CEHv7 Question Collection

1. You are performing a port scan with nmap. You are in hurry and conducting the scans at the
fastest possible speed. However, you don’t want to sacrifice reliability for speed. If stealth is not an
issue, what type of scan should you run to get very reliable results?
A. XMAS scan
B. Stealth scan
C. Connect scan
D. Fragmented packet scan
Explanation:
A TCP Connect scan, named after the Unix connect() system call is the most accurate
scanning method. If a port is open the operating system completes the TCP three-way
handshake, and the port scanner immediately closes the connection.
2. What does ICMP (type 11, code 0) denote?
A. Unknown Type
B. Time Exceeded
C. Source Quench
D. Destination Unreachable
Explanation:
An ICMP Type 11, Code 0 means Time Exceeded [RFC792], Code 0 = Time to Live
exceeded in Transit and Code 1 = Fragment Reassembly Time Exceeded.
3. Steve scans the network for SNMP enabled devices. Which port number Steve should scan?
A. 69
B. 150
C. 161
D. 169
Explanation:
The SNMP default port is 161. Port 69 is used for tftp, 150 is for SQL-NET and 169 is for
SEND.
4. Which type of scan does not open a full TCP connection?
A. Stealth Scan
B. XMAS Scan
C. Null Scan
D. FIN Scan
Explanation:
Stealth Scan: Instead of completing the full TCP three-way-handshake a full connection is
not made. A SYN packet is sent to the system and if a SYN/ACK packet is received it is
assumed that the port on the system is active. In that case a RST/ACK will be sent which
will determined the listening state the system is in. If a RST/ACK packet is received, it is
assumed that the port on the system is not active.

5. What does FIN in TCP flag define?
A. Used to close a TCP connection
B. Used to abort a TCP connection abruptly
C. Used to indicate the beginning of a TCP connection
D. Used to acknowledge receipt of a previous packet or transmission
Explanation:
The FIN flag stands for the word FINished. This flag is used to tear down the virtual
connections created using the previous flag (SYN), so because of this reason, the FIN flag
always appears when the last packets are exchanged between a connection.
6. What port number is used by LDAP protocol?
A. 110
B. 389
C. 445
D. 464
Explanation:
Active Directory and Exchange use LDAP via TCP port 389 for clients.
7. What sequence of packets is sent during the initial TCP three-way handshake?
A. SYN, URG, ACK
B. FIN, FIN-ACK, ACK
C. SYN, ACK, SYN-ACK
D. SYN, SYN-ACK, ACK
Explanation:
This is referred to as a "three way handshake." The "SYN" flags are requests by the TCP
stack at one end of a socket to synchronize themselves to the sequence numbering for this
new sessions. The ACK flags acknowlege earlier packets in this session. Obviously only
the initial packet has no ACK flag, since there are no previous packets to acknowlege. Only
the second packet (the first response from a server to a client) has both the SYN and the
ACK bits set.
8. What file system vulnerability does the following command take advantage of?
type c:anyfile.exe > c:winntsystem32calc.exe:anyfile.exe
A. HFS
B. ADS
C. NTFS
D. Backdoor access
Explanation:
ADS (or Alternate Data Streams) is a "feature" in the NTFS file system that makes it
possible to hide information in alternate data streams in existing files. The file can have
multiple data streams and the data streams are accessed by filename:stream.

9. In the context of Trojans, what is the definition of a Wrapper?
A. An encryption tool to protect the Trojan.
B. A tool used to bind the Trojan with legitimate file.
C. A tool used to encapsulated packets within a new header and footer.
D. A tool used to calculate bandwidth and CPU cycles wasted by the Trojan.
Explanation:
These wrappers allow an attacker to take any executable back-door program and combine it
with any legitimate executable, creating a Trojan horse without writing a single line of new
code.
10. Which of the following statements would not be a proper definition for a Trojan Horse?
A. An unauthorized program contained within a legitimate program.
This unauthorized program performs functions unknown (and probably unwanted) by the user.
B. A legitimate program that has been altered by the placement of unauthorized code within it; this
code perform functions unknown (and probably unwanted) by the user.
C. An authorized program that has been designed to capture keyboard keystrokes while the user
remains unaware of such an activity being performed.
D. Any program that appears to perform a desirable and necessary function but that (because of
unauthorized code within it that is unknown to the user) performs functions unknown (and definitely
unwanted) by the user.
Explanation:
A Trojan is all about running unauthorized code on the users computer without the user
knowing of it.
11. Which definition below best describes a covert channel?
A. Making use of a Protocol in a way it was not intended to be used
B. It is the multiplexing taking place on communication link
C. It is one of the weak channels used by WEP that makes it insecure
D. A Server Program using a port that is not well known
Explanation:
A covert channel is a hidden communication channel not intended for information transfer
at all. Redundancy can often be used to communicate in a covert way. There are several
ways that hidden communication can be set up.
12. John the hacker is sniffing the network to inject ARP packets. He injects broadcast frames onto
the wire to conduct MiTM attack. What is the destination MAC address of a broadcast frame?
A. 0xFFFFFFFFFFFF
B. 0xAAAAAAAAAAAA
C. 0xBBBBBBBBBBBB
D. 0xDDDDDDDDDDDD
Explanation:
0xFFFFFFFFFFFF is the destination MAC address of the broadcast frame.

13. What port number is used by Kerberos protocol?
A. 44
B. 88
C. 419
D. 487
Explanation:
Kerberos traffic uses UDP/TCP protocol source and destination port 88.
14. What is the command used to create a binary log file using tcpdump?
A. tcpdump -r log
B. tcpdump -w ./log
C. tcpdump -vde -r log
D. tcpdump -l /var/log/
Explanation:
tcpdump [ -adeflnNOpqStvx ] [ -c count ] [ -F file ] [ -i interface ] [ -r file ] [ -s snaplen ] [
-T type ] [ -w file ] [ expression ]
-w Write the raw packets to file rather than parsing and printing them out.
15. How do you defend against ARP spoofing?
A. Place static ARP entries on servers, workstation and routers
B. True IDS Sensors to look for large amount of ARP traffic on local subnets
C. Use private VLANS
D. Use ARPWALL system and block ARP spoofing attacks
Explanation:
ARPWALL is a opensource tools will give early warning when arp attack occurs.
This tool is still under construction.
16. How does a denial-of-service attack work?
A. A hacker tries to decipher a password by using a system, which subsequently crashes the network
B. A hacker attempts to imitate a legitimate user by confusing a computer or even another person
C. A hacker prevents a legitimate user (or group of users) from accessing a service
D. A hacker uses every character, word, or letter he or she can think of to defeat authentication
Explanation:
In computer security, a denial-of-service attack (DoS attack) is an attempt to make a
computer resource unavailable to its intended users. Typically the targets are high-profile
web servers, and the attack attempts to make the hosted web pages unavailable on the
Internet. It is a computer crime that violates the Internet proper use policy as indicated by
the Internet Architecture Board (IAB).

17. Bob waits near a secured door, holding a box. He waits until an employee walks up to the
secured door and uses the special card in order to access the restricted area of the target company. Just
as the employee opens the door, Bob walks up to the employee (still holding the box) and asks the
employee to hold the door open so that he can enter. What is the best way to undermine the social
engineering activity of tailgating?
A. issue special cards to access secured doors at the company and provide a one-time only brief
description of use of the special card
B. to post a sign that states "no tailgating" next to the special card reader adjacent to the secured door
C. setup a mock video camera next to the special card reader adjacent to the secured door
D. to educate all of the employees of the company on best security practices on a recurring basis
Explanation:
Tailgating will not work in small company’s where everyone knows everyone, and neither
will it work in very large companies where everyone is required to swipe a card to pass, but
it’s a very simple and effective social engineering attack against mid-sized companies
where it’s common for one employee not to know everyone. There is two ways of stop this
attack either by buying expensive perimeter defense in form of gates that only let on
employee pass at every swipe of a card or by educating every employee on a recurring
basis.
18. Jake works as a system administrator at Acme Corp. Jason, an accountant of the firm befriends
him at the canteen and tags along with him on the pretext of appraising him about potential tax
benefits. Jason waits for Jake to swipe his access card and follows him through the open door into the
secure systems area. How would you describe Jason’s behavior within a security context?
A. Trailing
B. Tailgating
C. Swipe Gating
D. Smooth Talking
Explanation:
Tailgating, in which an unauthorized person follows someone with a pass into an office, is a
very simple social engineering attack. The intruder opens the door, which the authorized
user walks through, and then engages them in conversation about the weather or weekend
sport while they walk past the reception area together.
19. A majority of attacks come from insiders, people who have direct access to a company’s
computer system as part of their job function or a business relationship. Who is considered an insider?
A. The CEO of the company because he has access to all of the computer systems
B. A government agency since they know the company computer system strengths and weaknesses
C. Disgruntled employee, customers, suppliers, vendors, business partners, contractors, temps,
and consultants
D. A competitor to the company because they can directly benefit from the publicity generated by
making such an attack
Explanation:
An insider is anyone who already has an foot inside one way or another.

20. Which type of hacker represents the highest risk to your network?
A. script kiddies
B. grey hat hackers
C. black hat hackers
D. disgruntled employees
Explanation:
The disgruntled users have some permission on your database, versus a hacker who might
not get into the database. Global Crossings is a good example of how a disgruntled
employee — who took the internal payroll database home on a hard drive — caused big
problems for the telecommunications company. The employee posted the names, Social
Security numbers and birthdates of company employees on his Web site. He may have been
one of the factors that helped put them out of business.
21. Data is sent over the network as clear text (unencrypted) when Basic Authentication is
configured on Web Servers.
A. True
B. False
Explanation:
Using HTTP basic authentication will result in your password being sent over the internet
as clear text. Don’t use this technique unless you understand what the ramifications of this
are.
22. You have chosen a 22 character word from the dictionary as your password. How long will it
take to crack the password by an attacker?
A. 5 minutes
B. 23 days
C. 200 years
D. 16 million years
Explanation:
A dictionary password cracker simply takes a list of dictionary words, and one at a time
encrypts them to see if they encrypt to the one way hash from the system. If the hashes are
equal, the password is considered cracked, and the word tried from the dictionary list is the
password. As long as you use a word found in or similar to a word found in a dictionary the
password is considered to be weak.
23. Jimmy, an attacker, knows that he can take advantage of poorly designed input validation
routines to create or alter SQL commands to gain access to private data or execute commands in the
database. What technique does Jimmy use to compromise a database?
A. Jimmy can submit user input that executes an operating system command to compromise a target
system
B. Jimmy can utilize this particular database threat that is an SQL injection technique to
penetrate a target system
C. Jimmy can utilize an incorrect configuration that leads to access with higher-than-expected privilege

of the database
D. Jimmy can gain control of system to flood the target system with requests, preventing legitimate
users from gaining access
Explanation:
SQL injection is a security vulnerability that occurs in the database layer of an application.
The vulnerability is present when user input is either incorrectly filtered for string literal
escape characters embedded in SQL statements or user input is not strongly typed and
thereby unexpectedly executed. It is in fact an instance of a more general class of
vulnerabilities that can occur whenever one programming or scripting language is
embedded inside another.
24. Identify SQL injection attack from the HTTP requests shown below:
A. http://www.victim.com/example?accountnumber=67891&creditamount=999999999
B. http://www.xsecurity.com/cgiin/bad.cgi?foo=..%fc%80%80%80%80%af../bin/ls%20-al
C. http://www.myserver.com/search.asp?lname=smith%27%3bupdate%20usertable%20set
%20pass wd%3d%27hAx0r%27%3b–%00
D. http://www.myserver.com/script.php?mydata=%3cscript%20src=%22https%3a%2f%2fsiteproxy.ruqli.workers.dev%3a443%2fhttp%2fwww.yourser
ver.c0m%2fbadscript.js%22% 3e%3c%2fscript%3e
Explanation:
Explantion: The correct answer contains the code to alter the usertable in order to change
the password for user smith to hAx0r
25. Study the snort rule given below and interpret the rule.
alert tcp any any –> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msg: "mountd access";)
A. An alert is generated when a TCP packet is originated from port 111 of any IP address to the
192.168.1.0 subnet
B. An alert is generated when any packet other than a TCP packet is seen on the network and destined
for the 192.168.1.0 subnet
C. An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and
destined to any IP on port 111
D. An alert is generated when a TCP packet originating from any IP address is seen on the
network and destined for any IP address on the 192.168.1.0 subnet on port 111
Explanation:
Refer to the online documentation on creating Snort rules at
http://snort.org/docs/snort_htmanuals/htmanual_261/node147.html
26. June, a security analyst, understands that a polymorphic virus has the ability to mutate and can
change its known viral signature and hide from signature-based antivirus programs. Can June use an
antivirus program in this case and would it be effective against a polymorphic virus?
A. No. June can’t use an antivirus program since it compares the size of executable files to the database
of known viral signatures and it is effective on a polymorphic virus
B. Yes. June can use an antivirus program since it compares the parity bit of executable files to the
database of known check sum counts and it is effective on a polymorphic virus

C. Yes. June can use an antivirus program since it compares the signatures of executable files to the
database of known viral signatures and it is very effective against a polymorphic virus
D. No. June can’t use an antivirus program since it compares the signatures of executable files to
the database of known viral signatures and in the case the polymorphic viruses cannot be
detected by a signature-based anti-virus program
Explanation:
Although there are functions like heuristic scanning and sandbox technology, the Antivirus
program is still mainly depending of signature databases and can only find already known
viruses.
27. You are the security administrator for a large network. You want to prevent attackers from
running any sort of traceroute into your DMZ and discovering the internal structure of publicly
accessible areas of the network. How can you achieve this?
A. Block TCP at the firewall
B. Block UDP at the firewall
C. Block ICMP at the firewall
D. There is no way to completely block tracerouting into this area
Explanation:
If you create rules that prevents attackers to perform traceroutes to your DMZ then you’ll
also prevent anyone from accessing the DMZ from outside the company network and in
that case it is not a DMZ you have.
28. Which of the following countermeasure can specifically protect against both the MAC Flood
and MAC Spoofing attacks?
A. Port Security
B. Switch Mapping
C. Port Reconfiguring
D. Multiple Recognition
Explanation:
With Port Security the switch will keep track of which ports are allowed to send traffic on a
port.
29. A simple compiler technique used by programmers is to add a terminator ‘canary word’
containing four letters NULL (0×00), CR (0x0d), LF (0x0a) and EOF (0xff) so that most string
operations are terminated. If the canary word has been altered when the function returns, and the
program responds by emitting an intruder alert into syslog, and then halts what does it indicate?
A. The system has crashed
B. A buffer overflow attack has been attempted
C. A buffer overflow attack has already occurred
D. A firewall has been breached and this is logged
E. An intrusion detection system has been triggered

Explanation:
Terminator Canaries are based on the observation that most buffer overflows and stack
smash attacks are based on certain string operations which end at terminators. The reaction
to this observation is that the canaries are built of NULL terminators, CR, LF, and -1. The
undesirable result is that the canary is known.
30. In Buffer Overflow exploit, which of the following registers gets overwritten with return
address of the exploit code?
A. EIP
B. ESP
C. EAP
D. EEP
Explanation:
EIP is the instruction pointer which is a register, it points to your next command.
31. Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the
cookie even while the session is valid on the server. Why do you think this is possible?
A. Any cookie can be replayed irrespective of the session status
B. The scenario is invalid as a secure cookie cannot be replayed
C. It works because encryption is performed at the network layer (layer 1 encryption)
D. It works because encryption is performed at the application layer (single encryption key)
32. How many bits encryption does SHA-1 use?
A. 64 bits
B. 128 bits
C. 160 bits
D. 256 bits
Explanation:
SHA-1 (as well as SHA-0) produces a 160-bit digest from a message with a maximum
length of 264 – 1 bits, and is based on principles similar to those used by Professor Ronald
L. Rivest of MIT in the design of the MD4 and MD5 message digest algorithms.
33. A digital signature is simply a message that is encrypted with the public key instead of the
private key.
A. True
B. False
Explanation:
Digital signatures enable the recipient of information to verify the authenticity of the information’s
origin, and also verify that the information is intact. Thus, public key digital signatures provide
authentication and data integrity. A digital signature also provides non-repudiation, which means that it
prevents the sender from claiming that he or she did not actually send the information. Instead of
encrypting information using someone else’s public key, you encrypt it with your private key. If the
information can be decrypted with your public key, then it must have originated with you.

34. Which of the following encryption is not based on Block Cipher?
A. DES
B. Blowfish
C. AES
D. RC4
Explanation:
RC4 (also known as ARC4 or ARCFOUR) is the most widely-used software stream cipher
and is used in popular protocols such as Secure Sockets Layer (SSL) (to protect Internet
traffic) and WEP (to secure wireless networks).
Topic 22, Penetration Testing Methodologies
35. Oregon Corp is fighting a litigation suit with Scamster Inc. Oregon has assigned a private
investigative agency to go through garbage, recycled paper, and other rubbish at Scamster’s office site
in order to find relevant information. What would you call this kind of activity?
A. Garbage Scooping
B. Dumpster Diving
C. Scanning
D. CI Gathering
Explanation:
Dumpster diving is the colloquial name for going through somebody’s garbage — which
will usually be in dumpsters for large organizations. This is a powerful tactic because it is
protected by social taboos. Trash is bad, and once it goes into the trash, something is best
forgotten. The reality is that most company trash is fairly clean, and provides a gold mine
of information.
36. TCP/IP Session Hijacking is carried out in which OSI layer?
A. Transport layer
B. Datalink layer
C. Physical Layer
D. Network Layer
37. This type of Port Scanning technique splits TCP header into several packets so that the packet
filters are not able to detect what the packets intends to do.
A. UDP Scanning
B. IP Fragment Scanning
C. Inverse TCP flag scanning
D. ACK flag scanning

38. How do you defend against Privilege Escalation?
A. Use encryption to protect sensitive data
B. Restrict the interactive logon privileges
C. Run services as unprivileged accounts
D. Allow security settings of IE to zero or Low
E. Run users and applications on the least privileges
39. Which of the following type of scanning utilizes automated process of proactively identifying
vulnerabilities of the computing systems present on a network?
A. Port Scanning
B. Single Scanning
C. External Scanning
D. Vulnerability Scanning
40. What are the limitations of Vulnerability scanners? (Select 2 answers)
A. There are often better at detecting well-known vulnerabilities than more esoteric ones
B. The scanning speed of their scanners are extremely high
C. It is impossible for any, one scanning product to incorporate all known vulnerabilities in a
timely manner
D. The more vulnerabilities detected, the more tests required
E. They are highly expensive and require per host scan license
41. Stephanie works as senior security analyst for a manufacturing company in Detroit. Stephanie
manages network security throughout the organization. Her colleague Jason told her in confidence that
he was able to see confidential corporate information posted on the external website
http://www.jeansclothesman.com. He tries random URLs on the company’s website and finds
confidential information leaked over the web. Jason says this happened about a month ago. Stephanie
visits the said URLs, but she finds nothing. She is very concerned about this, since someone should be
held accountable if there was sensitive information posted on the website.
Where can Stephanie go to see past versions and pages of a website?
A. She should go to the web page Samspade.org to see web pages that might no longer be on the
website
B. If Stephanie navigates to Search.com; she will see old versions of the company website
C. Stephanie can go to Archive.org to see past versions of the company website
D. AddressPast.com would have any web pages that are no longer hosted on the company’s website

42. How does traceroute map the route a packet travels from point A to point B?
A. Uses a TCP timestamp packet that will elicit a time exceeded in transit message
B. Manipulates the value of the time to live (TTL) within packet to elicit a time exceeded in
transit message
C. Uses a protocol that will be rejected by gateways on its way to the destination
D. Manipulates the flags within packets to force gateways into generating error messages
43. Neil is a network administrator working in Istanbul. Neil wants to setup a protocol analyzer on
his network that will receive a copy of every packet that passes through the main office switch. What
type of port will Neil need to setup in order to accomplish this?
A. Neil will have to configure a Bridged port that will copy all packets to the protocol analyzer.
B. Neil will need to setup SPAN port that will copy all network traffic to the protocol analyzer.
C. He will have to setup an Ether channel port to get a copy of all network traffic to the analyzer.
D. He should setup a MODS port which will copy all network traffic.
44. Jayden is a network administrator for her company. Jayden wants to prevent MAC spoofing on
all the Cisco switches in the network. How can she accomplish this?
A. Jayden can use the command: ip binding set.
B. Jayden can use the command: no ip spoofing.
C. She should use the command: no dhcp spoofing.
D. She can use the command: ip dhcp snooping binding.
45. Google uses a unique cookie for each browser used by an individual user on a computer. This
cookie contains information that allows Google to identify records about that user on its database. This
cookie is submitted every time a user launches a Google search, visits a site using AdSense etc. The
information stored in Google’s database, identified by the cookie, includes
- Everything you search for using Google
- Every web page you visit that has Google Adsense ads
How would you prevent Google from storing your search keywords?
A. Block Google Cookie by applying Privacy and Security settings in your web browser
B. Disable the Google cookie using Google Advanced Search settings on Google Search page
C. Do not use Google but use another search engine Bing which will not collect and store your search
keywords
D. Use MAC OS X instead of Windows 7. Mac OS has higher level of privacy controls by default.
46. You want to hide a secret.txt document inside c:windowssystem32tcpip.dll kernel library using
ADS streams. How will you accomplish this?
A. copy secret.txt c:windowssystem32tcpip.dll kernel>secret.txt
B. copy secret.txt c:windowssystem32tcpip.dll:secret.txt
C. copy secret.txt c:windowssystem32tcpip.dll |secret.txt
D. copy secret.txt >< c:windowssystem32tcpip.dll kernel secret.txt

47. Shayla is an IT security consultant, specializing in social engineering and external penetration
tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense.
Shayla has been given authority to perform any and all tests necessary to audit the company’s network
security.
No employees for the company, other than the IT director, know about Shayla’s work she will be doing.
Shayla’s first step is to obtain a list of employees through company website contact pages. Then she
befriends a female employee of the company through an online chat website. After meeting with the
female employee numerous times, Shayla is able to gain her trust and they become friends. One day,
Shayla steals the employee’s access badge and uses it to gain unauthorized access to the Treks Avionics
offices.
What type of insider threat would Shayla be considered?
A. She would be considered an Insider Affiliate
B. Because she does not have any legal access herself, Shayla would be considered an Outside Affiliate
C. Shayla is an Insider Associate since she has befriended an actual employee
D. Since Shayla obtained access with a legitimate company badge; she would be considered a Pure
Insider
48. This attack technique is used when a Web application is vulnerable to an SQL Injection but the
results of the Injection are not visible to the attacker.
A. Unique SQL Injection
B. Blind SQL Injection
C. Generic SQL Injection
D. Double SQL Injection
49. In what stage of Virus life does a stealth virus gets activated with the user performing certain
actions such as running an infected program?
A. Design
B. Elimination
C. Incorporation
D. Replication
E. Launch
F. Detection
50. What is a sniffing performed on a switched network called?
A. Spoofed sniffing
B. Passive sniffing
C. Direct sniffing
D. Active sniffing

51. Which Steganography technique uses Whitespace to hide secret messages?
A. snow
B. beetle
C. magnet
D. cat
52. Cyber Criminals have long employed the tactic of masking their true identity. In IP spoofing, an
attacker gains unauthorized access to a computer or a network by making it appear that a malicious
message has come from a trusted machine, by "spoofing" the IP address of that machine.
How would you detect IP spoofing?
A. Check the IPID of the spoofed packet and compare it with TLC checksum. If the numbers match
then it is spoofed packet
B. Probe a SYN Scan on the claimed host and look for a response SYN/FIN packet, if the connection
completes then it is a spoofed packet
C. Turn on ‘Enable Spoofed IP Detection’ in Wireshark, you will see a flag tick if the packet is spoofed
D. Sending a packet to the claimed host will result in a reply. If the TTL in the reply is not the
same as the packet being checked then it is a spoofed packet
53. David is a security administrator working in Boston. David has been asked by the office’s
manager to block all POP3 traffic at the firewall because he believes employees are spending too much
time reading personal email. How can David block POP3 at the firewall?
A. David can block port 125 at the firewall.
B. David can block all EHLO requests that originate from inside the office.
C. David can stop POP3 traffic by blocking all HELO requests that originate from inside the office.
D. David can block port 110 to block all POP3 traffic.
54. You want to capture Facebook website traffic in Wireshark. What display filter should you use
that shows all TCP packets that contain the word ‘facebook’?
A. display==facebook
B. traffic.content==facebook
C. tcp contains facebook
D. list.display.facebook
55. Maintaining a secure Web server requires constant effort, resources, and vigilance from an
organization. Securely administering a Web server on a daily basis is an essential aspect of Web server
security.
Maintaining the security of a Web server will usually involve the following steps:
1. Configuring, protecting, and analyzing log files
2. Backing up critical information frequently
3. Maintaining a protected authoritative copy of the organization’s Web content

4. Establishing and following procedures for recovering from compromise
5. Testing and applying patches in a timely manner
6. Testing security periodically.
In which step would you engage a forensic investigator?
A. 1
B. 2
C. 3
D. 4
E. 5
F. 6
56. Web servers often contain directories that do not need to be indexed. You create a text file with
search engine indexing restrictions and place it on the root directory of the Web Server.
User-agent: *
Disallow: /images/
Disallow: /banners/
Disallow: /Forms/
Disallow: /Dictionary/
Disallow: /_borders/
Disallow: /_fpclass/
Disallow: /_overlay/
Disallow: /_private/
Disallow: /_themes/
What is the name of this file?
A. robots.txt
B. search.txt
C. blocklist.txt
D. spf.txt
57. What is War Dialing?
A. War dialing involves the use of a program in conjunction with a modem to penetrate the
modem/PBX-based systems
B. War dialing is a vulnerability scanning technique that penetrates Firewalls
C. It is a social engineering technique that uses Phone calls to trick victims
D. Involves IDS Scanning Fragments to bypass Internet filters and stateful Firewalls

58. Steven the hacker realizes the network administrator of Acme Corporation is using syskey in
Windows 2008 Server to protect his resources in the organization. Syskey independently encrypts the
hashes so that physical access to the server, tapes, or ERDs is only first step to cracking the passwords.
Steven must break through the encryption used by syskey before he can attempt to use brute force
dictionary attacks on the hashes. Steven runs a program called "SysCracker" targeting the Windows
2008 Server machine in attempting to crack the hash used by Syskey. He needs to configure the
encryption level before he can launch the attack. How many bits does Syskey use for encryption?
A. 40-bit encryption
B. 128-bit encryption
C. 256-bit encryption
D. 64-bit encryption
59. Ursula is a college student at a University in Amsterdam. Ursula originally went to college to
study engineering but later changed to marine biology after spending a month at sea with her friends.
These friends frequently go out to sea to follow and harass fishing fleets that illegally fish in foreign
waters. Ursula eventually wants to put companies practicing illegal fishing out of business. Ursula
decides to hack into the parent company’s computers and destroy critical data knowing fully well that,
if caught, she probably would be sent to jail for a very long time. What would Ursula be considered?
A. Ursula would be considered a gray hat since she is performing an act against illegal activities.
B. She would be considered a suicide hacker.
C. She would be called a cracker.
D. Ursula would be considered a black hat.
60. Attacking well-known system defaults is one of the most common hacker attacks. Most
software is shipped with a default configuration that makes it easy to install and setup the application.
You should change the default settings to secure the system.
Which of the following is NOT an example of default installation?
A. Many systems come with default user accounts with well-known passwords that administrators
forget to change
B. Often, the default location of installation files can be exploited which allows a hacker to retrieve a
file from the system
C. Many software packages come with "samples" that can be exploited, such as the sample programs
on IIS web services
D. Enabling firewall and anti-virus software on the local system
61. One of the effective DoS/DDoS countermeasures is ‘Throttling’. Which statement correctly
defines this term?
A. Set up routers that access a server with logic to adjust incoming traffic to levels that will be
safe for the server to process
B. Providers can increase the bandwidth on critical connections to prevent them from going down in
the event of an attack

C. Replicating servers that can provide additional failsafe protection
D. Load balance each server in a multiple-server architecture
62. Bob has set up three web servers on Windows Server 2008 IIS 7.0. Bob has followed all the
recommendations for securing the operating system and IIS. These servers are going to run numerous
e-commerce websites that are projected to bring in thousands of dollars a day. Bob is still concerned
about the security of these servers because of the potential for financial loss. Bob has asked his
company’s firewall administrator to set the firewall to inspect all incoming traffic on ports 80 and 443
to ensure that no malicious data is getting into the network.
Why will this not be possible?
A. Firewalls cannot inspect traffic coming through port 443
B. Firewalls can only inspect outbound traffic
C. Firewalls cannot inspect traffic at all, they can only block or allow certain ports
D. Firewalls cannot inspect traffic coming through port 80
63. You are the CIO for Avantes Finance International, a global finance company based in Geneva.
You are responsible for network functions and logical security throughout the entire corporation. Your
company has over 250 servers running Windows Server, 5000 workstations running Windows Vista,
and 200 mobile users working from laptops on Windows 7.
Last week, 10 of your company’s laptops were stolen from salesmen while at a conference in
Amsterdam. These laptops contained proprietary company information. While doing damage
assessment on the possible public relations nightmare this may become, a news story leaks about the
stolen laptops and also that sensitive information from those computers was posted to a blog online.
What built-in Windows feature could you have implemented to protect the sensitive information on
these laptops?
A. You should have used 3DES which is built into Windows
B. If you would have implemented Pretty Good Privacy (PGP) which is built into Windows, the
sensitive information on the laptops would not have leaked out
C. You should have utilized the built-in feature of Distributed File System (DFS) to protect the
sensitive information on the laptops
D. You could have implemented Encrypted File System (EFS) to encrypt the sensitive files on the
laptops
64. Which of the following is NOT part of CEH Scanning Methodology?
A. Check for Live systems
B. Check for Open Ports
C. Banner Grabbing
D. Prepare Proxies
E. Social Engineering attacks
F. Scan for Vulnerabilities
G. Draw Network Diagrams

65. Lee is using Wireshark to log traffic on his network. He notices a number of packets being
directed to an internal IP from an outside IP where the packets are ICMP and their size is around 65,536
bytes. What is Lee seeing here?
A. Lee is seeing activity indicative of a Smurf attack.
B. Most likely, the ICMP packets are being sent in this manner to attempt IP spoofing.
C. Lee is seeing a Ping of death attack.
D. This is not unusual traffic, ICMP packets can be of any size.
66. This method is used to determine the Operating system and version running on a remote target
system. What is it called?
A. Service Degradation
B. OS Fingerprinting
C. Manual Target System
D. Identification Scanning
67. You are gathering competitive intelligence on an organization. You notice that they have jobs
listed on a few Internet job-hunting sites. There are two jobs for network and system administrators.
How can this help you in foot printing the organization?
A. To learn about the IP range used by the target network
B. To identify the number of employees working for the company
C. To test the limits of the corporate security policy enforced in the company
D. To learn about the operating systems, services and applications used on the network
68. TCP packets transmitted in either direction after the initial three-way handshake will have
which of the following bit set?
A. SYN flag
B. ACK flag
C. FIN flag
D. XMAS flag
69. What techniques would you use to evade IDS during a Port Scan? (Select 4 answers)
A. Use fragmented IP packets
B. Spoof your IP address when launching attacks and sniff responses from the server
C. Overload the IDS with Junk traffic to mask your scan
D. Use source routing (if possible)
E. Connect to proxy servers or compromised Trojaned machines to launch attacks

70. Leesa is the senior security analyst for a publicly traded company. The IT department recently
rolled out an intranet for company use only with information ranging from training, to holiday
schedules, to human resources data. Leesa wants to make sure the site is not accessible from outside
and she also wants to ensure the site is Sarbanes-Oxley (SOX) compliant. Leesa goes to a public library
as she wants to do some Google searching to verify whether the company’s intranet is accessible from
outside and has been indexed by Google. Leesa wants to search for a website title of "intranet" with
part of the URL containing the word "intranet" and the words "human resources" somewhere in the
webpage.
What Google search will accomplish this?
A. related:intranet allinurl:intranet:"human resources"
B. cache:"human resources" inurl:intranet(SharePoint)
C. intitle:intranet inurl:intranet+intext:"human resources"
D. site:"human resources"+intext:intranet intitle:intranet
71. Harold works for Jacobson Unlimited in the IT department as the security manager. Harold has
created a security policy requiring all employees to use complex 14 character passwords.
Unfortunately, the members of management do not want to have to use such long complicated
passwords so they tell Harold’s boss this new password policy should not apply to them. To comply
with the management’s wishes, the IT department creates another Windows domain and moves all the
management users to that domain. This new domain has a password policy only requiring 8 characters.
Harold is concerned about having to accommodate the managers, but cannot do anything about it.
Harold is also concerned about using LanManager security on his network instead of NTLM or
NTLMv2, but the many legacy applications on the network prevent using the more secure NTLM and
NTLMv2. Harold pulls the SAM files from the DC’s on the original domain and the new domain using
Pwdump6.
Harold uses the password cracking software John the Ripper to crack users’ passwords to make sure
they are strong enough. Harold expects that the users’ passwords in the original domain will take much
longer to crack than the management’s passwords in the new domain. After running the software,
Harold discovers that the 14 character passwords only took a short time longer to crack than the 8
character passwords.
Why did the 14 character passwords not take much longer to crack than the 8 character passwords?
A. Harold should have used Dumpsec instead of Pwdump6
B. Harold’s dictionary file was not large enough
C. Harold should use LC4 instead of John the Ripper
D. LanManger hashes are broken up into two 7 character fields
72. Which of the following Trojans would be considered ‘Botnet Command Control Center’?
A. YouKill DOOM
B. Damen Rock
C. Poison Ivy
D. Matten Kit

73. John is using a special tool on his Linux platform that has a database containing signatures to be
able to detect hundreds of vulnerabilities in UNIX, Windows, and commonly used web CGI/ASPX
scripts. Moreover, the database detects DDoS zombies and Trojans as well. What would be the name of
this tool?
A. hping2
B. nessus
C. nmap
D. make
74. Your company has blocked all the ports via external firewall and only allows port 80/443 to
connect to the Internet. You want to use FTP to connect to some remote server on the Internet.
How would you accomplish this?
A. Use HTTP Tunneling
B. Use Proxy Chaining
C. Use TOR Network
D. Use Reverse Chaining
75. In which location, SAM hash passwords are stored in Windows 7?
A. c:windowssystem32configSAM
B. c:winntsystem32machineSAM
C. c:windowsetcdriversSAM
D. c:windowsconfigetcSAM
76. File extensions provide information regarding the underlying server technology. Attackers can
use this information to search vulnerabilities and launch attacks. How would you disable file extensions
in Apache servers?
A. Use disable-eXchange
B. Use mod_negotiation
C. Use Stop_Files
D. Use Lib_exchanges
77. NetBIOS over TCP/IP allows files and/or printers to be shared over the network. You are trying
to intercept the traffic from a victim machine to a corporate network printer. You are attempting to
hijack the printer network connection from your laptop by sniffing the wire. Which port does SMB
over TCP/IP use?
A. 443
B. 139
C. 179
D. 445

78. Charlie is the network administrator for his company. Charlie just received a new Cisco router
and wants to test its capabilities out and to see if it might be susceptible to a DoS attack resulting in its
locking up. The IP address of the Cisco switch is 172.16.0.45. What command can Charlie use to
attempt this task?
A. Charlie can use the command: ping -l 56550 172.16.0.45 -t.
B. Charlie can try using the command: ping 56550 172.16.0.45.
C. By using the command ping 172.16.0.45 Charlie would be able to lockup the router
D. He could use the command: ping -4 56550 172.16.0.45.
79. Attackers send an ACK probe packet with random sequence number, no response means port is
filtered (Stateful firewall is present) and RST response means the port is not filtered. What type of Port
Scanning is this?
A. RST flag scanning
B. FIN flag scanning
C. SYN flag scanning
D. ACK flag scanning
80. What is the IV key size used in WPA2?
A. 32
B. 24
C. 16
D. 48
E. 128
81. What is the default Password Hash Algorithm used by NTLMv2?
A. MD4
B. DES
C. SHA-1
D. MD5
82. Frederickson Security Consultants is currently conducting a security audit on the networks of
Hawthorn Enterprises, a contractor for the Department of Defense. Since Hawthorn Enterprises
conducts business daily with the federal government, they must abide by very stringent security
policies. Frederickson is testing all of Hawthorn’s physical and logical security measures including
biometrics, passwords, and permissions. The federal government requires that all users must utilize
random, non-dictionary passwords that must take at least 30 days to crack. Frederickson has confirmed
that all Hawthorn employees use a random password generator for their network passwords. The
Frederickson consultants have saved off numerous SAM files from Hawthorn’s servers using Pwdump6
and are going to try and crack the network passwords. What method of attack is best suited to crack
these passwords in the shortest amount of time?
A. Brute force attack

B. Birthday attack
C. Dictionary attack
D. Brute service attack
83. Blane is a network security analyst for his company. From an outside IP, Blane performs an
XMAS scan using Nmap. Almost every port scanned does not illicit a response. What can he infer from
this kind of response?
A. These ports are open because they do not illicit a response.
B. He can tell that these ports are in stealth mode.
C. If a port does not respond to an XMAS scan using NMAP, that port is closed.
D. The scan was not performed correctly using NMAP since all ports, no matter what their state, will
illicit some sort of response from an XMAS scan.
84. Neil is closely monitoring his firewall rules and logs on a regular basis. Some of the users have
complained to Neil that there are a few employees who are visiting offensive web site during work
hours, without any consideration for others. Neil knows that he has an up-to-date content filtering
system and such access should not be authorized. What type of technique might be used by these
offenders to access the Internet without restriction?
A. They are using UDP that is always authorized at the firewall
B. They are using HTTP tunneling software that allows them to communicate with protocols in a
way it was not intended
C. They have been able to compromise the firewall, modify the rules, and give themselves proper
access
D. They are using an older version of Internet Explorer that allow them to bypass the proxy server
85. "Testing the network using the same methodologies and tools employed by attackers" Identify
the correct terminology that defines the above statement.
A. Vulnerability Scanning
B. Penetration Testing
C. Security Policy Implementation
D. Designing Network Security
86. Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP
cache of these switches. If these switches’ ARP cache is successfully flooded, what will be the result?
A. The switches will drop into hub mode if the ARP cache is successfully flooded.
B. If the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to
attacks.
C. Depending on the switch manufacturer, the device will either delete every entry in its ARP cache or
reroute packets to the nearest switch.

D. The switches will route all traffic to the broadcast address created collisions.
87. This TCP flag instructs the sending system to transmit all buffered data immediately.
A. SYN
B. RST
C. PSH
D. URG
E. FIN
88. You work for Acme Corporation as Sales Manager. The company has tight network security
restrictions. You are trying to steal data from the company’s Sales database (Sales.xls) and transfer
them to your home computer. Your company filters and monitors traffic that leaves from the internal
network to the Internet. How will you achieve this without raising suspicion?
A. Encrypt the Sales.xls using PGP and e-mail it to your personal gmail account
B. Package the Sales.xls using Trojan wrappers and telnet them back your home computer
C. You can conceal the Sales.xls database in another file like photo.jpg or other files and send it
out in an innocent looking email or file transfer using Steganography techniques
D. Change the extension of Sales.xls to sales.txt and upload them as attachment to your hotmail
account
89. Fred is the network administrator for his company. Fred is testing an internal switch. From an
external IP address, Fred wants to try and trick this switch into thinking it already has established a
session with his computer. How can Fred accomplish this?
A. Fred can accomplish this by sending an IP packet with the RST/SIN bit and the source address of his
computer.
B. He can send an IP packet with the SYN bit and the source address of his computer.
C. Fred can send an IP packet with the ACK bit set to zero and the source address of the switch.
D. Fred can send an IP packet to the switch with the ACK bit and the source address of his
machine.
90. Yancey is a network security administrator for a large electric company. This company provides
power for over 100,000 people in Las Vegas. Yancey has worked for his company for over 15 years and
has become very successful. One day, Yancey comes in to work and finds out that the company will be
downsizing and he will be out of a job in two weeks. Yancey is very angry and decides to place logic
bombs, viruses, Trojans, and backdoors all over the network to take down the company once he has
left. Yancey does not care if his actions land him in jail for 30 or more years, he just wants the company
to pay for what they are doing to him. What would Yancey be considered?
A. Yancey would be considered a Suicide Hacker
B. Since he does not care about going to jail, he would be considered a Black Hat
C. Because Yancey works for the company currently; he would be a White Hat
D. Yancey is a Hacktivist Hacker since he is standing up to a company that is downsizing

91. You went to great lengths to install all the necessary technologies to prevent hacking attacks,
such as expensive firewalls, antivirus software, anti-spam systems and intrusion detection/prevention
tools in your company’s network. You have configured the most secure policies and tightened every
device on your network. You are confident that hackers will never be able to gain access to your
network with complex security system in place. Your peer, Peter Smith who works at the same
department disagrees with you. He says even the best network security technologies cannot prevent
hackers gaining access to the network because of presence of "weakest link" in the security chain. What
is Peter Smith talking about?
A. Untrained staff or ignorant computer users who inadvertently become the weakest link in
your security chain
B. "zero-day" exploits are the weakest link in the security chain since the IDS will not be able to detect
these attacks
C. "Polymorphic viruses" are the weakest link in the security chain since the Anti-Virus scanners will
not be able to detect these attacks
D. Continuous Spam e-mails cannot be blocked by your security system since spammers use different
techniques to bypass the filters in your gateway
92. You are trying to break into a highly classified top-secret mainframe computer with highest
security system in place at Merclyn Barley Bank located in Los Angeles. You know that conventional
hacking doesn’t work in this case, because organizations such as banks are generally tight and secure
when it comes to protecting their systems. In other words you are trying to penetrate an otherwise
impenetrable system. How would you proceed?
A. Look for "zero-day" exploits at various underground hacker websites in Russia and China and buy
the necessary exploits from these hackers and target the bank’s network B. Try to hang around the local
pubs or restaurants near the bank, get talking to a poorly-paid or disgruntled employee, and offer them
money if they’ll abuse their access privileges by providing you with sensitive information
B. Launch DDOS attacks against Merclyn Barley Bank’s routers and firewall systems using
100,000 or more "zombies" and "bots"
C. Try to conduct Man-in-the-Middle (MiTM) attack and divert the network traffic going to the
Merclyn Barley Bank’s Webserver to that of your machine using DNS Cache Poisoning techniques
93. In which step Steganography fits in CEH System Hacking Cycle (SHC)
A. Step 2: Crack the password
B. Step 1: Enumerate users
C. Step 3: Escalate privileges
D. Step 4: Execute applications
E. Step 5: Hide files
F. Step 6: Cover your tracks
94. To see how some of the hosts on your network react, Winston sends out SYN packets to an IP
range. A number of IPs respond with a SYN/ACK response. Before the connection is established he
sends RST packets to those hosts to stop the session. Winston has done this to see how his intrusion
detection system will log the traffic. What type of scan is Winston attempting here?

A. Winston is attempting to find live hosts on your company’s network by using an XMAS scan.
B. He is utilizing a SYN scan to find live hosts that are listening on your network.
C. This type of scan he is using is called a NULL scan.
D. He is using a half-open scan to find live hosts on your network.
95. NTP allows you to set the clocks on your systems very accurately, to within 100ms and
sometimes-even 10ms. Knowing the exact time is extremely important for enterprise security. Various
security protocols depend on an accurate source of time information in order to prevent "playback"
attacks. These protocols tag their communications with the current time, to prevent attackers from
replaying the same communications, e.g., a login/password interaction or even an entire
communication, at a later date. One can circumvent this tagging, if the clock can be set back to the time
the communication was recorded. An attacker attempts to try corrupting the clocks on devices on your
network. You run Wireshark to detect the NTP traffic to see if there are any irregularities on the
network. What port number you should enable in Wireshark display filter to view NTP packets?
A. TCP Port 124
B. UDP Port 125
C. UDP Port 123
D. TCP Port 126
96. Bill is a security analyst for his company. All the switches used in the company’s office are
Cisco switches. Bill wants to make sure all switches are safe from ARP poisoning. How can Bill
accomplish this?
A. Bill can use the command: ip dhcp snooping.
B. Bill can use the command: no ip snoop.
C. Bill could use the command: ip arp no flood.
D. He could use the command: ip arp no snoop.
97. What do you call a pre-computed hash?
A. Sun tables
B. Apple tables
C. Rainbow tables
D. Moon tables
98. Why attackers use proxy servers?
A. To ensure the exploits used in the attacks always flip reverse vectors
B. Faster bandwidth performance and increase in attack speed
C. Interrupt the remote victim’s network traffic and reroute the packets to attackers machine
D. To hide the source IP address so that an attacker can hack without any legal corollary

99. You are writing security policy that hardens and prevents Footprinting attempt by Hackers.
Which of the following countermeasures will NOT be effective against this attack?
A. Configure routers to restrict the responses to Footprinting requests
B. Configure Web Servers to avoid information leakage and disable unwanted protocols
C. Lock the ports with suitable Firewall configuration
D. Use an IDS that can be configured to refuse suspicious traffic and pick up Footprinting patterns
E. Evaluate the information before publishing it on the Website/Intranet
F. Monitor every employee computer with Spy cameras, keyloggers and spy on them
G. Perform Footprinting techniques and remove any sensitive information found on DMZ sites
H. Prevent search engines from caching a Webpage and use anonymous registration services
I. Disable directory and use split-DNS
100. If an attacker’s computer sends an IPID of 24333 to a zombie (Idle Scanning) computer on a
closed port, what will be the response?
A. The zombie computer will respond with an IPID of 24334.
B. The zombie computer will respond with an IPID of 24333.
C. The zombie computer will not send a response.
D. The zombie computer will respond with an IPID of 24335.
101. Jacob is looking through a traffic log that was captured using Wireshark. Jacob has come across
what appears to be SYN requests to an internal computer from a spoofed IP address. What is Jacob
seeing here?
A. Jacob is seeing a Smurf attack.
B. Jacob is seeing a SYN flood.
C. He is seeing a SYN/ACK attack.
D. He has found evidence of an ACK flood.
102. Perimeter testing means determining exactly what your firewall blocks and what it allows. To
conduct a good test, you can spoof source IP addresses and source ports. Which of the following
command results in packets that will appear to originate from the system at 10.8.8.8? Such a packet is
useful for determining whether the firewall is allowing random packets in or out of your network.
A. hping3 -T 10.8.8.8 -S netbios -c 2 -p 80
B. hping3 -Y 10.8.8.8 -S windows -c 2 -p 80
C. hping3 -O 10.8.8.8 -S server -c 2 -p 80
D. hping3 -a 10.8.8.8 -S springfield -c 2 -p 80
103. Lauren is performing a network audit for her entire company. The entire network is comprised
of around 500 computers. Lauren starts an ICMP ping sweep by sending one IP packet to the broadcast
address of the network, but only receives responses from around five hosts. Why did this ping sweep
only produce a few responses?

A. Only Windows systems will reply to this scan.
B. A switched network will not respond to packets sent to the broadcast address.
C. Only Linux and Unix-like (Non-Windows) systems will reply to this scan.
D. Only servers will reply to this scan.
104. Neil is an IT security consultant working on contract for Davidson Avionics. Neil has been hired
to audit the network of Davidson Avionics. He has been given permission to perform any tests
necessary. Neil has created a fake company ID badge and uniform. Neil waits by one of the company’s
entrance doors and follows an employee into the office after they use their valid access card to gain
entrance. What type of social engineering attack has Neil employed here?
A. Neil has used a tailgating social engineering attack to gain access to the offices
B. He has used a piggybacking technique to gain unauthorized access
C. This type of social engineering attack is called man trapping
D. Neil is using the technique of reverse social engineering to gain access to the offices of Davidson
Avionics
105. Which of the following represent weak password? (Select 2 answers)
A. Passwords that contain letters, special characters, and numbers Example: ap1$%##f@52
B. Passwords that contain only numbers Example: 23698217
C. Passwords that contain only special characters Example: &*#@!(%)
D. Passwords that contain letters and numbers Example: meerdfget123
E. Passwords that contain only letters Example: QWERTYKLRTY
F. Passwords that contain only special characters and numbers Example: 123@$45
G. Passwords that contain only letters and special characters Example: bob@&ba
H. Passwords that contain Uppercase/Lowercase from a dictionary list Example: OrAnGe
106. Harold just got home from working at Henderson LLC where he works as an IT technician. He
was able to get off early because they were not too busy. When he walks into his home office, he
notices his teenage daughter on the computer, apparently chatting with someone online. As soon as she
hears Harold enter the room, she closes all her windows and tries to act like she was playing a game.
When Harold asks her what she was doing, she acts very nervous and does not give him a straight
answer. Harold is very concerned because he does not want his daughter to fall victim to online
predators and the sort. Harold doesn’t necessarily want to install any programs that will restrict the sites
his daughter goes to, because he doesn’t want to alert her to his trying to figure out what she is doing.
Harold wants to use some kind of program that will track her activities online, and send Harold an
email of her activity once a day so he can see what she has been up to. What kind of software could
Harold use to accomplish this?
A. Install hardware Keylogger on her computer
B. Install screen capturing Spyware on her computer
C. Enable Remote Desktop on her computer

D. Install VNC on her computer
107. Blane is a security analyst for a law firm. One of the lawyers needs to send out an email to a
client but he wants to know if the email is forwarded on to any other recipients. The client is explicitly
asked not to re-send the email since that would be a violation of the lawyer’s and client’s agreement for
this particular case. What can Blane use to accomplish this?
A. He can use a split-DNS service to ensure the email is not forwarded on.
B. A service such as HTTrack would accomplish this.
C. Blane could use MetaGoofil tracking tool.
D. Blane can use a service such as ReadNotify tracking tool.
108. You want to perform advanced SQL Injection attack against a vulnerable website. You are
unable to perform command shell hacks on this server. What must be enabled in SQL Server to launch
these attacks?
A. System services
B. EXEC master access
C. xp_cmdshell
D. RDC
109. Kevin is an IT security analyst working for Emerson Time Makers, a watch manufacturing
company in Miami. Kevin and his girlfriend Katy recently broke up after a big fight. Kevin believes
that she was seeing another person. Kevin, who has an online email account that he uses for most of his
mail, knows that Katy has an account with that same company. Kevin logs into his email account
online and gets the following URL after successfully logged in:
http://www.youremailhere.com/mail.asp?mailbox=Kevin&Smith=121%22 Kevin changes the URL
to: http://www.youremailhere.com/mail.asp?mailbox=Katy&Sanchez=121%22 Kevin is trying to
access her email account to see if he can find out any information. What is Kevin attempting here to
gain access to Katy’s mailbox?
A. This type of attempt is called URL obfuscation when someone manually changes a URL to try and
gain unauthorized access
B. By changing the mailbox’s name in the URL, Kevin is attempting directory transversal
C. Kevin is trying to utilize query string manipulation to gain access to her email account
D. He is attempting a path-string attack to gain access to her mailbox
110. If an attacker’s computer sends an IPID of 31400 to a zombie (Idle Scanning) computer on an
open port, what will be the response?
A. 31400
B. 31402
C. The zombie will not send a response
D. 31401

111. Which of the following Exclusive OR transforms bits is NOT correct?
A. 0 xor 0 = 0
B. 1 xor 0 = 1
C. 1 xor 1 = 1
D. 0 xor 1 = 1
112. Simon is security analyst writing signatures for a Snort node he placed internally that captures
all mirrored traffic from his border firewall. From the following signature, what will Snort look for in
the payload of the suspected packets?
alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msg: "BACKDOOR SIG – SubSseven
22";flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids,485;) alert
A. The payload of 485 is what this Snort signature will look for.
B. Snort will look for 0d0a5b52504c5d3030320d0a in the payload.
C. Packets that contain the payload of BACKDOOR SIG – SubSseven 22 will be flagged.
D. From this snort signature, packets with HOME_NET 27374 in the payload will be flagged.
113. You are trying to package a RAT Trojan so that Anti-Virus software will not detect it. Which of
the listed technique will NOT be effective in evading Anti-Virus scanner?
A. Convert the Trojan.exe file extension to Trojan.txt disguising as text file
B. Break the Trojan into multiple smaller files and zip the individual pieces
C. Change the content of the Trojan using hex editor and modify the checksum
D. Encrypt the Trojan using multiple hashing algorithms like MD5 and SHA-1
114. What will the following command produce on a website’s login page if executed successfully?
SELECT email, passwd, login_id, full_name FROM members WHERE email =
‘someone@somewhere.com’; DROP TABLE members; –’
A. This code will insert the someone@somewhere.com email address into the members table.
B. This command will delete the entire members table.
C. It retrieves the password for the first user in the members table.
D. This command will not produce anything since the syntax is incorrect.
115. An attacker is attempting to telnet into a corporation’s system in the DMZ. The attacker doesn’t
want to get caught and is spoofing his IP address. After numerous tries he remains unsuccessful in
connecting to the system. The attacker rechecks that the target system is actually listening on Port 23
and he verifies it with both nmap and hping2. He is still unable to connect to the target system. What
could be the reason?
A. The firewall is blocking port 23 to that system
B. He needs to use an automated tool to telnet in
C. He cannot spoof his IP and successfully use TCP
D. He is attacking an operating system that does not reply to telnet even when open

Explanation:
Spoofing your IP will only work if you dont need to get an answer from the target system.
In this case the answer (login prompt) from the telnet session will be sent to the real
location of the IP address that you are showing as the connection initiator.
116. How would you describe an attack where an attacker attempts to deliver the payload over
multiple packets over long periods of time with the purpose of defeating simple pattern matching in
IDS systems without session reconstruction? A characteristic of this attack would be a continuous
stream of small packets.
A. Session Splicing
B. Session Stealing
C. Session Hijacking
D. Session Fragmentation
117. SSL has been seen as the solution to a lot of common security problems. Administrator will
often time make use of SSL to encrypt communications from points A to point B. Why do you think
this could be a bad idea if there is an Intrusion Detection System deployed to monitor the traffic
between point A and B?
A. SSL is redundant if you already have IDS’s in place
B. SSL will trigger rules at regular interval and force the administrator to turn them off
C. SSL will slow down the IDS while it is breaking the encryption to see the packet content
D. SSL will blind the content of the packet and Intrusion Detection Systems will not be able to
detect them
Explanation:
SSL Encrypts Traffic
118. TCP SYN Flood attack uses the three-way handshake mechanism.
1. An attacker at system A sends a SYN packet to victim at system B.
2. System B sends a SYN/ACK packet to victim A.
3. As a normal three-way handshake mechanism system A should send an ACK packet to system B,
however, system A does not send an ACK packet to system B. In this case client B is waiting for an
ACK packet from client A.
This status of client B is called _________________
A. “half-closed”
B. “half open”
C. “full-open”
D. “xmas-open”

119. What type of session hijacking attack is shown in the exhibit?
A. Cross-site scripting Attack
B. SQL Injection Attack
C. Token sniffing Attack
D. Session Fixation Attack
120. This attack uses social engineering techniques to trick users into accessing a fake Web site and
divulging personal information. Attackers send a legitimate-looking e-mail asking users to update their
information on the company’s Web site, but the URLs in the e-mail actually point to a false Web site.
A. Wiresharp attack
B. Switch and bait attack
C. Phishing attack
D. Man-in-the-Middle attack
121. Most cases of insider abuse can be traced to individuals who are introverted, incapable of
dealing with stress or conflict, and frustrated with their job, office politics, and lack of respect or
promotion. Disgruntled employees may pass company secrets and intellectual property to competitors
for monitory benefits.
Here are some of the symptoms of a disgruntled employee:

A. Frequently leaves work early, arrive late or call in sick
B. Spends time surfing the Internet or on the phone
C. Responds in a confrontational, angry, or overly aggressive way to simple requests or comments
D. Always negative; finds fault with everything
These disgruntled employees are the biggest threat to enterprise security. How do you deal with these
threats? (Select 2 answers)
E. Limit access to the applications they can run on their desktop computers and enforce strict work
hour rules
F. By implementing Virtualization technology from the desktop to the data centre, organizations can
isolate different environments with varying levels of access and security to various employees
G. Organizations must ensure that their corporate data is centrally managed and delivered to users just
and when needed
H. Limit Internet access, e-mail communications, access to social networking sites and job hunting
portals
122. You receive an e-mail with the following text message.
“Microsoft and HP today warned all customers that a new, highly dangerous virus has been discovered
which will erase all your files at midnight. If there’s a file called hidserv.exe on your computer, you
have been infected and your computer is now running a hidden server that allows hackers to access
your computer. Delete the file immediately. Please also pass this message to all your friends and
colleagues as soon as possible.”
You launch your antivirus software and scan the suspicious looking file hidserv.exe located in
c:windows directory and the AV comes out clean meaning the file is not infected. You view the file
signature and confirm that it is a legitimate Windows system file “Human Interface Device Service”.
What category of virus is this?
A. Virus hoax
B. Spooky Virus
C. Stealth Virus
D. Polymorphic Virus
123. Every company needs a formal written document which spells out to employees precisely what
they are allowed to use the company’s systems for, what is prohibited, and what will happen to them if
they break the rules. Two printed copies of the policy should be given to every employee as soon as
possible after they join the organization. The employee should be asked to sign one copy, which should
be safely filed by the company. No one should be allowed to use the company’s computer systems until
they have signed the policy in acceptance of its terms. What is this document called?
A. Information Audit Policy (IAP)
B. Information Security Policy (ISP)
C. Penetration Testing Policy (PTP)
D. Company Compliance Policy (CCP)

124. This is an attack that takes advantage of a web site vulnerability in which the site displays
content that includes un-sanitized user-provided data.
<a href=”http://foobar.com/index.html?id=%3Cscript%20src=%22http://baddomain.com/badscript.js
%22%3E%3C/script%3E”>See foobar</a>
What is this attack?
A. Cross-site-scripting attack
B. SQL Injection
C. URL Traversal attack
D. Buffer Overflow attack
125. Hayden is the network security administrator for her company, a large finance firm based in
Miami. Hayden just returned from a security conference in Las Vegas where they talked about all kinds
of old and new security threats; many of which she did not know of. Hayden is worried about the
current security state of her company’s network so she decides to start scanning the network from an
external IP address. To see how some of the hosts on her network react, she sends out SYN packets to
an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established
she sends RST packets to those hosts to stop the session. She does this to see how her intrusion
detection system will log the traffic. What type of scan is Hayden attempting here?
A. Hayden is attempting to find live hosts on her company’s network by using an XMAS scan
B. She is utilizing a SYN scan to find live hosts that are listening on her network
C. The type of scan, she is using is called a NULL scan
D. Hayden is using a half-open scan to find live hosts on her network
126. The GET method should never be used when sensitive data such as credit card is being sent to a
CGI program. This is because any GET command will appear in the URL, and will be logged by any
servers. For example, let’s say that you’ve entered your credit card information into a form that uses the
GET method. The URL may appear like this:
https://www.xsecurity-bank.com/creditcard.asp?cardnumber=453453433532234
The GET method appends the credit card number to the URL. This means that anyone with access to a
server log will be able to obtain this information. How would you protect from this type of attack?
A. Never include sensitive information in a script
B. Use HTTPS SSLv3 to send the data instead of plain HTTPS
C. Replace the GET with POST method when sending data
D. Encrypt the data before you send using GET method
127. This IDS defeating technique works by splitting a datagram (or packet) into multiple fragments
and the IDS will not spot the true nature of the fully assembled datagram. The datagram is not
reassembled until it reaches its final destination. It would be a processor-intensive task for IDS to
reassemble all fragments itself, and on a busy system the packet will slip through the IDS onto the
network. What is this technique called?
A. IP Routing or Packet Dropping

B. IDS Spoofing or Session Assembly
C. IP Fragmentation or Session Splicing
D. IP Splicing or Packet Reassembly
Explanation:
The above evasion methods attempt to match a string within a packet without concern for
session or how an attack may be delivered partially through multiple packets. Whisker has
another network-level evasion method called session splicing. Session splicing divides the
string across several packets as follows:
Packet number Content
1 G
2 E
3 T
4 20
5 /
6 H
By delivering the data a few bytes at a time the string match is evaded.
Note : The Content is GET20/H
128. Jeremy is web security consultant for Information Securitas. Jeremy has just been hired to
perform contract work for a large state agency in Michigan. Jeremy’s first task is to scan all the
company’s external websites. Jeremy comes upon a login page which appears to allow employees
access to sensitive areas on the website. James types in the following statement in the username field:
SELECT * from Users where username=’admin’ ?AND password=” AND email like ‘%@testers.com
%’
What will the SQL statement accomplish?
A. If the page is susceptible to SQL injection, it will look in the Users table for usernames of
admin
B. This statement will look for users with the name of admin, blank passwords, and email addresses
that end in @testers.com
C. This Select SQL statement will log James in if there are any users with NULL passwords
D. James will be able to see if there are any default user accounts in the SQL database
Explanation:
SELECT * from Users where username=’admin’ ?AND password=” AND email like
‘%@testers.com%’
This Command will display Table Includes Two Columns – users & their passwords-username=
admin–> just display admins
129. Joel and her team have been going through tons of garbage, recycled paper, and other rubbish in
order to find some information about the target they are attempting to penetrate. How would you call
this type of activity?
A. Dumpster Diving
B. Scanning

C. CI Gathering
D. Garbage Scooping
Explanation:
Dumpster diving is the practice of sifting through commercial or residential trash to find
items that have been discarded by their owners, but that may be useful to the dumpster
diver.
130. Jake is a network administrator who needs to get reports from all the computer and network
devices on his network. Jake wants to use SNMP but is afraid that won’t be secure since passwords and
messages are in clear text. How can Jake gather network information in a secure manner?
A. He can use SNMPv3
B. Jake can use SNMPrev5
C. He can use SecWMI
D. Jake can use SecSNMP
Explanation:
SNMPv3 primarily added security and remote configuration enhancements to SNMP.
Security has been the biggest weakness of SNMP since the beginning. Authentication in
SNMP Versions 1 and 2 amounts to nothing more than a password (community string) sent
in clear text between a manager and agent.
Each SNMPv3 message contains security parameters which are encoded as an octet string
131. Anonymizer sites access the Internet on your behalf, protecting your personal information from
disclosure. An anonymizer protects all of your computer’s identifying information while it surfs for
you, enabling you to remain at least one step removed from the sites you visit.
You can visit Web sites without allowing anyone to gather information on sites visited by you. Services
that provide anonymity disable pop-up windows and cookies, and conceal visitor’s IP address.
These services typically use a proxy server to process each HTTP request. When the user requests a
Web page by clicking a hyperlink or typing a URL into their browser, the service retrieves and displays
the information using its own server. The remote server (where the requested Web page resides)
receives information on the anonymous Web surfing service in place of your information.
In which situations would you want to use anonymizer? (Select 3 answers)
A. Increase your Web browsing bandwidth speed by using Anonymizer
B. To protect your privacy and Identity on the Internet
C. To bypass blocking applications that would prevent access to Web sites or parts of sites that
you want to visit.
D. Post negative entries in blogs without revealing your IP identity
Explanation:
For Example:
1)TOR Browser.
2)Altra Surf

132. You ping a target IP to check if the host is up. You do not get a response. You suspect ICMP is
blocked at the firewall. Next you use hping2 tool to ping the target host and you get a response. Why
does the host respond to hping2 and not ping packet?
A. Ping packets cannot bypass firewalls
B. You must use ping 10.2.3.4 switch
C. Hping2 uses stealth TCP packets to connect
D. Hping2 uses TCP instead of ICMP by default
Explanation:
hping2 is a network tool able to send custom ICMP/UDP/TCP packets and to display target
replies like ping does with ICMP replies. It handles fragmentation and arbitrary packet
body and size, and can be used to transfer files under supported protocols. Using hping2,
you can: Test firewall rules, Perform [spoofed] port scanning, Test net performance using
different protocols, Packet size, TOS (type of service), and Fragmentation, Do path MTU
discovery, Transfer files (even between really Fascist firewall rules), Perform traceroute-like
actions under different protocols, Fingerprint remote OSs, Audit a TCP/IP stack, etc.
hping2 is a good tool for learning TCP/IP.
133. Jack Hacker wants to break into Brown Co.’s computers and obtain their secret double fudge
cookie recipe. Jack calls Jane, an accountant at Brown Co., pretending to be an administrator from
Brown Co. Jack tells Jane that there has been a problem with some accounts and asks her to verify her
password with him ”just to double check our records.” Jane does not suspect anything amiss, and parts
with her password. Jack can now access Brown Co.’s computers with a valid user name and password,
to steal the cookie recipe. What kind of attack is being illustrated here?
A. Reverse Psychology
B. Reverse Engineering
C. Social Engineering
D. Spoofing Identity
E. Faking Identity
Explanation:
Social engineering is commonly understood to mean the art of manipulating people into
performing actions or divulging confidential information. While it is similar to a confidence
trick or simple fraud, the term typically applies to trickery or deception for the purpose of

information gathering, fraud, or computer system access; in most cases the attacker never
comes face-to-face with the victims.
134. John is the network administrator of XSECURITY systems. His network was recently
compromised. He analyzes the log files to investigate the attack. Take a look at the following Linux log
file snippet. The hacker compromised and “owned” a Linux machine. What is the hacker trying to
accomplish here?
A. The hacker is attempting to compromise more machines on the network
B. The hacker is planting a rootkit
C. The hacker is running a buffer overflow exploit to lock down the system
D. The hacker is trying to cover his tracks
Explanation:
By deleting temporary directories and emptying like bash_history that contains the last
commands used with the bash shell he is trying to cover his tracks.
135. Blake is in charge of securing all 20 of his company’s servers. He has enabled hardware and
software firewalls, hardened the operating systems, and disabled all unnecessary services on all the
servers. Unfortunately, there is proprietary AS400 emulation software that must run on one of the
servers that requires the telnet service to function properly. Blake is especially concerned about this
since telnet can be a very large security risk in an organization. Blake is concerned about how this
particular server might look to an outside attacker so he decides to perform some footprinting,
scanning, and penetration tests on the server. Blake telnets into the server using Port 80 and types in the
following command:
HEAD / HTTP/1.0
After pressing enter twice, Blake gets the following results:

What has Blake just accomplished?
A. Downloaded a file to his local computer
B. Submitted a remote command to crash the server
C. Poisoned the local DNS cache of the server
D. Grabbed the Operating System banner
Explanation:
In the context of Computer Networking, Banner Grabbing is an enumeration technique
used to glean information about computer systems on a network and the services running its
open ports. Administrators can use this to take inventory of the systems and services on
their network. An intruder however can use banner grabbing in order to find network hosts
that are running versions of applications and operating systems with known exploits.
136. You are the security administrator of Jaco Banking Systems located in Boston. You are setting
up e-banking website (http://www.ejacobank.com) authentication system. Instead of issuing banking
customer with a single password, you give them a printed list of 100 unique passwords. Each time the
customer needs to log into the e-banking system website, the customer enters the next password on the
list. If someone sees them type the password using shoulder surfing, MiTM or keyloggers, then no
damage is done because the password will not be accepted a second time. Once the list of 100
passwords is almost finished, the system automatically sends out a new password list by encrypted e-mail
to the customer.
You are confident that this security implementation will protect the customer from password abuse.
Two months later, a group of hackers called "HackJihad" found a way to access the one-time password
list issued to customers of Jaco Banking Systems. The hackers set up a fake website (http://www.e-jacobank.
com) and used phishing attacks to direct ignorant customers to it. The fake website asked
users for their e-banking username and password, and the next unused entry from
their one-time password sheet. The hackers collected 200 customer’s username/passwords this way.
They transferred money from the customer’s bank account to various offshore accounts.
Your decision of password policy implementation has cost the bank with USD 925,000 to hackers. You
immediately shut down the e-banking website while figuring out the next best security solution
What effective security solution will you recommend in this case?

A. Implement Biometrics based password authentication system. Record the customers face image to
the authentication database
B. Configure your firewall to block logon attempts of more than three wrong tries
C. Enable a complex password policy of 20 characters and ask the user to change the password
immediately after they logon and do not store password histories
D. Implement RSA SecureID based authentication system
Explanation:
RSA SecurID two-factor authentication is based on something you know (a password or
PIN) and something you have (an authenticator)providing a much more reliable level of
user authentication than reusable passwords.
The only solution that automatically changes your password every 60 seconds
20-year history of outstanding performance and innovation
RSA offers enterprises a wide range of user authentication options to help positively
identify users before they interact with mission-critical data and applications through:
VPNs & WLANs
E-mail
Intranets & extranets
Microsoft Windows desktops
Web servers
Other network resources
137. Trojan horse attacks pose one of the most serious threats to computer security. The image below
shows different ways a Trojan can get into a system. Which are the easiest and most convincing ways
to infect a computer?
A. IRC (Internet Relay Chat)
B. Legitimate “shrink-wrapped” software packaged by a disgruntled employee
C. NetBIOS (File Sharing)

D. Downloading files, games and screensavers from Internet sites
138. More sophisticated IDSs look for common shellcode signatures. But even these systems can be
bypassed, by using polymorphic shellcode. This is a technique common among virus writers ?it
basically hides the true nature of the shellcode in different disguises.
How does a polymorphic shellcode work?
A. They encrypt the shellcode by XORing values over the shellcode, using loader code to decrypt
the shellcode, and then executing the decrypted shellcode
B. They convert the shellcode into Unicode, using loader to convert back to machine code then
executing them
C. They reverse the working instructions into opposite order by masking the IDS signatures
D. They compress shellcode into normal instructions, uncompress the shellcode using loader code and
then executing the shellcode
139. The traditional traceroute sends out ICMP ECHO packets with a TTL of one, and increments
the TTL until the destination has been reached. By printing the gateways that generate ICMP time
exceeded messages along the way, it is able to determine the path packets take to reach the destination.
The problem is that with the widespread use of firewalls on the Internet today, many of the packets that
traceroute sends out end up being filtered, making it impossible to completely trace the path to the
destination.

How would you overcome the Firewall restriction on ICMP ECHO packets?
A. Firewalls will permit inbound TCP packets to specific ports that hosts sitting behind the
firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO
packets, traceroute can bypass the most common firewall filters.
B. Firewalls will permit inbound UDP packets to specific ports that hosts sitting behind the firewall are
listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute
can bypass the most common firewall filters.
C. Firewalls will permit inbound UDP packets to specific ports that hosts sitting behind the firewall are
listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute
can bypass the most common firewall filters.

D. Do not use traceroute command to determine the path packets take to reach the destination instead
use the custom hacking tool JOHNTHETRACER and run with the command
E. > JOHNTHETRACER www.eccouncil.org -F -evade
Explanation:
You Can Use TCP SYN as Inbound Traffic of specific Port , Beacuase Firewall -mostly-
Block ICMP Traffic , but therer are ports in TCP are opened
140. SYN Flood is a DOS attack in which an attacker deliberately violates the three-way handshake
and opens a large number of half-open TCP connections. The signature of attack for SYN Flood
contains:
A. The source and destination address having the same value
B. A large number of SYN packets appearing on a network without the corresponding reply
packets
C. The source and destination port numbers having the same value
D. A large number of SYN packets appearing on a network with the corresponding reply packets
141. Jason works in the sales and marketing department for a very large advertising agency located
in Atlanta. Jason is working on a very important marketing campaign for his company’s largest client.
Before the project could be completed and implemented, a competing advertising company comes out
with the exact same marketing materials and advertising, thus rendering all the work done for Jason’s
client unusable. Jason is questioned about this and says he has no idea how all the material ended up in
the hands of a competitor.
Without any proof, Jason’s company cannot do anything except move on. After working on another
high profile client for about a month, all the marketing and sales material again ends up in the hands of
another competitor and is released to the public before Jason’s company can finish the project. Once
again, Jason says that he had nothing to do with it and does not know how this could have happened.
Jason is given leave with pay until they can figure out what is going on.
Jason’s supervisor decides to go through his email and finds a number of emails that were sent to the
competitors that ended up with the marketing material. The only items in the emails were attached jpg
files, but nothing else. Jason’s supervisor opens the picture files, but cannot find
anything out of the ordinary with them.
What technique has Jason most likely used?
A. Stealth Rootkit Technique
B. ADS Streams Technique
C. Snow Hiding Technique
D. Image Steganography Technique
142. The SYN flood attack sends TCP connections requests faster than a machine can process them.
- Attacker creates a random source address for each packet
- SYN flag set in each packet is a request to open a new connection to the server from the spoofed IP
address
- Victim responds to spoofed IP address, then waits for confirmation that never arrives (timeout wait is
about 3 minutes)

- Victim’s connection table fills up waiting for replies and ignores new connections
- Legitimate users are ignored and will not be able to access the server
How do you protect your network against SYN Flood attacks?
A. SYN cookies. Instead of allocating a record, send a SYN-ACK with a carefully constructed
sequence number generated as a hash of the clients IP address, port number, and other
information. When the client responds with a normal ACK, that special sequence number will be
included, which the server then verifies. Thus, the server first allocates memory on the third
packet of the handshake, not the first.
B. RST cookies – The server sends a wrong SYN/ACK back to the client. The client should then
generate a RST packet telling the server that something is wrong. At this point, the server knows
the client is valid and will now accept incoming connections from that client normally
C. Check the incoming packet’s IP address with the SPAM database on the Internet and enable the filter
using ACLs at the Firewall
D. Stack Tweaking. TCP stacks can be tweaked in order to reduce the effect of SYN floods.
Reduce the timeout before a stack frees up the memory allocated for a connection
E. Micro Blocks. Instead of allocating a complete connection, simply allocate a micro record of
16- bytes for the incoming SYN object
143. Stephanie works as a records clerk in a large office building in downtown Chicago. On Monday,
she went to a mandatory security awareness class (Security5) put on by her company’s IT department.
During the class, the IT department informed all employees that everyone’s Internet activity was
thenceforth going to be monitored.
Stephanie is worried that her Internet activity might give her supervisor reason to write her up, or worse
get her fired. Stephanie’s daily work duties only consume about four hours of her time, so she usually
spends the rest of the day surfing the web. Stephanie really enjoys surfing the Internet but definitely
does not want to get fired for it.
What should Stephanie use so that she does not get in trouble for surfing the Internet?
A. Stealth IE
B. Stealth Anonymizer
C. Stealth Firefox
D. Cookie Disabler
Explanation:
For Example:
1)TOR Browser.
2)Altra Surf
144. SNMP is a connectionless protocol that uses UDP instead of TCP packets (True or False)
A. true
B. false

145. You are the Security Administrator of Xtrinity, Inc. You write security policies and conduct
assessments to protect the company’s network. During one of your periodic checks to see how well
policy is being observed by the employees, you discover an employee has attached cell phone 3G
modem to his telephone line and workstation. He has used this cell phone 3G modem to dial in to his
workstation, thereby bypassing your firewall. A security breach has occurred as a direct result of this
activity. The employee explains that he used the modem because he had to download software for a
department project. How would you resolve this situation?
A. Reconfigure the firewall
B. Enforce the corporate security policy
C. Install a network-based IDS
D. Conduct a needs analysis
146. While performing a ping sweep of a local subnet you receive an ICMP reply of Code 3/Type 13
for all the pings you have sent out. What is the most likely cause of this?
A. The firewall is dropping the packets
B. An in-line IDS is dropping the packets
C. A router is blocking ICMP
D. The host does not respond to ICMP packets
147. Consider the following code:
URL:http://www.certified.com/search.pl?
text=<script>alert(document.cookie)</script>
If an attacker can trick a victim user to click a link like this, and the Web application does not validate
input, then the victim’s browser will pop up an alert showing the users current set of cookies. An
attacker can do much more damage, including stealing passwords, resetting your home page, or
redirecting the user to another Web site.
What is the countermeasure against XSS scripting?
A. Create an IP access list and restrict connections based on port number
B. Replace "<" and ">" characters with "& l t;" and "& g t;" using server scripts
C. Disable Javascript in IE and Firefox browsers
D. Connect to the server using HTTPS protocol instead of HTTP
148. An attacker has successfully compromised a remote computer. Which of the following comes as
one of the last steps that should be taken to ensure that the compromise cannot be traced back to the
source of the problem?
A. Install patches
B. Setup a backdoor
C. Install a zombie for DDOS
D. Cover your tracks

149. Bret is a web application administrator and has just read that there are a number of surprisingly
common web application vulnerabilities that can be exploited by unsophisticated attackers with easily
available tools on the Internet. He has also read that when an organization deploys a web application,
they invite the world to send HTTP requests. Attacks buried in these requests sail past firewalls, filters,
platform hardening, SSL, and IDS without notice because they are inside legal HTTP requests. Bret is
determined to weed out vulnerabilities.
What are some of the common vulnerabilities in web applications that he should be concerned about?
A. Non-validated parameters, broken access control, broken account and session management,
cross-site scripting and buffer overflows are just a few common vulnerabilities
B. Visible clear text passwords, anonymous user account set as default, missing latest security patch, no
firewall filters set and no SSL configured are just a few common vulnerabilities
C. No SSL configured, anonymous user account set as default, missing latest security patch, no firewall
filters set and an inattentive system administrator are just a few common vulnerabilities
D. No IDS configured, anonymous user account set as default, missing latest security patch, no firewall
filters set and visible clear text passwords are just a few common vulnerabilities
150. In the context of password security: a simple dictionary attack involves loading a dictionary file
(a text file full of dictionary words) into a cracking application such as L0phtCrack or John the Ripper,
and running it against user accounts located by the application. The larger the word and word fragment
selection, the more effective the dictionary attack is. The brute force method is the most inclusive –
though slow. Usually, it tries every possible letter and number combination in its automated
exploration. If you would use both brute force and dictionary combined together to have variations of
words, what would you call such an attack?
A. Full Blown Attack
B. Thorough Attack
C. Hybrid Attack
D. BruteDict Attack
151. Choose one of the following pseudo codes to describe this statement:
"If we have written 200 characters to the buffer variable, the stack should stop because it cannot hold
any more data."
A. If (I > 200) then exit (1)
B. If (I < 200) then exit (1)
C. If (I <= 200) then exit (1)
D. If (I >= 200) then exit (1)
152. Which of the following tool would be considered as Signature Integrity Verifier (SIV)?
A. Nmap
B. SNORT
C. VirusSCAN
D. Tripwire

153. You are footprinting an organization and gathering competitive intelligence. You visit the
company’s website for contact information and telephone numbers but do not find them listed there.
You know they had the entire staff directory listed on their website 12 months ago but now it is not
there. Is there any way you can retrieve information from a website that is outdated?
A. Visit Google’s search engine and view the cached copy
B. Crawl the entire website and store them into your computer
C. Visit Archive.org web site to retrieve the Internet archive of the company’s website
D. Visit the company’s partners and customers website for this information
154. Which of the following steganography utilities exploits the nature of white space and allows the
user to conceal information in these white spaces?
A. Image Hide
B. Snow
C. Gif-It-Up
D. NiceText
155. While testing web applications, you attempt to insert the following test script into the search
area on the company’s web site:
<script>alert(‘Testing Testing Testing’)</script>
Later, when you press the search button, a pop up box appears on your screen with the text "Testing
Testing Testing". What vulnerability is detected in the web application here?
A. Cross Site Scripting
B. Password attacks
C. A Buffer Overflow
D. A hybrid attack
156. Bob was frustrated with his competitor, Brownies Inc., and decided to launch an attack that
would result in serious financial losses. He planned the attack carefully and carried out the attack at the
appropriate moment.
Meanwhile, Trent, an administrator at Brownies Inc., realized that their main financial transaction
server had been attacked. As a result of the attack, the server crashed and Trent needed to reboot the
system, as no one was able to access the resources of the company. This process involves human
interaction to fix it.
What kind of Denial of Service attack was best illustrated in the scenario above?
A. Simple DDoS attack
B. DoS attacks which involves flooding a network or system
C. DoS attacks which involves crashing a network or system
D. DoS attacks which is done accidentally or deliberately

157. Johnny is a member of the hacking group Orpheus1. He is currently working on breaking into
the Department of Defense’s front end Exchange Server. He was able to get into the server, located in a
DMZ, by using an unused service account that had a very weak password that he was able to guess.
Johnny wants to crack the administrator password, but does not have a lot of time to crack
it. He wants to use a tool that already has the LM hashes computed for all possible permutations of the
administrator password.
What tool would be best used to accomplish this?
A. SMBCrack
B. SmurfCrack
C. PSCrack
D. RainbowTables
158. Bob has been hired to do a web application security test. Bob notices that the site is dynamic
and must make use of a back end database. Bob wants to see if SQL Injection would be possible. What
is the first character that Bob should use to attempt breaking valid SQL request?
A. Semi Column
B. Double Quote
C. Single Quote
D. Exclamation Mark
Explanation:
Topic 2, Volume B
159. Hampton is the senior security analyst for the city of Columbus in Ohio. His primary
responsibility is to ensure that all physical and logical aspects of the city’s computer network are secure
from all angles. Bill is an IT technician that works with Hampton in the same IT department. Bill’s
primary responsibility is to keep PC’s and servers up to date and to keep track of all the agency laptops
that the company owns and lends out to its employees. After Bill setup a wireless network for the
agency, Hampton made sure that everything was secure. He instituted encryption, rotating keys, turned
off SSID broadcasting, and enabled MAC filtering. According to agency policy, only company laptops
are allowed to use the wireless network, so Hampton entered all the MAC addresses for those laptops
into the wireless security utility so that only those laptops should be able to access the wireless
network.
Hampton does not keep track of all the laptops, but he is pretty certain that the agency only purchases
Dell laptops. Hampton is curious about this because he notices Bill working on a Toshiba laptop one
day and saw that he was on the Internet. Instead of jumping to conclusions, Hampton decides to talk to
Bill’s boss and see if they had purchased a Toshiba laptop instead of the usual Dell. Bill’s boss said no,
so now Hampton is very curious to see how Bill is accessing the Internet. Hampton does site surveys
every couple of days, and has yet to see any outside wireless network signals inside the company’s
building.
How was Bill able to get Internet access without using an agency laptop?
A. Bill spoofed the MAC address of Dell laptop
B. Bill connected to a Rogue access point

C. Toshiba and Dell laptops share the same hardware address
D. Bill brute forced the Mac address ACLs
160. LAN Manager Passwords are concatenated to 14 bytes, and split in half. The two halves are
hashed individually. If the password is 7 characters or less, than the second half of the hash is always:
A. 0xAAD3B435B51404EE
B. 0xAAD3B435B51404AA
C. 0xAAD3B435B51404BB
D. 0xAAD3B435B51404CC
161. Jess the hacker runs L0phtCrack’s built-in sniffer utility that grabs SMB password hashes and
stores them for offline cracking. Once cracked, these passwords can provide easy access to whatever
network resources the user account has access to. But Jess is not picking up hashes from the network.
Why?
A. The network protocol is configured to use SMB Signing
B. The physical network wire is on fibre optic cable
C. The network protocol is configured to use IPSEC
D. L0phtCrack SMB sniffing only works through Switches and not Hubs
162. What type of port scan is represented here?
A. Stealth Scan
B. Full Scan
C. XMAS Scan
D. FIN Scan
Explanation:
A stealth scan is a kind of scan that is designed to go undetected by auditing tools.
163. If a competitor wants to cause damage to your organization, steal critical secrets, or put you out
of business, they just have to find a job opening, prepare someone to pass the interview, have that
person hired, and they will be in the organization.

How would you prevent such type of attacks?
A. It is impossible to block these attacks
B. Hire the people through third-party job agencies who will vet them for you
C. Conduct thorough background checks before you engage them
D. Investigate their social networking profiles
164. What type of attack is shown in the following diagram?

A. Man-in-the-Middle (MiTM) Attack
B. Session Hijacking Attack
C. SSL Spoofing Attack
D. Identity Stealing Attack
Explanation:
the attacker makes independent connections with the victims and relays messages between
them, making them believe that they are talking directly to each other over a private
connection, when in fact the entire conversation is controlled by the attacker.
165. Fred is scanning his network to ensure it is as secure as possible. Fred sends a TCP probe packet
to a host with a FIN flag and he receives a RST/ACK response. What does this mean?
A. This response means the port he is scanning is open.
B. The RST/ACK response means the port Fred is scanning is disabled.
C. This means the port he is scanning is half open.
D. This means that the port he is scanning on the host is closed.
166. Lori is a Certified Ethical Hacker as well as a Certified Hacking Forensics Investigator working
as an IT security consultant. Lori has been hired on by Kiley Innovators, a large marketing firm that
recently underwent a string of thefts and corporate espionage incidents. Lori is told that a rival
marketing company came out with an exact duplicate product right before Kiley Innovators was about
to release it. The executive team believes that an employee is leaking information to the rival company.
Lori questions all employees, reviews server logs, and firewall logs; after which she finds nothing. Lori
is then given permission to search through the corporate email system. She searches by email being
sent to and sent from the rival marketing company.
She finds one employee that appears to be sending very large email to this other marketing company,
even though they should have no reason to be communicating with them. Lori tracks down the actual
emails sent and upon opening them, only finds picture files attached to them. These files seem perfectly
harmless, usually containing some kind of joke. Lori decides to use some special software to further
examine the pictures and finds that each one had hidden text that was stored in each picture.

What technique was used by the Kiley Innovators employee to send information to the rival marketing
company?
A. The Kiley Innovators employee used cryptography to hide the information in the emails sent
B. The method used by the employee to hide the information was logical watermarking
C. The employee used steganography to hide information in the picture attachments
D. By using the pictures to hide information, the employee utilized picture fuzzing
167. You run nmap port Scan on 10.0.0.5 and attempt to gain banner/server information from
services running on ports 21, 110 and 123.
Here is the output of your scan results:
Which of the following nmap command did you run?
A. nmap -A -sV -p21,110,123 10.0.0.5
B. nmap -F -sV -p21,110,123 10.0.0.5
C. nmap -O -sV -p21,110,123 10.0.0.5
D. nmap -T -sV -p21,110,123 10.0.0.5
Explanation:
-O : Enable OS detection
-sV: Probe open ports to determine service/version info
-p <port ranges>:Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
168. You have successfully gained access to a victim’s computer using Windows 2003 Server SMB
Vulnerability. Which command will you run to disable auditing from the cmd?
A. stoplog stoplog ?
B. EnterPol /nolog
C. EventViewer o service
D. auditpol.exe /disable

169. The following script shows a simple SQL injection. The script builds an SQL query by
concatenating hard-coded strings together with a string entered by the user:
The user is prompted to enter the name of a city on a Web form. If she enters Chicago, the query
assembled by the script looks similar to the following:
SELECT * FROM OrdersTable WHERE ShipCity = ‘Chicago’
How will you delete the OrdersTable from the database using SQL Injection?
A. Chicago’; drop table OrdersTable –
B. Delete table’blah’; OrdersTable –
C. EXEC; SELECT * OrdersTable > DROP –
D. cmdshell’; ‘del c:sqlmydbOrdersTable’ //
Explanation:
“Drop Table OrdersTable” deletes the OrdersTable
170. Dan is conducting penetration testing and has found a vulnerability in a Web Application which
gave him the sessionID token via a cross site scripting vulnerability. Dan wants to replay this token.
However, the session ID manager (on the server) checks the originating IP address as well. Dan decides
to spoof his IP address in order to replay the sessionID. Why do you think Dan might not be able to get
an interactive session?
A. Dan cannot spoof his IP address over TCP network
B. The scenario is incorrect as Dan can spoof his IP and get responses
C. The server will send replies back to the spoofed IP address
D. Dan can establish an interactive session only if he uses a NAT
171. What type of Virus is shown here?
A. Cavity Virus
B. Macro Virus
C. Boot Sector Virus
D. Metamorphic Virus
E. Sparse Infector Virus

Explanation:
A sparse infector viruses use conditions before infecting files. Examples include files
infected only on the 10th execution or files that have a maximum size of 128kb. These
viruses use the conditions to infect less often and therefore avoid detection
172. Bob has a good understanding of cryptography, having worked with it for many years.
Cryptography is used to secure data from specific threats, but it does not secure the application from
coding errors. It can provide data privacy; integrity and enable strong authentication but it cannot
mitigate programming errors. What is a good example of a programming error that Bob can use to
explain to the management how encryption will not address all their security concerns?
A. Bob can explain that using a weak key management technique is a form of programming error
B. Bob can explain that using passwords to derive cryptographic keys is a form of a programming error
C. Bob can explain that a buffer overflow is an example of programming error and it is a common
mistake associated with poor programming technique
D. Bob can explain that a random number generator can be used to derive cryptographic keys but it
uses a weak seed value and this is a form of a programming error
173.
An attacker finds a web page for a target organization that supplies contact information for the
company. Using available details to make the message seem authentic, the attacker drafts e-mail to an
employee on the contact page that appears to come from an individual who might reasonably request
confidential information, such as a network administrator.
The email asks the employee to log into a bogus page that requests the employee’s user name and
password or click on a link that will download spyware or other malicious programming.
Google’s Gmail was hacked using this technique and attackers stole source code and sensitive data
from Google servers. This is highly sophisticated attack using zero-day exploit vectors, social
engineering and malware websites that focused on targeted individuals working for the company.
What is this deadly attack called?
A. Spear phishing attack
B. Trojan server attack
C. Javelin attack
D. Social networking attack

174. Vulnerability scanners are automated tools that are used to identify vulnerabilities and
misconfiguration of hosts. They also provide information regarding mitigating discovered
vulnerabilities.
Which of the following statements is incorrect?
A. Vulnerability scanners attempt to identify vulnerabilities in the hosts scanned.
B. Vulnerability scanners can help identify out-of-date software versions, missing patches, or system
upgrades
C. They can validate compliance with or deviations from the organization’s security policy
D. Vulnerability scanners can identify weakness and automatically fix and patch the
vulnerabilities without user intervention
Explanation:
Vulnerability scanners cannot automatically fix and patch the vulnerabilities without user
intervention
175. How do you defend against DHCP Starvation attack?

A. Enable ARP-Block on the switch
B. Enable DHCP snooping on the switch
C. Configure DHCP-BLOCK to 1 on the switch
D. Install DHCP filters on the switch to block this attack
Explanation:
DHCP snooping is a series of techniques applied to ensure the security of an existing
DHCP infrastructure.
When DHCP servers are allocating IP addresses to the clients on the LAN, DHCP snooping
can be configured on LAN switches to harden the security on the LAN to allow only clients
with specific IP/MAC addresses to have access to the network.
176. What type of port scan is shown below?
A. Idle Scan
B. FIN Scan
C. XMAS Scan
D. Windows Scan
Explanation:The FIN scan’s “stealth” frames are unusual because they are sent to a device
without first going through the normal TCP handshaking. If a TCP session isn’t active, the
session certainly can’t be formally closed!

In this FIN scan, TCP port 443 is closed so the remote station sends a RST frame response
to the FIN packet:
sF_scan_closed
Source Destination Summary
—————————————————————————————-
[192.168.0.8] [192.168.0.7] TCP: D=443 S=62178 FIN SEQ=3532094343 LEN=0
WIN=2048
[192.168.0.7] [192.168.0.8] TCP: D=62178 S=443 RST ACK=3532094343 WIN=0
If a port is open on a remote device, no response is received to the FIN scan:
sF_scan_open
Source Destination Summary
————————————————————————————–
[192.168.0.8] [192.168.0.7] TCP: D=23 S=62178 FIN SEQ=3532094343 LEN=0
WIN=2048
The nmap output shows the open ports located with the FIN scan:
# nmap -sF -v 192.168.0.7
Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2005-04-23 21:17 EDT
Initiating FIN Scan against 192.168.0.7 [1663 ports] at 21:17
The FIN Scan took 1.51s to scan 1663 total ports.
Host 192.168.0.7 appears to be up … good.
Interesting ports on 192.168.0.7:
(The 1654 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp open|filtered ftp
22/tcp open|filtered ssh
23/tcp open|filtered telnet
79/tcp open|filtered finger
110/tcp open|filtered pop3
111/tcp open|filtered rpcbind
514/tcp open|filtered shell
886/tcp open|filtered unknown
2049/tcp open|filtered nfs
MAC Address: 00:03:47:6D:28:D7 (Intel)
Nmap finished: 1 IP address (1 host up) scanned in 2.276 seconds
Raw packets sent: 1674 (66.9KB) | Rcvd: 1655 (76.1KB)

177. What type of encryption does WPA2 use?
A. DES 64 bit
B. AES-CCMP 128 bit
C. MD5 48 bit
D. SHA 160 bit
178. In TCP communications there are 8 flags; FIN, SYN, RST, PSH, ACK, URG, ECE, CWR.
These flags have decimal numbers assigned to them:
FIN = 1
SYN = 2
RST = 4
PSH = 8
ACK = 16
URG = 32
ECE = 64
CWR = 128
Jason is the security administrator of ASPEN Communications. He analyzes some traffic using
Wireshark and has enabled the following filters.
What is Jason trying to accomplish here?
A. SYN, FIN, URG and PSH
B. SYN, SYN/ACK, ACK
C. RST, PSH/URG, FIN
D. ACK, ACK, SYN, URG
Explanation:
TCP.FLAGS==0x0x: In Decimal=2 –> SYN
TCP.FLAGS==0×12: In Decimal 2/16–> SYN/ACK
TCP.FLAGS==0×10:In Decimal 16–> ACK && ACK=1 && Not LEN
———————————————->ACK
179. Peter extracts the SID list from Windows 2008 Server machine using the hacking tool
“SIDExtracter”. Here is the output of the SIDs:
From the above list identify the user account with System Administrator privileges?

A. John
B. Rebecca
C. Sheela
D. Shawn
E. Somia
F. Chang
G. Micah
Explanation:
The SID of the built-in administrator will always follow this example: S-1-5- domain -500
180. Gerald, the Systems Administrator for Hyped Enterprises, has just discovered that his network
has been breached by an outside attacker. After performing routine maintenance on his servers, he
discovers numerous remote tools were installed that no one claims to have knowledge of in his
department. Gerald logs onto the management console for his IDS and discovers an unknown IP
address that scanned his network constantly for a week and was able to access his network through a
high-level port that was not closed. Gerald traces the IP address he found in the IDS log to a proxy
server in Brazil. Gerald calls the company that owns the proxy server and after
searching through their logs, they trace the source to another proxy server in Switzerland. Gerald calls
the company in Switzerland that owns the proxy server and after scanning through the logs again, they
trace the source back to a proxy server in China. What proxy tool has Gerald’s attacker used to cover
their tracks?
A. ISA proxy
B. IAS proxy
C. TOR proxy
D. Cheops proxy
181. You want to know whether a packet filter is in front of 192.168.1.10. Pings to 192.168.1.10
don’t get answered. A basic nmap scan of 192.168.1.10 seems to hang without returning any
information. What should you do next?
A. Run NULL TCP hping2 against 192.168.1.10
B. Run nmap XMAS scan against 192.168.1.10
C. The firewall is blocking all the scans to 192.168.1.10
D. Use NetScan Tools Pro to conduct the scan
182. In TCP communications there are 8 flags; FIN, SYN, RST, PSH, ACK, URG, ECE, CWR.
These flags have decimal numbers assigned to them:
FIN = 1
SYN = 2
RST = 4
PSH = 8

ACK = 16
URG = 32
ECE = 64
CWR =128
Example: To calculate SYN/ACK flag decimal value, add 2 (which is the decimal value of the SYN
flag) to 16 (which is the decimal value of the ACK flag), so the result would be 18.
Based on the above calculation, what is the decimal value for XMAS scan?
A. 23
B. 24
C. 41
D. 64
183. Bob is going to perform an active session hijack against Brownies Inc. He has found a target
that allows session oriented connections (Telnet) and performs the sequence prediction on the target
operating system. He manages to find an active session due to the high level of traffic on the network.
What is Bob supposed to do next?
A. Take over the session
B. Reverse sequence prediction
C. Guess the sequence numbers
D. Take one of the parties offline
184. The network administrator at Spears Technology, Inc has configured the default gateway Cisco
router’s access-list as below:
You are hired to conduct security testing on their network. You successfully brute-force the SNMP
community string using a SNMP crack tool. The access-list configured at the router prevents you from
establishing a successful connection. You want to retrieve the Cisco configuration from the router. How
would you proceed?
A. Use the Cisco’s TFTP default password to connect and download the configuration file
B. Run a network sniffer and capture the returned traffic with the configuration file from the
router
C. Run Generic Routing Encapsulation (GRE) tunneling protocol from your computer to the router
masking your IP address
D. Send a customized SNMP set request with a spoofed source IP address in the range –
192.168.1.0
185. Within the context of Computer Security, which of the following statements describes Social
Engineering best?
A. Social Engineering is the act of publicly disclosing information
B. Social Engineering is the means put in place by human resource to perform time accounting

C. Social Engineering is the act of getting needed information from a person rather than
breaking into a system
D. Social Engineering is a training program within sociology studies
186. In Trojan terminology, what is a covert channel?
A. A channel that transfers information within a computer system or network in a way that
violates the security policy
B. A legitimate communication path within a computer system or network for transfer of data
C. It is a kernel operation that hides boot processes and services to mask detection
D. It is Reverse tunneling technique that uses HTTPS protocol instead of HTTP protocol to establish
connections
187. Michael is a junior security analyst working for the National Security Agency (NSA) working
primarily on breaking terrorist encrypted messages. The NSA has a number of methods they use to
decipher encrypted messages including Government Access to Keys (GAK) and inside informants. The
NSA holds secret backdoor keys to many of the encryption algorithms used on the Internet. The
problem for the NSA, and Michael, is that terrorist organizations are starting to use custom-built
algorithms or obscure algorithms purchased from corrupt governments. For this reason, Michael and
other security analysts like him have been forced to find different methods of deciphering terrorist
messages. One method that Michael thought of using was to hide malicious code inside seemingly
harmless programs. Michael first monitors sites and bulletin boards used by known terrorists, and then
he is able to glean email addresses to some of these suspected terrorists. Michael then inserts a stealth
keylogger into a mapping program file readme.txt and then sends that as an attachment to the terrorist.
This keylogger takes screenshots every 2 minutes and also logs all keyboard activity into a hidden file
on the terrorist’s computer. Then, the keylogger emails those files to Michael twice a day with a built in
SMTP server. What technique has Michael used to disguise this keylogging software?
A. Steganography
B. Wrapping
C. ADS
D. Hidden Channels
188. Joseph has just been hired on to a contractor company of the Department of Defense as their
Senior Security Analyst. Joseph has been instructed on the company’s strict security policies that have
been implemented, and the policies that have yet to be put in place. Per the Department of Defense, all
DoD users and the users of their contractors must use two-factor authentication to access their
networks. Joseph has been delegated the task of researching and implementing the best two-factor
authentication method for his company. Joseph’s supervisor has told him that they would like to use
some type of hardware device in tandem with a security or identifying pin number. Joseph’s company
has already researched using smart cards and all the resources needed to implement them, but found the
smart cards to not be cost effective. What type of device should Joseph use for two-factor
authentication?
A. Biometric device
B. OTP

C. Proximity cards
D. Security token
189. Jane wishes to forward X-Windows traffic to a remote host as well as POP3 traffic. She is
worried that adversaries might be monitoring the communication link and could inspect captured
traffic.
She would like to tunnel the information to the remote end but does not have VPN capabilities to do so.
Which of the following tools can she use to protect the link?
A. MD5
B. PGP
C. RSA
D. SSH
190. Which type of password cracking technique works like dictionary attack but adds some
numbers and symbols to the words from the dictionary and tries to crack the password?
A. Dictionary attack
B. Brute forcing attack
C. Hybrid attack
D. Syllable attack
E. Rule-based attack
191. The SNMP Read-Only Community String is like a password. The string is sent along with each
SNMP Get-Request and allows (or denies) access to a device. Most network vendors ship their
equipment with a default password of "public". This is the so-called "default public community string".
How would you keep intruders from getting sensitive information regarding the network devices using
SNMP? (Select 2 answers)
A. Enable SNMPv3 which encrypts username/password authentication
B. Use your company name as the public community string replacing the default ‘public’
C. Enable IP filtering to limit access to SNMP device
D. The default configuration provided by device vendors is highly secure and you don’t need to change
anything
192. WWW wanderers or spiders are programs that traverse many pages in the World Wide Web by
recursively retrieving linked pages. Search engines like Google, frequently spider web pages for
indexing. How will you stop web spiders from crawling certain directories on your website?
A. Place robots.txt file in the root of your website with listing of directories that you don’t want to
be crawled
B. Place authentication on root directories that will prevent crawling from these spiders
C. Enable SSL on the restricted directories which will block these spiders from crawling
D. Place "HTTP:NO CRAWL" on the html pages that you don’t want the crawlers to index

193. Wayne is the senior security analyst for his company. Wayne is examining some traffic logs on a
server and came across some inconsistencies. Wayne finds some IP packets from a computer purporting
to be on the internal network. The packets originate from 192.168.12.35 with a TTL of
15. The server replied to this computer and received a response from 192.168.12.35 with a TTL of
21. What can Wayne infer from this traffic log?
A. The initial traffic from 192.168.12.35 was being spoofed.
B. The traffic from 192.168.12.25 is from a Linux computer.
C. The TTL of 21 means that the client computer is on wireless.
D. The client computer at 192.168.12.35 is a zombie computer.
194. What is the problem with this ASP script (login.asp)?
A. The ASP script is vulnerable to Cross Site Scripting attack
B. The ASP script is vulnerable to Session Splice attack
C. The ASP script is vulnerable to XSS attack
D. The ASP script is vulnerable to SQL Injection attack

195. In Trojan terminology, what is required to create the executable file chess.exe as shown below?
A. Mixer
B. Converter
C. Wrapper
D. Zipper
Explanation:
Some wrappers allow for combining two, six, nine, or even an arbitrary number of
programs together.
196. Syslog is a standard for logging program messages. It allows separation of the software that
generates messages from the system that stores them and the software that reports and analyzes them. It
also provides devices, which would otherwise be unable to communicate a means to notify
administrators of problems or performance.

What default port Syslog daemon listens on?
A. 242
B. 312
C. 416
D. 514
197. What is the correct command to run Netcat on a server using port 56 that spawns command
shell when connected?
A. nc -port 56 -s cmd.exe
B. nc -p 56 -p -e shell.exe
C. nc -r 56 -c cmd.exe
D. nc -L 56 -t -e cmd.exe
Explanation:
-e filename specify filename to exec after connect (use with caution).
-l listen mode, for inbound connects
-t enable telnet negotiation

198. In which part of OSI layer, ARP Poisoning occurs?
A. Transport Layer
B. Datalink Layer
C. Physical Layer
D. Application layer
Explanation:
ARP Resolve IP–>MAC : layer2 –> Data Link
199. Your computer is infected by E-mail tracking and spying Trojan. This Trojan infects the
computer with a single file – emos.sys
Which step would you perform to detect this type of Trojan?
A. Scan for suspicious startup programs using msconfig

B. Scan for suspicious network activities using Wireshark
C. Scan for suspicious device drivers in c:windowssystem32drivers
D. Scan for suspicious open ports using netstat
Explanation:
.sys—> system32 Trojan
200. You just purchased the latest DELL computer, which comes pre-installed with Windows 7,
McAfee antivirus software and a host of other applications. You want to connect Ethernet wire to your
cable modem and start using the computer immediately. Windows is dangerously insecure when
unpacked from the box, and there are a few things that you must do before you use it.
A. New installation of Windows should be patched by installing the latest service packs and
hotfixes
B. Key applications such as Adobe Acrobat, Macromedia Flash, Java, Winzip etc., must have the latest
security patches installed
C. Install a personal firewall and lock down unused ports from connecting to your computer
D. Install the latest signatures for Antivirus software
E. Configure “Windows Update” to automatic
F. Create a non-admin user with a complex password and logon to this account
G. You can start using your computer as vendors such as DELL, HP and IBM would have already
installed the latest service packs.
201. A common technique for luring e-mail users into opening virus-launching attachments is to send
messages that would appear to be relevant or important to many of their potential recipients. One way
of accomplishing this feat is to make the virus-carrying messages appear to come from some type of
business entity retailing sites, UPS, FEDEX, CITIBANK or a major provider of a common service.
Here is a fraudulent e-mail claiming to be from FedEx regarding a package that could not be delivered.
This mail asks the receiver to open an attachment in order to obtain the FEDEX tracking number for
picking up the package. The attachment contained in this type of e-mail activates a virus.

Vendors send e-mails like this to their customers advising them not to open any files attached with the
mail, as they do not include attachments.
Fraudulent e-mail and legit e-mail that arrives in your inbox contain the fedex.com as the sender of the
mail.
How do you ensure if the e-mail is authentic and sent from fedex.com?
A. Verify the digital signature attached with the mail, the fake mail will not have Digital ID at all
B. Check the Sender ID against the National Spam Database (NSD)
C. Fake mail will have spelling/grammatical errors
D. Fake mail uses extensive images, animation and flash content
202. A rootkit is a collection of tools (programs) that enable administrator-level access to a computer.
This program hides itself deep into an operating system for malicious activity and is extremely difficult
to detect. The malicious software operates in a stealth fashion by hiding its files, processes and registry
keys and may be used to create a hidden directory or folder designed to keep out of view from a user’s
operating system and security software.

What privilege level does a rootkit require to infect successfully on a Victim’s machine?
A. User level privileges
B. Ring 3 Privileges
C. System level privileges
D. Kernel level privileges
203. XSS attacks occur on Web pages that do not perform appropriate bounds checking on data
entered by users. Characters like < > that mark the beginning/end of a tag should be converted into
HTML entities.
What is the correct code when converted to html entities?

A. Option A
B. Option B
C. Option C
D. Option D
204. Fake Anti-Virus, is one of the most frequently encountered and persistent threats on the web.
This malware uses social engineering to lure users into infected websites with a technique called
Search Engine Optimization.
Once the Fake AV is downloaded into the user’s computer, the software will scare them into believing
their system is infected with threats that do not really exist, and then push users to purchase services to
clean up the non-existent threats.
The Fake AntiVirus will continue to send these annoying and intrusive alerts until a payment is made.

What is the risk of installing Fake AntiVirus?
A. Victim’s Operating System versions, services running and applications installed will be published on
Blogs and Forums
B. Victim’s personally identifiable information such as billing address and credit card details,
may be extracted and exploited by the attacker
C. Once infected, the computer will be unable to boot and the Trojan will attempt to format the hard
disk
D. Denial of Service attack will be launched against the infected computer crashing other machines on
the connected network
205. Samuel is the network administrator of DataX Communications, Inc. He is trying to configure
his firewall to block password brute force attempts on his network. He enables blocking the intruder’s
IP address for a period of 24 hours’ time after more than three unsuccessful attempts. He is confident
that this rule will secure his network from hackers on the Internet.
But he still receives hundreds of thousands brute-force attempts generated from various IP addresses
around the world. After some investigation he realizes that the intruders are using a proxy somewhere
else on the Internet which has been scripted to enable the random usage of various proxies on each
request so as not to get caught by the firewall rule.
Later he adds another rule to his firewall and enables small sleep on the password attempt so that if the
password is incorrect, it would take 45 seconds to return to the user to begin another attempt. Since an
intruder may use multiple machines to brute force the password, he also throttles the number of
connections that will be prepared to accept from a particular IP address.
This action will slow the intruder’s attempts.

Samuel wants to completely block hackers brute force attempts on his network.
What are the alternatives to defending against possible brute-force password attacks on his site?
A. Enforce a password policy and use account lockouts after three wrong logon attempts even though
this might lock out legit users
B. Enable the IDS to monitor the intrusion attempts and alert you by e-mail about the IP address of the
intruder so that you can block them at the
Firewall manually
C. Enforce complex password policy on your network so that passwords are more difficult to brute
force
D. You cannot completely block the intruders attempt if they constantly switch proxies
206. What type of Trojan is this?
A. RAT Trojan
B. E-Mail Trojan
C. Defacement Trojan
D. Destructing Trojan
E. Denial of Service Trojan

207. Attackers target HINFO record types stored on a DNS server to enumerate information. These
are information records and potential source for reconnaissance. A network administrator has the option
of entering host information specifically the CPU type and operating system when creating a new DNS
record. An attacker can extract this type of information easily from a DNS server.
Which of the following commands extracts the HINFO record?
A. Option A
B. Option B
C. Option C
D. Option D
208. This tool is widely used for ARP Poisoning attack. Name the tool.

A. Cain and Able
B. Beat Infector
C. Poison Ivy
D. Webarp Infector
209. BankerFox is a Trojan that is designed to steal users’ banking data related to certain banking
entities.
When they access any website of the affected banks through the vulnerable Firefox 3.5 browser, the
Trojan is activated and logs the information entered by the user. All the information entered in that
website will be logged by the Trojan and transmitted to the attacker’s machine using covert channel.
BankerFox does not spread automatically using its own means. It needs an attacking user’s intervention
in order to reach the affected computer.

What is the most efficient way an attacker located in remote location to infect this banking Trojan on a
victim’s machine?
A. Physical access – the attacker can simply copy a Trojan horse to a victim’s hard disk infecting the
machine via Firefox add-on extensions
B. Custom packaging – the attacker can create a custom Trojan horse that mimics the appearance of a
program that is unique to that particular computer
C. Custom packaging – the attacker can create a custom Trojan horse that mimics the appearance of a
D. Custom packaging – the attacker can create a custom Trojan horse that mimics the appearance of a
E. Downloading software from a website? An attacker can offer free software, such as shareware
programs and pirated mp3 files
210. Attackers footprint target Websites using Google Hacking techniques. Google hacking is a term
that refers to the art of creating complex search engine queries. It detects websites that are vulnerable to
numerous exploits and vulnerabilities. Google operators are used to locate specific strings of text
within the search results.
The configuration file contains both a username and a password for an SQL database. Most sites with
forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN
access to the database. WordPress uses config.php that stores the database Username and Password.
Which of the below Google search string brings up sites with “config.php” files?

A. Search:index config/php
B. Wordpress:index config.php
C. intitle:index.of config.php
D. Config.php:index list

211. Which of the following statement correctly defines ICMP Flood Attack? (Select 2 answers)
A. Bogus ECHO reply packets are flooded on the network spoofing the IP and MAC address
B. The ICMP packets signal the victim system to reply and the combination of traffic saturates
the bandwidth of the victim’s network
C. ECHO packets are flooded on the network saturating the bandwidth of the subnet causing denial of
service
D. A DDoS ICMP flood attack occurs when the zombies send large volumes of
ICMP_ECHO_REPLY packets to the victim system.
212. Lori was performing an audit of her company’s internal Sharepoint pages when she came across
the following code:
What is the purpose of this code?
A. This JavaScript code will use a Web Bug to send information back to another server.
B. This code snippet will send a message to a server at 192.154.124.55 whenever the “escape” key is
pressed.

C. This code will log all keystrokes.
D. This bit of JavaScript code will place a specific image on every page of the RSS feed.
213. A Trojan horse is a destructive program that masquerades as a benign application. The software
initially appears to perform a desirable function for the user prior to installation and/or execution, but in
addition to the expected function steals information or harms the system.
The challenge for an attacker is to send a convincing file attachment to the victim, which gets easily
executed on the victim machine without raising any suspicion. Today’s end users are quite
knowledgeable about malwares and viruses. Instead of sending games and fun executable, Hackers
today are quite successful in spreading the Trojans using Rogue security software.
What is Rogue security software?
A. A flash file extension to Firefox that gets automatically installed when a victim visits rogue software
disabling websites
B. A Fake AV program that claims to rid a computer of malware, but instead installs spyware or
other malware onto the computer. This kind of software is known as rogue security software.
C. A Fake AV program that claims to rid a computer of malware, but instead installs spyware or
D. A Fake AV program that claims to rid a computer of malware, but instead installs spyware or
E. Rogue security software is based on social engineering technique in which the attackers lures victim
to visit spear phishing websites
F. This software disables firewalls and establishes reverse connecting tunnel between the victim’s
machine and that of the attacker
214. William has received a Chess game from someone in his computer programming class through
email. William does not really know the person who sent the game very well, but decides to install the
game anyway because he really likes Chess.

After William installs the game, he plays it for a couple of hours. The next day, William plays the
Chess game again and notices that his machine has begun to slow down. He brings up his Task
Manager and sees the following programs running:
What has William just installed?
A. Zombie Zapper (ZoZ)

B. Remote Access Trojan (RAT)
C. Bot IRC Tunnel (BIT)
D. Root Digger (RD)
215. The programmers on your team are analyzing the free, open source software being used to run
FTP services on a server in your organization. They notice that there is excessive number of functions
in the source code that might lead to buffer overflow. These C++ functions do not check bounds.
Identify the line in the source code that might lead to buffer overflow?
A. 9A.9
B. 17B.17
C. 20C.20
D. 32D.32
E. 35E.35

216. What framework architecture is shown in this exhibit?
A. Core Impact
B. Metasploit
C. Immunity Canvas
D. Nessus
217. In this type of Man-in-the-Middle attack, packets and authentication tokens are captured using a
sniffer. Once the relevant information is extracted, the tokens are placed back on the network to gain
access.
A. Token Injection Replay attacks
B. Shoulder surfing attack
C. Rainbow and Hash generation attack
D. Dumpster diving attack

218. The FIN flag is set and sent from host A to host B when host A has no more data to transmit
(Closing a TCP connection). This flag releases the connection resources. However, host A can continue
to receive data as long as the SYN sequence numbers of transmitted packets from host B are lower than
the packet segment containing the set FIN flag.
A. false
B. true
219. Jason is the network administrator of Spears Technology. He has enabled SNORT IDS to detect
attacks going through his network. He receives Snort SMS alerts on his iPhone whenever there is an
attempted intrusion to his network.
He receives the following SMS message during the weekend.
An attacker Chew Siew sitting in Beijing, China had just launched a remote scan on Jason’s network
with the hping command.
Which of the following hping2 command is responsible for the above snort alert?
A. chenrocks:/home/siew # hping -S -R -P -A -F -U 192.168.2.56 -p 22 -c 5 -t 118
B. chenrocks:/home/siew # hping -F -Q -J -A -C -W 192.168.2.56 -p 22 -c 5 -t 118
C. chenrocks:/home/siew # hping -D -V -R -S -Z -Y 192.168.2.56 -p 22 -c 5 -t 118
D. chenrocks:/home/siew # hping -G -T -H -S -L -W 192.168.2.56 -p 22 -c 5 -t 118
220. When writing shellcodes, you must avoid ____________ because these will end the string.
A. Root bytes
B. Null bytes
C. Char bytes
D. Unicode bytes

221. You establish a new Web browser connection to Google. Since a 3-way handshake is required
for any TCP connection, the following actions will take place.
- DNS query is sent to the DNS server to resolve www.google.com
- DNS server replies with the IP address for Google?
- SYN packet is sent to Google.
- Google sends back a SYN/ACK packet
- Your computer completes the handshake by sending an ACK
- The connection is established and the transfer of data commences
Which of the following packets represent completion of the 3-way handshake?
A. 4th packet
B. 3rdpacket
C. 6th packet
D. 5th packet
222. _____________ is a type of symmetric-key encryption algorithm that transforms a fixed-length
block of plaintext (unencrypted text) data into a block of ciphertext (encrypted text) data of the same
length.
A. Stream Cipher
B. Block Cipher
C. Bit Cipher
D. Hash Cipher

223. How do you defend against MAC attacks on a switch?
A. Disable SPAN port on the switch
B. Enable SNMP Trap on the switch
C. Configure IP security on the switch
D. Enable Port Security on the switch
224. E-mail tracking is a method to monitor and spy the delivered e-mails to the intended recipient.
Select a feature, which you will NOT be able to accomplish with this probe?
A. When the e-mail was received and read
B. Send destructive e-mails
C. GPS location and map of the recipient
D. Time spent on reading the e-mails
E. Whether or not the recipient visited any links sent to them
F. Track PDF and other types of attachments
G. Set messages to expire after specified time
H. Remote control the User’s E-mail client application and hijack the traffic

225. Finding tools to run dictionary and brute forcing attacks against FTP and Web servers is an easy
task for hackers. They use tools such as arhontus or brutus to break into remote servers.
A command such as this, will attack a given 10.0.0.34 FTP and Telnet servers simultaneously with a list
of passwords and a single login name: linksys. Many FTP-specific password-guessing tools are also
available from major security sites.
What defensive measures will you take to protect your network from these attacks?
A. Never leave a default password
B. Never use a password that can be found in a dictionary
C. Never use a password related to your hobbies, pets, relatives, or date of birth.
D. Use a word that has more than 21 characters from a dictionary as the password
E. Never use a password related to the hostname, domain name, or anything else that can be
found with whois
226. One of the most common and the best way of cracking RSA encryption is to begin to derive the
two prime numbers, which are used in the RSA PKI mathematical process. If the two numbers p and q
are discovered through a _____________ process, then the private key can be derived.
A. Factorization
B. Prime Detection
C. Hashing
D. Brute-forcing
227. One of the ways to map a targeted network for live hosts is by sending an ICMP ECHO request
to the broadcast or the network address. The request would be broadcasted to all hosts on the targeted
network. The live hosts will send an ICMP ECHO Reply to the attacker’s source IP address.
You send a ping request to the broadcast address 192.168.5.255.
There are 40 computers up and running on the target network. Only 13 hosts send a reply while others
do not. Why?

A. Windows machines will not generate an answer (ICMP ECHO Reply) to an ICMP ECHO
request aimed at the broadcast address or at the network address.
B. Linux machines will not generate an answer (ICMP ECHO Reply) to an ICMP ECHO request aimed
at the broadcast address or at the network address.
C. You should send a ping request with this command ping ? 192.168.5.0-255
D. You cannot ping a broadcast address. The above scenario is wrong.
228. What type of session hijacking attack is shown in the exhibit?
A. Session Sniffing Attack
B. Cross-site scripting Attack
C. SQL Injection Attack
D. Token sniffing Attack
229. Which port, when configured on a switch receives a copy of every packet that passes through it?
A. R-DUPE Port
B. MIRROR port

C. SPAN port
D. PORTMON
230. An Attacker creates a zuckerjournals.com website by copying and mirroring
HACKERJOURNALS.COM site to spread the news that Hollywood actor Jason Jenkins died in a car
accident. The attacker then submits his fake site for indexing in major search engines. When users
search for “Jason Jenkins”, attacker’s fake site shows up and dupes victims by the fake news.
This is another great example that some people do not know what URL’s are. Real website:
Fake website: http://www.zuckerjournals.com
The website is clearly not WWW.HACKERJOURNALS.COM. It is obvious for many, but
unfortunately some people still do not know what an URL is. It’s the address that you enter into the
address bar at the top your browser and this is clearly not legit site, its www.zuckerjournals.com
How would you verify if a website is authentic or not?
A. Visit the site using secure HTTPS protocol and check the SSL certificate for authenticity
B. Navigate to the site by visiting various blogs and forums for authentic links
C. Enable Cache on your browser and lookout for error message warning on the screen
D. Visit the site by clicking on a link from Google search engine

231. This is an example of whois record.
Sometimes a company shares a little too much information on their organization through public domain
records. Based on the above whois record, what can an attacker do? (Select 2 answers)
A. Search engines like Google, Bing will expose information listed on the WHOIS record
B. An attacker can attempt phishing and social engineering on targeted individuals using the
information from WHOIS record
C. Spammers can send unsolicited e-mails to addresses listed in the WHOIS record
D. IRS Agents will use this information to track individuals using the WHOIS record information

232. In this attack, a victim receives an e-mail claiming from PayPal stating that their account has
been disabled and confirmation is required before activation. The attackers then scam to collect not one
but two credit card numbers, ATM PIN number and other personal details.
Ignorant users usually fall prey to this scam.
Which of the following statement is incorrect related to this attack?
A. Do not reply to email messages or popup ads asking for personal or financial information
B. Do not trust telephone numbers in e-mails or popup ads
C. Review credit card and bank account statements regularly
D. Antivirus, anti-spyware, and firewall software can very easily detect these type of attacks
E. Do not send credit card numbers, and personal or financial information via e-mail
233. ViruXine.W32 virus hides their presence by changing the underlying executable code. This
Virus code mutates while keeping the original algorithm intact, the code changes itself each time it
runs, but the function of the code (its semantics) will not change at all.

Here is a section of the Virus code:
What is this technique called?
A. Polymorphic Virus
B. Metamorphic Virus
C. Dravidic Virus
D. Stealth Virus
234. Buffer X in an Accounting application module for Brownies Inc. can contain 200 characters.
The programmer makes an assumption that 200 characters are more than enough. Because there were
no proper boundary checks being conducted, Bob decided to insert 400 characters into the 200-
character buffer. (Overflows the buffer). Below is the code snippet:

How can you protect/fix the problem of your application as shown above?
A. Because the counter starts with 0, we would stop when the counter is less than 200
B. Because the counter starts with 0, we would stop when the counter is more than 200
C. Add a separate statement to signify that if we have written less than 200 characters to the buffer, the
stack should stop because it cannot hold any more data
D. Add a separate statement to signify that if we have written 200 characters to the buffer, the
stack should stop because it cannot hold any more data “Pass Any
235. John runs a Web server, IDS and firewall on his network. Recently his Web server has been
under constant hacking attacks. He looks up the IDS log files and sees no intrusion attempts but the
Web server constantly locks up and needs rebooting due to various brute force and buffer overflow
attacks but still the IDS alerts no intrusion whatsoever. John becomes suspicious and views the Firewall
logs and he notices huge SSL connections constantly hitting his Web server. Hackers have been using
the encrypted HTTPS protocol to send exploits to the Web server and that was the reason the IDS did
not detect the intrusions. How would John protect his network from these types of attacks?
A. Install a proxy server and terminate SSL at the proxy
B. Enable the IDS to filter encrypted HTTPS traffic
C. Install a hardware SSL “accelerator” and terminate SSL at this layer
D. Enable the Firewall to filter encrypted HTTPS traffic
236. What type of attack is shown here?
A. Bandwidth exhaust Attack

B. Denial of Service Attack
C. Cluster Service Attack
D. Distributed Denial of Service Attack
237. What is the correct order of steps in CEH System Hacking Cycle?
A. Option A
B. Option B
C. Option C
D. Option D
238. You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes
in the program exploit.c
What is the hexadecimal value of NOP instruction?
A. 0×60
B. 0×80
C. 0×70
D. 0×90

239. You generate MD5 128-bit hash on all files and folders on your computer to keep a baseline
check for security reasons?
What is the length of the MD5 hash?
A. 32 bit
B. 64 byte
C. 48 char
D. 128 kb
240. When a normal TCP connection starts, a destination host receives a SYN (synchronize/start)
packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination
host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This
is referred to as the “TCP three-way handshake.” While waiting for the ACK to the SYN ACK, a
connection queue of finite size on the destination host keeps track of connections waiting to be
completed. This queue typically empties quickly since the ACK is expected to arrive a few
milliseconds after the SYN ACK. How would an attacker exploit this design by launching TCP SYN
attack?
A. Attacker generates TCP SYN packets with random destination addresses towards a victim host
B. Attacker floods TCP SYN packets with random source addresses towards a victim host
C. Attacker generates TCP ACK packets with random source addresses towards a victim host
D. Attacker generates TCP RST packets with random source addresses towards a victim host
241. You receive an e-mail like the one shown below. When you click on the link contained in the
mail, you are redirected to a website seeking you to download free Anti-Virus software.
Dear valued customers,
We are pleased to announce the newest version of Antivirus 2010 for Windows which will probe you

with total security against the latest spyware, malware, viruses, Trojans and other online threats. Simply
visit the link below and enter your antivirus code:
Antivirus code: 5014
http://www.juggyboy/virus/virus.html
Thank you for choosing us, the worldwide leader Antivirus solutions.
Mike Robertson
PDF Reader Support
Copyright Antivirus 2010 ?All rights reserved
If you want to stop receiving mail, please go to:
http://www.juggyboy.com
or you may contact us at the following address: Media Internet Consultants, Edif. Neptuno, Planta
Baja, Ave. Ricardo J. Alfaro, Tumba Muerto, n/a Panama
How will you determine if this is Real Anti-Virus or Fake Anti-Virus website?
A. Look at the website design, if it looks professional then it is a Real Anti-Virus website
B. Connect to the site using SSL, if you are successful then the website is genuine
C. Search using the URL and Anti-Virus product name into Google and lookout for suspicious
warnings against this site
D. Download and install Anti-Virus software from this suspicious looking site, your Windows 7 will
prompt you and stop the installation if the downloaded file is a malware
E. Download and install Anti-Virus software from this suspicious looking site, your Windows 7 will
prompt you and stop the installation if the downloaded file is a malware
242. Take a look at the following attack on a Web Server using obstructed URL:
How would you protect from these attacks?
A. Configure the Web Server to deny requests involving “hex encoded” characters
B. Create rules in IDS to alert on strange Unicode requests
C. Use SSL authentication on Web Servers
D. Enable Active Scripts Detection at the firewall and routers

243. Which type of sniffing technique is generally referred as MiTM attack?
A. Password Sniffing
B. ARP Poisoning
C. Mac Flooding
D. DHCP Sniffing
244. What command would you type to OS fingerprint a server using the command line?

A. Option A
B. Option B
C. Option C
D. Option D
245. Switches maintain a CAM Table that maps individual MAC addresses on the network to
physical ports on the switch.
In MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source
MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC addresses
to physical ports.
What happens when the CAM table becomes full?
A. Switch then acts as hub by broadcasting packets to all machines on the network
B. The CAM overflow table will cause the switch to crash causing Denial of Service
C. The switch replaces outgoing frame switch factory default MAC address of FF:FF:FF:FF:FF:FF
D. Every packet is dropped and the switch sends out SNMP alerts to the IDS port

246. Bank of Timbuktu is a medium-sized, regional financial institution in Timbuktu. The bank has
deployed a new Internet-accessible Web application recently. Customers can access their account
balances, transfer money between accounts, pay bills and conduct online financial business using a
Web browser.
John Stevens is in charge of information security at Bank of Timbuktu. After one month in production,
several customers have complained about the Internet enabled banking application. Strangely, the
account balances of many of the bank’s customers had been changed! However, money hasn’t been
removed from the bank; instead, money was transferred between accounts. Given this attack profile,
John Stevens reviewed the Web application’s logs and found the following entries:
What kind of attack did the Hacker attempt to carry out at the bank?
A. Brute force attack in which the Hacker attempted guessing login ID and password from password
cracking tools.
B. The Hacker attempted Session hijacking, in which the Hacker opened an account with the bank, then
logged in to receive a session ID, guessed the next ID and took over Jason’s session.
C. The Hacker used a generator module to pass results to the Web server and exploited Web application
CGI vulnerability.
D. The Hacker first attempted logins with suspected user names, then used SQL Injection to gain
access to valid bank login IDs.
247. You are trying to hijack a telnet session from a victim machine with IP address 10.0.0.5 to Cisco
router at 10.0.0.1. You sniff the traffic and attempt to predict the sequence and acknowledgement
numbers to successfully hijack the telnet session.
Here is the captured data in tcpdump.

What are the next sequence and acknowledgement numbers that the router will send to the victim
machine?
A. Sequence number: 82980070 Acknowledgement number: 17768885A.
B. Sequence number: 17768729 Acknowledgement number: 82980070B.
C. Sequence number: 87000070 Acknowledgement number: 85320085C.
D. Sequence number: 82980010 Acknowledgement number: 17768885D.

248. Web servers are often the most targeted and attacked hosts on organizations’ networks.
Attackers may exploit software bugs in the Web server, underlying operating system, or active content
to gain unauthorized access.
Identify the correct statement related to the above Web Server installation?
A. Lack of proper security policy, procedures and maintenance
B. Bugs in server software, OS and web applications
C. Installing the server with default settings
D. Unpatched security flaws in the server software, OS and applications
249. Which of the following Registry location does a Trojan add entries to make it persistent on
Windows 7? (Select 2 answers)

A. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
B. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsSystem32CurrentVersion Run
C. HKEY_CURRENT_USERSoftwareMicrosoftWindowsSystem32CurrentVersionRun
D. HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
250. Keystroke logging is the action of tracking (or logging) the keys struck on a keyboard, typically
in a covert manner so that the person using the keyboard is unaware that their actions are being
monitored.

How will you defend against hardware keyloggers when using public computers and Internet Kiosks?
(Select 4 answers)
A. Alternate between typing the login credentials and typing characters somewhere else in the
focus window
B. Type a wrong password first, later type the correct password on the login page defeating the
keylogger recording
C. Type a password beginning with the last letter and then using the mouse to move the cursor
for each subsequent letter.
D. The next key typed replaces selected text portion. E.g. if the password is “secret”, one could
type “s”, then some dummy keys “asdfsd”.
Then these dummies could be selected with mouse, and next character from the password “e” is
typed, which replaces the dummies “asdfsd”
E. The next key typed replaces selected text portion. E.g. if the password is “secret”, one could
type “s”, then some dummy keys “asdfsd”.
Then these dummies could be selected with mouse, and next character from the password “e” is
typed, which replaces the dummies “asdfsd”
251. How do you defend against ARP Poisoning attack? (Select 2 answers)

A. Enable DHCP Snooping Binding Table
B. Restrict ARP Duplicates
C. Enable Dynamic ARP Inspection
D. Enable MAC snooping Table
252. Here is the ASCII Sheet.

You want to guess the DBO username juggyboy (8 characters) using Blind SQL Injection technique.
What is the correct syntax?
A. Option A
B. Option B
C. Option C
D. Option D
253. After a client sends a connection request (SYN) packet to the server, the server will respond
(SYN-ACK) with a sequence number of its choosing, which then must be acknowledged (ACK) by the
client. This sequence number is predictable; the attack connects to a service first with its own IP
address, records the sequence number chosen, and then opens a second connection from a forged IP
address. The attack doesn’t see the SYN-ACK (or any other packet) from the server, but can guess the
correct responses. If the source IP address is used for authentication, then the attacker can use the one-sided
communication to break into the server.
What attacks can you successfully launch against a server using the above technique?
A. Denial of Service attacks
B. Session Hijacking attacks
C. Web page defacement attacks
D. IP spoofing attacks

CEHv7 Question Collection

More Related Content

What's hot

Viewers also liked

Similar to CEHv7 Question Collection

Recently uploaded

CEHv7 Question Collection