312-50v11 Certified Ethical Hacker Exam - C|EH v11 Free Updated Questions - Free Latest Dumps for IT Certification Exams

312-50v11 Certified Ethical Hacker Exam – C|EH v11 Free Updated Questions

dumps2021-09-22T08:12:13+08:00

312-50 exam is much pop among those EC-Council certifications. Now it is v11. There are 125 questions in real Certified Ethical Hacker Exam – C|EH v11 312-50v11 exam, and you have 4 hours to complete all the questions. We provide the latest EC-Council certification 312-50v11 exam updated questions, which are helpful for you to study this CEH exam. Free EC-Council certification 312-50v11 updated questions are available below.

Page 1 of 11

1. Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor".

Here is the output of the SIDs:

From the above list identify the user account with System Administrator privileges.

John

Rebecca

Sheela

Shawn

Somia

Chang

Micah

2. During the process of encryption and decryption, what keys are shared?

Private keys

User passwords

Public keys

Public and private keys

3. ping-* 6 192.168.0.101

Output:

Pinging 192.168.0.101 with 32 bytes of data:

Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

Reply from 192.168.0.101: bytes=32 time<1ms TTL=128

Reply from 192.168.0.101:

Ping statistics for 192.168.0101

Packets: Sent = 6, Received = 6, Lost = 0 (0% loss).

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

What does the option * indicate?

4. While examining audit logs, you discover that people are able to telnet into the SMTP server on port 25. You would like to block this, though you do not see any evidence of an attack or other wrong doing. However, you are concerned about affecting the normal functionality of the email server.

From the following options choose how best you can achieve this objective?

Block port 25 at the firewall.

Shut off the SMTP service on the server.

Force all connections to use a username and password.

Switch from Windows Exchange to UNIX Sendmail.

None of the above.

5. What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?

Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.

Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail.

Symmetric encryption allows the server to security transmit the session keys out-of-band.

Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.

6. Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

To determine who is the holder of the root account

To perform a DoS

To create needless SPAM

To illicit a response back that will reveal information about email servers and how they treat undeliverable mail

To test for virus protection

7. The company ABC recently contracts a new accountant. The accountant will be working with the financial statements. Those financial statements need to be approved by the CFO and then they will be sent to the accountant but the CFO is worried because he wants to be sure that the information sent to the accountant was not modified once he approved it .

Which of the following options can be useful to ensure the integrity of the data?

The CFO can use a hash algorithm in the document once he approved the financial statements

The CFO can use an excel file with a password

The financial statements can be sent twice, one by email and the other delivered in USB and the accountant can compare both to be sure is the same document

The document can be sent to the accountant using an exclusive USB for that document

8. While scanning with Nmap, Patin found several hosts which have the IP ID of incremental sequences. He then decided to conduct: nmap -Pn -p- -si kiosk.adobe.com www.riaa.com. kiosk.adobe.com is the host with incremental IP ID sequence .

What is the purpose of using "-si" with Nmap?

Conduct stealth scan

Conduct ICMP scan

Conduct IDLE scan

Conduct silent scan

9. Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111

An alert is generated when any packet other than a TCP packet is seen on the network and destined for the 192.168.1.0 subnet

An alert is generated when a TCP packet is originated from port 111 of any IP address to the 192.168.1.0 subnet

An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111

10. You are a penetration tester and are about to perform a scan on a specific server. The agreement that you signed with the client contains the following specific condition for the scan: “The attacker must scan every port on the server several times using a set of spoofed sources IP addresses. ” Suppose that you are using Nmap to perform this scan .

What flag will you use to satisfy this requirement?

The -A flag

The -g flag

The -f flag

The -D flag

11. During a black-box pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded .

What type of firewall is inspecting outbound traffic?

Circuit

Stateful

Application

Packet Filtering

12. Bob wants to ensure that Alice can check whether his message has been tampered with.

He creates a checksum of the message and encrypts it using asymmetric cryptography.

What key does Bob use to encrypt the checksum for accomplishing this goal?

Alice's private key

Alice's public key

His own private key

His own public key

13. Bob, an attacker, has managed to access a target loT device. He employed an online tool to gather information related to the model of the loT device and the certifications granted to it .

Which of the following tools did Bob employ to gather the above Information?

search.com

EarthExplorer

Google image search

FCC ID search

14. CORRECT TEXT

You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly.

What is the best Nmap command you will use?

nmap -T4 -q 10.10.0.0/24

nmap -T4 -F 10.10.0.0/24

nmap -T4 -r 10.10.1.0/24

nmap -T4 -O 10.10.0.0/24

15. By using a smart card and pin, you are using a two-factor authentication that satisfies

Something you are and something you remember

Something you have and something you know

Something you know and something you are

Something you have and something you are

16. What useful information is gathered during a successful Simple Mail Transfer Protocol (SMTP) enumeration?

The two internal commands VRFY and EXPN provide a confirmation of valid users, email addresses, aliases, and mailing lists.

Reveals the daily outgoing message limits before mailboxes are locked

he internal command RCPT provides a list of ports open to message traffic.

A list of all mail proxy server addresses used by the targeted host

17. Bob, your senior colleague, has sent you a mail regarding a deal with one of the clients. You are requested to accept the offer and you oblige. After 2 days. Bob denies that he had ever sent a mail .

What do you want to ""know"" to prove yourself that it was Bob who had send a mail?

Authentication

Confidentiality

Integrity

Non-Repudiation

18. You have compromised a server and successfully gained a root access. You want to pivot and pass traffic undetected over the network and evade any possible Intrusion Detection System .

What is the best approach?

Use Alternate Data Streams to hide the outgoing packets from this server.

Use HTTP so that all traffic can be routed vis a browser, thus evading the internal Intrusion Detection Systems.

Install Cryptcat and encrypt outgoing packets from this server.

Install and use Telnet to encrypt all outgoing traffic from this server.

19. Jim, a professional hacker, targeted an organization that is operating critical Industrial Infrastructure. Jim used Nmap to scan open pons and running services on systems connected to the organization's OT network. He used an Nmap command to identify Ethernet/IP devices connected to the Internet and further gathered Information such as the vendor name, product code and name, device name, and IP address .

Which of the following Nmap commands helped Jim retrieve the required information?

nmap -Pn -sT --scan-delay 1s --max-parallelism 1 -p < Port List > < Target IP >

nmap -Pn -sU -p 44818 --script enip-info < Target IP >

nmap -Pn -sT -p 46824 < Target IP >

nmap -Pn -sT -p 102 --script s7-info < Target IP >

20. Upon establishing his new startup, Tom hired a cloud service provider (CSP) but was dissatisfied with their service and wanted to move to another CSP.

What part of the contract might prevent him from doing so?

Virtualization

Lock-in

Lock-down

Lock-up

Page 2 of 11

21. What is the known plaintext attack used against DES which gives the result that encrypting plaintext with one DES key followed by encrypting it with a second DES key is no more secure than using a single key?

Man-in-the-middle attack

Meet-in-the-middle attack

Replay attack

Traffic analysis attack

22. What piece of hardware on a computer's motherboard generates encryption keys and only releases a part of the key so that decrypting a disk on a new piece of hardware is not possible?

CPU

GPU

UEFI

TPM

23. You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address was blacklisted just before the alert. You are starting an investigation to roughly analyze the severity of the situation .

Which of the following is appropriate to analyze?

IDS log

Event logs on domain controller

Internet Firewall/Proxy log.

Event logs on the PC

24. Jane is working as a security professional at CyberSol Inc. She was tasked with ensuring the authentication and integrity of messages being transmitted in the corporate network. To encrypt the messages, she implemented a security model in which every user in the network maintains a ring of public keys. In this model, a user needs to encrypt a message using the receiver's public key, and only the receiver can decrypt the message using their private key .

What is the security model implemented by Jane to secure corporate messages?

Zero trust network

Transport Layer Security (TLS)

Secure Socket Layer (SSL)

Web of trust (WOT)

25. A company’s Web development team has become aware of a certain type of security vulnerability in their Web software. To mitigate the possibility of this vulnerability being exploited, the team wants to modify the software requirements to disallow users from entering HTML as input into their Web application.

What kind of Web application vulnerability likely exists in their software?

Cross-site scripting vulnerability

SQL injection vulnerability

Web site defacement vulnerability

Gross-site Request Forgery vulnerability

26. CompanyXYZ has asked you to assess the security of their perimeter email gateway. From your office in New York, you craft a specially formatted email message and send it across the Internet to an employee of CompanyXYZ. The employee of CompanyXYZ is aware of your test.

Your email message looks like this:

From: [email protected]

To: [email protected] Subject: Test message

Date: 4/3/2017 14:37

The employee of CompanyXYZ receives your email message.

This proves that CompanyXYZ’s email gateway doesn’t prevent what?

Email Masquerading

Email Harvesting

Email Phishing

Email Spoofing

27. Which of the following web vulnerabilities would an attacker be attempting to exploit if they delivered the following input?

<!DOCTYPE blah [ < IENTITY trustme SYSTEM "file:///etc/passwd" > ] >

XXE

SQLi

IDOR

XXS

28. John, a disgruntled ex-employee of an organization, contacted a professional hacker to exploit the organization. In the attack process, the professional hacker Installed a scanner on a machine belonging to one of the vktims and scanned several machines on the same network to Identify vulnerabilities to perform further exploitation .

What is the type of vulnerability assessment tool employed by John in the above scenario?

Proxy scanner

Agent-based scanner

Network-based scanner

Cluster scanner

29. One of your team members has asked you to analyze the following SOA record.

What is the TTL?

Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.)

200303028

3600

604800

2400

4800

30. Kevin, an encryption specialist, implemented a technique that enhances the security of keys used for encryption and authentication. Using this technique, Kevin input an initial key to an algorithm that generated an enhanced key that is resistant to brute-force attacks .

What is the technique employed by Kevin to improve the security of encryption keys?

Key derivation function

Key reinstallation

A Public key infrastructure

Key stretching

31. Which of the following is considered an exploit framework and has the ability to perform automated attacks on services, ports, applications and unpatched security flaws in a computer system?

Wireshark

Maltego

Metasploit

Nessus

32. _________ is a type of phishing that targets high-profile executives such as CEOs, CFOs, politicians, and celebrities who have access to confidential and highly valuable information.

Spear phishing

Whaling

Vishing

Phishing

33. You have compromised a server on a network and successfully opened a shell. You aimed to identify all operating systems running on the network. However, as you attempt to fingerprint all machines in the network using the nmap syntax below, it is not going through.

invictus@victim_server.~$ nmap -T4 -O 10.10.0.0/24 TCP/IP fingerprinting (for OS scan)

xxxxxxx xxxxxx

xxxxxxxxx. QUITTING!

What seems to be wrong?

The nmap syntax is wrong.

This is a common behavior for a corrupted nmap application.

The outgoing TCP/IP fingerprinting is blocked by the host firewall.

OS Scan requires root privileges.

34. Mary, a penetration tester, has found password hashes in a client system she managed to breach. She needs to use these passwords to continue with the test, but she does not have time to find the passwords that correspond to these hashes .

Which type of attack can she implement in order to continue?

LLMNR/NBT-NS poisoning

Internal monologue attack

Pass the ticket

Pass the hash

35. There are multiple cloud deployment options depending on how isolated a customer's resources are from those of other customers. Shared environments share the costs and allow each customer to enjoy lower operations expenses. One solution Is for a customer to Join with a group of users or organizations to share a cloud environment .

What is this cloud deployment option called?

Hybrid

Community

Public

Private

36. Bobby, an attacker, targeted a user and decided to hijack and intercept all their wireless communications. He installed a fake communication tower between two authentic endpoints to mislead the victim. Bobby used this virtual tower to interrupt the data transmission between the user and real tower, attempting to hijack an active session, upon receiving the users request. Bobby manipulated the traffic with the virtual tower and redirected the victim to a malicious website .

What is the attack performed by Bobby in the above scenario?

Wardriving

KRACK attack

jamming signal attack

aLTEr attack

37. Attacker Rony installed a rogue access point within an organization's perimeter and attempted to intrude into its internal network. Johnson, a security auditor, identified some unusual traffic in the internal network that is aimed at cracking the authentication mechanism. He immediately turned off the targeted network and tested for any weak and outdated security mechanisms that are open to attack .

What is the type of vulnerability assessment performed by johnson in the above scenario?

Host-based assessment

Wireless network assessment

Application assessment

Distributed assessment

38. Stephen, an attacker, targeted the industrial control systems of an organization. He generated a fraudulent email with a malicious attachment and sent it to employees of the target organization. An employee who manages the sales software of the operational plant opened the fraudulent email and clicked on the malicious attachment. This resulted in the malicious attachment being downloaded and malware being injected into the sales software maintained in the victim's system. Further, the malware propagated itself to other networked systems, finally damaging the industrial automation components .

What is the attack technique used by Stephen to damage the industrial systems?

Spear-phishing attack

SMishing attack

Reconnaissance attack

HMI-based attack

39. Gilbert, a web developer, uses a centralized web API to reduce complexity and increase the Integrity of updating and changing data. For this purpose, he uses a web service that uses HTTP methods such as PUT. POST. GET. and DELETE and can improve the overall performance, visibility, scalability, reliability, and portability of an application .

What is the type of web-service API mentioned in the above scenario?

JSON-RPC

SOAP API

RESTful API

REST API

40. These hackers have limited or no training and know how to use only basic techniques or tools.

What kind of hackers are we talking about?

Black-Hat Hackers A

Script Kiddies

White-Hat Hackers

Gray-Hat Hacker

Page 3 of 11

41. What is the least important information when you analyze a public IP address in a security alert?

DNS

Whois

Geolocation

ARP

42. What is the role of test automation in security testing?

It is an option but it tends to be very expensive.

It should be used exclusively. Manual testing is outdated because of low speed and possible test setup inconsistencies.

Test automation is not usable in security due to the complexity of the tests.

It can accelerate benchmark tests and repeat them with a consistent test setup. But it cannot replace manual testing completely.

43. Nicolas just found a vulnerability on a public-facing system that is considered a zero-day vulnerability. He sent an email to the owner of the public system describing the problem and how the owner can protect themselves from that vulnerability. He also sent an email to Microsoft informing them of the problem that their systems are exposed to .

What type of hacker is Nicolas?

Red hat

white hat

Black hat

Gray hat

44. Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN standards on a linux platform?

Kismet

Abel

Netstumbler

Nessus

45. A penetration tester is performing the footprinting process and is reviewing publicly available information about an organization by using the Google search engine.

Which of the following advanced operators would allow the pen tester to restrict the search to the organization’s web domain?

[allinurl:]

[location:]

[site:]

[link:]

46. If executives are found liable for not properly protecting their company’s assets and information systems, what type of law would apply in this situation?

Criminal

International

Common

Civil

47. Which tool can be used to silently copy files from USB devices?

USB Grabber

USB Snoopy

USB Sniffer

Use Dumper

48. During the enumeration phase. Lawrence performs banner grabbing to obtain information such as OS details and versions of services running. The service that he enumerated runs directly on TCP port 445.

Which of the following services is enumerated by Lawrence in this scenario?

Server Message Block (SMB)

Network File System (NFS)

Remote procedure call (RPC)

Telnet

49. You are attempting to crack LM Manager hashed from Windows 2000 SAM file. You will be using LM Brute force hacking tool for decryption .

What encryption algorithm will you be decrypting?

MD4

DES

SHA

SSL

50. When you are getting information about a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from the server. You can detect all these methods (GET, POST, HEAD, DELETE, PUT, TRACE) using NMAP script engine .

What Nmap script will help you with this task?

http-methods

http enum

http-headers

http-git

51. You have gained physical access to a Windows 2008 R2 server which has an accessible disc drive. When you attempt to boot the server and log in, you are unable to guess the password. In your toolkit, you have an Ubuntu 9.10 Linux LiveCD .

Which Linux-based tool can change any user’s password or activate disabled Windows accounts?

John the Ripper

SET

CHNTPW

Cain & Abel

52. This is an attack that takes advantage of a web site vulnerability in which the site displays content that includes un-sanitized user-provided data.

What is this attack?

Cross-site-scripting attack

SQL Injection

URL Traversal attack

Buffer Overflow attack

53. Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered. John decided to perform a TCP SYN ping scan on the target network .

Which of the following Nmap commands must John use to perform the TCP SVN ping scan?

nmap -sn -pp < target ip address >

nmap -sn -PO < target IP address >

Anmap -sn -PS < target IP address >

nmap -sn -PA < target IP address >

54. You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain, if the DNS server is at 192.168.10.2 and the domain name is abccorp.local, what command would you type at the nslookup prompt to attempt a zone transfer?

list server=192.168.10.2 type=all

is-d abccorp.local

Iserver 192.168.10.2-t all

List domain=Abccorp.local type=zone

55. Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp’s lobby. He checks his current SID, which is S-1-5-21-1223352397-1872883824-861252104-501 .

What needs to happen before Matthew has full administrator access?

He must perform privilege escalation.

He needs to disable antivirus protection.

He needs to gain physical access.

He already has admin privileges, as shown by the “501” at the end of the SI

56. An attacker redirects the victim to malicious websites by sending them a malicious link by email. The link appears authentic but redirects the victim to a malicious web page, which allows the attacker to steal the victim's data .

What type of attack is this?

Phishing

Vlishing

Spoofing

DDoS

57. Attacker Simon targeted the communication network of an organization and disabled the security controls of NetNTLMvl by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic. He then extracted all the non-network logon tokens from all the active processes to masquerade as a legitimate user to launch further attacks .

What is the type of attack performed by Simon?

Internal monologue attack

Combinator attack

Rainbow table attack

Dictionary attack

58. To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program.

What term is commonly used when referring to this type of testing?

Randomizing

Bounding

Mutating

Fuzzing

59. You have been authorized to perform a penetration test against a website. You want to use Google dorks to footprint the site but only want results that show file extensions .

What Google dork operator would you use?

filetype

ext

inurl

site

60. An Intrusion Detection System (IDS) has alerted the network administrator to a possibly malicious sequence of packets sent to a Web server in the network’s external DMZ. The packet traffic was captured by the IDS and saved to a PCAP file .

What type of network tool can be used to determine if these packets are genuinely malicious or simply a false positive?

Protocol analyzer

Network sniffer

Intrusion Prevention System (IPS)

Vulnerability scanner

Page 4 of 11

61. Which of the following describes the characteristics of a Boot Sector Virus?

Modifies directory table entries so that directory entries point to the virus code instead of the actual program.

Moves the MBR to another location on the RAM and copies itself to the original location of the MB

Moves the MBR to another location on the hard disk and copies itself to the original location of the MB

Overwrites the original MBR and only executes the new virus code.

62. How is the public key distributed in an orderly, controlled fashion so that the users can be sure of the sender’s identity?

Hash value

Private key

Digital signature

Digital certificate

63. As a securing consultant, what are some of the things you would recommend to a company to ensure DNS security?

Use the same machines for DNS and other applications

Harden DNS servers

Use split-horizon operation for DNS servers

Restrict Zone transfers

Have subnet diversity between DNS servers

64. What is the following command used for?

sqlmap.py-u ,,http://10.10.1.20/?p=1&forumaction=search" -dbs

Creating backdoors using SQL injection

A Enumerating the databases in the DBMS for the URL

Retrieving SQL statements being executed on the database

Searching database statements at the IP address given

65. A company’s security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating .

What sort of security breach is this policy attempting to mitigate?

Attempts by attackers to access the user and password information stored in the company’s SQL database.

Attempts by attackers to access Web sites that trust the Web browser user by stealing the user’s authentication credentials.

Attempts by attackers to access password stored on the user’s computer without the user’s knowledge.

Attempts by attackers to determine the user’s Web browser usage patterns, including when sites were visited and for how long.

66. The network in ABC company is using the network address 192.168.1.64 with mask 255.255.255.192. In the network the servers are in the addresses 192.168.1.122, 192.168.1.123 and 192.168.1.124. An attacker is trying to find those servers but he cannot see them in his scanning. The command he is using is: nmap 192.168.1.64/28.

Why he cannot see the servers?

He needs to add the command ““ip address”” just before the IP address

He needs to change the address to 192.168.1.0 with the same mask

He is scanning from 192.168.1.64 to 192.168.1.78 because of the mask /28 and the servers are not in that range

The network must be dawn and the nmap command and IP address are ok

67. Why is a penetration test considered to be more thorough than vulnerability scan?

Vulnerability scans only do host discovery and port scanning by default.

A penetration test actively exploits vulnerabilities in the targeted infrastructure, while a vulnerability scan does not typically involve active exploitation.

It is not C a penetration test is often performed by an automated tool, while a vulnerability scan requires active engagement.

The tools used by penetration testers tend to have much more comprehensive vulnerability databases.

68. You are a penetration tester tasked with testing the wireless network of your client Brakeme SA. You are attempting to break into the wireless network with the SSID "Brakeme-lnternal."

You realize that this network uses WPA3 encryption, which of the following vulnerabilities is the promising to exploit?

Dragonblood

Cross-site request forgery

Key reinstallation attack

AP Myconfiguration

69. Which of the following antennas is commonly used in communications for a frequency band of 10 MHz to VHF and UHF?

Yagi antenna

Dipole antenna

Parabolic grid antenna

Omnidirectional antenna

70. Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions.

Which of the following master components is explained in the above scenario?

Kube-controller-manager

Kube-scheduler

Kube-apiserver

Etcd cluster

71. George, an employee of an organization, is attempting to access restricted websites from an official computer. For this purpose, he used an anonymizer that masked his real IP address and ensured complete and continuous anonymity for all his online activities .

Which of the following anonymizers helps George hide his activities?

https://www.baidu.com

http://www.guardster.com

https://www.wolframalpha.com

http://karmadecay.com

72. Bob, a network administrator at BigUniversity, realized that some students are connecting their notebooks in the wired network to have Internet access. In the university campus,

there are many Ethernet ports available for professors and authorized visitors but not for students.

He identified this when the IDS alerted for malware activities in the network .

What should Bob do to avoid this problem?

Disable unused ports in the switches

Separate students in a different VLAN

Use the 802.1x protocol

Ask students to use the wireless network

73. In both pharming and phishing attacks, an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims.

What is the difference between pharming and phishing attacks?

In a pharming attack, a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DN

In a phishing attack, an attacker provides the victim with a URL that is either misspelled or looks similar to the actual websites domain name

In a phishing attack, a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DN

In a pharming attack, an attacker provides the victim with a URL that is either misspelled or looks very similar to the actual websites domain name

Both pharming and phishing attacks are purely technical and are not considered forms of social engineering

Both pharming and phishing attacks are identical

74. Ralph, a professional hacker, targeted Jane, who had recently bought new systems for her company. After a few days, Ralph contacted Jane while masquerading as a legitimate customer support executive, informing that her systems need to be serviced for proper functioning and that customer support will send a computer technician. Jane promptly replied positively. Ralph entered Jane's company using this opportunity and gathered sensitive information by scanning terminals for passwords, searching for important documents in desks, and rummaging bins .

What is the type of attack technique Ralph used on jane?

Dumpster diving

Eavesdropping

Shoulder surfing

impersonation

75. “........is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hot-spot by posing as a legitimate provider. This type of attack may be used to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up a fraudulent web site and luring people there.”

Fill in the blank with appropriate choice.

Evil Twin Attack

Sinkhole Attack

Collision Attack

Signal Jamming Attack

76. Jack, a disgruntled ex-employee of Incalsol Ltd., decided to inject fileless malware into Incalsol's systems. To deliver the malware, he used the current employees' email IDs to send fraudulent emails embedded with malicious links that seem to be legitimate. When a victim employee clicks on the link, they are directed to a fraudulent website that automatically loads Flash and triggers the exploit .

What is the technique used byjack to launch the fileless malware on the target systems?

In-memory exploits

Phishing

Legitimate applications

Script-based injection

77. An organization decided to harden its security against web-application and web-server attacks. John, a security personnel in the organization, employed a security scanner to automate web-application security testing and to guard the organization's web infrastructure against web-application threats. Using that tool, he also wants to detect XSS, directory transversal problems, fault injection, SQL injection, attempts to execute commands, and several other attacks .

Which of the following security scanners will help John perform the above task?

AlienVault®OSSIM™

ASyhunt Hybrid

Saleae Logic Analyzer

Cisco ASA

78. Given below are different steps involved in the vulnerability-management life cycle.

1) Remediation

2) Identify assets and create a baseline

3) Verification

4) Monitor

5) Vulnerability scan

6) Risk assessment

Identify the correct sequence of steps involved in vulnerability management.

2-->5-->6-->1-->3-->4

2-->1-->5-->6-->4-->3

2-->4-->5-->3-->6--> 1

1-->2-->3-->4-->5-->6

79. Which of the following tools can be used to perform a zone transfer?

NSLookup

Finger

Dig

Sam Spade

Host

Netcat

Neotrace

80. Which of the following LM hashes represent a password of less than 8 characters? (Choose two.)

BA810DBA98995F1817306D272A9441BB

44EFCE164AB921CQAAD3B435B51404EE

0182BD0BD4444BF836077A718CCDF409

CEC52EB9C8E3455DC2265B23734E0DAC

B757BF5C0D87772FAAD3B435B51404EE

E52CAC67419A9A224A3B108F3FA6CB6D

Page 5 of 11

81. What does the CoX flag do in an Nmap scan?

Perform an eXpress scan

Output the results in truncated format to the screen

Output the results in XML format to a file

Perform an Xmas scan

82. Richard, an attacker, targets an MNC In this process, he uses a footprinting technique to gather as much information as possible. Using this technique, he gathers domain information such as the target domain name, contact details of its owner, expiry date, and creation date. With this information, he creates a map of the organization's network and misleads domain owners with social engineering to obtain internal details of its network .

What type of footprinting technique is employed by Richard?

VPN footprinting

Email footprinting

VoIP footprinting

Whois footprinting

83. Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned.

Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?

“GET /restricted/goldtransfer?to=Rob&from=1 or 1=1’ HTTP/1.1Host: westbank.com”

“GET /restricted/r
%00account%00Ned%00access HTTP/1.1 Host: westbank.com”

“GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com”

“GET /restricted/ HTTP/1.1 Host: westbank.com

84. Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures .

Which tool can be used to perform session splicing attacks?

tcpsplice

Burp

Hydra

Whisker

85. You are logged in as a local admin on a Windows 7 system and you need to launch the Computer Management Console from command line.

Which command would you use?

c:compmgmt.msc

c:services.msc

c:
cpa.cp

c:gpedit

86. You are analysing traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs - 192.168.8.0/24 .

What command you would use?

wireshark --fetch ''192.168.8*''

wireshark --capture --local masked 192.168.8.0 ---range 24

tshark -net 192.255.255.255 mask 192.168.8.0

sudo tshark -f''net 192 .68.8.0/24''

87. Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to feed data and specifies the incorrect field in case of invalid credentials. Later, Calvin uses this information to perform social engineering.

Which of the following design flaws in the authentication mechanism is exploited by Calvin?

Insecure transmission of credentials

Verbose failure messages

User impersonation

Password reset mechanism

88. jane, an ethical hacker. Is testing a target organization's web server and website to identity security loopholes. In this process, she copied the entire website and its content on a local drive to view the complete profile of the site's directory structure, file structure, external links, images, web pages, and so on. This information helps jane map the website's directories and gain valuable information .

What is the attack technique employed by Jane in the above scenario?

website mirroring

Session hijacking

Web cache poisoning

Website defacement

89. The “Gray-box testing” methodology enforces what kind of restriction?

Only the external operation of a system is accessible to the tester.

The internal operation of a system in only partly accessible to the tester.

Only the internal operation of a system is known to the tester.

The internal operation of a system is completely known to the tester.

90. An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML code to embed a malicious applet in all HTTP connections.

When users accessed any page, the applet ran and exploited many machines .

Which one of the following tools the hacker probably used to inject HTML code?

Wireshark

Ettercap

Aircrack-ng

Tcpdump

91. Mr. Omkar performed tool-based vulnerability assessment and found two vulnerabilities.

During analysis, he found that these issues are not true vulnerabilities.

What will you call these issues?

False positives

True negatives

True positives

False negatives

92. Study the snort rule given below:

From the options below, choose the exploit against which this rule applies.

WebDav

SQL Slammer

MS Blaster

MyDoom

93. The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1(100%) .

What is the closest approximate cost of this replacement and recovery operation per year?

$1320

$440

$100

$146

94. Bill has been hired as a penetration tester and cyber security auditor for a major credit card company .

Which information security standard is most applicable to his role?

FISMA

HITECH

PCI-DSS

Sarbanes-OxleyAct

95. A new wireless client is configured to join a 802.11 network. This client uses the same hardware and software as many of the other clients on the network. The client can see the network, but cannot connect. A wireless packet sniffer shows that the Wireless Access Point (WAP) is not responding to the association requests being sent by the wireless client .

What is a possible source of this problem?

The WAP does not recognize the client’s MAC address

The client cannot see the SSID of the wireless network

Client is configured for the wrong channel

The wireless client is not configured to use DHCP

96. Tess King is using the nslookup command to craft queries to list all DNS information (such as Name Servers, host names, MX records, CNAME records, glue records (delegation for child Domains), zone serial number, TimeToLive (TTL) records, etc) for a Domain.

What do you think Tess King is trying to accomplish? Select the best answer.

A zone harvesting

A zone transfer

A zone update

A zone estimate

97. Scenario: Joe turns on his home computer to access personal online banking. When he enters the URL www.bank.com. the website is displayed, but it prompts him to re-enter his credentials as if he has never visited the site before. When he examines the website URL closer, he finds that the site is not secure and the web address appears different .

What type of attack he is experiencing?

Dos attack

DHCP spoofing

ARP cache poisoning

DNS hijacking

98. 16 (WiMax) 30 miles

802.16 (WiMax)

802.11g

802.11b

802.11a

99. Chandler works as a pen-tester in an IT-firm in New York. As a part of detecting viruses in the systems, he uses a detection method where the anti-virus executes the malicious codes on a virtual machine to simulate CPU and memory activities .

Which type of virus detection method did Chandler use in this context?

Heuristic Analysis

Code Emulation

Scanning

Integrity checking

100. Within the context of Computer Security, which of the following statements describes Social Engineering best?

Social Engineering is the act of publicly disclosing information

Social Engineering is the means put in place by human resource to perform time accounting

Social Engineering is the act of getting needed information from a person rather than breaking into a system

Social Engineering is a training program within sociology studies

Page 6 of 11

101. Clark, a professional hacker, was hired by an organization lo gather sensitive Information about its competitors surreptitiously. Clark gathers the server IP address of the target organization using Whole footprinting. Further, he entered the server IP address as an input to an online tool to retrieve information such as the network range of the target organization and to identify the network topology and operating system used in the network .

What is the online tool employed by Clark in the above scenario?

AOL

ARIN

DuckDuckGo

Baidu

102. Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weaknesses and key loggers.

Which of the following options best represents the means that Bob can adopt to retrieve passwords from his clients hosts and servers?

Hardware, Software, and Sniffing.

Hardware and Software Keyloggers.

Passwords are always best obtained using Hardware key loggers.

Software only, they are the most effective.

103. In order to tailor your tests during a web-application scan, you decide to determine which web-server version is hosting the application.

On using the sV flag with Nmap. you obtain the following response: 80/tcp open http-proxy Apache Server 7.1.6

What Information-gathering technique does this best describe?

WhOiS lookup

Banner grabbing

Dictionary attack

Brute forcing

104. Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to implant malicious backdoors in its firmware. He also identified that an installed backdoor can persist even if the server is reallocated to new clients or businesses that use it as an laaS.

What is the type of cloud attack that can be performed by exploiting the vulnerability discussed in the above scenario?

Man-in-the-cloud (MITC) attack

Cloud cryptojacking

Cloudborne attack

Metadata spoofing attack

105. CORRECT TEXT

Allen, a professional pen tester, was hired by xpertTech solutWns to perform an attack simulation on the organization's network resources. To perform the attack, he took advantage of the NetBIOS API and targeted the NetBIOS service. B/enumerating NetBIOS, he found that port 139 was open and could see the resources that could be accessed or viewed on a remote system. He came across many NetBIOS codes during enumeration.

identify the NetBIOS code used for obtaining the messenger service running for the logged-in user?

<1B>

<00>

<03>

<20>

106. what firewall evasion scanning technique make use of a zombie system that has low network activity as well as its fragment identification numbers?

Decoy scanning

Packet fragmentation scanning

Spoof source address scanning

Idle scanning

107. Which type of sniffing technique is generally referred as MiTM attack?

Password Sniffing

ARP Poisoning

Mac Flooding

DHCP Sniffing

108. Ben purchased a new smartphone and received some updates on it through the OTA method. He received two messages: one with a PIN from the network operator and another asking him to enter the PIN received from the operator. As soon as he entered the PIN, the smartphone started functioning in an abnormal manner .

What is the type of attack performed on Ben in the above scenario?

Advanced SMS phishing

Bypass SSL pinning

Phishing

Tap 'n ghost attack

109. DHCP snooping is a great solution to prevent rogue DHCP servers on your network .

Which security feature on switchers leverages the DHCP snooping database to help prevent man-in-the-middle attacks?

Spanning tree

Dynamic ARP Inspection (DAI)

Port security

Layer 2 Attack Prevention Protocol (LAPP)

110. Harry. a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers. Using these techniques, he successfully deployed malware on the target system to establish an outbound connection .

What is the APT lifecycle phase that Harry is currently executing?

Preparation

Cleanup

Persistence

initial intrusion

111. Which Nmap option would you use if you were not concerned about being detected and wanted to perform a very fast scan?

-T5

-O

-T0

-A

112. While browsing his Facebook teed, Matt sees a picture one of his friends posted with the caption. "Learn more about your friends!", as well as a number of personal questions. Matt is suspicious and texts his friend, who confirms that he did indeed post it. With assurance that the post is legitimate. Matt responds to the questions on the post, a few days later. Mates bank account has been accessed, and the password has been changed .

What most likely happened?

Matt inadvertently provided the answers to his security questions when responding to the post.

Matt's bank-account login information was brute forced.

Matt Inadvertently provided his password when responding to the post.

Matt's computer was infected with a keylogger.

113. An attacker can employ many methods to perform social engineering against unsuspecting employees, including scareware.

What is the best example of a scareware attack?

A pop-up appears to a user stating, "You have won a free cruise! Click here to claim your prize!"

A banner appears to a user stating, "Your account has been locked. Click here to reset your password and unlock your account."

A banner appears to a user stating, "Your Amazon order has been delayed. Click here to find out your new delivery date."

A pop-up appears to a user stating, "Your computer may have been infected with spyware. Click here to install an anti-spyware tool to resolve this issue."

114. Why containers are less secure that virtual machines?

Host OS on containers has a larger surface attack.

Containers may full fill disk space of the host.

A compromise container may cause a CPU starvation of the host.

Containers are attached to the same virtual network.

115. Which of the following tools performs comprehensive tests against web servers, including dangerous files and CGIs?

Nikto

John the Ripper

Dsniff

Snort

116. Which of the following commands checks for valid users on an SMTP server?

RCPT

CHK

VRFY

EXPN

117. Kevin, a professional hacker, wants to penetrate CyberTech Inc.’s network. He employed a technique, using which he encoded packets with Unicode characters. The company’s IDS cannot recognize the packet, but the target web server can decode them.

What is the technique used by Kevin to evade the IDS system?

Desynchronization

Obfuscating

Session splicing

Urgency flag

118. Josh has finished scanning a network and has discovered multiple vulnerable services. He knows that several of these usually have protections against external sources but are frequently susceptible to internal users. He decides to draft an email, spoof the sender as the internal IT team, and attach a malicious file disguised as a financial spreadsheet. Before Josh sends the email, he decides to investigate other methods of getting the file onto the system.

For this particular attempt, what was the last stage of the cyber kill chain that Josh performed?

Exploitation

Weaponization

Delivery

Reconnaissance

119. What is the proper response for a NULL scan if the port is closed?

SYN

ACK

FIN

PSH

RST

No response

120. Sam, a professional hacker. targeted an organization with intention of compromising AWS IAM credentials. He attempted to lure one of the employees of the organization by initiating fake calls while posing as a legitimate employee. Moreover, he sent phishing emails to steal the AWS 1AM credentials and further compromise the employee's account .

What is the technique used by Sam to compromise the AWS IAM credentials?

Social engineering

insider threat

Password reuse

Reverse engineering

Page 7 of 11

121. is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.

DNSSEC

Resource records

Resource transfer

Zone transfer

122. What is correct about digital signatures?

A digital signature cannot be moved from one signed document to another because it is the hash of the original document encrypted with the private key of the signing party.

Digital signatures may be used in different documents of the same type.

A digital signature cannot be moved from one signed document to another because it is a plain hash of the document content.

Digital signatures are issued once for each user and can be used everywhere until they expire.

123. Identify the UDP port that Network Time Protocol (NTP) uses as its primary means of communication?

113

123

161

124. Which type of security feature stops vehicles from crashing through the doors of a building?

Bollards

Receptionist

Mantrap

Turnstile

125. Alice, a professional hacker, targeted an organization's cloud services. She infiltrated the targets MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization .

Which of the following cloud attacks did Alice perform in the above scenario?

Cloud hopper attack

Cloud cryptojacking

Cloudborne attack

Man-in-the-cloud (MITC) attack

126. Which of the following types of SQL injection attacks extends the results returned by the original query, enabling attackers to run two or more statements if they have the same structure as the original one?

Error-based injection

Boolean-based blind SQL injection

Blind SQL injection

Allnion SQL injection

127. Which of the following tools is used to analyze the files produced by several packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

tcptrace

Nessus

OpenVAS

tcptraceroute

128. Ethical hacker jane Smith is attempting to perform an SQL injection attach. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs.

Which two SQL Injection types would give her the results she is looking for?

Out of band and boolean-based

Time-based and union-based

union-based and error-based

Time-based and boolean-based

129. What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?

The attacker queries a nameserver using the DNS resolver.

The attacker makes a request to the DNS resolver.

The attacker forges a reply from the DNS resolver.

The attacker uses TCP to poison the ONS resofver.

130. The following is an entry captured by a network IDS. You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor. You figure that the attacker is attempting a buffer overflow attack.

You also notice "/bin/sh" in the ASCII part of the output.

As an analyst what would you conclude about the attack?

The buffer overflow attack has been neutralized by the IDS

The attacker is creating a directory on the compromised machine

The attacker is attempting a buffer overflow attack and has succeeded

The attacker is attempting an exploit that launches a command-line shell

131. What hacking attack is challenge/response authentication used to prevent?

Replay attacks

Scanning attacks

Session hijacking attacks

Password cracking attacks

132. John wants to send Marie an email that includes sensitive information, and he does not trust the network that he is connected to. Marie gives him the idea of using PGP .

What should John do to communicate correctly using this type of encryption?

Use his own public key to encrypt the message.

Use Marie's public key to encrypt the message.

Use his own private key to encrypt the message.

Use Marie's private key to encrypt the message.

133. Which of the following steps for risk assessment methodology refers to vulnerability identification?

Determines if any flaws exist in systems, policies, or procedures

Assigns values to risk probabilities; Impact values.

Determines risk probability that vulnerability will be exploited (High. Medium, Low)

Identifies sources of harm to an IT system. (Natural, Human. Environmental)

134. Which system consists of a publicly available set of databases that contain domain name registration contact information?

WHOIS

CAPTCHA

IANA

IETF

135. You want to do an ICMP scan on a remote computer using hping2 .

What is the proper syntax?

hping2 host.domain.com

hping2 --set-ICMP host.domain.com

hping2 -i host.domain.com

hping2 -1 host.domain.com

136. Jake, a professional hacker, installed spyware on a target iPhone to spy on the target user's activities. He can take complete control of the target mobile device by jailbreaking the device remotely and record audio, capture screenshots, and monitor all phone calls and SMS messages .

What is the type of spyware that Jake used to infect the target device?

DroidSheep

Androrat

Zscaler

Trident

137. You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c

What is the hexadecimal value of NOP instruction?

0x60

0x80

0x70

0x90

138. How can you determine if an LM hash you extracted contains a password that is less than 8 characters long?

There is no way to tell because a hash cannot be reversed

The right most portion of the hash is always the same

The hash always starts with AB923D

The left most portion of the hash is always the same

A portion of the hash will be all 0's

139. You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist’s email, and you send her an email changing the source email to her boss’s email (boss@company). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your malicious links (these links contain malware) and send back the modified pdf, saying that the links don’t work. She reads your email, opens the links, and her machine gets infected. You now have access to the company network .

What testing method did you use?

Social engineering

Piggybacking

Tailgating

Eavesdropping

140. BitLocker encryption has been implemented for all the Windows-based computers in an organization. You are concerned that someone might lose their cryptographic key. Therefore, a mechanism was implemented to recover the keys from Active Directory .

What is this mechanism called in cryptography?

Key archival

Key escrow.

Certificate rollover

Key renewal

Page 8 of 11

141. Attempting an injection attack on a web server based on responses to True/False questions is called which of the following?

Compound SQLi

Blind SQLi

Classic SQLi

DMS-specific SQLi

142. Your company was hired by a small healthcare provider to perform a technical assessment on the network.

What is the best approach for discovering vulnerabilities on a Windows-based computer?

Use the built-in Windows Update tool

Use a scan tool like Nessus

Check MITR

org for the latest list of CVE findings

Create a disk image of a clean Windows installation

143. Which results will be returned with the following Google search query?

site:target.com C site: Marketing.target.com accounting

Results from matches on the site marketing.target.com that are in the domain target.com but do not include the word accounting.

Results matching all words in the query.

Results for matches on target.com and Marketing.target.com that include the word “accounting”

Results matching “accounting” in domain target.com but not on the site Marketing.target.com

144. Jack, a professional hacker, targets an organization and performs vulnerability scanning on the target web server to identify any possible weaknesses, vulnerabilities, and misconfigurations. In this process, Jack uses an automated tool that eases his work and performs vulnerability scanning to find hosts, services, and other vulnerabilities in the target server .

Which of the following tools is used by Jack to perform vulnerability scanning?

Infoga

WebCopier Pro

Netsparker

NCollector Studio

145. Joel, a professional hacker, targeted a company and identified the types of websites frequently visited by its employees. Using this information, he searched for possible loopholes in these websites and injected a malicious script that can redirect users from the web page and download malware onto a victim's machine. Joel waits for the victim to access the infected web application so as to compromise the victim's machine .

Which of the following techniques is used by Joel in the above scenario?

DNS rebinding attack

Clickjacking attack

MarioNet attack

Watering hole attack

146. John is investigating web-application firewall logs and observers that someone is attempting to inject the following:

char buff[10];

buff[>o] - 'a':

What type of attack is this?

CSRF

XSS

Buffer overflow

SQL injection

147. In an internal security audit, the white hat hacker gains control over a user account and attempts to acquire access to another account's confidential files and information .

How can he achieve this?

Privilege Escalation

Shoulder-Surfing

Hacking Active Directory

Port Scanning

148. Which is the first step followed by Vulnerability Scanners for scanning a network?

OS Detection

Firewall detection

TCP/UDP Port scanning

Checking if the remote host is alive

149. Which of these is capable of searching for and locating rogue access points?

HIDS

WISS

WIPS

NIDS

150. John, a security analyst working for an organization, found a critical vulnerability on the

organization's LAN that allows him to view financial and personal information about the rest of the employees. Before reporting the vulnerability, he examines the information shown by the vulnerability for two days without disclosing any information to third parties or other internal employees. He does so out of curiosity about the other employees and may take advantage of this information later .

What would John be considered as?

Acybercriminal

Black hat

White hat

Gray hat

151. During an Xmas scan what indicates a port is closed?

No return response

RST

ACK

SYN

152. You work for Acme Corporation as Sales Manager. The company has tight network security restrictions. You are trying to steal data from the company's Sales database (Sales.xls) and transfer them to your home computer. Your company filters and monitors traffic that leaves from the internal network to the Internet .

How will you achieve this without raising suspicion?

Encrypt the Sales.xls using PGP and e-mail it to your personal gmail account

Package the Sales.xls using Trojan wrappers and telnet them back your home computer

You can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent looking email or file transfer using Steganography techniques

Change the extension of Sales.xls to sales.txt and upload them as attachment to your hotmail account

153. Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers.

The time a hacker spends performing research to locate this information about a company is known as?

Exploration

Investigation

Reconnaissance

Enumeration

154. Which of the following tactics uses malicious code to redirect users' web traffic?

Spimming

Pharming

Phishing

Spear-phishing

155. What does the following command in netcat do?

nc -l -u -p55555 < /etc/passwd

logs the incoming connections to /etc/passwd file

loads the /etc/passwd file to the UDP port 55555

grabs the /etc/passwd file when connected to UDP port 55555

deletes the /etc/passwd file when connected to the UDP port 55555

156. This form of encryption algorithm is asymmetric key block cipher that is characterized by a 128-bit block size, and its key size can be up to 256 bits .

Which among the following is this encryption algorithm?

Twofish encryption algorithm

HMAC encryption algorithm

IDEA

Blowfish encryption algorithm

157. Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed.

What is the port scanning technique used by Sam to discover open ports?

Xmas scan

IDLE/IPID header scan

TCP Maimon scan

ACK flag probe scan

158. Mason, a professional hacker, targets an organization and spreads Emotet malware through malicious script. After infecting the victim's device. Mason further used Emotet to spread the infection across local networks and beyond to compromise as many machines as possible. In this process, he used a tool, which is a self-extracting RAR file, to retrieve information related to network resources such as writable share drives .

What is the tool employed by Mason in the above scenario?

NetPass.exe

Outlook scraper

WebBrowserPassView

Credential enumerator

159. An attacker utilizes a Wi-Fi Pineapple to run an access point with a legitimate-looking SSID for a nearby business in order to capture the wireless password .

What kind of attack is this?

MAC spoofing attack

Evil-twin attack

War driving attack

Phishing attack

160. Mike, a security engineer, was recently hired by BigFox Ltd. The company recently experienced disastrous DoS attacks. The management had instructed Mike to build defensive strategies for the company's IT infrastructure to thwart DoS/DDoS attacks. Mike deployed some countermeasures to handle jamming and scrambling attacks .

What is the countermeasure Mike applied to defend against jamming and scrambling attacks?

Allow the usage of functions such as gets and strcpy

Allow the transmission of all types of addressed packets at the ISP level

Implement cognitive radios in the physical layer

A Disable TCP SYN cookie protection

Page 9 of 11

161. Which type of malware spreads from one system to another or from one network to another and causes similar types of damage as viruses do to the infected system?

Rootkit

Trojan

A Worm

Adware

162. Louis, a professional hacker, had used specialized tools or search engines to encrypt all his browsing activity and navigate anonymously to obtain sensitive/hidden information about official government or federal databases. After gathering the Information, he successfully performed an attack on the target government organization without being traced .

Which of the following techniques is described in the above scenario?

Dark web footprinting

VoIP footpnnting

VPN footprinting

website footprinting

163. Fred is the network administrator for his company. Fred is testing an internal switch.

From an external IP address, Fred wants to try and trick this switch into thinking it already has established a session with his computer .

How can Fred accomplish this?

Fred can accomplish this by sending an IP packet with the RST/SIN bit and the source address of his computer.

He can send an IP packet with the SYN bit and the source address of his computer.

Fred can send an IP packet with the ACK bit set to zero and the source address of the switch.

Fred can send an IP packet to the switch with the ACK bit and the source address of his machine.

164. in this attack, an adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying cryptographic handshake messages. When the victim reinstall the key, associated parameters such as the incremental transmit packet number and receive packet number are reset to their initial values .

What is this attack called?

Chop chop attack

KRACK

Evil twin

Wardriving

165. What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?

Residual risk

Impact risk

Deferred risk

Inherent risk

166. CORRECT TEXT

A group of hackers were roaming around a bank office building in a city, driving a luxury car. They were using hacking tools on their laptop with the intention to find a free-access wireless network .

What is

this hacking process known as?

GPS mapping

Spectrum analysis

Wardriving Wireless sniffing

167. Attacker creates a transparent 'iframe' in front of the URL which victim attempts to click, so victim thinks that he/she clicks to the 'Do you want to make $1000 in a day?' URL but actually he/she clicks to the content or URL that exists in the transparent 'iframe' which is setup by the attacker.

What is the name of the attack which is mentioned in the scenario?

Session Fixation

HTML Injection

HTTP Parameter Pollution

Clickjacking Attack

168. On performing a risk assessment, you need to determine the potential impacts when some of the critical business processes of the company interrupt its service.

What is the name of the process by which you can determine those critical businesses?

Emergency Plan Response (EPR)

Business Impact Analysis (BIA)

Risk Mitigation

Disaster Recovery Planning (DRP)

169. A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a single server.

Based on this information, what should be one of your key recommendations to the bank?

Place a front-end web server in a demilitarized zone that only handles external web traffic

Require all employees to change their anti-virus program with a new one

Move the financial data to another server on the same IP subnet

Issue new certificates to the web servers from the root certificate authority

170. Which of the following DoS tools is used to attack target web applications by starvation of available sessions on the web server?

The tool keeps sessions at halt using never-ending POST transmissions and sending an arbitrarily large content-length header value.

My Doom

Astacheldraht

R-U-Dead-Yet?(RUDY)

LOIC

171. DNS cache snooping is a process of determining if the specified resource address is present in the DNS cache records. It may be useful during the examination of the network to determine what software update resources are used, thus discovering what software is installed.

What command is used to determine if the entry is present in DNS cache?

nslookup -fullrecursive update.antivirus.com

dnsnooping Crt update.antivirus.com

nslookup -norecursive update.antivirus.com

dns --snoop update.antivirus.com

172. What is the purpose of DNS AAAA record?

Authorization, Authentication and Auditing record

Address prefix record

Address database record

IPv6 address resolution record

173. Log monitoring tools performing behavioral analysis have alerted several suspicious logins on a Linux server occurring during non-business hours. After further examination of all login activities, it is noticed that none of the logins have occurred during typical work hours. A Linux administrator who is investigating this problem realizes the system time on the Linux server is wrong by more than twelve hours .

What protocol used on Linux servers to synchronize the time has stopped working?

Time Keeper

NTP

PPP

OSPP

174. What does a firewall check to prevent particular ports and applications from getting packets into an organization?

Transport layer port numbers and application layer headers

Presentation layer headers and the session layer port numbers

Network layer headers and the session layer port numbers

Application layer port numbers and the transport layer headers

175. An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events do not match up.

What is the most likely cause?

The network devices are not all synchronized.

Proper chain of custody was not observed while collecting the logs.

The attacker altered or erased events from the logs.

The security breach was a false positive.

176. To create a botnet. the attacker can use several techniques to scan vulnerable machines. The attacker first collects Information about a large number of vulnerable machines to create a list. Subsequently, they infect the machines. The list Is divided by assigning half of the list to the newly compromised machines. The scanning process runs simultaneously. This technique ensures the spreading and installation of malicious code in little time.

Which technique is discussed here?

Hit-list-scanning technique

Topological scanning technique

Subnet scanning technique

Permutation scanning technique

177. Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this cached record, he determines the sites recently visited by the organization's user .

What is the enumeration technique used by Henry on the organization?

DNS zone walking

DNS cache snooping

DNS SEC zone walking

DNS cache poisoning

178. Alice needs to send a confidential document to her coworker. Bryan. Their company has public key infrastructure set up. Therefore. Alice both encrypts the message and digitally signs it. Alice uses_______to encrypt the message, and Bryan uses__________to confirm the digital signature.

Bryan’s public key; Bryan’s public key

Alice’s public key; Alice’s public key

Bryan’s private key; Alice’s public key

Bryan’s public key; Alice’s public key

179. You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine .

What Wireshark filter will show the connections from the snort machine to kiwi syslog machine?

tcp.srcport= = 514 && ip.src= = 192.168.0.99

tcp.srcport= = 514 && ip.src= = 192.168.150

tcp.dstport= = 514 && ip.dst= = 192.168.0.99

tcp.dstport= = 514 && ip.dst= = 192.168.0.150

180. Which regulation defines security and privacy controls for Federal information systems and organizations?

HIPAA

EU Safe Harbor

PCI-DSS

NIST-800-53

Page 10 of 11

181. Which of the following is the least-likely physical characteristic to be used in biometric control that supports a large company?

Iris patterns

Voice

Height and Weight

Fingerprints

182. Tony is a penetration tester tasked with performing a penetration test. After gaining initial access to a target system, he finds a list of hashed passwords.

Which of the following tools would not be useful for cracking the hashed passwords?

John the Ripper

Hashcat

netcat

THC-Hydra

183. In Trojan terminology, what is a covert channel?

A channel that transfers information within a computer system or network in a way that violates the security policy

A legitimate communication path within a computer system or network for transfer of data

It is a kernel operation that hides boot processes and services to mask detection

It is Reverse tunneling technique that uses HTTPS protocol instead of HTTP protocol to establish connections

184. Bob received this text message on his mobile phone: “Hello, this is Scott Smelby from the Yahoo Bank. Kindly contact me for a vital transaction on: [email protected]” .

Which statement below is true?

This is a scam as everybody can get a @yahoo address, not the Yahoo customer service employees.

This is a scam because Bob does not know Scott.

Bob should write to [email protected] to verify the identity of Scott.

This is probably a legitimate message as it comes from a respectable organization.

185. Which protocol is used for setting up secure channels between two devices, typically in

VPNs?

PEM

ppp

IPSEC

SET

186. An organization has automated the operation of critical infrastructure from a remote location. For this purpose, all the industrial control systems are connected to the Internet. To empower the manufacturing process, ensure the reliability of industrial networks, and reduce downtime and service disruption, the organization deckled to install an OT security tool that further protects against security incidents such as cyber espionage, zero-day attacks, and malware .

Which of the following tools must the organization employ to protect its critical infrastructure?

Robotium

BalenaCloud

Flowmon

IntentFuzzer

187. An Internet Service Provider (ISP) has a need to authenticate users connecting via analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Frame Relay network.

Which AAA protocol is the most likely able to handle this requirement?

TACACS+

DIAMETER

Kerberos

RADIUS

188. Which of the following is the structure designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?

SOA

biometrics

single sign on

PKI

189. Although FTP traffic is not encrypted by default, which layer 3 protocol would allow for end-to-end encryption of the connection?

SFTP

Ipsec

SSL

FTPS

190. An attacker changes the profile information of a particular user (victim) on the target website. The attacker uses this string to update the victim’s profile to a text file and then submit the data to the attacker’s database.

< iframe src=““http://www.vulnweb.com/updateif.php”” style=““display:none””</iframe> >

What is this type of attack (that can use either HTTP GET or HTTP POST) called?

Browser Hacking

Cross-Site Scripting

SQL Injection

Cross-Site Request Forgery

191. Samuel, a professional hacker, monitored and Intercepted already established traffic between Bob and a host machine to predict Bob's ISN. Using this ISN, Samuel sent spoofed packets with Bob's IP address to the host machine. The host machine responded with <| packet having an Incremented ISN. Consequently. Bob's connection got hung, and Samuel was able to communicate with the host machine on behalf of Bob .

What is the type of attack performed by Samuel in the above scenario?

UDP hijacking

Blind hijacking

TCP/IP hacking

Forbidden attack

192. In the context of Windows Security, what is a 'null' user?

A user that has no skills

An account that has been suspended by the admin

A pseudo account that has no username and password

A pseudo account that was created for security administration purpose

193. This TCP flag instructs the sending system to transmit all buffered data immediately.

SYN

RST

PSH

URG

FIN

194. When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK.

How would an attacker exploit this design by launching TCP SYN attack?

Attacker generates TCP SYN packets with random destination addresses towards a victim host

Attacker floods TCP SYN packets with random source addresses towards a victim host

Attacker generates TCP ACK packets with random source addresses towards a victim host

Attacker generates TCP RST packets with random source addresses towards a victim host

195. Elante company has recently hired James as a penetration tester. He was tasked with performing enumeration on an organization's network. In the process of enumeration, James discovered a service that is accessible to external sources. This service runs directly on port 21 .

What is the service enumerated byjames in the above scenario?

Border Gateway Protocol (BGP)

File Transfer Protocol (FTP)

Network File System (NFS)

Remote procedure call (RPC)

196. When you are testing a web application, it is very useful to employ a proxy tool to save every request and response. You can manually test every request and analyze the response to find vulnerabilities. You can test parameter and headers manually to get more precise results than if using web vulnerability scanners.

What proxy tool will help you find web vulnerabilities?

Maskgen

Dimitry

Burpsuite

Proxychains

197. in an attempt to increase the security of your network, you Implement a solution that will help keep your wireless network undiscoverable and accessible only to those that know It .

How do you accomplish this?

Delete the wireless network

Remove all passwords

Lock all users

Disable SSID broadcasting

198. Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack of a built-in bounds checking mechanism?

Code:

#include <string.h> int main(){char buffer[8];

strcpy(buffer, ““11111111111111111111111111111””);} Output: Segmentation fault

Python

Java

C++

199. Which of the following algorithms can be used to guarantee the integrity of messages being sent, in transit, or stored?

symmetric algorithms

asymmetric algorithms

hashing algorithms

integrity algorithms

200. Which among the following is the best example of the hacking concept called "clearing tracks"?

After a system is breached, a hacker creates a backdoor to allow re-entry into a system.

During a cyberattack, a hacker injects a rootkit into a server.

An attacker gains access to a server through an exploitable vulnerability.

During a cyberattack, a hacker corrupts the event logs on all machines.

Page 11 of 11

201. Peter is surfing the internet looking for information about DX Company .

Which hacking process is Peter doing?

Scanning

Footprinting

Enumeration

System Hacking

202. When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator’s Computer to update the router configuration .

What type of an alert is this?

False negative

True negative

True positive

False positive

203. Study the following log extract and identify the attack.

Hexcode Attack

Cross Site Scripting

Multiple Domain Traversal Attack

Unicode Directory Traversal Attack

204. An attacker identified that a user and an access point are both compatible with WPA2 and WPA3 encryption. The attacker installed a rogue access point with only WPA2 compatibility in the vicinity and forced the victim to go through the WPA2 four-way handshake to get connected. After the connection was established, the attacker used automated tools to crack WPA2-encrypted messages .

What is the attack performed in the above scenario?

Timing-based attack

Side-channel attack

Downgrade security attack

Cache-based attack

205. If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?

Birthday

Brute force

Man-in-the-middle

Smurf

206. What is the proper response for a NULL scan if the port is open?

SYN

ACK

FIN

PSH

RST

No response

207. Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches.

If these switches' ARP cache is successfully flooded, what will be the result?

The switches will drop into hub mode if the ARP cache is successfully flooded.

If the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to attacks.

Depending on the switch manufacturer, the device will either delete every entry in its ARP cache or reroute packets to the nearest switch.

The switches will route all traffic to the broadcast address created collisions.

208. What did the following commands determine?

That the Joe account has a SID of 500

These commands demonstrate that the guest account has NOT been disabled

These commands demonstrate that the guest account has been disabled

That the true administrator is Joe

Issued alone, these commands prove nothing

312-50v11 Certified Ethical Hacker Exam – C|EH v11 Free Updated Questions

312-50v11 Certified Ethical Hacker Exam – C|EH v11 Free Updated Questions

Share this post

Leave a Reply Cancel reply

Related Posts