by a process to transfer information in a manner that violates the systems security policy." Essentially, it is a method of communication that is not part of an actual computer system design, but can be used to transfer information to users or system processes that normally would not be allowed access to the information.

138 ( Topic 4) Eric has discovered a fantastic package of tools named Dsniff on the Internet. He has learnt to use these tools in his lab and is now ready for real world exploitation. He was able to effectively intercept communications between the two entities and establish credentials with both sides of the connections. The two remote ends of the communication never notice that Eric is relaying the information between the two. What would you call this attack? A. Interceptor B. Man-in-the-middle C. ARP Proxy D. Poisoning Attack

: B Explanation: A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised.

193 ( Topic 5) What file system vulnerability does the following command take advantage of? type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe A. HFS B. ADS C. NTFS D. Backdoor access

: B Explanation: ADS (or Alternate Data Streams) is a feature in the NTFS file system that makes it possible to hide information in alternate data streams in existing files. The file can have multiple data streams and the data streams are accessed by filename:stream.

169 ( Topic 4) What port number is used by LDAP protocol? A. 110 B. 389 C. 445 D. 464

: B Explanation: Active Directory and Exchange use LDAP via TCP port 389 for clients.

192 ( Topic 5) What is the algorithm used by LM for Windows2000 SAM ? A. MD4 B. DES C. SHA D. SSL

: B Explanation: Explanation: Okay, this is a tricky question. We say B, DES, but it could be A MD4 depending on what their asking - Windows 2000/XP keeps users passwords not "apparently", but as hashes, i.e. actually as "check sum" of the passwords. Let's go into the passwords keeping at large. The most interesting structure of the complex SAM-file building is so called V-block. It's size is 32 bytes and it includes hashes of the password for the local entering: NT Hash of 16-byte length, and hash used during the authentication of access to the common resources of other computers LanMan Hash, or simply LM Hash, of the same 16-byte length. Algorithms of the formation of these hashes are following: NT Hash formation: -> User password is being generated to the Unicode-line. -> Hash is being generated based on this line using MD4 algorithm. -> Gained hash in being encoded by the DES algorithm, RID (i.e. user identifier) had been used as a key. It was necessary for gaining variant hashes for users who have equal passwords. You remember that all users have different RIDs (RID of the Administrator's built in account is 500, RID of the Guest's built in account is 501, all other users get RIDs equal 1000, 1001,1002, etc.). LM Hash formation: -> User password is being shifted to capitals and added by nulls up to 14-byte length. -> Gained line is divided on halves 7 bytes each, and each of them is being encoded separately using DES, output is 8-byte hash and total 16-byte hash. -> Then LM Hash is being additionally encoded the same way as it had been done in the NT Hash formation algorithm step 3.

155 ( Topic 4) Exhibit: Based on the following extract from the log of a compromised machine, what is the hacker really trying to steal? A. har.txt B. SAM file C. wwwroot D. Repair file

: B Explanation: He is actually trying to get the file har.txt but this file contains a copy of the SAM file.

128 ( Topic 3) While performing ping scans into a target network you get a frantic call from the organizations security team. They report that they are under a denial of service attack. When you stop your scan, the smurf attack event stops showing up on the organizations IDS monitor. How can you modify your scan to prevent triggering this event in the IDS? A. Scan more slowly. B. Do not scan the broadcast IP. C. Spoof the source IP address. D. Only scan the Windows systems.

: B Explanation: Scanning the broadcast address makes the scan target all IP addresses on that subnet at the same time. Topic 4, Enumeration -

187 ( Topic 5) You are attempting to crack LM Manager hashed from Windows 2000 SAM file. You will be using LM Brute force hacking tool for decryption. What encryption algorithm will you be decrypting? A. MD4 B. DES C. SHA D. SSL

: B Explanation: The LM hash is computed as follows.1. The users password as an OEM string is converted to uppercase. 2. This password is either null-padded or truncated to 14 bytes. 3. The fixed-length password is split into two 7-byte halves. 4. These values are used to create two DES keys, one from each 7-byte half. 5. Each of these keys is used to DES-encrypt the constant ASCII string KGS!@#$%, resulting in two 8-byte ciphertext values. 6. These two ciphertext values are concatenated to form a 16-byte value, which is the LM hash.

162 ( Topic 4) Which DNS resource record can indicate how long any "DNS poisoning" could last? A. MX B. SOA C. NS D. TIMEOUT

: B Explanation: The SOA contains information of secondary servers, update intervals and expiration times.

188 ( Topic 5) You have successfully brute forced basic authentication configured on a Web Server using Brutus hacking tool. The username/password is Admin and Bettlemani@. You logon to the system using the brute forced password and plant backdoors and rootkits. After downloading various sensitive documents from the compromised machine, you proceed to clear the log files to hide your trace.. Which event log located at C:\Windows\system32\config contains the trace of your brute force attempts? A. AppEvent.Evt B. SecEvent.Evt C. SysEvent.Evt D. WinEvent.Evt

: B Explanation: The Security Event log (SecEvent.Evt) will contain all the failed logins against the system.

101 ( Topic 3) When Nmap performs a ping sweep, which of the following sets of requests does it send to the target device? A. ICMP ECHO_REQUEST & TCP SYN B. ICMP ECHO_REQUEST & TCP ACK C. ICMP ECHO_REPLY & TFP RST D. ICMP ECHO_REPLY & TCP FIN

: B Explanation: The default behavior of NMAP is to do both an ICMP ping sweep (the usual kind of ping) and a TCP port 80 ACK ping sweep. If an admin is logging these this will be fairly characteristic of NMAP.

135 ( Topic 4) MX record priority increases as the number increases.(True/False. A. True B. False

: B Explanation: The highest priority MX record has the lowest number.

142 ( Topic 4) Sara is using the nslookup command to craft queries to list all DNS information (such as Name Servers, host names, MX records, CNAME records, glue records (delegation for child Domains), zone serial number, TimeToLive (TTL) records, etc) for a Domain. What do you think Sara is trying to accomplish? Select the best answer. A. A zone harvesting B. A zone transfer C. A zone update D. A zone estimate

: B Explanation: The zone transfer is the method a secondary DNS server uses to update its information from the primary DNS server. DNS servers within a domain are organized using a master-slave method where the slaves get updated DNS information from the from secondary (slave) DNS servers but this is often not implemented. By connecting to a specific DNS server and successfully issuing the ls d domain-name > file-name you have initiated a zone transfer.

133 ( Topic 4) John is a keen administrator, and has followed all of the best practices as he could find on securing his Windows Server. He has renamed the Administrator account to a new name that he is sure cannot be easily guessed. However, there are people who already attempt to compromise his newly renamed administrator account. How is it possible for a remote attacker to decipher the name of the administrator account if it has been renamed? A. The attacker used the user2sid program. B. The attacker used the sid2user program. C. The attacker used nmap with the -V switch. D. The attacker guessed the new name.

: B Explanation: User2sid.exe can retrieve a SID from the SAM (Security Accounts Manager) from the local or a remote machine Sid2user.exe can then be used to retrieve the names of all the user accounts and more. These utilities do not exploit a bug but call the functions LookupAccountName and LookupAccountSid respectively. What is more these can be called against a remote machine without providing logon credentials save those needed for a null session connection.

181 ( Topic 5) How can you determine if an LM hash you extracted contains a password that is less than 8 characters long? A. There is no way to tell because a hash cannot be reversed B. The right most portion of the hash is always the same C. The hash always starts with AB923D D. The left most portion of the hash is always the same E. A portion of the hash will be all 0's

: B Explanation: When looking at an extracted LM hash, you will sometimes observe that the right most portion is always the same. This is padding that has been added to a password that is less than 8 characters long.

154 ( Topic 4) SNMP is a protocol used to query hosts, servers, and devices about performance or health status data. This protocol has long been used by hackers to gather great amount of information about remote hosts. Which of the following features makes this possible? (Choose two) A. It used TCP as the underlying protocol. B. It uses community string that is transmitted in clear text. C. It is susceptible to sniffing. D. It is used by all network devices on the market.

: B,C Explanation: Simple Network Management Protocol (SNMP) is a protocol which can be used by administrators to remotely manage a computer or network device. There are typically 2 modes of remote SNMP monitoring. These modes are roughly 'READ' and 'WRITE' (or PUBLIC and PRIVATE). If an attacker is able to guess a PUBLIC community string, they would be able to read SNMP data (depending on which MIBs are installed) from the remote device. This information might include system time, IP addresses, interfaces, processes running, etc. Version 1 of SNMP has been criticized for its poor security. Authentication of clients is performed only by a "community string", in effect a type of password, which is transmitted in cleartext.

157 ( Topic 4) As a securing consultant, what are some of the things you would recommend to a company to ensure DNS security? Select the best answers. A. Use the same machines for DNS and other applications B. Harden DNS servers C. Use split-horizon operation for DNS servers D. Restrict Zone transfers E. Have subnet diversity between DNS servers

: B,C,D,E Explanation: Explanations: A is not a correct answer as it is never recommended to use a DNS server for any other application. Hardening of the DNS servers makes them less vulnerable to attack. It is recommended to split internal and external DNS servers (called split-horizon operation). Zone transfers should only be accepted from authorized DNS servers. By having DNS servers on different subnets, you may prevent both from going down, even if one of your networks goes down.

139 ( Topic 4) What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?(Choose all that apply. A. 110 B. 135 C. 139 D. 161 E. 445 F. 1024

: B,C,E Explanation: NetBIOS traffic can quickly be used to enumerate and attack Windows computers. Ports 135, 139, and 445 should be blocked.

143 ( Topic 4) Which of the following tools are used for enumeration? (Choose three.) A. SolarWinds B. USER2SID C. Cheops D. SID2USER E. DumpSec

: B,D,E Explanation: USER2SID, SID2USER, and DumpSec are three of the tools used for system enumeration. Others are tools such as NAT and Enum. Knowing which tools are used in each step of the hacking methodology is an important goal of the CEH exam. You should spend a portion of your time preparing for the test practicing with the tools and learning to understand their output.

195 ( Topic 5) Which of the following LM hashes represent a password of less than 8 characters? (Select 2) A. BA810DBA98995F1817306D272A9441BB B. 44EFCE164AB921CQAAD3B435B51404EE C. 0182BD0BD4444BF836077A718CCDF409 D. CEC52EB9C8E3455DC2265B23734E0DAC E. B757BF5C0D87772FAAD3B435B51404EE F. E52CAC67419A9A224A3B108F3FA6CB6D

: B,E Explanation: Notice the last 8 characters are the same

190 ( Topic 5) What does the following command in netcat do? nc -l -u -p 55555 < /etc/passwd A. logs the incoming connections to /etc/passwd file B. loads the /etc/passwd file to the UDP port 55555 C. grabs the /etc/passwd file when connected to UDP port 55555 D. deletes the /etc/passwd file when connected to the UDP port 55555

: C Explanation: -l forces netcat to listen for incoming connections. -u tells netcat to use UDP instead of TCP -p 5555 tells netcat to use port 5555 < /etc/passwd tells netcat to grab the /etc/passwd file when connected to.

111 ( Topic 3) You are performing a port scan with nmap. You are in hurry and conducting the scans at the fastest possible speed. However, you don't want to sacrifice reliability for speed. If stealth is not an issue, what type of scan should you run to get very reliable results? A. XMAS scan B. Stealth scan C. Connect scan D. Fragmented packet scan

: C Explanation: A TCP Connect scan, named after the Unix connect() system call is the most accurate scanning method. If a port is open the operating system completes the TCP three- way handshake, and the port scanner immediately closes the connection.

158 ( Topic 4) Susan has attached to her companys network. She has managed to synchronize her bosss sessions with that of the file server. She then intercepted his traffic destined for the server, changed it the way she wanted to and then placed it on the server in his home directory. What kind of attack is Susan carrying on? A. A sniffing attack B. A spoofing attack C. A man in the middle attack D. A denial of service attack

: C Explanation: A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised.

197 ( Topic 5) Which of the following is the primary objective of a rootkit? A. It opens a port to provide an unauthorized service B. It creates a buffer overflow C. It replaces legitimate programs D. It provides an undocumented opening in a program

: C Explanation: Actually the objective of the rootkit is more to hide the fact that a system has been compromised and the normal way to do this is by exchanging, for example, ls to a version that doesnt show the files and process implanted by the attacker.

112 ( Topic 3) You are conducting a port scan on a subnet that has ICMP blocked. You have discovered 23 live systems and after scanning each of them you notice that they all show port 21 in closed state. What should be the next logical step that should be performed? A. Connect to open ports to discover applications. B. Perform a ping sweep to identify any additional systems that might be up. C. Perform a SYN scan on port 21 to identify any additional systems that might be up. D. Rescan every computer to verify the results.

: C Explanation: As ICMP is blocked youll have trouble determining which computers are up and running by using a ping sweep. As all the 23 computers that you had discovered earlier had port 21 closed, probably any additional, previously unknown, systems will also have port 21 closed. By running a SYN scan on port 21 over the target network you might get replies from additional systems.

106 ( Topic 3) You ping a target IP to check if the host is up. You do not get a response. You suspect ICMP is blocked at the firewall. Next you use hping2 tool to ping the target host and you get a response. Why does the host respond to hping2 and not ping packet? [ceh]# ping 10.2.3.4 PING 10.2.3.4 (10.2.3.4) from 10.2.3.80 : 56(84) bytes of data. --- 10.2.3.4 ping statistics --- 3 packets transmitted, 0 packets received, 100% packet loss [ceh]# ./hping2 -c 4 -n -i 2 10.2.3.4 HPING 10.2.3.4 (eth0 10.2.3.4): NO FLAGS are set, 40 headers + 0 data bytes len=46 ip=10.2.3.4 flags=RA seq=0 ttl=128 id=54167 win=0 rtt=0.8 ms len=46 ip=10.2.3.4 flags=RA seq=1 ttl=128 id=54935 win=0 rtt=0.7 ms len=46 ip=10.2.3.4 flags=RA seq=2 ttl=128 id=55447 win=0 rtt=0.7 ms len=46 ip=10.2.3.4 flags=RA seq=3 ttl=128 id=55959 win=0 rtt=0.7 ms --- 10.2.3.4 hping statistic --- 4 packets tramitted, 4 packets received, 0% packet loss round-trip min/avg/max = 0.7/0.8/0.8 ms A. ping packets cannot bypass firewalls B. you must use ping 10.2.3.4 switch C. hping2 uses TCP instead of ICMP by default D. hping2 uses stealth TCP packets to connect

: C Explanation: Default protocol is TCP, by default hping2 will send tcp headers to target host's port 0 with a winsize of 64 without any tcp flag on. Often this is the best way to do an 'hide ping', useful when target is behind a firewall that drop ICMP. Moreover a tcp null-flag to port 0 has a good probability of not being logged.

140 ( Topic 4) Eve is spending her day scanning the library computers. She notices that Alice is using a computer whose port 445 is active and listening. Eve uses the ENUM tool to enumerate Alice machine. From the command prompt, she types the following command. For /f "tokens=1 %%a in (hackfile.txt) do net use * \\10.1.2.3\c$ /user:"Administrator" %%a What is Eve trying to do? A. Eve is trying to connect as an user with Administrator privileges B. Eve is trying to enumerate all users with Administrative privileges C. Eve is trying to carry out a password crack for user Administrator D. Eve is trying to escalate privilege of the null user to that of Administrator

: C Explanation: Eve tries to get a successful login using the username Administrator and passwords from the file hackfile.txt.

146 ( Topic 4) Joseph was the Web site administrator for the Mason Insurance in New York, who's main Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to administer the Web site. One night, Joseph received an urgent phone call from his friend, Smith. According to Smith, the main Mason Insurance web site had been vandalized! All of its normal content was removed and replaced with an attacker's message ''Hacker Message: You are dead! Freaks!'' From his office, which was directly connected to Mason Insurance's internal network, Joseph surfed to the Web site using his laptop. In his browser, the Web site looked completely intact. No changes were apparent. Joseph called a friend of his at his home to help troubleshoot the problem. The Web site appeared defaced when his friend visited using his DSL connection. So, while Smith and his friend could see the defaced page, Joseph saw the intact Mason Insurance web site. To help make sense of this problem, Joseph decided to access the Web site using his dial-up ISP. He disconnected his laptop from the corporate internal network and used his modem to dial up the same ISP used by Smith. After his modem connected, he quickly typed www.masonins.com in his browser to reveal the following web page: H@cker Mess@ge: Y0u @re De@d! Fre@ks! After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal network, and used Secure Shell (SSH) to log in directly to the Web server. He ran Tripwire against the entire Web site, and determined that every system file and all the Web content on the server were intact. How did the attacker accomplish this hack? A. ARP spoofing B. SQL injection C. DNS poisoning D. Routing table injection

: C Explanation: External calls for the Web site has been redirected to another server by a successful DNS poisoning.

191 ( Topic 5) Which of the following algorithms can be used to guarantee the integrity of messages being sent, in transit, or stored? (Choose the best answer) A. symmetric algorithms B. asymmetric algorithms C. hashing algorithms D. integrity algorithms

: C Explanation: In cryptography, a cryptographic hash function is a hash function with certain additional security properties to make it suitable for use as a primitive in various information security applications, such as authentication and message integrity. A hash function takes a long string (or 'message') of any length as input and produces a fixed length string as output, sometimes termed a message digest or a digital fingerprint.

186 ( Topic 5) In the context of Windows Security, what is a 'null' user? A. A user that has no skills B. An account that has been suspended by the admin C. A pseudo account that has no username and password D. A pseudo account that was created for security administration purpose

: C Explanation: NULL sessions take advantage of features in the SMB (Server Message Block) protocol that exist primarily for trust relationships. You can establish a NULL session with a Windows host by logging on with a NULL user name and password. Using these NULL connections allows you to gather the following information from the host:* List of users and groups * List of machines * List of shares * Users and host SID' (Security Identifiers) NULL sessions exist in windows networking to allow: * Trusted domains to enumerate resources * Computers outside the domain to authenticate and enumerate users * The SYSTEM account to authenticate and enumerate resources NetBIOS NULL sessions are enabled by default in Windows NT and 2000. Windows XP and 2003 will allow anonymous enumeration of shares, but not SAM accounts.

108 ( Topic 3) ________ is an automated vulnerability assessment tool. A. Whack a Mole B. Nmap C. Nessus D. Kismet E. Jill32

: C Explanation: Nessus is a vulnerability assessment tool.

118 ( Topic 3) Which of the following is an automated vulnerability assessment tool. A. Whack a Mole B. Nmap C. Nessus D. Kismet E. Jill32

: C Explanation: Nessus is a vulnerability assessment tool.

121 ( Topic 3) John is using a special tool on his Linux platform that has a signature database and is therefore able to detect hundred of vulnerabilities in UNIX, Windows, and commonly-used web CGI scripts. Additionally, the database detects DDoS zombies and Trojans. What would be the name of this multifunctional tool? A. nmap B. hping C. nessus D. make

: C Explanation: Nessus is the world's most popular vulnerability scanner, estimated to be used by over 75,000 organizations world-wide. Nmap is mostly used for scanning, not for detecting vulnerabilities. Hping is a free packet generator and analyzer for the TCP/IP protocol and make is used to automatically build large applications on the *nix plattform.

137 ( Topic 4) You have the SOA presented below in your Zone. Your secondary servers have not been able to contact your primary server to synchronize information. How long will the secondary servers attempt to contact the primary server before it considers that zone is dead and stops responding to queries? A. One day B. One hour C. One week D. One month

: C Explanation: The numbers represents the following values: 200302028; se = serial number 3600; ref = refresh = 1h 3600; ret = update retry = 1h 604800; ex = expiry = 1w 3600; min = minimum TTL = 1h

116 ( Topic 3) Which of the following would be the best reason for sending a single SMTP message to an address that does not exist within the target company? A. To create a denial of service attack. B. To verify information about the mail administrator and his address. C. To gather information about internal hosts used in email treatment. D. To gather information about procedures that are in place to deal with such messages.

: C Explanation: The replay from the email server that states that there is no such recipient will also give you some information about the name of the email server, versions used and so on.

120 ( Topic 3) While performing a ping sweep of a subnet you receive an ICMP reply of Code 3/Type 13 for all the pings sent out. What is the most likely cause behind this response? A. The firewall is dropping the packets. B. An in-line IDS is dropping the packets. C. A router is blocking ICMP. D. The host does not respond to ICMP packets.

: C Explanation: Type 3 message = Destination Unreachable [RFC792], Code 13 (cause) = Communication Administratively Prohibited [RFC1812]

173 ( Topic 4) Jonathan being a keen administrator has followed all of the best practices he could find on securing his Windows Server. He renamed the Administrator account to a new name that cant be easily guessed but there remain people who attempt to compromise his newly renamed administrator account. How can a remote attacker decipher the name of the administrator account if it has been renamed? A. The attacker guessed the new name B. The attacker used the user2sid program C. The attacker used to sid2user program D. The attacker used NMAP with the V option

: C Explanation: User2sid.exe can retrieve a SID from the SAM (Security Accounts Manager) from the local or a remote machine Sid2user.exe can then be used to retrieve the names of all the user accounts and more. These utilities do not exploit a bug but call the functions LookupAccountName and LookupAccountSid respectively. What is more these can be called against a remote machine without providing logon credentials save those needed for a null session connection.

200 ( Topic 5) John Beetlesman, the hacker has successfully compromised the Linux System of Agent Telecommunications, Incs WebServer running Apache. He has downloaded sensitive documents and database files off the machine. Upon performing various tasks, Beetlesman finally runs the following command on the Linux box before disconnecting. for ((i=0;i<1;i++));do ?dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done What exactly is John trying to do? A. He is making a bit stream copy of the entire hard disk for later download B. He is deleting log files to remove his trace C. He is wiping the contents of the hard disk with zeros D. He is infecting the hard disk with random virus strings

: C Explanation: dd copies an input file to an output file with optional conversions. if is input file, -of is output file. /dev/zero is a special file that provides as many null characters (ASCII ASCII character "digit zero", "0", 0x30) as are read from it. /dev/hda is the hard drive.

117 ( Topic 3) Sandra is the security administrator of ABC.com. One day she notices that the ABC.com Oracle database server has been compromised and customer information along with financial data has been stolen. The financial loss will be estimated in millions of dollars if the database gets into the hands of competitors. Sandra wants to report this crime to the law enforcement agencies immediately. Which organization coordinates computer crime investigations throughout the United States? A. NDCA B. NICP C. CIRP D. NPC E. CIA

: D

125 ( Topic 3) You are scanning the target network for the first time. You are able to detect few convention open ports. While attempting to perform conventional service identification by connecting to the open ports, the scan yields either bad or no result. As you are unsure of the protocols in use, you want to discover as many different protocols as possible. Which of the following scan options can help you achieve this? A. Nessus sacn with TCP based pings B. Netcat scan with the switches C. Nmap scan with the P (ping scan) switch D. Nmap with the O (Raw IP Packets switch

: D Explanation: -sO IP protocol scans: This method is used to determine which IP protocols are supported on a host. The technique is to send raw IP packets without any further protocol header to each specified protocol on the target machine. If we receive an ICMP protocol unreachable message, then the protocol is not in use. Otherwise we assume it is open. Note that some hosts (AIX, HP-UX, Digital UNIX) and firewalls may not send protocol unreachable messages.

168 ( Topic 4) Exhibit: What type of attack is shown in the above diagram? A. SSL Spoofing Attack B. Identity Stealing Attack C. Session Hijacking Attack D. Man-in-the-Middle (MiTM) Attack

: D Explanation: A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised.

199 ( Topic 5) _____ is found in all versions of NTFS and is described as the ability to fork file data into existing files without affecting their functionality, size, or display to traditional file browsing utilities like dir or Windows Explorer A. Steganography B. Merge Streams C. NetBIOS vulnerability D. Alternate Data Streams

: D Explanation: ADS (or Alternate Data Streams) is a feature in the NTFS file system that makes it possible to hide information in alternate data streams in existing files. The file can have multiple data streams and the data streams are accessed by filename:stream.

180 ( Topic 5) Which of the following keyloggers cannot be detected by anti-virus or anti-spyware products? A. Covert keylogger B. Stealth keylogger C. Software keylogger D. Hardware keylogger

: D Explanation: As the hardware keylogger never interacts with the Operating System it is undetectable by anti-virus or anti-spyware products.

171 ( Topic 4) What tool can crack Windows SMB passwords simply by listening to network traffic? Select the best answer. A. This is not possible B. Netbus C. NTFSDOS D. L0phtcrack

: D Explanation: Explanations: This is possible with a SMB packet capture module for L0phtcrack and a known weaknesses in the LM hash algorithm.

194 ( Topic 5) What is GINA? A. Gateway Interface Network Application B. GUI Installed Network Application CLASS C. Global Internet National Authority (G-USA) D. Graphical Identification and Authentication DLL

: D Explanation: In computing, GINA refers to the graphical identification and authentication library, a component of some Microsoft Windows operating systems that provides secure authentication and interactive logon services.

147 ( Topic 4) Which address translation scheme would allow a single public IP address to always correspond to a single machine on an internal network, allowing "server publishing"? A. Overloading Port Address Translation B. Dynamic Port Address Translation C. Dynamic Network Address Translation D. Static Network Address Translation

: D Explanation: Mapping an unregistered IP address to a registered IP address on a one-to- one basis. Particularly useful when a device needs to be accessible from outside the network.

114 ( Topic 3) Why would an attacker want to perform a scan on port 137? A. To discover proxy servers on a network B. To disrupt the NetBIOS SMB service on the target host C. To check for file and print sharing on Windows systems D. To discover information about a target host using NBTSTAT

: D Explanation: Microsoft encapsulates netbios information within TCP/Ip using ports 135-139. It is trivial for an attacker to issue the following command: nbtstat -A (your Ip address) from their windows machine and collect information about your windows machine (if you are not blocking traffic to port 137 at your borders).

150 ( Topic 4) Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on your network? A. 137 and 139 B. 137 and 443 C. 139 and 443 D. 139 and 445

: D Explanation: NULL sessions take advantage of features in the SMB (Server Message Block) protocol that exist primarily for trust relationships. You can establish a NULL session with a Windows host by logging on with a NULL user name and password. Primarily the following ports are vulnerable if they are accessible: TCP - NETBIOS Session Service - UDP - NETBIOS Session Service - TCP - SMB/CIFS -

174 ( Topic 4) What did the following commands determine? C : user2sid \earth guest - S-1-5-21-343818398-789336058-1343024091-501 C:sid2user 5 21 343818398 789336058 1343024091 500 Name is Joe - Domain is EARTH - A. That the Joe account has a SID of 500 B. These commands demonstrate that the guest account has NOT been disabled C. These commands demonstrate that the guest account has been disabled D. That the true administrator is Joe E. Issued alone, these commands prove nothing

: D Explanation: One important goal of enumeration is to determine who the true administrator is. In the example above, the true administrator is Joe.

103 ( Topic 3) Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned. As a security professional, what would you infer from this scan? A. It is a network fault and the originating machine is in a network loop B. It is a worm that is malfunctioning or hardcoded to scan on port 500 C. The attacker is trying to detect machines on the network which have SSL enabled D. The attacker is trying to determine the type of VPN implementation and checking for IPSec

: D Explanation: Port 500 is used by IKE (Internet Key Exchange). This is typically used for IPSEC-based VPN software, such as Freeswan, PGPnet, and various vendors of in-a-box VPN solutions such as Cisco. IKE is used to set up the session keys. The actual session is usually sent with ESP (Encapsulated Security Payload) packets, IP protocol 50 (but some in-a-box VPN's such as Cisco are capable of negotiating to send the encrypted tunnel over a UDP channel, which is useful for use across firewalls that block IP protocols other than TCP or UDP).

151 ( Topic 4) Exhibit: Study the following log extract and identify the attack. A. Hexcode Attack B. Cross Site Scripting C. Multiple Domain Traversal Attack D. Unicode Directory Traversal Attack

: D Explanation: The Get /msadc////winnt/system32/cmd.exe? shows that a Unicode Directory Traversal Attack has been performed.

167 ( Topic 4) Sandra has been actively scanning the client network on which she is doing a vulnerability assessment test. While conducting a port scan she notices open ports in the range of 135 to 139. What protocol is most likely to be listening on those ports? A. Finger B. FTP C. Samba D. SMB

: D Explanation: The SMB (Server Message Block) protocol is used among other things for file sharing in Windows NT / 2000. In Windows NT it ran on top of NBT (NetBIOS over TCP/IP), which used the famous ports 137, 138 (UDP) and 139 (TCP). In Windows 2000, Microsoft added the possibility to run SMB directly over TCP/IP, without the extra layer of NBT. For this they use TCP port 445.

149 ( Topic 4) One of your team members has asked you to analyze the following SOA record. What is the TTL? Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400. A. 200303028 B. 3600 C. 604800 D. 2400 E. 60 F. 4800

: D Explanation: The SOA includes a timeout value. This value can tell an attacker how long any DNS "poisoning" would last. It is the last set of numbers in the record.

172 ( Topic 4) What is the following command used for? net use \targetipc$ "" /u:"" A. Grabbing the etc/passwd file B. Grabbing the SAM C. Connecting to a Linux computer through Samba. D. This command is used to connect as a null session E. Enumeration of Cisco routers

: D Explanation: The null session is one of the most debilitating vulnerabilities faced by Windows. Null sessions can be established through port 135, 139, and 445.

189 ( Topic 5) You are the Security Administrator of Xtrinity, Inc. You write security policies and conduct assesments to protect the company's network. During one of your periodic checks to see how well policy is being observed by the employees, you discover an employee has attached a modem to his telephone line and workstation. He has used this modem to dial in to his workstation, thereby bypassing your firewall. A security breach has occurred as a direct result of this activity. The employee explains that he used the modem because he had to download software for a department project. How would you resolve this situation? A. Reconfigure the firewall B. Conduct a needs analysis C. Install a network-based IDS D. Enforce the corporate security policy

: D Explanation: The security policy is meant to always be followed until changed. If a need rises to perform actions that might violate the security policy youll have to find another way to accomplish the task or wait until the policy has been changed.

163 ( Topic 4) A zone file consists of which of the following Resource Records (RRs)? A. DNS, NS, AXFR, and MX records B. DNS, NS, PTR, and MX records C. SOA, NS, AXFR, and MX records D. SOA, NS, A, and MX records

: D Explanation: The zone file typically contains the following records: SOA Start Of Authority - NS Name Server record - MX Mail eXchange record - A Address record -

164 ( Topic 4) What sequence of packets is sent during the initial TCP three-way handshake? A. SYN, URG, ACK B. FIN, FIN-ACK, ACK C. SYN, ACK, SYN-ACK D. SYN, SYN-ACK, ACK

: D Explanation: This is referred to as a "three way handshake." The "SYN" flags are requests by the TCP stack at one end of a socket to synchronize themselves to the sequence numbering for this new sessions. The ACK flags acknowlege earlier packets in this session. Obviously only the initial packet has no ACK flag, since there are no previous packets to acknowlege. Only the second packet (the first response from a server to a client) has both the SYN and the ACK bits set.

159 ( Topic 4) Exhibit: The following is an entry captured by a network IDS. You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor. You figure that the attacker is attempting a buffer overflow attack. You also notice "/bin/sh" in the ASCII part of the output. As an analyst what would you conclude about the attack? A. The buffer overflow attack has been neutralized by the IDS B. The attacker is creating a directory on the compromised machine C. The attacker is attempting a buffer overflow attack and has succeeded D. The attacker is attempting an exploit that launches a command-line shell

: D Explanation: This log entry shows a hacker using a buffer overflow to fill the data buffer and trying to insert the execution of /bin/sh into the executable code part of the thread. It is probably an existing exploit that is used, or a directed attack with a custom built buffer overflow with the payload that launches the command shell.

179 ( Topic 5) Samuel is the network administrator of DataX communications Inc. He is trying to configure his firewall to block password brute force attempts on his network. He enables blocking the intruders IP address for a period of 24 hours time after more than three unsuccessful attempts. He is confident that this rule will secure his network hackers on the Internet. But he still receives hundreds of thousands brute-force attempts generated from various IP addresses around the world. After some investigation he realizes that the intruders are using a proxy somewhere else on the Internet which has been scripted to enable the random usage of various proxies on each request so as not to get caught by the firewall use. Later he adds another rule to his firewall and enables small sleep on the password attempt so that if the password is incorrect, it would take 45 seconds to return to the user to begin another attempt. Since an intruder may use multiple machines to brute force the password, he also throttles the number of connections that will be prepared to accept from a particular IP address. This action will slow the intruders attempts. Samuel wants to completely block hackers brute force attempts on his network. What are the alternatives to defending against possible brute-force password attacks on his site? A. Enforce a password policy and use account lockouts after three wrong logon attempts even through this might lock out legit users B. Enable the IDS to monitor the intrusion attempts and alert you by e-mail about the IP address of the intruder so that you can block them at the firewall manually C. Enforce complex password policy on your network so that passwords are more difficult to brute force D. You can't completely block the intruders attempt if they constantly switch proxies

: D Explanation: Without knowing from where the next attack will come there is no way of proactively block the attack. This is becoming a increasing problem with the growth of large bot nets using ordinary workstations and home computers in large numbers.

105 ( Topic 3) Because UDP is a connectionless protocol: (Select 2) A. UDP recvfrom() and write() scanning will yield reliable results B. It can only be used for Connect scans C. It can only be used for SYN scans D. There is no guarantee that the UDP packets will arrive at their destination E. ICMP port unreachable messages may not be returned successfully

: D,E Explanation: Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners must also implement retransmission of packets that appear to be lost (or you will get a bunch of false positives).

178 ( Topic 5) While examining audit logs, you discover that people are able to telnet into the SMTP server on port 25. You would like to block this, though you do not see any evidence of an attack or other wrong doing. However, you are concerned about affecting the normal functionality of the email server. From the following options choose how best you can achieve this objective? A. Block port 25 at the firewall. B. Shut off the SMTP service on the server. C. Force all connections to use a username and password. D. Switch from Windows Exchange to UNIX Sendmail. E. None of the above.

: E Explanation: Blocking port 25 in the firewall or forcing all connections to use username and password would have the consequences that the server is unable to communicate with other SMTP servers. Turning of the SMTP service would disable the email function completely. All email servers use SMTP to communicate with other email servers and therefore changing email server will not help.

156 ( Topic 4) What is the proper response for a NULL scan if the port is closed? A. SYN B. ACK C. FIN D. PSH E. RST F. No response

: E Explanation: Closed ports respond to a NULL scan with a reset.

109 ( Topic 3) You want to scan the live machine on the LAN, what type of scan you should use? A. Connect B. SYN C. TCP D. UDP E. PING

: E Explanation: The ping scan is one of the quickest scans that nmap performs, since no actual ports are queried. Unlike a port scan where thousands of packets are transferred between two stations, a ping scan requires only two frames. This scan is useful for locating active devices or determining if ICMP is passing through a firewall.

127 ( Topic 3) What is the disadvantage of an automated vulnerability assessment tool? A. Ineffective B. Slow C. Prone to false positives D. Prone to false negatives E. Noisy

: E Explanation: Vulnerability assessment tools perform a good analysis of system vulnerabilities; however, they are noisy and will quickly trip IDS systems.

161 ( Topic 4) What is the proper response for a NULL scan if the port is open? A. SYN B. ACK C. FIN D. PSH E. RST F. No response

: F Explanation: A NULL scan will have no response if the port is open.

107 ( Topic 3) What is the proper response for a FIN scan if the port is open? A. SYN B. ACK C. FIN D. PSH E. RST F. No response

: F Explanation: Open ports respond to a FIN scan by ignoring the packet in question.

148 ( Topic 4) Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool SIDExtractor. Here is the output of the SIDs: s-1-5-21-1125394485-807628933-54978560-100Johns s-1-5-21-1125394485-807628933-54978560-652Rebecca s-1-5-21-1125394485-807628933-54978560-412Sheela s-1-5-21-1125394485-807628933-54978560-999Shawn s-1-5-21-1125394485-807628933-54978560-777Somia s-1-5-21-1125394485-807628933-54978560-500chang s-1-5-21-1125394485-807628933-54978560-555Micah From the above list identify the user account with System Administrator privileges. A. John B. Rebecca C. Sheela D. Shawn E. Somia F. Chang G. Micah

: F Explanation: The SID of the built-in administrator will always follow this example: S-1-5- domain-500