Filters
Question type
Study Flashcards

A host is bombarded with packets intended to exploit stateful network protocols. Every time it gets a packet, it allocates memory for the expected connection. The connection is never fully established by the sender. What form of attack is this?


A) SYN Flood
B) Smurf
C) Ping of Death
D) Stachledraught

E) All of the above
F) B) and C)

Correct Answer

verifed

verified

In terms of information security and malware classification, a RAT is a:


A) Remote Authentication Terminal
B) Someone that reports the activities of a coworker to management
C) Remote Access Tool
D) The Reveal - Access - Target, model of malicious activity

E) None of the above
F) B) and D)

Correct Answer

verifed

verified

Mary notices her machine has internet access for about 10 minutes then it seems to slow down. She reboots, everything is fine for ten minutes again. What is the most likely problem?


A) Her internet filter is metering her usage and throttling her down
B) Her ISP sucks
C) The website she is visiting is down
D) Her host is vulnerable to slammer.

E) All of the above
F) A) and D)

Correct Answer

verifed

verified

If you have the following pseudo code, what is the most accurate natural language description? If (i >= 300) then exit


A) If we have written 300 characters to the buffer variable, the function should stop because it cannot hold any more data
B) If we have written more than 300 characters to the buffer variable, the function should stop because it cannot hold any more data
C) If we have written less than 300 characters to the buffer variable, the function should stop because it cannot hold any more data
D) If we have written less than or equal to 300 characters to the buffer variable, the function should stop because it cannot hold any more data

E) All of the above
F) None of the above

Correct Answer

verifed

verified

Melissa receives an email that comes from a random email address. She has many friends that use their online "handles" like zebranuts321@yahoo.com for instance so she isn't really surprised by that. There is an attachment on the email called "Iloveyou.txt" which looks intriguing even if she doesn't remember knowing this person. What is about to happen?


A) She will open the attachment and it will be from a long lost partner she has been hoping to get back in touch with for years.
B) The file is really named "iloveyou.txt.vbs" and is a well known classic trick to spread a macro virus
C) Her boss sent her this as a practical joke to see if she would open it, but its harmless
D) A Windows will pop open to a command shell and a lot of noise will come from her speakers. The shell will say "Will you marry me?" the email was from her finacee.

E) A) and C)
F) All of the above

Correct Answer

verifed

verified

Willard wants to use the tool "Qfecheck" to scan his network to see if the latest updates are yet installed. In order to make sure it runs correctly permission on what reqistry will have to be set properly?


A) HKEY_LOCAL_MACHINE\SOFTWARE\Services\Microsoft\Updates
B) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServicePacks
C) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Patches
D) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates

E) None of the above
F) B) and D)

Correct Answer

verifed

verified

You just attacked a IIS server and managed to exploit a buffer overflow in the .printer ISAPI. Turns out there are serveral tools to choose from. Which of the following tools does not perform this attack?


A) Jill.c
B) iishack2000.c
C) iis5hack.zip
D) john the printer

E) A) and D)
F) A) and B)

Correct Answer

verifed

verified

Which of the following languages is less vulnerable to buffer overflow attacks?


A) ActiveX
B) Assembly
C) Java
D) C++

E) A) and B)
F) A) and C)

Correct Answer

verifed

verified

Tony wants to clear his afternoon to play a video game. He needs to manufacture an emergency and tell his boss that the servers are vulnerable to an "Evil Bit" attack, and it will take all afternoon to fix them. This sounds bad, so the boss tells him to get right on it. What is Tony really talking about?


A) He is referring to a character in his video game, but the boss doesn't realize this
B) He just gave the boss a simple explanation for a real attack knowing he wouldn't understand the right
One
C) The high order bit in the fragment offset field is set, but it is supposed to be reserved with a value 0, and most IP stacks have not been updated to understand it. It crashes the system
D) This is an IT inside Joke

E) A) and B)
F) None of the above

Correct Answer

verifed

verified

Chandler is having a conversation with Benjamin, the present IT administrator. Benjamin is convinced his network is rock solid secure and impenetrable. He has each and every technology based countermeasure installed. Chandler mentions there is always a weak link, and that somehow, someway A weakness will be present somewhere. What principle of defense is Chandler talking about?


A) Viruses such as Polymorphic and Metamorphic are too sophisticated to be stopped.
B) Nuisances such as Spam will never go away and the attackers are always one step ahead.
C) "Zero-day" exploits are constantly being discovered and cannot be defended against.
D) People are always the weakest link. Untrained users, careless users, and inside attackers are always a risk.

E) A) and B)
F) A) and C)

Correct Answer

verifed

verified

What are the three phases of a viral outbreak?


A) Release, Detection, Removal
B) Invention, release, detection
C) Infection, Spreading, Attack
D) Spreading, Attack, Infection

E) C) and D)
F) All of the above

Correct Answer

verifed

verified

Kelly sent an email out to the entire staff warning of a new vulnerability in Outlook that would expose the entire contact list. She explains that several versions of the email have been found, but they all contain the words "Sales Lead" or "Service Request" in the subject line. These emails must be deleted without being opened for the next 72 hours while a patch is released. What statement below is not true?


A) Kelly is being helpful. Coworkers watching out for events like this and helping one another is critical to any working security program.
B) This looks like a hoax. If Kelly is even a real person she should be fired on the spot, since hoaxes are considered as dangerous as actual viruses.
C) Hoaxes are considered as dangerous as actual viruses and this could be an indication that training is in order for more people than just Kelly
D) An investigation should be conducted to find out if Kelly was attempting a hoax or was herself social engineered.

E) None of the above
F) B) and C)

Correct Answer

verifed

verified

Applications that clean viruses from systems are sometimes called "Virus Scrubbers". One drawback is that they are only as good as their last signature update, and even at that, many types of malware could be undetectable if there is no signature. Another approach is to detect corrupt files, or at the very least, files that have been modified that shouldn't be. What type of tool performs this technique?


A) Rootkit Revealers
B) Firewalls and Virtual Private Networks
C) Anti-Phishing, Anti-Malware etc
D) File Integrity Verification tools

E) A) and D)
F) B) and C)

Correct Answer

verifed

verified

A tool that is part of the "sysinternals" collection can scan the Windows registry and help detect unusual events. What is the name of this tool?


A) Regmon
B) Rootkit Revealer
C) Registry Revealer
D) Registry Baseliner

E) None of the above
F) A) and D)

Correct Answer

verifed

verified

Which of the following registers will be over written in a buffer overflow exploit?


A) EIP
B) ESP
C) ERP
D) EXP

E) C) and D)
F) B) and D)

Correct Answer

verifed

verified

It is hard to be precise with the offset value that gets placed into the return register when an overflow is deliberate, as in during an attack. A NOOP sled cane be placed at the beginning of the shell code to create some margin for error. Which of the following looks like a sled?


A) 0xA4\0x23\0xFE\0x65\0xA5\0x65\0xAE\0x5B
B) 0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\
C) 0x00\0x0D\0x0A\0xFF\0x00\0x0D\0x0A\0xFF\
D) 0x90\0x90\0x90\0x90\0x90\0x90\0x90\0x90\

E) B) and C)
F) A) and D)

Correct Answer

verifed

verified

Which of these types of Virus primarily attack Windows systems?


A) Boot Sector
B) System level viruses
C) Multi-partite viruses
D) Macro viruses

E) All of the above
F) A) and B)

Correct Answer

verifed

verified

What are the six steps of the virus lifecycle?


A) Design, Replication, Infection, Detection, Incorporation, Elimination
B) Design, Replication, Monitoring, Detection, Incorporation, Elimination
C) Design, Replication, Launch, Detection, Elimination, Incorporation
D) Design, Replication, Launch, Detection, Incorporation, Elimination

E) A) and B)
F) A) and C)

Correct Answer

verifed

verified

Larry notices in his log file that a lot of TCP traffic with the UPF flags set are targeting various internal hosts on port 31337. He suspects this traffic is unusual but does not quite know what to make of it. Knowing you just passed your CEH exam, Larry decides to ask what you think. What would be a possible conclusion?


A) UPF scans are common license tracking mechanisms and should always be ignored. The port belongs to an old tool no one uses anymore and therefore poses no threat.
B) Larry should download the 27001 spec and pour through it word for word until it tells him what to do
C) Larry should run "Zombie P0wn3r" a tool he got from the last Defcon security conference he attended that was guaranteed to wipe out all malicious servers.
D) The traffic is being sent from a tool, and based on port 31337, the assumption could be this is this is a Back Orifice scan.

E) C) and D)
F) All of the above

Correct Answer

verifed

verified

Gary assembles an ACL for his Cisco router that looks something like this: Access-list 111 deny ip 10.0.0.0 0.255.255.255 any Access-list 111 deny ip 172.16.0.0 0.15.255.255 any Access-list 111 deny ip 192.168.0.0 0.0.255.255 any Access-list 111 deny ip 127.0.0.1 0.255.255.255 any Access-list 111 deny ip 224.0.0.0 31.255.255.255 any Access-list 111 deny ip host 0.0.0.0 any The list is applied to an outside interface. What is this list trying to accomplish?


A) Defining private IPs
B) Defining internal networks
C) Anti-NAT attacks
D) Anti-spoofing

E) A) and C)
F) A) and D)

Correct Answer

verifed

verified

Showing 21 - 40 of 58

Related Exams

Exam 1

Ethical Hacking and Testing

52 Questions

Exam 2

Information Gathering

65 Questions

Exam 4

Operating Systems and Applications

63 Questions

Exam 5

Networks and Services

64 Questions

Show Answer