Ceh V9 Random Questions

Front 1

Which 802.11 standard covers security relating to WPA2?

Back 1

802.11i is the standard concerned with the design and implementation of WPA2

Front 2

Which 802.11 standard specifies a data transmit rate of 11 Mbps?

Back 2

802.11b is an early wireless standard that allows for a transmission rate of only 11 Mbps in theory, but in practice it is around half this speed.

Front 3

How is a cookie best described?

Back 3

A cookie is a text file placed on a computer system by a web application or page that stores information that can be used to customize a user's experience. Cookies are used by web applications in situations where information needs to be stored for later retrieval due to stateless protocols such as HTTP being unable to store persistent information.

The file can be targeted by an attacker to gain information or plant information on a host system. Methods to do this include XXS and session hijacking.

Front 4

A bot is used in which type of attack?

Back 4

A bot (also sometimes called a drone or zombie) is commonly used in the commission of a DDoS attack. During the course of this attack, thousands of these systems may be used to attack a target.

Front 5

What is the LOIC used to perform?

Back 5

The Low Orbit Ion Cannon (LOIC) is used to perform DoS or DDoS attacks against a victim system.

Front 6

On a stand-alone Windows system, where is the password and account information stored?

Back 6

In the Security Accounts Manager (SAM), which is a database on the local system that stores credential information only for the local system. The SAM is a component of the Windows registry.

Front 7

What is steganography used for?

Back 7

It is used to hide information within other information. The process is an excellent example of a covert channel, which is where something is used counter to its design. In steganography this could be when an image is used to store a PDF, not something an image is meant to do.

Front 8

What is a covert channel?

Back 8

It is a secret facility that enables you to use a system in a way counter to its design. A covert channel is particularly dangerous because using something counter to the way it was designed to be used can also mean that no security mechanisms are in place to look for it.

Front 9

What is an overt channel?

Back 9

An overt channel is a system that is used in a manner consistent with its design.

Front 10

What weakness does a Trojan exploit?

Back 10

A Trojan exploits weaknesses in human nature by enticing a victim to open and execute a file using false promises or enticing language. More specifically, a Trojan utilizes social engineering techniques to manipulate the recipient into opening and executing what looks like something of value but in reality contains a malicious payload.

Front 11

What is a host intrusion detection system (HIDS) used for?

Back 11

An HIDS is used to monitor potential or suspected intrusions on a system or host. Unlike an NIDS it cannot be used to monitor traffic or activity on a network. It looks for changes to files, misuse, privilege abuse, alterations to log files, and other activities depending on the vendor.

Front 12

What is a network intrusion detection system (NIDS) used to monitor?

Back 12

An NIDS is used to monitor potential breaches or malicious activities on a network. An NIDS can look for deviations from known or expected behavior on a network, or it can be a knowledge-based system that compares activity against a database much like an antivirus application does.

Front 13

What is a demilitarized zone (DMZ)?

Back 13

A demilitarized zone refers metaphorically to a buffer zone between intranet and internet services. In many cases the DMZ is used to host publicly accessible services in the semi-protected region between an intranet and the internet.

Front 14

What type of firewall can operate at Layer 4 of the OSI model and above?

Back 14

Stateful firewalls are designed to work at Layer 4 and above, where they can perform stateful packet inspection (SPI). These firewalls need to be able to monitor the activities that happen with a connection, including the traffic present at these layers.

Front 15

What device can direct traffic based on physical addresses?

Back 15

A switch operates at Layer 2, which is where physical or MAC addresses are assigned. A switch uses the MAC address to differentiate traffic.

Front 16

What device operates at Layer 3?

Back 16

A router works specifically at Layer 3, where routable protocols start to appear. The IP portion of the TCP/IP suite resides at Layer 3.

Front 17

Bluetooth goes by which IEEE standard number?

Back 17

802.15

Front 18

What is the name of the directional antenna used in wireless communications?

Back 18

Yagi is an antenna used to focus and highly concentrate a wireless signal in a single direction. The result is increased range, a stronger signal, and better security from less scattering of the signal.

Front 19

Which port is used by SSL?

Back 19

Port 443 is set aside by convention to be used by the SSL and TLS protocols when combined with HTTP.

Front 20

Which part of CIA is concerned with the quality of information?

Back 20

Integrity: CIA means Confidentiality, Integrity, Availability.

Front 21

What type of attack uses a flood of half-open connections to perform a DoS?

Back 21

A SYN flood works via a three-way handshake but removes the final ACK in the handshake, thus exhausting the target party's resources. It's also known as a half-open connection.

Front 22

What type of attack uses an unusual combination of TCP flags to cause a DoS?

Back 22

A Xmas tree is a packet where legal but unusual combinations of flags are set, resulting in systems not knowing how to respond or deal with the packets. Modern systems usually ignore or drop the packets, but in old or unpatched systems a crash can result.

Front 23

What does the receipt of an RST flag indicate?

Back 23

A reset (RST) flag indicates that a port is closed.

Front 24

What tools can be used to determine the open and closed ports on a system?

Back 24

Port scanners such as Nmap and SuperScan can determine the status of ports on a system or groups of systems.

Front 25

What technique can be used to determine whether a whole subnet of hosts is up or down?

Back 25

Ping sweeps (or ICMP) can be used to determine which hosts are up or down on a given subnet. Tools like Nmap or Angry IP Scanner can be used to perform this task.

Front 26

What is the proper syntax for connecting to a system using a NULL session?

Back 26

net use

\\host_name_or_IP_address\ipc$ "" "/user:"

Front 27

What protocol or service makes a system potentially vulnerable to a NULL session?

Back 27

NetBIOS can potentially open the door to NULL session exploitation. In newer Windows systems, the registry setting RestrictAnonymous can be used to control this problem.

Front 28

What is an example of a utility that uses ICMP?

Back 28

Ping

Front 29

What tool is used to determine the path of a packet?

Back 29

Tracert or Visual Traceroute

Front 30

What registry key was introduced to lessen the impact of NULL sessions?

Back 30

The RestrictAnonymous key was introduced to blunt the impact of NULL sessions.

Front 31

What is a black-box test?

Back 31

A black-box test is one in which no information is provided to the testing party. The intention is to simulate the experience an outside party would have when trying to engage a target.

Front 32

What is a gray-box test?

Back 32

A gray-box test is one in which limited information is given to the testing party for purposes of evaluation.

Front 33

What is the purpose of a white-box test?

Back 33

In a white-box test, extensive or full information is given to an evaluating party, typically in order to test the internal workings of an environment for audit purposes.

Front 34

What does a pentester need prior to beginning a test?

Back 34

A pentester must have permission from the system owner as part of the contract. Any modifications or requests to expand the scope of the test must always be added to the contract.

Front 35

What is a law pertaining to the privacy of healthcare information?

Back 35

Health Insurance Portability and Accountability Act of 1996 (HIPPA)

Front 36

What is used to manage keys and certificates in a large-scale environment?

Back 36

Public Key Infrastructure (PKI)

Front 37

Which key is restricted to being used by a small or single party?

Back 37

The private key is by definition restricted to being used by a single user or small group.

Front 38

What is the commonly used standard for digital certificates?

Back 38

X.509

Front 39

What is PGP?

Back 39

Pretty Good Privacy (PGP) is a peer-to-peer encryption system commonly used to exchange secure email.

Front 40

What protocol is used to transfer email from client to server?

Back 40

Simple Mail Transfer Protocol (SMTP) is used to transfer email from client to server or from server to server.

Front 41

What email protocol leaves messages on the server and can maintain status information?

Back 41

Internet Message Access Protocol version 4 is commonly used in situations where a mailbox is accessed on multiple systems to coordinate which messages have been read and which ones have not.

Front 42

From a security standpoint, what is a problem with SMTP?

Back 42

The protocol is unencrypted and provides no protection against sniffing or hijacking. However, the protocol can be protected if used with a VPN or similar technology.

Front 43

Which authentication protocol uses a KDC?

Back 43

Kerberos makes use of a key distribution center (KDC).

Front 44

What mechanism uses both AH and ESP modes?

Back 44

IPsec, or IP Security uses both AH and ESP modes to protect information in transit.

Front 45

What is AH mode?

Back 45

Authentication Header (AH) mode is used to digitally sign and protect the header of a packet.

Front 46

What is ESP mode?

Back 46

Encapsulating Security Payload (ESP) mode protects the contents of a packet in IPsec.

Front 47

What command can be used to view the shares on a Windows system?

Back 47

net view

or

net view

Front 48

What utility can be used to view active sessions in real time on a Windows system?

Back 48

TCPView or netstat; the difference between these two utilities is that while TCPView gives a real time look at traffic, netstat gives a snapshot.

Front 49

What is the purpose of a packet crafter?

Back 49

Tools such as hping3 are designed to create custom packets to test and evade devices.

Front 50

What does a level 3 firewall do?

Back 50

A level 3 firewall filters packets by source and destination IP address and protocol.

Front 51

What is a false positive?

Back 51

A report of an attack where one does not exist.

Front 52

What is a false negative?

Back 52

A false negative is no report of an attack even thought one is actually taking place.

Front 53

What is a device used to prevent tailgating?

Back 53

Mantrap

Front 54

What mechanism uses email to entice users to provide information they shouldn't reveal?

Back 54

Phishing

Front 55

What type of NIDS uses a database of known attacks to compare traffic against?

Back 55

A signature based IDS

Front 56

What is a HIDS?

Back 56

A host-based IDS (HIDS) detects intrustions and anomalous behavior on a system.

Front 57

Snort is an example of what kind of IDS?

Back 57

Snort is an NIDS for both Linux and Windows and is highly configurable and scalable.

Front 58

Tripwire is an example of which kind of IDS?

Back 58

Tripwire is the oldest HIDS in existence.

Front 59

What task is AirPcap used to perform?

Back 59

AirPcap is a hardware dongle used to analyze Wi-Fi data frames with the assistance of a sniffer.

Front 60

If you are using Wireshark by itself, can you analyze 802.11 frames?

Back 60

Yes, but not as closely and detailed as you can with AirPcap.

Front 61

What hardware device can be used to create VLANs?

Back 61

A switch can be used to create VLANs.

Front 62

How can a keylogger be installed onto a target system?

Back 62

Either as a hardware solution or as a piece of software such as a Trojan.

Front 63

What piece of malware can alter the files and behavior of a system?

Back 63

A rootkit is designed to alter the files and behavior of a system at a low level.

Front 64

What technique is typically used to detect changes in files?

Back 64

Hashing

Front 65

What technique can be used to hide PDF files within an image?

Back 65

Steganography

Front 66

What flaw can allow an attacker to perform a SQL injection through a field on a form?

Back 66

Lack of input validation on a form can allow an attacker to attempt a SQL injection.

Front 67

What is a timing attack in SQL injections?

Back 67

It is an attack where the time used to respond to a request is observed and used to determine success (also known as a blind SQL injection).

Front 68

What is banner grabbing?

Back 68

It is a technique used to extract information from a service. Common ways include using Telnet, Netcat, and Nmap.

Front 69

What is the most common tool used to perform banner grabbing?

Back 69

Telnet is the most common tool used to perform banner grabbing.

Front 70

What is BlackWidow?

Back 70

A tool used to download content from a website for viewing offline.

Front 71

Why would you use alerts to monitor a website?

Back 71

In order to be notified of changes to web pages and have the results sent to you.

Front 72

What is Google hacking?

Back 72

A technique where specific keywords are used to customize search results from Google.

Front 73

What does the keyword allinurl do?

Back 73

It allows the searching of specific words in a URL in Google. It's often referred to as Google hacking.

Front 74

What would the search "filetype:pdf" do?

Back 74

Return only search results that are PDF files.

Front 75

What is ODBC?

Back 75

Open Database Connectivity (ODBC) is an API (application programming interface) used to connect applications to databases.

Front 76

What is JSP?

Back 76

JavaServer Pages (JSP) is a technology that allows you to dynamically generate web pages.

Front 77

What is the definition of a client-side scripting language?

Back 77

A script that is delivered by the server to the client and then processed on the client system.

Front 78

What is the definition of a server-side scripting language?

Back 78

A script that is processed by the server and the results delivered to the requesting client.

Front 79

What is SNMP?

Back 79

Simple Network Management Protocol (SNMP) is used to monitor and issue commands to network devices.

Front 80

What ports does SNMP run over by default?

Back 80

161 and 162

Front 81

What is HTTPS?

Back 81

This is HTTP (HyperText Transfer Protocol) running with the SSL (Secure Sockets Layer) technology for encryption and integrity purposes.

Front 82

Which encryption technique is best at processing bulk data?

Back 82

Symmetric algorithms are the most efficient at processing bulk data.

Front 83

What is the purpose of a key in encryption?

Back 83

To determine the settings of specific encryption instance.

Front 84

What is AES?

Back 84

Advanced Encryption Standard (AES) is a symmetric encryption standard. AES was originally named Rijndael.

Front 85

Who are Rivest, Shamir and Adelman?

Back 85

The founders of the RSA Corporation and the creators of the RSA algorithm.

Front 86

What is an ad hoc wireless network?

Back 86

It is a peer-to-peer wireless network that doesn't use an access point.

Front 87

What technique can be used to take over a connection after two hosts have completed authentication.

Back 87

Session hijacking is used at the network level. Application-level session hijacking typically targets web applications.

Front 88

What is TCP?

Back 88

Transmission Control Protocol (TCP) is used to ensure delivery and perform flow control in the TCP/IP suite; it's also referred to as a connection-oriented service.

Front 89

Give an example of a best-effort protocol.

Back 89

User Datagram Protocol (UDP) is a best-effort protocol.

Front 90

What is OSI?

Back 90

The Open Systems Interconnection (OSI) model is a standardized model for defining the seven layers of networking services.

Front 91

What is TrueCrypt?

Back 91

TrueCrypt is software used to perform drive encryption; it is no longer recommended and is considered unsafe.

Front 92

What is TPM?

Back 92

A trusted platform module (TPM) is used to hold keys and aid in the encryption process. It binds the hard drive to the motherboard.

Front 93

What is the significance of more bits in an encryption key?

Back 93

Keys with more bits are generally stronger because they require more compute time to break.

Front 94

What is a keyspace?

Back 94

A keyspace represents the number of potential keys present in a particular encryption algorithm.

Front 95

What technique would be used to detect a change in a file?

Back 95

Hashing or creating a message digest.

Front 96

What is WEP?

Back 96

Wired Equivalent Privacy (WEP) is an encryption standard used for Wi-Fi networks.

Front 97

What is Hunt?

Back 97

It is a tool used to perform session hijacking.

Front 98

What is a Smurf Attack?

Back 98

It is a DoS attack based on TCP used to send large volumes of traffic to a victim.

Front 99

What is a Fraggle Attack?

Back 99

It is a DoS attack based on UDP used to send large volumes of traffic to a victim.

Front 100

What is a land attack?

Back 100

It is an attack in which the source and destination of a packet are the same.

Front 101

What is an offline password attack that trades performance for speed?

Back 101

Rainbow table

Front 102

What is an attack against passwords that tries every possible combination of characters?

Back 102

A brute-force attack

Front 103

What is a dictionary attack.

Back 103

This is an attack where words, phrases, or predefined combinations are used from a file.

Front 104

Does drive encryption prevent theft of data?

Back 104

No, it poses a substantial barrier against theft, but theft is not impossible. If the device is lost or stolen, it makes it more likely that the thief will choose to reset the device rather than attempt to recover the information.