Question 1

Mike is trying to recover his password from a site. It asks for his email address. Just then, his cat walks across the keyboard and enters an extra character. He ends up entering into the form mike.portnoy@silverlinings.com' and the return page shows an error was returned from the server.
What is the cause of this on the webserver?
A) User input is not sanitized
B) The email address is not valid
C) The Databse server on the backend of the site is down
D) The ISP is traffic shaping again and made a mistake

Accepted Answer

It is easy to miss the tick character that trails the email address. It is not a speck on your monitor or a typo. Look carefully for it. This character is often used to test for the possibility of SQL injection vulnerabilities.

Question 2

You see an email in your box that looks suspicious. It has typos and seems to be preying on a current event that is volitile and has a large audience of passionate people that want to believe its message. Classic social engineering spam. It reads:
…
Stop them from setting up death panels!!!! Only when the government interfeeres does things go terribly wrong. Sign our petition to put an end to this madness and recover your constitutional rights! While you are there, join in the fight by purchasing a t-shirt for ony $29.95. With the slogan, Government is the only disease I have !! Wear it at the next town hall meeting to let them know you are paying attention. http://0x7F2D52DB/stophealthcare.ee
(The address is encrypted to protect your indentity. They are collecting enemy lists we are making sure
You are safe)
…
What is the real IP address of this site?
A) 127.45.83.218
B) 127.45.82.219
C) 127.44.83.219
D) 127.44.83.218

Accepted Answer

Open a command window and ping it. Before the exam however, make sure you can do hex, octal, decimal, and binary conversions.

Question 3

You have a website that is not meant for everyone, only a particular audience. You do not want certain directories to be crawled by a spider. How can you limit (in theory at least) what search engines will index?
A) .htaccess file
B) robots.txt file
C) set permissions on the directories to deny spiders read access
D) Require a login page

Accepted Answer

Robots.txt file in placed at the root directory of the website. The .htaccess file is used in apacher webservers as an authentication feature and was at one time placed in the root directory but is no longer with newer versions. Login pages sometimes protect "The dark net" but search enignes might still be able to reach the files. EC-Coincil states that robots.txt will work, but in the real world keep in mind that compliance is up to the developer of the spider.

Question 4

Janet wants a no cost solution to blocking certain applications from lauching pop-up windows while she is surfing the web. She had tried everything her old Windows XP computer can run. Alternative browsers, freeware spyware scanner, nothing helps.
A) She needs to understand that these pop ups are pat of using the internet and that it is impolaite to block them because the sites she is visiting for free depend on them for revenue.
B) SP2 upgrade with the windows firewall enabled
C) She needs to use Linux instead
D) She needs to modify the hosts file daily to point all addresses that generate the pop-ups to 0.0.0.0 to keep them from resolving.

Accepted Answer

Her pop ups may not be related to browsing at all. They could also be Windows Messenger spam. The firewall will block them.

Question 5

You notice the following in your log files. What attack is being attempted?
GET /scripts/root.exe?/c+dir
GET /MSADC/root.exe?/c+dir
GET /c/winnt/system32/cmd.exe?/c+dir
GET /d/winnt/system32/cmd.exe?/c+dir
GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
GET/msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir
GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir
GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir
A) XSS
B) directory traversal
C) showcode.asp
D) Nimda

Accepted Answer

Look at line 2. If you see MSADC think Nimda. If you see it with showcode.asp, that is a vulnerability that allows attacker to view source code on the server. Directory traversal is happening also, but nimda is a better answer in this case.

Question 6

Jacob finds the following packet dump in his log file
05/20-17.06.45.061034 192.160.13.4.3465 -> 172.16.1.101:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seq. 0XA1D954BD Ack. 0x0 Win. 0x400
05/20-17.06.58.685879 192.160.13.4.3466 -> 172.16.1.102:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seg. 0XB7C5627D Ack. 0x0 Win. 0x400
What is likely happening?
A) ACK Scan to port 80
B) Snort alerts noticing strange events
C) Sequence numbers are random, indicating custom packets
D) TTL of 44 is too low, this is a firewalk scan

Accepted Answer

The ACK bit is set, the destination host address is changing and the traffic is aimed for port 80. This is a simple ACK scan looking for live hosts on this segment.

Question 7

What does the following IPTables commands accomplish?
Iptables -A FORWARD -j ACCEPT -p UDP --dport 53
Iptables -A FORWARD -j ACCEPT -p TCP --dport 80
A) Allow web requests to be routed
B) Accept only packet that are destined for port 53 and port 80
C) Append the FORWARD table with a jump (-j) rule that send this traffic to the IDS
D) Nothing, since -p is the option for port number and that is not how these commands were written

Accepted Answer

This is of course a very incomplete set of rules. On the CEH exam it is important to remember not to debug, it is a test, not a specification manual. Do not complicate your thoughts with material that is not even present in the question. In this case, even not knowing some of the command options, the answer can be guessed effectively.

Question 8

You wish to capture a set of data for about 10 minutes from a host that you only have command line access to. You use TCPDump for the capture, but find it is hard to work with. You aren't so much interested in the data within the packets but statistics about how much data and of what type is being sent.
Which of the following tools can be used along with your sniffer to collect this data?
A) IDS Wakeup
B) TCP Slice
C) Win Dump
D) WinpCap

Accepted Answer

Reviewing from the sniffer chapter, know the command line tools that work well in Linux for sniffing and analysis as this activity often goes and in hand with tuning IDS and Firewall products. IDSWakeup and NIDSBench are two tools you should know about for testing IDS as well as hand crafted packets with HPing.

Question 9

What is the most accurate statement below regarding the following snort rule:
Alert tcp any any -> any 111 (content:"|00 01 86 A5|"; \ msg: "mountd access";)
A) An alert is generated when a packet originates from anywhere and destined for any IP and port 111
B) An alert is generated when a packet orginates from port 111 and destined for any IP and port
C) An alert is generated when the string 00 01 6 A5 is seen in the payload
D) An alert is generated when the command mountd access is seen in a packet that is destined for port
111

Accepted Answer

Practice any command line tool or rule by converting it into plain natural language. "I would like snort to alert me whenever tcp based traffic coming from anywhere going to any hosts port 111 contains the hex values 00 01 86 A5, and label it in the log as "Mountd Access""

Question 10

Using Hping, you wish to enumerate the rules of a firewall. You direct the traffic to a confirmed host and set the TTL value to one hop past the firewall, also incrementing the destination port by one with each packet. Return ICMP type 11 messages will tell you want the firewall allowed to pass.
What is this technique called?
A) Firewall footprinting
B) Firewalking
C) Firewall enumeration
D) Bounce scanning

Accepted Answer

The tool "firewalk" can also be used for this purpose. Hping and nmap are both capable of it as well. For other questions, remember that if nothing is returned at all, the firewall is blocking the return ICMP messages.

Question 11

During a traceroute, you notice that the last two hops reveal the same IP address. What is a possible explanation?
A) Application proxy is in use
B) A stateful inspection firewall
C) A load balancer or cluster
D) A honeypot is returning deliberately confusing results

Accepted Answer

There are other hosts behind the one address, but their configuration is hidden or obscured. Read the following  http://www.exit109.com/~jeremy/news/providers/traceroute.html

Question 12

Curtis works for a small company. His boss isn't too interested in security issues as he isn't certain the risk is high enough. Still, Curtis wants to implement something that can collect data about just how often they are attacked, and from this, perhaps create a business case for why security must be taken seriously. He needs to know even when a simple scan is taking place.
That tool can he use?
A) GFI Guard
B) NMap
C) Genius
D) Snort

Accepted Answer

Genius was a multi-purpose tool, and the other tools are used for assessments and footprinting. Snort is also available in a pre- built virtual machine which includes additional software such as ACID and Barnyard for graphical reporting. Look for "NST Virtual Appliance"

Question 13

Steve is suspicious that someone in his company is attempting to access folders that are unrelated to their job or projects. His first step is to create groups and solidify permissions to prevent this sort of access. He then creates a folder project called "New Netbook OS Project - Do Not Leak to Media" and places fictitious documents inside of it. He then monitors the gadget sites for information and when he sees something, checks what employee accessed that file.
What has Steve done?
A) Created a "Honeypot"
B) Setup a network "Tar Pit"
C) Configured a "Black Hole Trap"
D) Created a "Honey Token"

Accepted Answer

A honey token is when bogus information is placed in a system that should never be accessed is then monitored. A honey pot does not target a specific problem like information leakage. It is meant to watch, but the researcher does not know what will happen.

Question 14

Which of the following tools can be used to collect webpages for offline browsing?
A) url snarf
B) mget
C) wget
D) black spider

Accepted Answer

WGet is a great tool for downloading multiple documents from a website. Many sites will blacklist an IP if wget is detected.

Question 15

NIDS operate at layer 2. Raw traffic is observed by the hardware and the packets are provided to analysys software. It can be possible to confuse the detection engine of the NIDS by modifying the packets in stream. Which of the following tools accomplishes this?
A) Fragroute
B) tcpfrag
C) rcpdump
D) fragtraf

Accepted Answer

Be careful of the real exam with the tool names, frageroute captures packets and allows them to be modified and replayed. Fragrouter, causes packets to be excessively fragmented, which is also an IDS evasion technique.

Question 16

When evaluating possible NIDS, you are concerned that an attacker might detect the present of
Your monitoring agent. Which if the following techniques can be used to hide the NIDS? (Choose two)
A) NIDS will not respond to scans by default, detection is not possible
B) Set the IP address of the tap to be the same as the gateway
C) Have two NICS, and make sure the tap is not bound to the IP stack
D) Use a receive only cable on the tap

Accepted Answer

A receive only cable prevents the NIC from responding in any way to a scan. The next best thing is to make sure that no protocol stacks are bound to the interface.

Question 17

Jeremy knows that the network has been breached and several important files have been modified. After analyzing the access and firewall logs, he can't come to any sort of conclusion about exactly what happened. In the future, he wants to make sure he can detect when certain files change, then maybe use honey tokens to catch the intruders.
Of the following will accomplish this task?
A) Kismet
B) Strataguard
C) Snortsam
D) Tripwire

Accepted Answer

Tripware keeps a database of hashes for critical system files. Kismet is a wireless analysis tool and the others are IPS (Intrusion Prevention System) products that can make changes to access points on the fly.

Question 18

ARP spoofing can be used to perform "Man in the Middle" attacks and should be monitored against. Which of the following techniques can be used to defend against this?
A) Use Arpwall to block ARP spoofing attacks
B) VLANs
C) Static ARP configurations
D) Detection of large amounts of ARP traffic

Accepted Answer

An ARP poisoning attack only works on a single VLAN; the members of it are vulnerable. The other techniques are all valid monitoring or prevention tools.

Question 19

Which of the following snort rules looks for FTP login attempts?
A) Alert tcp any any -> any any 21 (content:"user root"; msg:"FTP Login attempt";)
B) Alert ftp -> any port 21 (content:"user login";)
C) -A INPUT -j LOG -dport 21 -p TCP
D) Tcp.port == 21 && host eq any

Accepted Answer

The syntax of snort rules, ipchains acls, wireshark display filters, and tcpdump capture filters are all covered on the exam. You do not have to memorize the full languages, just become comfortable with what they look like.

Question 20

Marco is noticing several xmas scans on his network. What can he use to prevent this?
A) Implement an IDS to block this flag combination
B) Use port sentry to detect and block port scans
C) Use an IPS to react to the scan by blocking traffic from that source address
D) xmas scans are an outdated technique that won't work anyway. He shouldn't worry about it

Accepted Answer

An IPS (Instrusion Prevention System), is capable of sensing attacks and then reacting to them by making changes to firewall rules on the fly. A network IDS is passive and does not prevent anything, it only detects.

Quiz 5: Networks and Services

You have a website that is not meant for everyone, only a particular audience. You do not want certain directories to be crawled by a spider. How can you limit (in theory at least) what search engines will index?

Janet wants a no cost solution to blocking certain applications from lauching pop-up windows while she is surfing the web. She had tried everything her old Windows XP computer can run. Alternative browsers, freeware spyware scanner, nothing helps.

What does the following IPTables commands accomplish? Iptables -A FORWARD -j ACCEPT -p UDP --dport 53 Iptables -A FORWARD -j ACCEPT -p TCP --dport 80

What is the most accurate statement below regarding the following snort rule: Alert tcp any any -> any 111 (content:"|00 01 86 A5|"; \ msg: "mountd access";)

During a traceroute, you notice that the last two hops reveal the same IP address. What is a possible explanation?

Which of the following tools can be used to collect webpages for offline browsing?

NIDS operate at layer 2. Raw traffic is observed by the hardware and the packets are provided to analysys software. It can be possible to confuse the detection engine of the NIDS by modifying the packets in stream. Which of the following tools accomplishes this?

When evaluating possible NIDS, you are concerned that an attacker might detect the present of Your monitoring agent. Which if the following techniques can be used to hide the NIDS? (Choose two)

ARP spoofing can be used to perform "Man in the Middle" attacks and should be monitored against. Which of the following techniques can be used to defend against this?

Which of the following snort rules looks for FTP login attempts?

Marco is noticing several xmas scans on his network. What can he use to prevent this?