CEHv9 Exam Questions & Answers

Part 5 , 30 Questions (Question Number 131 to 160)

131. What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?

• A. Impact Risk

• B. Inherent Risk

• C. Deferred Risk

• D. Residual Risk

Answer – D 

132. Which of the following problems can be solved by using Wireshark?

• A. Resetting the administrator password on multiple systems

• B. Troubleshooting communication resets between two systems

• C. Tracking version changes of source code

• D. Checking creation dates on all webpages on a server

Answer – B

133. This kind of malware is installed by criminals on your computer so they can lock it from a remote location. This malware generates a popup window, webpage, or email warning from what looks like an official authority such as the FBI.It explains your computer has been locked because of possible illegal activities and demands payment before you can access your files and programs again. Which term best matches this definition?

• A. Ransomware

• B. Adware

• C. Riskware

• D. Spyware

Answer – A

134. Which of the following is a hashing algorithm?

• A. DES

• B. PGP

• C. ROT13

• D. MD5

Answer – D

135. An attacker gains access to a Web server’s database and displays the contents of the table that holds all of the names, passwords, and other user information. The attacker did this by entering information into the Web site’s user login page that the software’s designers did not expect to
be entered. This is an example of what kind of software design problem/issue?

• A. Insufficient firewall rules

• B. Insufficient input validation

• C. Insufficient exception handling

• D. Insufficient anti-virus detection

Answer – B

136. What is the best way to defend against network sniffing?

• A. Register all machines MAC address in a Centralized Database and

• B. limit network connection to those machines

• C. Use Static IP’s

• D. Using encryption protocols on network communications

• E. Restrict physical access to server rooms host critical servers

 Answer – D

137. What is a collision attack in cryptography?

• A. Collision attacks try to break the hash into two parts with the same bytes in each part to get the private key

• B. Collision attacks try to get the public key

• C. Collision attacks try to find two inputs that produce the same hash

• D. Collision attacks try to break the hash into three parts.

Answer – C

138. Which of the following is an example of the principle of least privilege as a system security control?

• A. User should have limited access to the information regardless of its purpose

• B. User must be able to access only the information and resources that are necessary for legitimate purpose

• C. User should access all the information stored in the business to best execute their functions

• D. Companies should have only a few employees

Answer – B 

139. Which tool queries publicly available databases that contain domain name registration contact information?

• A. netstat

• B. ifconfig

• C. WHOIS

• D. Nslookup

Answer – C

140. The TJ Max breach happened in part because this type of weak wireless security was implemented.

• A. WiFi Protected Access (WPA)

• B. TKIP

• C. Wired Equivalent Privacy (WEP)

• D. WPA2

Answer – C

141. Which wireless hacking tool attacks WEP and WPA-PSK?

• A. Airguard

• B. wificracker

• C. Aircrack-ng

• D. WLAN-crack

Answer – C

142. Which of the following techniques will identify if computer files have been changed?

• A. Network sniffing

• B. Integrity checking hashes

• C. Firewall alerts

• D. Permissions sets

Answer – B

143. Nation-state threat actors often discover vulnerabilities and hold on to them until they want to launch a sophisticated attack.Stuxnet attack was an unprecedented style of attack because it used four types of this vulnerability. What is this style of attack called?

• A. zero-sum

• B. zero-day

• C. no-day

• D. zero-hour

Answer – B

144. An individual who aims to bring down critical infrastructure for a “cause” and is not worried about facing 30 years in jail for their action.

• A. Black Hat

• B. Suicide Hacker

• C. Gray Hat

• D. White Hat

Answer – B 

145. During a security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?

• A. Terminate the audit

• B. Identify and evaluate existing practices

• C. Create a procedures document

• D. Conduct compliance testing

Answer – B

146. As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing. What document describes the specifics of the testing, the associated violations, and essentially protects both the organization’s interest and your liabilities as a tester?

• A. Project Scope

• B. Rules of Engagement

• C. Service Level Agreement 

• D. Non-disclosure Agreement

  Answer – B

147. An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events do not match up. What is the most likely cause?

• A. The attacker altered or erased events from the logs.

• B. Proper chain of custody was not observed while collecting the logs.

• C. The security breach was a false positive.

• D. The network devices are not all synchronized.

Answer – A

148. While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts and displays a video of cats playing a piano. The next business day, the user receives what looks like an email from his bank, indicating that his bank account has been accessed from a foreign country.
The email asks the user to call his bank and verify the authorization of a funds transfer that took
place. What Web browser-based security vulnerability was exploited to compromise the user?

• A. Web form input validation

• B. Cross-Site Request Forgery

• C. Clickjacking

• D. Cross-Site Scripting

Answer – B

149. This phase will increase the odds of success in later phases of the penetration test. It is also the very first step in Information Gathering, and it will tell you what the “landscape” looks like.
What is the most important phase of ethical hacking in which you need to spend a considerable
amount of time?

• A. Gaining access

• B. Escalating privileges

• C. Network mapping

• D. Footprinting

Answer – D

150. Which of the following is a command line packet analyzer similar to GUI- based Wireshark?

• A. Ethereal

• B. Nessus

• C. Tcpdump

• D. John the ripper

Answer – C

151. Which of the following is the structure designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?

• A. SOA

• B. Biometrics

• C. PKI

• D. Single sign on

Answer – C

152. Which of the following incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an organization?

• A. Containment phase

• B. Recovery phase

• C. Identification phase

• D. Preparation phase

Answer – D

153. Which of the following is a protocol specifically designed for transporting event messages?

• A. ICMP

• B. SMS

• C. RDP

• D. SYSLOG

Answer – D

154. You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration?
alert tcp any any -> 192.168.100.0/24 21 (msg: “”FTP on the network!””;)

• A. FTP Server rule

• B. A Router IPTable

• C. An Intrusion Detection System

• D. A firewall IPTable

Answer – C

155. You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist’s email, and you send her an email changing the source email to her boss’s email ( boss@company ). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your malicious links (these links contain malware) and send back the modified pdf, saying that the links don’t work. She reads your email, opens the links, and her machine gets infected. You now have access to the company network. What testing method did you use?

• A. Piggybacking

• B. Social engineering

• C. Tailgating

• D. Eavesdropping

Answer – B

156. An attacker changes the profile information of a particular user (victim) on the target website. The attacker uses this string to update the victim’s profile to a text file and then submit the data to the attacker’s database.

What is this type of attack (that can use either HTTP GET or HTTP POST) called?

• A. SQL Injection

• B. Cross-Site Scripting

• C. Browser Hacking

• D. Cross-Site Request Forgery

Answer – B

157. Which of the following is a design pattern based on distinct pieces of software providing application functionality as services to other applications?

• A. Service Oriented Architecture

• B. Agile Process

• C. Lean Coding

• D. Object Oriented Architecture

Answer – A 

158. After trying multiple exploits, you’ve gained root access to a Centos 6 server. To ensure you maintain access, what would you do first?

• A. Disable Key Services

• B. Create User Account

• C. Disable IPTables

• D. Download and Install Netcat

Answer – D

159. This international organization regulates billions of transactions daily and provides security guidelines to protect personally identifiable information (PII). These security controls provide a baseline and prevent low-level hackers sometimes known as script kiddies from causing a data breach. Which of the following organizations is being described?

• A. International Security Industry Organization (ISIO)

• B. Payment Card Industry (PCI)

• C. Institute of Electrical and Electronics Engineers (IEEE)

• D. Center for Disease Control (CDC)

Answer – B

160. What is the process of logging, recording, and resolving events that take place in an organization?

• A. Security Policy

• B. Internal Procedure

• C. Incident Management Process

• D. Metrics

Answer – C