Quiz-summary
0 of 30 questions completed
Questions:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
Information
Certified Ethical Hacker Exam Practice Questions
You have already completed the quiz before. Hence you can not start it again.
Quiz is loading...
You must sign in or sign up to start the quiz.
You have to finish following quiz, to start this quiz:
Results
0 of 30 questions answered correctly
Your time:
Time has elapsed
You have reached 0 of 0 points, (0)
Categories
- Not categorized 0%
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- Answered
- Review
-
Question 1 of 30
1. Question
Internet Protocol (IP) provides a standard set of rules for sending and receiving data over the Internet. Several headers are defined for IP, one of which is the fragment offset header. Which of the following sentences defines the fragment offset header?
Correct
The fragment offset field is 13 bits long and indicates where the data in the packet aligns. This lets the receiving system know how to stitch all the fragments together. The value in this field is in double words or 8 octets.
Incorrect
The fragment offset field is 13 bits long and indicates where the data in the packet aligns. This lets the receiving system know how to stitch all the fragments together. The value in this field is in double words or 8 octets.
-
Question 2 of 30
2. Question
Network topology refers to the layout of a network and how different nodes in a network are connected and how they communicate. Which of the following descriptions defines a star topology?
Correct
In a star topology, there is a mediating device between all the devices. A star takes more cable than a bus network, but the benefit is that if a cable fails, only one node will be brought down.
Incorrect
In a star topology, there is a mediating device between all the devices. A star takes more cable than a bus network, but the benefit is that if a cable fails, only one node will be brought down.
-
Question 3 of 30
3. Question
The Open Systems Interconnection (OSI) model is created by the International Organization for Standardization to help refer to boundaries between functions within a network stack. It is consists of seven layers. Which of the following statements defines the data link layer in the OSI model?
Correct
The data link layer is the second layer of the OSI model of computer networking. This layer identifies the network interface on the network so communications can get from one system to another on the local network. The data link layer provides the functional and procedural means to transfer data between network entities and might provide the means to detect and possibly correct errors that may occur in the physical layer.
Incorrect
The data link layer is the second layer of the OSI model of computer networking. This layer identifies the network interface on the network so communications can get from one system to another on the local network. The data link layer provides the functional and procedural means to transfer data between network entities and might provide the means to detect and possibly correct errors that may occur in the physical layer.
-
Question 4 of 30
4. Question
A computer network is a system in which multiple computers are connected to share information and resources. Computer network varies with each other based on their functionality, geography, ownership, and communication media used. Metropolitan Area Network (MAN) is a type of computer network based on the geographical area. Which of the following sentences is not true about MAN?
Correct
A metropolitan area network (MAN) is similar to a local area network (LAN) but spans an entire city or campus. It is a medium-sized network and can be used for connecting the various offices of the same organization, spread over the whole city. MANs can be connected using an optical fiber cable as a communication medium.
Incorrect
A metropolitan area network (MAN) is similar to a local area network (LAN) but spans an entire city or campus. It is a medium-sized network and can be used for connecting the various offices of the same organization, spread over the whole city. MANs can be connected using an optical fiber cable as a communication medium.
-
Question 5 of 30
5. Question
Cloud computing is the process of storing and accessing data and programs over the internet instead of your computer’s hard drive. Cloud computing services come in different forms, one of which is the Infrastructure as a Service (IaaS). Which of the following statements best describes IaaS?
Correct
Infrastructure as a Service (IaaS) is an instant computing infrastructure, provisioned, and managed over the internet. It helps you avoid the expense and complexity of buying and managing your physical servers and other datacenter infrastructure. Each resource is offered as a separate service component, and it scales up and down with demand, letting you pay only for what you use.
Incorrect
Infrastructure as a Service (IaaS) is an instant computing infrastructure, provisioned, and managed over the internet. It helps you avoid the expense and complexity of buying and managing your physical servers and other datacenter infrastructure. Each resource is offered as a separate service component, and it scales up and down with demand, letting you pay only for what you use.
-
Question 6 of 30
6. Question
Internet of Things (IoT) refers to the growing network of physical objects that feature an IP address for internet connectivity, and the communication that occurs between these objects and other internet-enabled devices and systems. Which of the following is not an example of IoT?
Correct
Any devices that have embedded software and also have network access are considered to be part of the Internet of Things (IoT). Other examples of IoT include the following: home automation devices, digital video recorders, satellite set-top boxes, and anything that can be reached over the network that doesn’t have a built-in screen or the ability to take direct user interaction. Meanwhile, smartphones or general-purpose computers would not be part of IoT because they have traditional input/output devices like a screen and keyboard.
Incorrect
Any devices that have embedded software and also have network access are considered to be part of the Internet of Things (IoT). Other examples of IoT include the following: home automation devices, digital video recorders, satellite set-top boxes, and anything that can be reached over the network that doesn’t have a built-in screen or the ability to take direct user interaction. Meanwhile, smartphones or general-purpose computers would not be part of IoT because they have traditional input/output devices like a screen and keyboard.
-
Question 7 of 30
7. Question
A vulnerability is a weakness in a system, this may be its software, its configuration, or how the entire information solution is put together. A race condition is an example of vulnerability. Which of the following statements is not true about race condition?
Correct
A race condition is a synchronization problem that occurs when a software program depends on the timing of one or more processes to function correctly. It is a programmatic situation where one process or thread is writing data while another process or thread is reading the data. This type of vulnerability cannot be exploited.
Incorrect
A race condition is a synchronization problem that occurs when a software program depends on the timing of one or more processes to function correctly. It is a programmatic situation where one process or thread is writing data while another process or thread is reading the data. This type of vulnerability cannot be exploited.
-
Question 8 of 30
8. Question
Security is a business enabler; hence, organizations must set parameters around what is important and the means to protect it. It does that by creating policies, guidelines, standards, and procedures. Which of the following statements best defines security policies?
Correct
A security policy is a written document in an organization outlining what a company considers what resources need to be protected, how resources should be utilized properly, and how resources can or should be accessed. Security policies are also about setting expectations of employees and defining what users can and cannot do. Any violation of this policy on the part of the employee can cause sanctions or termination, depending on the extent of the violation and the impact on the business.
Incorrect
A security policy is a written document in an organization outlining what a company considers what resources need to be protected, how resources should be utilized properly, and how resources can or should be accessed. Security policies are also about setting expectations of employees and defining what users can and cannot do. Any violation of this policy on the part of the employee can cause sanctions or termination, depending on the extent of the violation and the impact on the business.
-
Question 9 of 30
9. Question
A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules. Which of the following statements is true about stateful filtering firewalls?
Correct
The first stateful firewall was developed in the late 1980s. It is a firewall that keeps track of the state of messages. It combines both packet inspection technology and TCP handshake verification to create a level of protection greater than either of the previous two architectures could provide alone.
Incorrect
The first stateful firewall was developed in the late 1980s. It is a firewall that keeps track of the state of messages. It combines both packet inspection technology and TCP handshake verification to create a level of protection greater than either of the previous two architectures could provide alone.
-
Question 10 of 30
10. Question
Users are often the most vulnerable point on your network, and they are regularly targets of social engineering and malware attacks. Unified Threat Management (UTM) is a useful tool to protect users. Which of the following statements best defines UTM?
Correct
Unified threat management (UTM) is an information security term that refers to a single security solution and usually a single security appliance that provides multiple security functions at a single point on the network.
Incorrect
Unified threat management (UTM) is an information security term that refers to a single security solution and usually a single security appliance that provides multiple security functions at a single point on the network.
-
Question 11 of 30
11. Question
An intrusion detection system (IDS) is a device or software application that monitors a network for malicious activity or policy violations. There are two different types of IDS: host-based IDS and network IDS. Which of the following sentences is true about network IDS?
Correct
Network-based intrusion detection systems (NIDS) are devices that analyze incoming network traffic. NIDS can be hardware or software-based systems and, depending on the manufacturer of the system, can attach to various network mediums such as Ethernet and FDDI.
Incorrect
Network-based intrusion detection systems (NIDS) are devices that analyze incoming network traffic. NIDS can be hardware or software-based systems and, depending on the manufacturer of the system, can attach to various network mediums such as Ethernet and FDDI.
-
Question 12 of 30
12. Question
Implementing security solutions requires understanding where your resources are, like your information assets, technology assets, and human assets. A defense-in-depth approach is a layered approach to security design and architecture. Which of the following statements is not true about defense in depth?
Correct
Defense in depth originates from a military strategy by the same name, which uses multiple defensive measures in case a security control fails or a vulnerability is exploited. If one line of defense is compromised, additional layers of defense are in place to ensure that threats don’t slip through the cracks. This method is based on controls that are designed to protect the physical, technical and administrative aspects of your network.
Incorrect
Defense in depth originates from a military strategy by the same name, which uses multiple defensive measures in case a security control fails or a vulnerability is exploited. If one line of defense is compromised, additional layers of defense are in place to ensure that threats don’t slip through the cracks. This method is based on controls that are designed to protect the physical, technical and administrative aspects of your network.
-
Question 13 of 30
13. Question
Several organizations govern the internet when it comes to domains and addresses. One of these organizations is the Internet Corporation for Assigned Names and Numbers (ICANN). Which of the following statements defines ICANN?
Correct
The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit public benefit corporation established in the U.S in 1998 that develops policy on unique identifiers and coordinates the internet’s naming, addressing, protocol systems, and accredits domain name registrars. In other words, the ICANN is the overseeing body for the domain names on the internet
Incorrect
The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit public benefit corporation established in the U.S in 1998 that develops policy on unique identifiers and coordinates the internet’s naming, addressing, protocol systems, and accredits domain name registrars. In other words, the ICANN is the overseeing body for the domain names on the internet
-
Question 14 of 30
14. Question
A regional internet registry (RIR) is an organization that manages and controls internet addresses in a specific region, usually a country and sometimes an entire continent. There are five types of RIR based in different geographic regions. Which of the following is not included in the five types of RIR?
Correct
The five types of RIR and the geographical areas they are responsible for include the following:
(1) African Network Information Center (AfriNIC) Africa
(2) American Registry for Internet Numbers (ARIN) North America (the US and Canada) as well as Antarctica and parts of the Caribbean
(3) Asia Pacific Network Information Centre (APNIC) Asia, Australia, New Zealand, and neighboring countries
(4) Latin America and Caribbean Network Information Centre (LACNIC) Latin America and parts of the Caribbean
(5) Réseaux IP Européens Network Coordination Centre (RIPE NCC) Europe, Russia, West Asia, and Central AsiaIncorrect
The five types of RIR and the geographical areas they are responsible for include the following:
(1) African Network Information Center (AfriNIC) Africa
(2) American Registry for Internet Numbers (ARIN) North America (the US and Canada) as well as Antarctica and parts of the Caribbean
(3) Asia Pacific Network Information Centre (APNIC) Asia, Australia, New Zealand, and neighboring countries
(4) Latin America and Caribbean Network Information Centre (LACNIC) Latin America and parts of the Caribbean
(5) Réseaux IP Européens Network Coordination Centre (RIPE NCC) Europe, Russia, West Asia, and Central Asia -
Question 15 of 30
15. Question
In the domain name system (DNS), a name lookup is the process of a resolver sending a request to a name server. The resolver sends the hostname of a TCP/IP host on the internetwork, and the name server returns the host’s IP address. Nslookup is an effective tool that can be used to perform the name lookups. Which of the following sentences best describes the nslookup?
Correct
In nslookup, you can issue many requests without having to keep running the program. When you run nslookup without any parameters, you will be placed into an nslookup shell, where you are interacting with the program, issuing requests.
Incorrect
In nslookup, you can issue many requests without having to keep running the program. When you run nslookup without any parameters, you will be placed into an nslookup shell, where you are interacting with the program, issuing requests.
-
Question 16 of 30
16. Question
A ping sweep is a technique used to identify if the hosts are alive in the networks using their IP addresses. Many tools can perform a ping sweep; one of the common ones is MegaPing. Which of the following statements is not true about MegaPing?
Correct
MegaPing is a GUI-based tool that runs under Windows that incorporates several functions into a single interface. It can scan your entire network and provide information such as open shared resources, open ports, services/drivers active on the computer, key registry entries, users, and groups, trusted domains, and printers. Scan results can be saved in HTML or TXT reports, which can be used to secure your network. You can conduct a ping sweep using MegaPing by utilizing the IP scanner tool, which you would select from the list on the left-hand side.
Incorrect
MegaPing is a GUI-based tool that runs under Windows that incorporates several functions into a single interface. It can scan your entire network and provide information such as open shared resources, open ports, services/drivers active on the computer, key registry entries, users, and groups, trusted domains, and printers. Scan results can be saved in HTML or TXT reports, which can be used to secure your network. You can conduct a ping sweep using MegaPing by utilizing the IP scanner tool, which you would select from the list on the left-hand side.
-
Question 17 of 30
17. Question
Transmission Control Protocol (TCP) scanning is the most detailed and complex type of port scanning. There are different types of TCP scans that Nmap can perform, one of which is the full connect scan. Which of the following sentences best describes the full connect scan?
Correct
In a full connect scan, instead of writing raw packets as most other scan types do, Nmap asks the underlying system to establish a connection with the target machine and port by issuing the connect system call. Nmap will complete the connection and then tear it down once the connection is complete.
Incorrect
In a full connect scan, instead of writing raw packets as most other scan types do, Nmap asks the underlying system to establish a connection with the target machine and port by issuing the connect system call. Nmap will complete the connection and then tear it down once the connection is complete.
-
Question 18 of 30
18. Question
A port scan identifies open ports on systems connected to the target network. It is a starting point for identifying services and applications that are listening on those ports. Masscan is an effective port scanner developed by Robert Graham. Which of the following statements best defines a masscan?
Correct
Masscan is an internet-scale port scanner that can scan the entire internet in under 6 minutes, transmitting 10 million packets per second, from a single machine.
Incorrect
Masscan is an internet-scale port scanner that can scan the entire internet in under 6 minutes, transmitting 10 million packets per second, from a single machine.
-
Question 19 of 30
19. Question
Vulnerability scanning is the inspection of the potential points of exploitation on a computer or network to identify security holes. Several tools can be used to perform vulnerability scanning, one of which is the Open Vulnerability Assessment System (OpenVAS). Which of the following sentences describes OpenVAS?
Correct
The Open Vulnerability Assessment System (OpenVAS) is a vulnerability scanner maintained and distributed by Greenbone Networks. It developed the Greenbone Security Assistant (GSA) as the user interface for its program. It is intended to be an all-in-one vulnerability scanner with a variety of built-in tests and a web interface designed to make setting up and running vulnerability scans fast and easy while providing a high level of user configurability.
Incorrect
The Open Vulnerability Assessment System (OpenVAS) is a vulnerability scanner maintained and distributed by Greenbone Networks. It developed the Greenbone Security Assistant (GSA) as the user interface for its program. It is intended to be an all-in-one vulnerability scanner with a variety of built-in tests and a web interface designed to make setting up and running vulnerability scans fast and easy while providing a high level of user configurability.
-
Question 20 of 30
20. Question
Nessus is an open-source network vulnerability scanner that uses the Common Vulnerabilities and Exposures architecture for easy cross-linking between compliant security tools. Nessus employs the Nessus Attack Scripting Language (NASL), a simple language that describes individual threats and potential attacks. If you’re using a Linux system, where can you find the NASL scripts?
Correct
On a Linux system, the Nessus Attack Scripting Language (NASL) are stored in /opt/nesses with the plugins in /opt/nessus/lib/plugins. Meanwhile, on a Windows system, the scripts are stored in the program files directory.
Incorrect
On a Linux system, the Nessus Attack Scripting Language (NASL) are stored in /opt/nesses with the plugins in /opt/nessus/lib/plugins. Meanwhile, on a Windows system, the scripts are stored in the program files directory.
-
Question 21 of 30
21. Question
Packet crafting is the art of creating a packet according to various requirements to carry out attacks and to exploit vulnerabilities in a network. Several tools can be used to craft or otherwise manipulate the header data, one of which is the packETH tool. Which of the following descriptions best defines a packETH tool?
Correct
PackETH is a GUI and CLI packet generator tool for ethernet that lets you set the fields. It allows you to create and send any possible packet or sequence of packets on the ethernet link. It is very simple to use, powerful, and supports many adjustments of parameters while sending.
Incorrect
PackETH is a GUI and CLI packet generator tool for ethernet that lets you set the fields. It allows you to create and send any possible packet or sequence of packets on the ethernet link. It is very simple to use, powerful, and supports many adjustments of parameters while sending.
-
Question 22 of 30
22. Question
Remote method invocation (RMI) is a distributed object technology developed by Sun for the Java programming language. It is available as part of the core Java application programming interface (API), where the object interfaces are defined as Java interfaces and use object serialization. Which of the following tools can you use if you want to scan for RMI services?
Correct
Metasploit is not the only way you can scan for RMI services. If you search a little, you can find additional programs like BaRMIe. The goal of BaRMIe is to enable security professionals to identify, attack, and secure uptight RMI services. Using partial RMI interfaces from existing software, BaRMIe can interact directly with those services without first brute-forcing 64-bits over the network.
Incorrect
Metasploit is not the only way you can scan for RMI services. If you search a little, you can find additional programs like BaRMIe. The goal of BaRMIe is to enable security professionals to identify, attack, and secure uptight RMI services. Using partial RMI interfaces from existing software, BaRMIe can interact directly with those services without first brute-forcing 64-bits over the network.
-
Question 23 of 30
23. Question
Enumeration is about determining what services are running and then extracting information from those services. There are a variety of protocols and tools that you would use during enumeration, one of which is the Simple Network Management Protocol (SNMP). Which of the following statements best defines SNMP?
Correct
Simple Network Management Protocol (SNMP) is a set of protocols for network management and monitoring. It is mostly used for collecting statistical and configuration information about network devices such as computers, hubs, switches, and even network printers. The SNMP protocol is included in the application layer of TCP/IP as defined by the Internet Engineering Task Force (IETF).
Incorrect
Simple Network Management Protocol (SNMP) is a set of protocols for network management and monitoring. It is mostly used for collecting statistical and configuration information about network devices such as computers, hubs, switches, and even network printers. The SNMP protocol is included in the application layer of TCP/IP as defined by the Internet Engineering Task Force (IETF).
-
Question 24 of 30
24. Question
Once you have an exploited system, you will want to start gathering information in it. Mimikatz is one of the useful tools that can grab password hashes. Which of the following statements best describes mimikatz?
Correct
Mimikatz is an open-source malware program that can be used to check if the security support provider (SSP) has credentials and to pull hashes from the live SSP. To function completely, mimikatz requires an administrator or full system controls. A mimikatz attack uses several techniques to find sensitive information such as plaintext passwords, hash, pin codes, and tickets from the memory of a system. The collected credentials can then be used to access unauthorized information or perform lateral movement attacks.
Incorrect
Mimikatz is an open-source malware program that can be used to check if the security support provider (SSP) has credentials and to pull hashes from the live SSP. To function completely, mimikatz requires an administrator or full system controls. A mimikatz attack uses several techniques to find sensitive information such as plaintext passwords, hash, pin codes, and tickets from the memory of a system. The collected credentials can then be used to access unauthorized information or perform lateral movement attacks.
-
Question 25 of 30
25. Question
An easy way to handle logs on the target is to just clear them. This means that you will either wipe all the entries in the case of the event logs on a Windows system or delete log files in the case of a Linux or Unix-like system. If you’re using a Windows system, what command can you use if you want to wipe all the entries in the system event log?
Correct
Once we have compromised a Windows system and have a Meterpreter shell, we can use the clearev command. You need to have adequate permissions to be able to clear the system event log. The LOCALSYSTEM user has the permissions necessary to adjust the logs.
Incorrect
Once we have compromised a Windows system and have a Meterpreter shell, we can use the clearev command. You need to have adequate permissions to be able to clear the system event log. The LOCALSYSTEM user has the permissions necessary to adjust the logs.
-
Question 26 of 30
26. Question
If you’re using a Windows system and you want to hide the data in plain sight, you can store the files in temporary directories. One example of a temporary directory is a folder that shows a listing for the internet files on a Windows system. Where can you find this directory in your computer system?
Correct
The path to that directory is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files, which has a lot of waypoints where you can similarly hide files where they won’t be seen. This is not a directory most people visit, so it wouldn’t be hard to place a file here and just have it never get noticed.
Incorrect
The path to that directory is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files, which has a lot of waypoints where you can similarly hide files where they won’t be seen. This is not a directory most people visit, so it wouldn’t be hard to place a file here and just have it never get noticed.
-
Question 27 of 30
27. Question
Malware refers to software programs designed to damage and to do other unwanted actions on a computer system. There are several examples of malware, one of which is a worm. Which of the following sentences defines a worm?
Correct
A worm propels itself. It doesn’t require any assistance from the user. This means that it has a way of connecting to remote systems and executing itself on those systems.
Incorrect
A worm propels itself. It doesn’t require any assistance from the user. This means that it has a way of connecting to remote systems and executing itself on those systems.
-
Question 28 of 30
28. Question
Ransomware is another type of malware wherein the goal is to extort money from a victim. One of the best-known families of ransomware is WannaCry. Which of the following sentences does not describe WannaCry?
Correct
WannaCry is a ransomware worm that spread rapidly across several computer networks in May of 2017. It was spread through the use of EternalBlue, an exploit developed by the United States National Security Agency (NSA). It struck several important and high-profile systems, including many in Britain’s National Health Service. After infecting Windows computers, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin to decrypt them.
Incorrect
WannaCry is a ransomware worm that spread rapidly across several computer networks in May of 2017. It was spread through the use of EternalBlue, an exploit developed by the United States National Security Agency (NSA). It struck several important and high-profile systems, including many in Britain’s National Health Service. After infecting Windows computers, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin to decrypt them.
-
Question 29 of 30
29. Question
Packet capturing is the process of acquiring network traffic that is addressed to systems other than your own. One valuable tool used in packet capturing is TShark. Which of the following sentences best describes TShark?
Correct
TShark is a network protocol analyzer and comes installed with the Wireshark package. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark’s native capture file format is a pcapng format, which is also the format used by Wireshark and various other tools.
Incorrect
TShark is a network protocol analyzer and comes installed with the Wireshark package. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark’s native capture file format is a pcapng format, which is also the format used by Wireshark and various other tools.
-
Question 30 of 30
30. Question
The purpose of a denial of service attack is to take an application out of service so legitimate users can’t use it. As users often interact with businesses through web applications, they are often the target of a denial of service attacks. There are several types of denial of service attacks, one of which is the bandwidth attack. Which of the following statements defines a bandwidth attack?
Correct
A bandwidth attack is a denial-of-service attack that is used to generate a lot of traffic that overwhelms the network connection service is using. The primary means for achieving this goal is by sending large traffic volumes that do not respect congestion control signals, such as that in the Transmission Control Protocol (TCP) or Explicit Congestion Notification (ECN).
Incorrect
A bandwidth attack is a denial-of-service attack that is used to generate a lot of traffic that overwhelms the network connection service is using. The primary means for achieving this goal is by sending large traffic volumes that do not respect congestion control signals, such as that in the Transmission Control Protocol (TCP) or Explicit Congestion Notification (ECN).