CEH Chapters 9-15 Questions
Phishing can be mitigated through the use of __________.
Spam filtering Education
What is an eight-in-one DoS tool that can launch such attacks as land and teardrop?
Targa
The command-line equivalent of WinDump is known as what?
Tcpdump
What is the hexadecimal value of a NOP instruction in an Intel system?
0x90
What technique funnels all traffic back to a single client, allowing sniffing from all connected hosts?
ARP poisoning
Social engineering preys on many weaknesses, including __________.
All of them
Which function(s) are considered dangerous because they don't check memory bounds? (Choose all that apply.)
All of them
A blind SQL injection attack is used when which of the following is true?
Error messages are not available.
A closed network is typically which of the following?
Private network
A man-in-the-middle attack is an attack where the attacking party does which of the following?
Insert themselves into an active session
The stack operates on _______ a basis.
LIFO
Which of the following challenges can be solved by firewalls?
Protection against scanning
Web applications are used to __________.
Provide dynamic content
What is a vulnerability scan designed to provide to those executing it?
A way to reveal vulnerabilities
Session hijacking can be thwarted with which of the following?
Authentication
Which command would retrieve banner information from a website at port 80?
nc 192.168.10.27 80
Which of the following operates at 5 GHz?
802.11a
Which of the following specifies security standards for wireless?
802.11i
What is a PSK?
A key entered into each client
What is a client-to-client wireless connection called?
Ad hoc
What can an error message tell an attacker?
All of the above
What is a rogue access point?
An access point not managed by a company
AirPcap is used to do which of the following?
Assist in the sniffing of wireless traffic.
A honeyspot is designed to do what?
Attract victims to connect to it.
Input validation is used to prevent which of the following?
Bad input
Which of the following is a scripting language?
CGI
Monitor mode is used by wireless cards to do what?
Capture information about wireless networks.
Databases can be a victim of code exploits depending on which of the following?
Configuration
What is used to store session information?
Cookie
SQL injection attacks are aimed at which of the following?
Databases
What type of database has its information spread across many disparate systems?
Distributed
Groups and individuals who hack systems based on principle or personal beliefs are known as ___________.
Hacktivists
Browsers do not display __________.
Hidden fields
In addition to relational databases, there is also what kind of database?
Hierarchical
An SSID is used to do which of the following?
Identify a network.
Jason receives notices that he has unauthorized charges on his credit card account. What type of attack is Jason a victim of?
Identity theft
When a wireless client is attached to an access point, it is known as which of the following?
Infrastructure
The wardriving process involves which of the following?
Locating wireless networks
Warchalking is used to do which of the following?
Make others aware of a wireless network.
Proper input validation can prevent what from occurring?
Operating system exploits
Which of the following is an example of a server-side scripting language?
PHP
Bluesnarfing is used to perform what type of attack?
Read information from a device.
What type of database uses multiple tables linked together in complex relationships?
Relational
Which of the following is another name for a record in a database?
Row
__________ can be used to attack databases.
SQL injection
__________ is used to audit databases.
SQLPing
A POODLE attack targets what exactly?
SSL
Bluejacking is a means of which of the following?
Sending unsolicited messages
Which of the following is designed to locate wireless access points?
Site survey
What is the best option for thwarting social-engineering attacks?
Training
Which statement is used to limit data in SQL Server?
WHERE
Which command is used to query data in SQL Server?
WHERE SELECT from
Which feature makes WPA easy to defeat?
WPS support
Which of the following is a device used to perform a DoS on a wireless network?
Wi-Fi jammer
WEP is designed to offer security comparable to which of the following?
Wired networks
Which command is used to remove a table from a database?
drop table
Jennifer is using tcpdump to capture traffic on her network. She would like to save the capture for later review. What command can Jennifer use?
tcpdump -w capture.log
What is the command to retrieve header information from a web server using Telnet?
telnet <website name> 80
Which command can be used to access the command prompt in SQL Server?
xp_cmdshell
Tiffany is analyzing a capture from a client's network. She is particularly interested in NetBIOS traffic. What port does Tiffany filter for?
139
MAC spoofing applies a legitimate MAC address to an unauthenticated host, which allows the attacker to pose as a valid user. Based on your understanding of ARP, what would indicate a bogus client?
A reverse ARP request maps to two hosts.
Which of the following options shows the protocols in order from strongest to weakest?
WPA2, WPA, WEP, Open
What response is missing in a SYN flood attack?
ACK
Which of the following is used to set permissions on content in a website?
ACL
A common attack against web servers and web applications is __________.
Buffer overflow
Phishing takes place using __________.
Which attack can be used to take over a previous session?
Session hijacking
Which statement defines session hijacking most accurately?
Session hijacking is an attack that aims at stealing a legitimate session and posing as that user while communicating with the web resource or host machine.
When talking to a victim, using __________ can make an attack easier.
Keywords
Based on the diagram, what attack is occurring?
MITM
What protocol is used to carry out a fraggle attack?
UDP
A public use workstation contains the browsing history of multiple users who logged in during the last seven days. While digging through the history, a user runs across the following web address: www.snaz22enu.com/&w25/session=22525. What kind of embedding are you seeing?
URL embedding
Social engineering is designed to __________.
Manipulate human behavior
Which command launches a CLI version of Wireshark?
tshark
Jennifer is a junior system administrator for a small firm of 50 employees. For the last week a few users have been complaining of losing connectivity intermittently with no suspect behavior on their part such as large downloads or intensive processes. Jennifer runs Wireshark on Monday morning to investigate. She sees a large amount of ARP broadcasts being sent at a fairly constant rate. What is Jennifer most likely seeing?
ARP poisoning
__________ can be used to identify a web server.
Banner grab
How is a brute-force attack performed?
By trying all possible combinations of characters
Jason notices that he is receiving mail, phone calls, and other requests for information. He has also noticed some problems with his credit checks such as bad debts and loans he did not participate in. What type of attack did Jason become a victim of?
Identity theft
Which of the following is an attribute used to secure a cookie?
Secure HttpOnly Domain
Based on the packet capture shown in the graphic, what is contained in the highlighted section of the packet?
Source and destination IP addresses
An ethical hacker sends a packet with a deliberate and specific path to its destination. What technique is the hacker using?
Source routing
Which network device can block sniffing to a single network collision domain, create VLANs, and make use of SPAN ports and port mirroring?
Switch
What is the key difference between a smurf and a fraggle attack?
TCP vs. UDP
XSS is typically targeted toward which of the following?
Web browsers
What command-line utility can you use to craft custom packets with specific flags set?
hping3
Julie has sniffed an ample amount of traffic between the targeted victim and an authenticated resource. She has been able to correctly guess the packet sequence numbers and inject packets, but she is unable to receive any of the responses. What does this scenario define?
Blind hijacking
What common tool can be used for launching an ARP poisoning attack?
Cain & Abel
Which of the following best describes a web application?
Code designed to be run on the server
On a switch, each switchport represents a ____________.
Collision domain
Which of the following is used to access content outside the root of a website?
Directory traversal
Which pointer in a program stack gets shifted or overwritten during a successful overflow attack?
EIP
What may be helpful in protecting the content on a web server from being viewed by unauthorized personnel?
Encryption
Wireshark requires a network card to be able to enter which mode to sniff all network traffic?
Promiscuous mode
Adding to and removing from a program stack are known as what?
Push and pop
In the field of IT security, the concept of defense in depth is layering more than one control on another. Why would this be helpful in the defense of a system of session-hijacking?
To provide better protection
Social engineering can use all the following except __________.
Viruses
A security camera picks up someone who doesn't work at the company following closely behind an employee while they enter the building. What type of attack is taking place?
Tailgating
Network-level hijacking focuses on the mechanics of a connection such as the manipulation of packet sequencing. What is the main focus of web app session hijacking?
Stealing session IDs
Which of the following is not a source of session IDs?
Anonymous login
What is the most common sign of a DoS attack?
Slow performance
What is the generic syntax of a Wireshark filter?
protocol.field operator value
The Wayback Machine would be useful in viewing what type of information relating to a web application?
Archived versions of websites
A session hijack can be initiated from all of the following except which one?
Cookies and devices
Human beings tend to follow set patterns and behaviors known as __________.
Habits
Groups and individuals who may hack a web server or web application based on principle or personal beliefs are known as __________.
Hacktivists
What is the name for the dynamic memory space that, unlike the stack, doesn't rely on sequential ordering or organization?
Heap
What device will neither limit the flow of traffic nor have an impact on the effectiveness of sniffing?
Hub
Wireless access points function as a ____________.
Hub
Which of the following prevents ARP poisoning?
IP DHCP Snooping
Session hijacking can be performed on all of the following protocols except which one?
IPsec
Which technology can provide protection against session hijacking?
IPsec
Jason is the local network administrator who has been tasked with securing the network from possible DoS attacks. Within the last few weeks, some traffic logs appear to have internal clients making requests from outside the internal LAN. Based on the traffic Jason has been seeing, what action should he take?
Implement ingress filtering.
Which of the following can prevent bad input from being presented to an application through a form?
Input validation
In a DDoS attack, what communications channel is commonly used to orchestrate the attack?
Internet Relay Chat (IRC)
__________ is a client-side scripting language.
JavaScript
In social engineering a proxy is used to __________.
Keep an attacker's origin hidden
What is a single-button DDoS tool suspected to be used by groups such as Anonymous?
LOIC
Which DoS attack sends traffic to the target with a spoofed IP of the target itself?
Land
What could be used to monitor application errors and violations on a web server or application?
Logs
Bob is attempting to sniff a wired network in his first pen test contract. He sees only traffic from the segment he is connected to. What can Bob do to gather all switch traffic?
MAC flooding
An attacker can use which technique to influence a victim?
Name-dropping
A session hijack can happen with which of the following?
Networks and applications
Which kind of values is injected into a connection to the host machine in an effort to increment the sequence number in a predictable fashion?
Null
What is the main difference between DoS and DDoS?
Number of attackers
Jennifer has been working with sniffing and session-hijacking tools on her company network. Since she wants to stay white hat—that is, ethical—she has gotten permission to undertake these activities. What would Jennifer's activities be categorized as?
Passive
Janet receives an email enticing her to click a link. But when she clicks this link she is taken to a website for her bank, asking her to reset her account info. However, Janet noticed that the bank is not hers and the website is not for her bank. What type of attack is this?
Phishing
Jennifer receives an email claiming that her bank account information has been lost and that she needs to click a link to update the bank's database. However, she doesn't recognize the bank, because it is not one she does business with. What type of attack is she being presented with?
Phishing
Social engineering can be used to carry out email campaigns known as __________.
Phishing
Training and education of end users can be used to prevent __________.
Phishing Tailgating/piggybacking
Session hijacking can do all of the following except which one?
Place a cookie on a server
What mode must be configured to allow an NIC to capture all traffic on the wire?
Promiscuous mode
Zombies Inc. is looking for ways to better protect their web servers from potential DoS attacks. Their web admin proposes the use of a network appliance that receives all incoming web requests and forwards them to the web server. He says it will prevent direct customer contact with the server and reduce the risk of DoS attacks. What appliance is he proposing?
Reverse proxy
Jennifer is a system administrator who is researching a technology that will secure network traffic from potential sniffing by unauthorized machines. Jennifer is not concerned with the future impact on legitimate troubleshooting. What technology can Jennifer implement?
SSH
While monitoring traffic on the network, Jason captures the following traffic. What is he seeing occur?
SYN flood
A man-in-the-browser attack is typically enabled by using which mechanism?
Trojans
Session fixation is a vulnerability in which of the following?
Web applications
Which Wireshark filter displays only traffic from 192.168.1.1?
ip.addr == 192.168.1.1
Jennifer is using tcpdump to capture traffic on her network. She would like to review a capture log gathered previously. What command can Jennifer use?
tcpdump -r capture.log
Which mechanism can be used to influence a targeted individual?
Means of dress or appearance
Social engineering can be thwarted using what kinds of controls?
Technical Administrative Physical