Free Certified Ethical Hacker (CEH-001) Exam Questions and Answers

Neil is a network administrator working in Istanbul. Neil wants to setup a protocol analyzer on his network that will receive a copy of every packet that passes through the main office switch. What type of port will Neil need to setup in order to accomplish this?

• AA. Neil will have to configure a Bridged port that will copy all packets to the protocol analyzer.
• BB. Neil will need to setup SPAN port that will copy all network traffic to the protocol analyzer.
• CC. He will have to setup an Ether channel port to get a copy of all network traffic to the analyzer.
• DD. He should setup a MODS port which will copy all network traffic.

David is a security administrator working in Boston. David has been asked by the office's manager to block all POP3 traffic at the firewall because he believes employees are spending too much time reading personal email. How can David block POP3 at the firewall?

• AA. David can block port 125 at the firewall.
• BB. David can block all EHLO requests that originate from inside the office.
• CC. David can stop POP3 traffic by blocking all HELO requests that originate from inside the office.
• DD. David can block port 110 to block all POP3 traffic.

Which of the following countermeasure can specifically protect against both the MAC Flood and MAC Spoofing attacks?

• AA. Configure Port Security on the switch
• BB. Configure Port Recon on the switch
• CC. Configure Switch Mapping
• DD. Configure Multiple Recognition on the switch

A rootkit is a collection of tools (programs) that enable administrator-level access to a computer. This program hides itself deep into an operating system for malicious activity and is extremely difficult to detect. The malicious software operates in a stealth fashion by hiding its files, processes and registry keys and may be used to create a hidden directory or folder designed to keep out of view from a user's operating system and security software. What privilege level does a rootkit require to infect successfully on a Victim's machine?

• AA. User level privileges
• BB. Ring 3 Privileges
• CC. System level privileges
• DD. Kernel level privileges

Cyber Criminals have long employed the tactic of masking their true identity. In IP spoofing, an attacker gains unauthorized access to a computer or a network by making it appear that a malicious message has come from a trusted machine, by "spoofing" the IP address of that machine. How would you detect IP spoofing?

• AA. Check the IPID of the spoofed packet and compare it with TLC checksum. If the numbers match then it is spoofed packet
• BB. Probe a SYN Scan on the claimed host and look for a response SYN/FIN packet, if the connection completes then it is a spoofed packet
• CC. Turn on 'Enable Spoofed IP Detection' in Wireshark, you will see a flag tick if the packet is spoofed
• DD. Sending a packet to the claimed host will result in a reply. If the TTL in the reply is not the same as the packet being checked then it is a spoofed packet

Shayla is an IT security consultant, specializing in social engineering and external penetration tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense. Shayla has been given authority to perform any and all tests necessary to audit the company's network security. No employees for the company, other than the IT director, know about Shayla's work she will be doing. Shayla's first step is to obtain a list of employees through company website contact pages. Then she befriends a female employee of the company through an online chat website. After meeting with the female employee numerous times, Shayla is able to gain her trust and they become friends. One day, Shayla steals the employee's access badge and uses it to gain unauthorized access to the Treks Avionics offices. What type of insider threat would Shayla be considered?

• AA. She would be considered an Insider Affiliate
• BB. Because she does not have any legal access herself, Shayla would be considered an Outside Affiliate
• CC. Shayla is an Insider Associate since she has befriended an actual employee
• DD. Since Shayla obtained access with a legitimate company badge; she would be considered a Pure Insider

Dan is conducting penetration testing and has found a vulnerability in a Web Application which gave him the sessionID token via a cross site scripting vulnerability. Dan wants to replay this token. However, the session ID manager (on the server) checks the originating IP address as well. Dan decides to spoof his IP address in order to replay the sessionID. Why do you think Dan might not be able to get an interactive session?

• AA. Dan cannot spoof his IP address over TCP network
• BB. The scenario is incorrect as Dan can spoof his IP and get responses
• CC. The server will send replies back to the spoofed IP address
• DD. Dan can establish an interactive session only if he uses a NAT

What is the correct command to run Netcat on a server using port 56 that spawns command shell when connected?

• AA. nc -port 56 -s cmd.exe
• BB. nc -p 56 -p -e shell.exe
• CC. nc -r 56 -c cmd.exe
• DD. nc -L 56 -t -e cmd.exe

The following script shows a simple SQL injection. The script builds an SQL query by concatenating hard-coded strings together with a string entered by the user: The user is prompted to enter the name of a city on a Web form. If she enters Chicago, the query assembled by the script looks similar to the following: SELECT * FROM OrdersTable WHERE ShipCity = 'Chicago' How will you delete the OrdersTable from the database using SQL Injection?

• AA. Chicago'; drop table OrdersTable --
• BB. Delete table'blah'; OrdersTable --
• CC. EXEC; SELECT * OrdersTable > DROP --
• DD. cmdshell'; 'del c:\sql\mydb\OrdersTable' //

In the context of Trojans, what is the definition of a Wrapper?

• AA. An encryption tool to protect the Trojan
• BB. A tool used to bind the Trojan with a legitimate file
• CC. A tool used to calculate bandwidth and CPU cycles wasted by the Trojan
• DD. A tool used to encapsulate packets within a new header and footer