CEH-001 시험 - EC-Council실제시험문제와 답 - 878문항

Question No : 1

How do you defend against ARP Spoofing? Select three.

A.Use ARPWALL system and block ARP spoofing attacks
B.Tune IDS Sensors to look for large amount of ARP traffic on local subnets
C.Use private VLANS
D.Place static ARP entries on servers, workstation and routers

정답:
Explanation:
ARPwall is used in protecting against ARP spoofing. Incorrect answer:
IDS option may works fine in case of monitoring the traffic from outside the network but not from internal hosts.

Question No : 2

Which of the following tool would be considered as Signature Integrity Verifier (SIV)?

A.Nmap
B.SNORT
C.VirusSCAN
D.Tripwire

정답:

Question No : 3

Bob waits near a secured door, holding a box. He waits until an employee walks up to the secured door and uses the special card in order to access the restricted area of the target company. Just as the employee opens the door, Bob walks up to the employee (still holding the box) and asks the employee to hold the door open so that he can enter.
What is the best way to undermine the social engineering activity of tailgating?

A.Issue special cards to access secure doors at the company and provide a one-time only brief description of use of the special card
B.Educate and enforce physical security policies of the company to all the employees on a regular basis
C.Setup a mock video camera next to the special card reader adjacent to the secure door
D.Post a sign that states, "no tailgating" next to the special card reader adjacent to the secure door

정답:

Question No : 4

Jimmy, an attacker, knows that he can take advantage of poorly designed input validation routines to create or alter SQL commands to gain access to private data or execute commands in the database.
What technique does Jimmy use to compromise a database?

A.Jimmy can submit user input that executes an operating system command to compromise a target system
B.Jimmy can gain control of system to flood the target system with requests, preventing legitimate users from gaining access
C.Jimmy can utilize an incorrect configuration that leads to access with higher-than expected privilege of the database
D.Jimmy can utilize this particular database threat that is an SQL injection technique to penetrate a target system

정답:

Question No : 5

Google uses a unique cookie for each browser used by an individual user on a computer. This cookie contains information that allows Google to identify records about that user on its database. This cookie is submitted every time a user launches a Google search, visits a site using AdSense etc.
The information stored in Google's database, identified by the cookie, includes
✑ Everything you search for using Google
✑ Every web page you visit that has Google Adsense ads
How would you prevent Google from storing your search keywords?

A.Block Google Cookie by applying Privacy and Security settings in your web browser
B.Disable the Google cookie using Google Advanced Search settings on Google Search page
C.Do not use Google but use another search engine Bing which will not collect and store your search keywords
D.Use MAC OS X instead of Windows 7. Mac OS has higher level of privacy controls by default.

정답:

Question No : 6

Stephanie works as a records clerk in a large office building in downtown Chicago. On Monday, she went to a mandatory security awareness class (Security5) put on by her company's IT department. During the class, the IT department informed all employees that everyone's Internet activity was thenceforth going to be monitored.
Stephanie is worried that her Internet activity might give her supervisor reason to write her up, or worse get her fired. Stephanie's daily work duties only consume about four hours of her time, so she usually spends the rest of the day surfing the web. Stephanie really enjoys surfing the Internet but definitely does not want to get fired for it.
What should Stephanie use so that she does not get in trouble for surfing the Internet?

A.Stealth IE
B.Stealth Anonymizer
C.Stealth Firefox
D.Cookie Disabler

정답:

Question No : 7

Peter extracts the SID list from Windows 2008 Server machine using the hacking tool "SIDExtracter". Here is the output of the SIDs:

From the above list identify the user account with System Administrator privileges?

A.John
B.Rebecca
C.Sheela
D.Shawn
E.Somia
F.Chang
G.Micah

정답:

Question No : 8

Most cases of insider abuse can be traced to individuals who are introverted, incapable of dealing with stress or conflict, and frustrated with their job, office politics, and lack of respect or promotion. Disgruntled employees may pass company secrets and intellectual property to competitors for monitory benefits.
Here are some of the symptoms of a disgruntled employee:
a) Frequently leaves work early, arrive late or call in sick
b) Spends time surfing the Internet or on the phone
c) Responds in a confrontational, angry, or overly aggressive way to simple requests or comments
d) Always negative; finds fault with everything
These disgruntled employees are the biggest threat to enterprise security.
How do you deal with these threats? (Select 2 answers)

A.Limit access to the applications they can run on their desktop computers and enforce strict work hour rules
B.By implementing Virtualization technology from the desktop to the data centre, organizations can isolate different environments with varying levels of access and security to various employees
C.Organizations must ensure that their corporate data is centrally managed and delivered to users just and when needed
D.Limit Internet access, e-mail communications, access to social networking sites and job hunting portals

정답:

Question No : 9

You want to hide a secret.txt document inside c:\windows\system32\tcpip.dll kernel library using ADS streams.
How will you accomplish this?

A.copy secret.txt c:\windows\system32\tcpip.dll kernel>secret.txt
B.copy secret.txt c:\windows\system32\tcpip.dll: secret.txt
C.copy secret.txt c:\windows\system32\tcpip.dll |secret.txt
D.copy secret.txt >< c:\windows\system32\tcpip.dll kernel secret.txt

정답:

Question No : 10

Dan is conducting penetration testing and has found a vulnerability in a Web Application which gave him the sessionID token via a cross site scripting vulnerability. Dan wants to replay this token. However, the session ID manager (on the server) checks the originating IP address as well. Dan decides to spoof his IP address in order to replay the sessionID.
Why do you think Dan might not be able to get an interactive session?

A.Dan cannot spoof his IP address over TCP network
B.The scenario is incorrect as Dan can spoof his IP and get responses
C.The server will send replies back to the spoofed IP address
D.Dan can establish an interactive session only if he uses a NAT

정답:

Question No : 11

Bret is a web application administrator and has just read that there are a number of surprisingly common web application vulnerabilities that can be exploited by unsophisticated attackers with easily available tools on the Internet. He has also read that when an organization deploys a web application, they invite the world to send HTTP requests. Attacks buried in these requests sail past firewalls, filters, platform hardening, SSL, and IDS without notice because they are inside legal HTTP requests. Bret is determined to weed out vulnerabilities.
What are some of the common vulnerabilities in web applications that he should be concerned about?

A.Non-validated parameters, broken access control, broken account and session management, cross-site scripting and buffer overflows are just a few common vulnerabilities
B.Visible clear text passwords, anonymous user account set as default, missing latest security patch, no firewall filters set and no SSL configured are just a few common vulnerabilities
C.No SSL configured, anonymous user account set as default, missing latest security patch, no firewall filters set and an inattentive system administrator are just a few common vulnerabilities
D.No IDS configured, anonymous user account set as default, missing latest security patch, no firewall filters set and visible clear text passwords are just a few common vulnerabilities

정답:

Question No : 12

Fake Anti-Virus, is one of the most frequently encountered and persistent threats on the web. This malware uses social engineering to lure users into infected websites with a technique called Search Engine Optimization.
Once the Fake AV is downloaded into the user's computer, the software will scare them into believing their system is infected with threats that do not really exist, and then push users to purchase services to clean up the non-existent threats.
The Fake AntiVirus will continue to send these annoying and intrusive alerts until a payment is made.

What is the risk of installing Fake AntiVirus?

A.Victim's Operating System versions, services running and applications installed will be published on Blogs and Forums
B.Victim's personally identifiable information such as billing address and credit card details, may be extracted and exploited by the attacker
C.Once infected, the computer will be unable to boot and the Trojan will attempt to format the hard disk
D.Denial of Service attack will be launched against the infected computer crashing other machines on the connected network

정답:

Question No : 13

More sophisticated IDSs look for common shellcode signatures. But even these systems can be bypassed, by using polymorphic shellcode. This is a technique common among virus writers?it basically hides the true nature of the shellcode in different disguises.
How does a polymorphic shellcode work?

A.They encrypt the shellcode by XORing values over the shellcode, using loader code to decrypt the shellcode, and then executing the decrypted shellcode
B.They convert the shellcode into Unicode, using loader to convert back to machine code then executing them
C.They reverse the working instructions into opposite order by masking the IDS signatures
D.They compress shellcode into normal instructions, uncompress the shellcode using loader code and then executing the shellcode

정답:

Question No : 14

Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the cookie even while the session is invalid on the server.
Why do you think this is possible?

A.It works because encryption is performed at the application layer (single encryption key)
B.The scenario is invalid as a secure cookie cannot be replayed
C.It works because encryption is performed at the network layer (layer 1 encryption)
D.Any cookie can be replayed irrespective of the session status

정답:

Question No : 15

This IDS defeating technique works by splitting a datagram (or packet) into multiple fragments and the IDS will not spot the true nature of the fully assembled datagram. The datagram is not reassembled until it reaches its final destination. It would be a processor-intensive task for IDS to reassemble all fragments itself, and on a busy system the packet will slip through the IDS onto the network.
What is this technique called?

A.IP Routing or Packet Dropping
B.IDS Spoofing or Session Assembly
C.IP Fragmentation or Session Splicing
D.IP Splicing or Packet Reassembly

정답:

EC-Council CEH-001 시험