All About Breathing CEH-001 Exam

NEW QUESTION 1

A company has publicly hosted web applications and an internal Intranet protected by a firewall. Which technique will help protect against enumeration?

• A. Reject all invalid email received via SMTP.
• B. Allow full DNS zone transfers.
• C. Remove A records for internal hosts.
• D. Enable null session pipes.

Answer: C

NEW QUESTION 2

A pentester is using Metasploit to exploit an FTP server and pivot to a LAN. How will the pentester pivot using Metasploit?

• A. Issue the pivot exploit and set the meterpreter.
• B. Reconfigure the network settings in the meterpreter.
• C. Set the payload to propagate through the meterpreter.
• D. Create a route statement in the meterpreter.

Answer: D

NEW QUESTION 3

Jane has just accessed her preferred e-commerce web site and she has seen an item she would like to buy. Jane considers the price a bit too steep; she looks at the page source code and decides to save the page locally to modify some of the page variables. In the context of web application security, what do you think Jane has changed?

• A. An integer variable
• B. A 'hidden' price value
• C. A 'hidden' form field value
• D. A page cannot be changed locally; it can only be served by a web server

Answer: C

Explanation:
Changing hidden form values is possible when a web site is poorly built and is trusting the visitors computer to submit vital data, like the price of a product, to the database.

NEW QUESTION 4

Which is the right sequence of packets sent during the initial TCP three way handshake?

• A. FIN, FIN-ACK, ACK
• B. SYN, URG, ACK
• C. SYN, ACK, SYN-ACK
• D. SYN, SYN-ACK, ACK

Answer: D

Explanation:
A TCP connection always starts with a request for synchronization, a SYN, the reply to that would be another SYN together with a ACK to acknowledge that the last package was delivered successfully and the last part of the three way handshake should be only an ACK to acknowledge that the SYN reply was recived.

NEW QUESTION 5

Password cracking programs reverse the hashing process to recover passwords.(True/False.

• A. True
• B. False

Answer: B

Explanation:
Password cracking programs do not reverse the hashing process. Hashing is a one-way process. What these programs can do is to encrypt words, phrases, and characters using the same encryption process and compare them to the original password.
A hashed match reveals the true password.

NEW QUESTION 6

Blane is a security analyst for a law firm. One of the lawyers needs to send out an email to a client but he wants to know if the email is forwarded on to any other recipients. The client is explicitly asked not to re-send the email since that would be a violation of the lawyer's and client's agreement for this particular case. What can Blane use to accomplish this?

• A. He can use a split-DNS service to ensure the email is not forwarded on.
• B. A service such as HTTrack would accomplish this.
• C. Blane could use MetaGoofil tracking tool.
• D. Blane can use a service such as ReadNotify tracking tool.

Answer: D

NEW QUESTION 7

In the context of using PKI, when Sven wishes to send a secret message to Bob, he looks up Bob’s public key in a directory, uses it to encrypt the message before sending it off. Bob then uses his private key to decrypt the message and reads it. No one listening on can decrypt the message.
Anyone can send an encrypted message to Bob but only Bob can read it. Thus, although many people may know Bob’s public key and use it to verify Bob’s signature, they cannot discover Bob’s private key and use it to forge digital signatures.
What does this principle refer to?

• A. Irreversibility
• B. Non-repudiation
• C. Symmetry
• D. Asymmetry

Answer: D

Explanation:
PKI uses asymmetric key pair encryption. One key of the pair is the only way to decrypt data encrypted with the other.

NEW QUESTION 8

A consultant has been hired by the V.P. of a large financial organization to assess the company's security posture. During the security testing, the consultant comes across child pornography on the V.P.'s computer. What is the consultant's obligation to the financial organization?

• A. Say nothing and continue with the security testing.
• B. Stop work immediately and contact the authorities.
• C. Delete the pornography, say nothing, and continue security testing.
• D. Bring the discovery to the financial organization's human resource department.

Answer: B

NEW QUESTION 9

What are the three phases involved in security testing?

• A. Reconnaissance, Conduct, Report
• B. Reconnaissance, Scanning, Conclusion
• C. Preparation, Conduct, Conclusion
• D. Preparation, Conduct, Billing

Answer: C

Explanation:
Preparation phase - A formal contract is executed containing non-disclosure of the client's data and legal protection for the tester. At a minimum, it also lists the IP addresses to be tested and time to test.
Conduct phase - In this phase the penetration test is executed, with the tester looking for potential vulnerabilities.
Conclusion phase - The results of the evaluation are communicated to the pre-defined organizational contact, and corrective action is advised.

NEW QUESTION 10

What port number is used by LDAP protocol?

• A. 110
• B. 389
• C. 464
• D. 445

Answer: B

NEW QUESTION 11

Carl has successfully compromised a web server from behind a firewall by exploiting a vulnerability in the web server program. He wants to proceed by installing a backdoor program. However, he is aware that not all inbound ports on the firewall are in the open state.
From the list given below, identify the port that is most likely to be open and allowed to reach the server that Carl has just compromised.

• A. 53
• B. 110
• C. 25
• D. 69

Answer: A

Explanation:
Port 53 is used by DNS and is almost always open, the problem is often that the port is opened for the hole world and not only for outside DNS servers.

NEW QUESTION 12

What are common signs that a system has been compromised or hacked? (Choose three.)

• A. Increased amount of failed logon events
• B. Patterns in time gaps in system and/or event logs
• C. New user accounts created
• D. Consistency in usage baselines
• E. Partitions are encrypted
• F. Server hard drives become fragmented

Answer: ABC

NEW QUESTION 13

A technician is resolving an issue where a computer is unable to connect to the Internet using a wireless access point. The computer is able to transfer files locally to other machines, but cannot successfully reach the Internet. When the technician examines the IP address and default gateway they are both on the 192.168.1.0/24. Which of the following has occurred?

• A. The gateway is not routing to a public IP address.
• B. The computer is using an invalid IP address.
• C. The gateway and the computer are not on the same network.
• D. The computer is not using a private IP address.

Answer: A

NEW QUESTION 14

Which one of the following attacks will pass through a network layer intrusion detection system undetected?

• A. A teardrop attack
• B. A SYN flood attack
• C. A DNS spoofing attack
• D. A test.cgi attack

Answer: D

Explanation:
Because a network-based IDS reviews packets and headers, it can also detect denial of service (DoS) attacks
Not A or B:
The following sections discuss some of the possible DoS attacks available. Smurf
Fraggle SYN Flood Teardrop
DNS DoS Attacks”

NEW QUESTION 15

Peter extracts the SID list from Windows 2008 Server machine using the hacking tool "SIDExtracter". Here is the output of the SIDs:

From the above list identify the user account with System Administrator privileges?

• A. John
• B. Rebecca
• C. Sheela
• D. Shawn
• E. Somia
• F. Chang
• G. Micah

Answer: F

NEW QUESTION 16

RC4 is known to be a good stream generator. RC4 is used within the WEP standard on wireless LAN. WEP is known to be insecure even if we are using a stream cipher that is known to be secured.
What is the most likely cause behind this?

• A. There are some flaws in the implementation.
• B. There is no key management.
• C. The IV range is too small.
• D. All of the above.
• E. None of the above.

Answer: D

Explanation:
Because RC4 is a stream cipher, the same traffic key must never be used twice. The purpose of an IV, which is transmitted as plain text, is to prevent any repetition, but a 24-bit IV is not long enough to ensure this on a busy network. The way the IV was used also opened WEP to a related key attack. For a 24-bit IV, there is a 50% probability
the same IV will repeat after 5000 packets.
Many WEP systems require a key in hexadecimal format. Some users choose keys that spell words in the limited 0-9, A-F hex character set, for example C0DE C0DE C0DE C0DE. Such keys are often easily guessed.

NEW QUESTION 17

John has scanned the web server with NMAP. However, he could not gather enough information to help him identify the operating system running on the remote host accurately.
What would you suggest to John to help identify the OS that is being used on the remote web server?

• A. Connect to the web server with a browser and look at the web page.
• B. Connect to the web server with an FTP client.
• C. Telnet to port 8080 on the web server and look at the default page code.
• D. Telnet to an open port and grab the banner.

Answer: D

Explanation:
Most people don’t care about changing the banners presented by applications listening to open ports and therefore you should get fairly accurate information when grabbing banners from open ports with, for example, a telnet application.

NEW QUESTION 18

Shayla is an IT security consultant, specializing in social engineering and external penetration tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense. Shayla has been given authority to perform any and all tests necessary to audit the company's network security.
No employees for the company, other than the IT director, know about Shayla's work she will be doing. Shayla's first step is to obtain a list of employees through company website contact pages. Then she befriends a female employee of the company through an online chat website. After meeting with the female employee numerous times, Shayla is able to gain her trust and they become friends. One day, Shayla steals the employee's access badge and uses it to gain unauthorized access to the Treks Avionics offices.
What type of insider threat would Shayla be considered?

• A. She would be considered an Insider Affiliate
• B. Because she does not have any legal access herself, Shayla would be considered an Outside Affiliate
• C. Shayla is an Insider Associate since she has befriended an actual employee
• D. Since Shayla obtained access with a legitimate company badge; she would be considered a Pure Insider

Answer: A

NEW QUESTION 19

A very useful resource for passively gathering information about a target company is:

• A. Host scanning
• B. Whois search
• C. Traceroute
• D. Ping sweep

Answer: B

Explanation:
A, C & D are "Active" scans, the question says: "Passively"

NEW QUESTION 20

International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining

• A. guidelines and practices for security controls.
• B. financial soundness and business viability metrics.
• C. standard best practice for configuration management.
• D. contract agreement writing standards.

Answer: A

NEW QUESTION 21

Windump is the windows port of the famous TCPDump packet sniffer available on a variety of platforms. In order to use this tool on the Windows platform you must install a packet capture library.
What is the name of this library?

• A. NTPCAP
• B. LibPCAP
• C. WinPCAP
• D. PCAP

Answer: C

Explanation:
WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.

NEW QUESTION 22

What file system vulnerability does the following command take advantage of?
type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe

• A. HFS
• B. ADS
• C. NTFS
• D. Backdoor access

Answer: B

Explanation:
ADS (or Alternate Data Streams) is a “feature” in the NTFS file system that makes it possible to hide information in alternate data streams in existing files. The file can have multiple data streams and the data streams are accessed by filename:stream.

NEW QUESTION 23

What is the main reason the use of a stored biometric is vulnerable to an attack?

• A. The digital representation of the biometric might not be unique, even if the physical characteristic is unique.
• B. Authentication using a stored biometric compares a copy to a copy instead of the original to a copy.
• C. A stored biometric is no longer "something you are" and instead becomes "something you have".
• D. A stored biometric can be stolen and used by an attacker to impersonate the individual identified by the biometric.

Answer: D

NEW QUESTION 24

Which of the statements concerning proxy firewalls is correct?

• A. Proxy firewalls increase the speed and functionality of a network.
• B. Firewall proxy servers decentralize all activity for an application.
• C. Proxy firewalls block network packets from passing to and from a protected network.
• D. Computers establish a connection with a proxy firewall which initiates a new network connection for the client.

Answer: D

NEW QUESTION 25

When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?

• A. Network tap
• B. Layer 3 switch
• C. Network bridge
• D. Application firewall

Answer: A

NEW QUESTION 26

The use of technologies like IPSec can help guarantee the followinG. authenticity, integrity,
confidentiality and

• A. non-repudiation.
• B. operability.
• C. security.
• D. usability.

Answer: A

NEW QUESTION 27

Which statement is TRUE regarding network firewalls preventing Web Application attacks?

• A. Network firewalls can prevent attacks because they can detect malicious HTTP traffic.
• B. Network firewalls cannot prevent attacks because ports 80 and 443 must be opened.
• C. Network firewalls can prevent attacks if they are properly configured.
• D. Network firewalls cannot prevent attacks because they are too complex to configure.

Answer: B

NEW QUESTION 28
......