Certified Ethical Hacking

Mock Test 1

Q1) Code injection is a form of attack in which a malicious user

A. Inserts text into a data field that gets interpreted as code

B. Gets the server to execute arbitrary code using a buffer overflow
C. Inserts additional code into the JavaScript running in the browser
D. Gains access to the codebase on the server and inserts new code

Q2) Which of the following is a wireless network detector that is commonly found on Linux?

A. Kismet
B. Abel
C. Netstumbler
D. Nessus

Q3)The Payment Card Industry Data Security Standard (PCI DSS) contains six
different categories of control objectives. Each objective contains one or more
requirements, which must be followed in order to achieve compliance. Which of the
following requirements would best fit under the objective, "Implement strong access
control measures"?

A. Regularly test security systems and processes.

B. Encrypt transmission of cardholder data across open, public networks.
C. Assign a unique ID to each person with computer access.
D. Use and regularly update anti-virus software on all systems commonly affected by malware.

Q4) Which of the following is an NMAP script that could help detect HTTP Methods
such as GET, POST, HEAD, PUT, DELETE, TRACE?
A. http-git
B. http-headers
C. http enum
D. http-methods
 Q5) A hacker has managed to gain access to a Linux host and stolen the password file from
/etc/passwd. How can he use it?

A. The password file does not contain the passwords themselves.

B. He can open it and read the user ids and corresponding passwords.
C. The file reveals the passwords to the root user only.
D. He cannot read it because it is encrypted.

Q6) Darius is analysing IDS logs. During the investigation, he noticed that there was
nothing suspicious found and an alert was triggered on normal web application
traffic. He can mark this alert as:

A. False-Negative
B. False-Positive
C. True-Positive
D. False-Signature

Q7) The Open Web Application Security Project (OWASP) is the worldwide not-for-
profit charitable organization focused on improving the security of software. What
item is the primary concern on OWASP's Top Ten Project Most Critical Web
Application Security Risks?

A. Injection
B. Cross Site Scripting
C. Cross Site Request Forgery
D. Path disclosure

Q8) Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?

A. Incident response services to any user, company, government agency, or organization in

partnership with the Department of Homeland Security
B. Maintenance of the nation's Internet infrastructure, builds out new Internet infrastructure,
and decommissions old Internet infrastructure
C. Registration of critical penetration testing for the Department of Homeland Security and
public and private sectors
D. Measurement of key vulnerability assessments on behalf of the Department of Defense
(DOD) and State Department, as well as private sectors
Q9) Supposed you are the Chief Network Engineer of a certain Telco. Your company is planning
for a big business expansion and it requires that your network authenticate users connecting
using analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private
Networks (VPN) over a Frame Relay network. Which AAA protocol would you implement?

A. TACACS+
B. DIAMETER
C. Kerberos
D. RADIUS

Q10) A security consultant is trying to bid on a large contract that involves penetration testing
and reporting. The company accepting bids wants proof of work so the consultant prints out
several audits that have been performed. Which of the following is likely to occur as a result?

A. The consultant will ask for money on the bid because of great work.
B. The consultant may expose vulnerabilities of other companies.
C. The company accepting bids will want the same type of format of testing.
D. The company accepting bids will hire the consultant because of the great work performed.

Q11) Which of the following is a hashing algorithm?

A. MD5
B. PGP
C. DES
D. ROT13

Q12) If an attacker uses the command SELECT*FROM user WHERE name = 'x' AND userid IS
NULL; --'; which type of SQL injection attack is the attacker performing?

A. End of Line Comment

B. UNION SQL Injection
C. Illegal/Logically Incorrect Query
D. Tautology

Q13) Which DNS resource record can indicate how long any "DNS poisoning" could last?

A. MX
B. SOA
C. NS
D. TIMEOUT
Q14) What does the following command in netcat do?
nc -l -u -p55555 < /etc/passwd

A. logs the incoming connections to /etc/passwd file

B. loads the /etc/passwd file to the UDP port 55555
C. grabs the /etc/passwd file when connected to UDP port 55555
D. deletes the /etc/passwd file when connected to the UDP port 55555

Q15) Which of the following is a characteristic of Public Key Infrastructure (PKI)?

A. Public-key cryptosystems are faster than symmetric-key cryptosystems.

B. Public-key cryptosystems distribute public-keys within digital signatures.
C. Public-key cryptosystems do not require a secure key distribution channel.
D. Public-key cryptosystems do not provide technical non-repudiation via digital signatures.

Q16) A common cryptographical tool is the use of XOR. XOR the following binary values:
10110001
00111010

A. 10001011
B. 11011000
C. 10011101
D. 10111100

Q17) During a recent security assessment, you discover the organization has one Domain Name
Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.
What is this type of DNS configuration commonly called?

A. Split DNS
B. DNSSEC
C. DynDNS
D. DNS Scheme

Q18) Which of the following commands runs snort in packet logger mode?

A. ./snort -dev -h ./log

B. ./snort -dev -l ./log
C. ./snort -dev -o ./log
D. ./snort -dev -p ./log

Q19) Every company needs a formal written document which spells out to employees precisely
what they are allowed to use the company's systems for, what is prohibited, and what will
happen to them if they break the rules. Two printed copies of the policy should be given to
every employee as soon as possible after they join the organization. The employee should be
asked to sign one copy, which should be safely filed by the company. No one should be allowed
to use the company's computer systems until they have signed the policy in acceptance of its
terms.What is this document called?

A. Information Audit Policy (IAP)

B. Information Security Policy (ISP)
C. Penetration Testing Policy (PTP)
D. Company Compliance Policy (CCP)

Q20) A security analyst is performing an audit on the network to determine if there are any
deviations from the security policies in place. The analyst discovers that a user from the IT
department had a dial-out modem installed. Which security policy must the security analyst
check to see if dial-out modems are allowed?

A. Firewall-management policy
B. Acceptable-use policy
C. Remote-access policy
D. Permissive policy

Q21) Which of the following open source tools would be the best choice to scan a network for
potential targets?

A. NMAP
B. NIKTO
C. CAIN
D. John the Ripper

Q22) Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n
WLAN standards on a linux platform?

A. Kismet
B. Nessus
C. Netstumbler
D. Abel

Q23) You went to great lengths to install all the necessary technologies to prevent hacking
attacks, such as expensive firewalls, antivirus software, anti-spam systems and intrusion
detection/prevention tools in your company's network. You have configured the most secure
policies and tightened every device on your network. You are confident that hackers will never
be able to gain access to your network with complex security system in place. Your peer, Peter
Smith who works at the same department disagrees with you. He says even the best network
security technologies cannot prevent hackers gaining access to the network because of
presence of "weakest link" in the security chain.
What is Peter Smith talking about?
A. Untrained staff or ignorant computer users who inadvertently become the weakest link in
your security chain
B. "zero-day" exploits are the weakest link in the security chain since the IDS will not be able to
detect these attacks
C. "Polymorphic viruses" are the weakest link in the security chain since the Anti-Virus scanners
will not be able to detect these attacks
D. Continuous Spam e-mails cannot be blocked by your security system since spammers use
different techniques to bypass the filters in your gateway

Q24) Which of the following can the administrator do to verify that a tape backup can be
recovered in its entirety?

A. Restore a random file.

B. Perform a full restore.
C. Read the first 512 bytes of the tape.
D. Read the last 512 bytes of the tape.

Q25) What is the approximate cost of replacement and recovery operation per year of a hard
drive that has a value of $300 given that the technician who charges $10/hr would need 10
hours to restore OS and Software and needs further 4 hours to restore the database from the
last backup to the new hard disk? Calculate the SLE, ARO, and ALE. Assume the EF = 1 (100%).

A. $440
B. $100
C. $1320
D. $146

Q26) As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external
security assessment through penetration testing. What document describes the specifics of the
testing, the associated violations, and essentially protects both the organization's interest and
your liabilities as a tester?
A. Terms of Engagement
B. Project Scope
C. Non-Disclosure Agreement
D. Service Level Agreement

Q27) Which protocol is used for setting up secure channels between two devices, typically in
VPNs?

A. PPP
B. IPSEC
C. PEM
D. SET

Q28) An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML
code to embed a malicious applet in all HTTP connections.
When users accessed any page, the applet ran and exploited many machines.
Which one of the following tools the hacker probably used to inject HTML code?

A. Wireshark
B. Ettercap
C. Aircrack-ng
D. Tcpdump

Q29) What is the name of the international standard that establishes a baseline level of
confidence in the security functionality of IT products by providing a set of requirements for
evaluation?

A. Blue Book
B. ISO 26029
C. Common Criteria
D. The Wassenaar Agreement

Q30) Which of the following programming languages is most susceptible to buffer overflow
attacks, due to its lack of a built-in-bounds checking mechanism?

Output:
Segmentation fault
A. C#
B. Python
C. Java
D. C++

Q31) Which of the following network attacks relies on sending an abnormally large packet size
that exceeds TCP/IP specifications?

A. Ping of death
B. SYN flooding
C. TCP hijacking
D. Smurf attack
Q32) You receive an e-mail like the one shown below. When you click on the link contained in
the mail, you are redirected to a website seeking you to download free Anti-Virus software.
Dear valued customers,
We are pleased to announce the newest version of Antivirus 2010 for Windows which will
probe you with total security against the latest spyware, malware, viruses, Trojans and other
online threats.
Simply visit the link below and enter your antivirus code:

or you may contact us at the following address:

Media Internet Consultants, Edif. Neptuno, Planta
Baja, Ave. Ricardo J. Alfaro, Tumba Muerto, n/a Panama
How will you determine if this is Real Anti-Virus or Fake Anti-Virus website?

A. Look at the website design, if it looks professional then it is a Real Anti-Virus website
B. Connect to the site using SSL, if you are successful then the website is genuine
C. Search using the URL and Anti-Virus product name into Google and lookout for suspicious
warnings against this site
D. Download and install Anti-Virus software from this suspicious looking site, your Windows 7
will prompt you and stop the installation if the downloaded file is a malware
E. Download and install Anti-Virus software from this suspicious looking site, your Windows 7
will prompt you and stop the installation if the downloaded file is a malware

Q33) Which of the following processes of PKI (Public Key Infrastructure) ensures that a trust
relationship exists and that a certificate is still valid for specific operations?

A. Certificate issuance
B. Certificate validation
C. Certificate cryptography
D. Certificate revocation

Q34) Bob is doing a password assessment for one of his clients. Bob suspects that security
policies are not in place.
He also suspects that weak passwords are probably the norm throughout the company he is
evaluating. Bob is familiar with password weaknesses and key loggers.
Which of the following options best represents the means that Bob can adopt to retrieve
passwords from his clients hosts and servers?
A. Hardware, Software, and Sniffing.
B. Hardware and Software Keyloggers.
C. Passwords are always best obtained using Hardware key loggers.
D. Software only, they are the most effective.

Q35) You have successfully gained access to a linux server and would like to ensure that the
succeeding outgoing traffic from this server will not be caught by a Network Based Intrusion
Detection Systems (NIDS). What is the best way to evade the NIDS?

A. Encryption
B. Protocol Isolation
C. Alternate Data Streams
D. Out of band signaling

Q36) An attacker with access to the inside network of a small company launches a successful
STP manipulation attack. What will he do next?

A. He will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.
B. He will activate OSPF on the spoofed root bridge.
C. He will repeat the same attack against all L2 switches of the network.
D. He will repeat this action so that it escalates to a DoS attack.
Q37) Which of the following Secure Hashing Algorithm (SHA) produces a 160-bit digest from a
message with a maximum length of (264-1) bits and resembles the MD5 algorithm?

A. SHA-2
B. SHA-3
C. SHA-1
D. SHA-0

Q38) Emil uses nmap to scan two hosts using this command.
nmap -sS -T4 -O 192.168.99.1 192.168.99.7
He receives this output:
What is his conclusion?

A. Host 192.168.99.7 is an iPad.

B. He performed a SYN scan and OS scan on hosts 192.168.99.1 and 192.168.99.7.
C. Host 192.168.99.1 is the host that he launched the scan from.
D. Host 192.168.99.7 is down.

Q39) A network admin contacts you. He is concerned that ARP spoofing or poisoning might
occur on his network.
What are some things he can do to prevent it? Select the best answers.

A. Use port security on his switches.

B. Use a tool like ARPwatch to monitor for strange ARP activity.
C. Use a firewall between all LAN segments.
D. If you have a small network, use static ARP entries.
E. Use only static IP addresses on all PC's.
Q40) You have initiated an active operating system fingerprinting attempt with nmap against a
target system:

What operating system is the target host running based on the open ports shown above?

A. Windows XP
B. Windows 98 SE
C. Windows NT4 Server
D. Windows 2000 Server

Q41) If you are to determine the attack surface of an organization, which of the following is the
BEST thing to do?

A. Running a network scan to detect network services in the corporate DMZ

B. Reviewing the need for a security clearance for each employee
C. Using configuration management to determine when and where to apply security patches
D. Training employees on the security policy regarding social engineering
Q42)

What does the option * indicate?

A. s
B. t
C. n
D. a

Q43) Bob, a network administrator at BigUniversity, realized that some students are connecting
their notebooks in the wired network to have Internet access. In the university campus, there
are many Ethernet ports available for professors and authorized visitors but not for students.
He identified this when the IDS alerted for malware activities in the network.
What should Bob do to avoid this problem?

A. Disable unused ports in the switches

B. Separate students in a different VLAN
C. Use the 802.1x protocol
D. Ask students to use the wireless network

Q44) Log monitoring tools performing behavioral analysis have alerted several suspicious logins
on a Linux server occurring during non-business hours. After further examination of all login
activities, it is noticed that none of the logins have occurred during typical work hours. A Linux
administrator who is investigating this problem realizes the system time on the Linux server is
wrong by more than twelve hours. What protocol used on Linux servers to synchronize the time
has stopped working?

A. Time Keeper
B. NTP
C. PPP
D. OSPP

Q45) On performing a risk assessment, you need to determine the potential impacts when
some of the critical business process of the company interrupt its service. What is the name of
the process by which you can determine those critical business?

A. Risk Mitigation
B. Emergency Plan Response (EPR)
C. Disaster Recovery Planning (DRP)
D. Business Impact Analysis (BIA)

Q46) Bob finished a C programming course and created a small C application to monitor the
network traffic and produce alerts when any origin sends "many" IP packets, based on the
average number of packets sent by all origins and using some thresholds.
In concept, the solution developed by Bob is actually:

A. Just a network monitoring tool

B. A signature-based IDS
C. A hybrid IDS
D. A behavior-based IDS

Q47) Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool
"SIDExtractor". Here is the output of the SIDs:

From the above list identify the user account with System Administrator privileges.

A. John
B. Rebecca
C. Sheela
D. Shawn
E. Somia
F. Chang
G. Micah
Q48) Which of the following tools performs comprehensive tests against web servers, including
dangerous files and CGIs?

A. Nikto
B. Snort
C. John the Ripper
D. Dsniff

Q49) Nedved is an IT Security Manager of a bank in his country. One day. he found out that
there is a security breach to his company's email server based on analysis of a suspicious
connection from the email server to an unknown IP Address.
What is the first thing that Nedved needs to do before contacting the incident response team?

A. Leave it as it Is and contact the incident response te3m right away

B. Block the connection to the suspicious IP Address from the firewall
C. Disconnect the email server from the network
D. Migrate the connection to the backup email server

Q50) What did the following commands determine?

A. That the Joe account has a SID of 500

B. These commands demonstrate that the guest account has NOT been disabled
C. These commands demonstrate that the guest account has been disabled
D. That the true administrator is Joe
E. Issued alone, these commands prove nothing