Question 1

In addition to the TTL field, which of the following can be analyzed during OS fingerprinting to identify the target OS? (Choose 5)
A) The setting of the DF bit
B) Window size
C) IPID incrementing
D) ToS bits
E) Initial NACK field 
F) Datagram size

Accepted Answer

All of these are used in active stack OS fingerprinting except for the initial NACK field, which doesn't exist.

Question 2

Which of the following is not one of the states of a port?
A) Half-open
B) Listening
C) Filtered
D) Established

Accepted Answer

The states of a port are: Listening, half-open, established, closed

Question 3

Frank's boss wants to start performing vulnerability scans and a golf partner recommended SAINT. He sets up a Windows machine and asks Frank to get started but immediately Frank runs into a problem.
What is wrong?
A) SAINT only runs on UNIX
B) Frank's boss needed SATAN, he bought the wrong product
C) SAINT only scans wireless networks
D) Vulnerability scans only tell the attackers where the weaknesses are

Accepted Answer

SAINT runs on UNIX, but there are many other vulnerability assessment tools to choose from. Visit http://sectools.org/vuln-scanners.html and be familiar with these tools for the CEH exam.

Question 4

Bart is running an nmap vanilla scan and believes the results are inaccurate. He decides that slowing down his scan might increase the accuracy, believing that latency or congestion is causing some dropped responses.
Which of the following choices will help Bart get the job done?
A) nmap -sT -v -T5 [Target IP]
B) nmap -sT -v -T0 [Target IP]
C) nmap -sV -v -T0 [Target IP]
D) nmap -sT -v --slow [Target IP]

Accepted Answer

The timing option for NMap scans has a range of 0-5, with 5 being the fastest. A vanilla scan is another name for a TCP Connect scan, which is the -sT option.

Question 5

Sean is trying to scan a network using the evasion technique of fragmenting his traffic with the -f option in NMap. What is the MTU (Maximum Transfer Unit) for an Ethernet network?
A) Depends on the speed of the link
B) 53
C) 65535
D) 1500

Accepted Answer

An IP packet should be neither smaller than 64 Bytes nor larger than 65535 Bytes. But the packet must be placed into a frame at Layer 2 before it can be placed on the link. Ethernet specifies a maximum size of 1500 for the framed packet, allowing up to 22 bytes for the frame header. (18 is typical, but 22 could happen if the frame has a VLan tag.)

Question 6

Which example is the correct syntax for establishing a null session?
A) net use \IPC$\[target ip] "" / user : ""
B) net use \[target ip]\IPC$ "" / user : ""
C) net use \[target ip]\IPC$ '' / user : ''
D) net use \[target ip]\NULL$ "" / user : ""

Accepted Answer

In general, do not debug the scripts or command syntax on the exam. Look for what statement makes the point logically in terms of what the question is really asking. However, in the case of NULL sessions, do practice this and make it work.

Question 7

What of the following lists of tools are used in a Linux system to gather information locally about what is running?
A) netstat, pstools, nbtstat, procmon
B) top, netstat, lsof, ps
C) ps, top, nbstat, net use
D) rpcinfo, ldap, nbstat, ps

Accepted Answer

Some of the tools listed in the choices are found in Windows or are not considered native tools. A default installation of Linux will include those listed in the correct answer by default.

Question 8

Which of the following Linux permissions will allow the owner to have full access, the members of the group to have Read and Write access, and the world to have only Read access?
A) chmod 764 foo.sh
B) chmod 664 foo.sh
C) cacls u+rwx g+rx o+r
D) calcs ./foo.sh /G owner:RWX /G group:rx /G world:R

Accepted Answer

Linux uses a simple octal system to denote file permissions. There are three digits representing Owner (user), Group, and Others (world). Each binary position of the octal number represents rwx
respectively. Octal 764 is 111110100 in binary, split the digits into three sets and you have rwxrw_r__. The tool "calcs.exe" shows up in other questions, but in reference to NTFS (Windows) volumes be sure to look it up.

Question 9

Which of the following represents an OID?
A) S-1-5-7-341656734543-512
B) S-1-5-7-545632867586-1001
C) AD3424FDA31404EE
D) 1.2.1.1.1.2.1.3.1.4.6

Accepted Answer

Be prepared to recognize elements in packet dumps and logs file entries.

Question 10

What are LSASS and GINA?
A) On a Linux system they are responsible for logins, much like PAM is for Windows
B) On a Windows system they manage SIDs and user account databases
C) On a Linux system they govern access to TCP based services along with Inetd and TCPWrappers
D) On a Windows host they comprise part of the authentication subsystem

Accepted Answer

LSASS (Local Security Authority Subsystem Service) is a process that enforces security policy and GINA (Graphical Identification and Authentication library) is part of the Windows authentication subsystem. The sasser worm attacks LSASS in unpatched systems.

Question 11

You are poking around in a Linux box and run the ls -l command and notice a curious entry:
_rwsr_xr_x 1 root users 381 2009-02-29 6:32 yes Which of the following statements is true? (Choose two)
A) The octal equivalent is of these permissions is 755 + SUID
B) The answer to the command was "yes" and the file requested does exist
C) The octal equivalent is of these permissions is 4755
D) The SGID bit is set and the file "yes" is executable with the root UID

Accepted Answer

Being able to do binary, octal, and hex numbers is a pre-requisite for the CEH. Understanding how Linux permissions work is also critical. The "4" in this case is in binary 100, which will set the UID bit for the User.

Question 12

Shalicia wants to find all of the currently open connections on a Windows host; which command would provide this information?
A) netstats -an
B) netstat /an
C) nbtstat -an
D) nmap -sT -P0 -v [target ip]

Accepted Answer

For this exam it is important not only to now the tools and a few of their switches, but it is also important to know some of the quirks involved between the Windows and Linux command shells. In Windows, a forward slash "/" is a way to express an option, but in Linux a hyphen is used. Many tools in Windows will accept a hyphen also so don't be surprised if you see it. In Linux the forward slash is a directory path character. Also, only netstat would work for this objective anyway.

Question 13

Edward is trying to locate the computers on a network by their computer names. What command line tool can he use? (Choose two)
A) Windows doesn't have a scanner that will help with discovery
B) He needs to install a tool first
C) He could use "net view" with no arguments
D) He could use the nbstat tool with the -r or -c or -n options to at least see names of machines he might have discovered via natural protocol behaviors

Accepted Answer

Try them out, but this might not reveal the most information possible. Get creative with the options.

Question 14

Kevaun wants to find file shares on a remote system. Which of the following commands would provide this information?
A) netstat /an
B) nbtstat -A
C) net view \[servername]
D) nbstat -shares [target ip]

Accepted Answer

Try it out on a Windows host.

Question 15

Chris is using a Linux box and is also attempting to enumerate the network for computer names and shares. What command below would he run?
A) smbclient -L [target ip]
B) nbtstat -L [target ip]
C) net view \[domain]
D) Linux doesn't support Windows file sharing, so Chris is wasting his time

Accepted Answer

Smbclient is the command line tool for Samba.

Question 16

From his Linux host, Kempton wants to connect to an unprotected share he has discovered. What should he do next (assuming he has a credential)?
A) smbclient \\[target ip]\c$ -U administrator
B) nbtstat \[target ip]\c$ -u administrator
C) net view \\[target ip]\ipc$ "" user : ""
D) Kempton cannot have a credential yet. He needs to read the system hacking chapter in the CEH courseware and try some of those techniques first.

Accepted Answer

Assuming the credentials, this command will mount the root of the system drive and allow access. If Kempton does not yet have the credentials he needs to get them he will need to try some of what is in the modules that follow.

Question 17

Joe extracts a SID using the tool "SIDExtracter." Which of the following SIDs has administrator privileges?
S-1-5-21-1147638176-875867241-945 Fred
S-1-5-21-1147638176-875867241-134 Paul
S-1-5-21-1147638176-875867241-777 Steve
S-1-5-21-1147638176-875867241-500 Liz
A) Fred
B) Paul
C) Steve
D) Liz

Accepted Answer

The RID for Liz is "500" Local administrator.

Question 18

What is a "NULL" user in the context of the Windows operating system?
A) An account with no user name or password
B) A user that has been disabled
C) The system user of the "NULL" service
D) An internal "loopback" user

Accepted Answer

The NULL user logs in to access the IPC$ share on Windows hosts for file sharing protocols.

Question 19

Sara has been asked to perform a port scan on a number of servers to check for access points that should not be running but would have elevated privileges. She is not familiar with port numbers and isn't sure how to scan only those that we know meet the scanning criteria. What advice would you give her?
A) She should scan 1-1023
B) She should scan 0-63535 just to be sure
C) She should scan 1-49151
D) She should consult the network documentation and avoid the scan altogether.

Accepted Answer

The key words here are "elevated privileges" and "known ports". This is the range 1-1023

Question 20

When performing a pen test Russell have been asked to perform a thorough network footprint for small company of about 50 hosts. He checks the address of his own machine and notices that it is a class c. Knowing there are multiple network segments he runs the following command: nmap -sS -p 0-65535 -P0 -O 192.0.0.0/8 >> /root/footprint.nmap
Which of the following statements describes what Russell has done?
A) The -sS scan looks for "Services" and this is not compatible with the -P0 (Do not ping first) option
B) He shouldn't run a dangerous scan like this as root, otherwise its OK
C) He is being thorough just as his boss asked him to. This range will be sure to notice everything.
D) He tried to scan 65536 ports on about 16 Million addresses. This is excessive traffic and is not a good approach.

Accepted Answer

A good footprint and fingerprint approach is a balance having an accurate scan, not creating excessive traffic and finishing in a reasonable amount of time. The example command does not meet these objectives.

Quiz 2: Information Gathering

In addition to the TTL field, which of the following can be analyzed during OS fingerprinting to identify the target OS? (Choose 5)

Which of the following is not one of the states of a port?

Frank's boss wants to start performing vulnerability scans and a golf partner recommended SAINT. He sets up a Windows machine and asks Frank to get started but immediately Frank runs into a problem. What is wrong?

Bart is running an nmap vanilla scan and believes the results are inaccurate. He decides that slowing down his scan might increase the accuracy, believing that latency or congestion is causing some dropped responses. Which of the following choices will help Bart get the job done?

Sean is trying to scan a network using the evasion technique of fragmenting his traffic with the -f option in NMap. What is the MTU (Maximum Transfer Unit) for an Ethernet network?

Which example is the correct syntax for establishing a null session?

What of the following lists of tools are used in a Linux system to gather information locally about what is running?

Which of the following Linux permissions will allow the owner to have full access, the members of the group to have Read and Write access, and the world to have only Read access?

Which of the following represents an OID?

What are LSASS and GINA?

You are poking around in a Linux box and run the ls -l command and notice a curious entry: _rwsr_xr_x 1 root users 381 2009-02-29 6:32 yes Which of the following statements is true? (Choose two)

Shalicia wants to find all of the currently open connections on a Windows host; which command would provide this information?

Edward is trying to locate the computers on a network by their computer names. What command line tool can he use? (Choose two)

Kevaun wants to find file shares on a remote system. Which of the following commands would provide this information?

Chris is using a Linux box and is also attempting to enumerate the network for computer names and shares. What command below would he run?

From his Linux host, Kempton wants to connect to an unprotected share he has discovered. What should he do next (assuming he has a credential) ?

Joe extracts a SID using the tool "SIDExtracter." Which of the following SIDs has administrator privileges? S-1-5-21-1147638176-875867241-945 Fred S-1-5-21-1147638176-875867241-134 Paul S-1-5-21-1147638176-875867241-777 Steve S-1-5-21-1147638176-875867241-500 Liz

What is a "NULL" user in the context of the Windows operating system?