Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH > CEH > Flashcards

CEH Flashcards

1
Q

What is the nmap parameter for aggressive scanning?

A

-A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the nmap parameter for enabling the script engine?

A

-sC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the nmap parameter used for OS fingerprinting?

A

-O

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the nmap parameter used to identify the path taken by a packet as it travels toward the destination?

A

–traceroute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What nmap parameter is used to disable ICMP pings?

A
  • P0 or -PN (old)

- Pn (new)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What nmap parameter configures nmap to perform a stealth scan, also known as a SYN scan or half-open scan?

A

-sS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What nmap parameter configures nmap to disable DNS?

A

-n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What nmap parameter configures nmap to always perform DNS?

A

-R

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What nmap command is equivalent to nmap -A?

A

nmap -sV -sC -O –traceroute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is JXplorer?

A

Java-based LDAP browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Luma?

A

Python-based LDAP browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Coral Directory?

A

LDAP browser specific to Windows 2000 or later

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Cloudborne attacks?

How can they be mitigated?

A

firmware backdoor is installed on cloud server that is later repurposed for another client

Reflash the firmware on a server before repurposing it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What was Operation Cloud Hopper?

A

Spear phishing was used to infiltrate cloud provider networks, enabling attackers to compromise target data stored in the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which MIB stores information about TCP/IP on network hosts as well as information about SNMP configuration itself?

A

MIB_II

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which MIB contains information about the network traffic between hosts and DHCP servers?

A

DHCP.MIB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which MIB contains information about workstation and server services?

A

LMMIB2.MIB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which MIB contains information the windows internet name service, a name resolution service for NetBIOS?

A

WINS.MIB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which MIB contains information about managing and monitoring resources on hosts on the network, such as host’s date and time, users, processes, memory, physical storage, etc.?

A

HOSTMIB.MIB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is KoreK chopchop?

A

An attack that can decrypt a WEP packet without requiring the key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is KRACK?

A

Key Reinstallation Attack. Replay attack that exploits WPA2’s four-way handshake process.
The attacker captures the shared secret and tricks the victim into reinstalling a key that is already in use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What type of information is included in a WHOIS query?

A

information about the IP network range from which the IP address was allocated
technical, administrative, and billing contact information for the parties associated with a particular domain name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which DNS records contain information about the OSs implemented and the hardware platforms in an organization?

A

HINFO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which nmap parameter configures nmap to perform an ACK scan?

A

-sA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a DROWN attack?

A

a vulnerability in servers that support SSLv2 related to its handling of the cipher text in an RSA certificate during the initial handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a linear cryptanalysis attack?

A

using both the plain text and corresponding cipher text to extract an encryption key. Also known as a known plaintext attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Describe blowfish

A

A symmetric 64-bit block cipher that uses a variable-length key ranging from 32 to 448 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Describe Twofish

A

A symmetric 128-bit block cipher that uses a key length of 128 or 256 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Describe IDEA

A

A symmetric 64-bit block cipher that uses a 128-bit key. It uses a series of eight rounds of 64-bit block encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Describe AES

A

A symmetric block cipher with 128 bit block size that uses a key length of 128, 192, or 256 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Describe 3DES

A

A 64-bit block symmetric encryption algorithm that uses multiple 56-bit passes to encrypt data, resulting in a 168-bit key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Describe RSA

A

An asymmetric encryption algorithm that uses prime numbers to generate keys, recommended at least 2048 bits long.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Describe SHA1

A

A hashing algorithm that creates a 160-bit hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which key is created when a TPM is manufactured?

A

endorsement key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which key is created when a user takes ownership of a TPM?

A

storage root key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is an STP attack?

A

rogue switch added to network and advertises as having the lowest bridge priority value, making it a root bridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is switch spoofing?

A

a VLAN hopping attack in which an attacker configures their system to act like a switch with a trunk port and uses DTP (dynamic trunking protocol) to negotiate a trunk link with a switch port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a MITC attack?

A

Attacker uses malware to steal synchronization tokens used to authenticate and synchronize data with cloud providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How can MITC attacks be mitigated?

A

Educating users about social engineering

Installing a CASB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is HULK?

A

HTTP Unbearable Load King tool

A tool that can initiate an HTTP flood and can evade IDSs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is MEDUSA?

A

Tool used to gather open-source intelligence (OSINT) from social media platforms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is hootsuite?

A

A social media management platform

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is VisualRotue?

A

a suite of networking tools that can visualize networking issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which port does SMB use?

A

445

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which port does SNMP use?

A

161 and 162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What algorithms do the different wireless protocols use to encrypt communications?

A

WEP: RC4
WPA: TKIP
WPA2: AES-CCMP
WPA3: AES-GCMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is dnsenum?

A

a Perl script used to enumerate DNS information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is Bluto?

A

a python script that can query a target domain for MX and NS records and can perform an AXFR query to discover subdomains. Can also brute force using Alexa Top 1 Million subdomains list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is SubBrute?

A

a python script used for DNS enumeration that recursively crawls enumerated DNS records similar to how a search engine spider crawls a website. Can enumerate any DNS record type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is InstaRecon?

A

A python-based DNS enumeration tool which adds the ability to use Shodan for performing queries and can perform reverse DNS lookups on an entire IP range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What do the various error directives in a php.ini file do?

A

error_log: configures the error log itself
log_errors: whether or not to write errors to log
display_errors: whether or not to display errors on browser
error_reporting: determines the level at which the PHP process will produce error messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is DGA?

A

Domain Generation Algorithm. Attack relying on domains that have not yet been categorized or classified by a reputation-based security system.
Commonly used to ensure that C2 systems remain accessible.
Malware dynamically generates predicable list of domain names that can be used to contact C2 server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is fast fluxing?

A

Using a network of compromised hosts to proxy services for an attacker. The attackers communications are dynamically proxied through the botnet, making it difficult for the security team to blacklist the IP of the hosts of the botnet

Can be mitigated by taking down the domain server that corresponds to the malicious domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is double fluxing?

A

similar to fast fluxing, but a separate botnet is used to proxy the DNS services for the attacker, protecting the attacker’s DNS server from takedown efforts

Can be mitigated by contacting the appropriate Top Level Domain (TLD) registrar to take down the domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What does the mod_negotiation module do on an Apache server?

A

Disables file extensions on the server. The file extensions are not revealed in the URL, and the extension of the file returned by the server is based on the browser’s preferences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Which parameter should be used to silence error messages when using the curl command to scrape hyperlinks from a webpage?

A

-s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is a DNS DDoS?

A

Flooding TCP port 53 of a DNS server with illegitimate traffic to deny access to the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is a DNS amplification attack?

A

A DRDoS attack in which attackers send a flood of DNS queries from their own servers, but the queries contain spoofed source addresses that are sent to the address of the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is DNS tunneling?

A

data exfiltration technique in which nonstandard traffic is sent over TCP port 53 in order to bypass firewall protections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What does the NSE smb-os-discovery script return?

A 
OS
Computer name
Domain name
Forest name
FQDN
NetBIOS name
NetBIOS domain name
Workgroup
System time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What does the NSE enip-info script return?

A 
If target device is listening on port 44818:
Device type
vendor ID
Product name
Serial number
Product Code
Revision number
Status
State
IP Address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What does the netbus-info NSE script return?

A 
Uses port 12345 to return:
Applications
Installation path
Restart persistence
User login ID
number of connected clients
Log settings
Password
Email address
SMTP server
Sound volume settings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What does the http-enum NSE script return?

A

exposed applications, directories, and files on web servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What does a passive aLTEr attack do?

A

Uses OSI Layer 2 meta-information to determine which sites a user visits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is an active aLTEr attack?

A

Attacker simulates a legitimate cell tower to redirect connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What is Maltego?

A

Software used for OSINT and forensics. Specializes in displaying info in graph format. Permits creating custom entities, allowing it to represent any type of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What was the previous name for Wireshark?

A

Ethereal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is Nessus?

A

A proprietary vulnerability scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What TTL value indicates a Windows OS?

A

128

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Describe the four iOS jailbreaking techniques

A

Tethered: Computer is required to boot and maintain jailbreak after restart
Untethered: Device remains jailbroken after restarting
Semi-tethered: Rebooting returns device to non-jailbroken status. Must use a computer to re-jailbreak
Semi-untethered: Device reboots to normal state, but can be re-jailbroken using an app installed on the device

71
Q

What are the common NetBIOS suffixes (also called NetBIOS End Character)?

A 
Unique names:
00: Workstation Name
03: Messenger service
06: remote access service
20: file service
21: Remote access service client
1B: domain master browser
1D: Master browser

Group names:
00: Workstation service (workgroup/domain name)
1C: domain controllers
1E: browser service elections

72
Q

What is RADIUS?

A

Remote Authentication Dial In User Service. AAA protocol for users who connect and use a networks service. Runs in the application layer and can use TCP or UDP. Provides 802.1X authentication.

73
Q

What are the different modes for Hping2?

A

default: TCP

- 1: ICMP

74
Q

What port do compromised IoT devices typically use to spread malware?

A

48101

75
Q

What type of web-service API uses HTTP methods such as PUT, POST, GET, and DELETE?

A

RESTful API

76
Q

What is Burp Suite?

A

A java-based web penetration testing framework. Industry standard suite of tools. Helps identify vulnerabilities and verify attack vectors affecting web apps

Can be classified as an interception proxy. Pen tester can configure their internet browser to route traffic through Burp Suite proxy server, which then acts as sort of a man in the middle, capturing and analyzing each request to and from the web app

77
Q

What SMTP command is used to verify a user ID on a mail domain?

A

VRFY

78
Q

Which SMTP command asks for confirmation about the ID of a mailing list?

A

EXPN

79
Q

What is an encryption virus?

A

Ransomware. Encrypts victims data and demands ransom to decrypt it

80
Q

What is a tunneling virus?

A

attempts to intercept anti-virus software before it can detect malicious code

81
Q

What is a teardrop attack?

A

DoS attacks in which an attacker sends several large overlapping IP fragments. When the victim system tries to reassemble the packets, the system will sometimes crash

82
Q

Which nmap parameter is used to perform a TCP ACK Ping scan?

A

-PA

83
Q

Which nmap parameter is used to indicate that nmap should not perform a port scan after performing host discovery?

A

-sn

84
Q

Which nmap parameter is used to perform a TCP SYN ping scan?

A

-PS

85
Q

Which nmap parameter is used to perform a UDP ping scan?

A

-PU

86
Q

What is Flowmon?

A

A company that provides network flow-based monitoring solutions

87
Q

What is Robotium?

A

An open-source test automation framework for Android apps

88
Q

What is URLFuzzer?

A

An app that uses fuzzing to seek out hidden files, directories, and other resources on a web server

89
Q

What is IntentFuzzer

A

a fuzzing framework which targets the Inter-process communication (IPC) mechanisms of Android apps

90
Q

Which type of nmap scan is most appropriate for scanning large IP ranges?

A

-PR ARP scan because it’s faster and more accurate than IP-based scans

91
Q

Which MSFVenom option is used to specify the output format?

A

-f or –format

92
Q

What file is a rich target to discover the structure of a website during web-server footprinting?

A

Robots.txt - used to control crawling access.

93
Q

What is the folder where the website files for a domain name are stored, such as index.php, index.html, default.html, etc.?

A

Document root

94
Q

What was operation cloud hopper?

A

Attackers used MSPs as intermediaries to acquire assets and trade secrets from MSP clients. Malware was delivered through spear-phishing emails. Stolen data was then compressed and exfiltrated from MSP’s network

95
Q

What is ZoomInfo?

A

Vancouver-based software company providing subscription-based SaaS services

96
Q

What is Factiva?

A

Business information and research tool which aggregates content from more than 32,000 news sources such as newspapers, journals, magazines, etc.

97
Q

What is Infoga?

A

Tool for gathering email account information from different public sources and checks to see if emails were leaked

98
Q

What is Netcraft

A

Internet services company from England. Provides cybercrime disruption services.

99
Q

What is cryptcat?

A

a tool that enables communication between two systems and encrypts the communication with twofish in order to evade IDS

100
Q

What is a webhook?

A

a method of augmenting or altering the behaviour of a web page or web app with custom callbacks
This is usually done with HTTP POST requests

101
Q

What is a TCP Maimon scan?

A

-sM
nmap scan using the FIN/ACK flags. a RST packet should be generated whether the port is open or closed. However, BSD-derived systems often drop the packet if it’s open

102
Q

What is a CRIME attack?

A

Compression Ratio Info-leak Made Easy. A security exploit against secret web cookies over connections using HTTPS and SPDY protocols. Can be used to perform session hijacking

103
Q

What is a slowloris attack?

A

DoS attack which allows single machine to take down another machine’s web server by keeping as many connections to the target server open, maxing out the concurrent connection pool

104
Q

What is Phlashing?

A

permanent DoS attack that exploits a vulnerability in network-based firmware updates. Currently theoretical.

105
Q

What is ike-scan?

A

a command-line IPSec VPN scanner and testing tool used to discover, fingerprint, and test IPSEC VPN systems

106
Q

What type of SQLi makes use of DNS to pass data to an attacker?

A

out-of-band

107
Q

What MSFVenom option can be used to manually specify the architecture for the output payload?

A

-a or –arch

108
Q

Which MSFVenom option can be used to specify characters which should not be included in the shellcode?

A

-b or –bard-chars

109
Q

Which MSFVenom option can be used to specify the payload?

A

-p or –payload

110
Q

Which techniques does Aircrack-ng use to crack WEP keys?

A

Dictionary
Pyshkin, Tews, Weinmann (PTW)
Fluhrer, Mantin, Shamir (FMS)
KoreK

111
Q

Which type of rootkit can migrate the OS into a VM?

A

hypervisor-level

They install themselves between the hardware layer and the OS

112
Q

What is the difference between DNS spoofing and DNS hijacking?

A

DNS spoofing is the same as poisoning. Malicious DNS data is inserted into a DNS server.
DNS hijacking is the same as DNS redirection. Malware is used to hijack DNS services and place them under the control of the attacker.
Rather than injecting data into a legitimate DNS server, DNS hijacking reconfigures the TCP/IP stack to point at a malicious server

113
Q

What is domain hijacking?

A

Registrar-level attack in which name servers assigned to resolve a target’s top-level domain are modified, redirecting requests for those domains to malicious servers

114
Q

If a computer’s data is protected with BitLocker and then Windows fails to start, how do you access the data?

A

Use the BitLocker recovery password

115
Q

What is the GNU Bash Shellshock vulnerability?

A

A vulnerability in GNU Bash versions 4.3 and earlier that enables an attacker to send trailing information in an environment variable and execute arbitrary commands on the remote host

116
Q

Which Bash shell file is parsed when Bash shell starts, automatically executing any config commands contained in the file?

A

.bashrc

Typically sets display coloring, command aliases, command history configurations, etc.

117
Q

Which Bash shell file contains a limited amount of the user’s command history?

A

.bash_history

118
Q

Which Bash shell file contains configuration commands that are executed when a user logs in and are only executed once regardless of the number of shells the user opens

A

.bash_profile

typically configured to search for a .bashrc file in order to configure command aliases and other info

119
Q

Which Bash shell file is executed when a user logs out of a session and contains cleanup routines?

A

.bash_logout

120
Q

Which cURL option is used to prevent errors from displaying in the output?

A

-s

121
Q

Which cURL option is used to specify a delimiter instead of the default delimiter?

A

-d

122
Q

Which cURL option is used to specify which field’s parsed input line will be included in the output line?

A

-f
Thus, -f 2 specifies that the second field will be in the output. As in, if a line is delimited into 2 parts, only the second part will be output

123
Q

What is the purpose of the classes.dex file in android apps?

A

It includes the java libraries that the app requires

124
Q

What is the RIR for China, India, Japan, and Australia?

A

APNIC

125
Q

What is the RIR for Africa and parts of the indian ocean?

A

AFRINIC

126
Q

What is the RIR for North America, including Canada and the US?

A

ARIN

127
Q

What is the RIR for Europe, the Middle East, and Central Asia?

A

RIPE NCC

128
Q

What is the RIR for Mexico, Central America, South America, and portions of the Caribbean?

A

LACNIC

129
Q

Where do network and agent-based vulnerability scanners operate from?

A

Network runs on a dedicated host such as an appliance or VM

Agent requires a small amount of code on each host to be scanned

130
Q

What is Zigbee?

A

Wireless communications protocol used in electronics such as switches, timers, remote controls, and sensors.
Low-cost alternative to other wireless PANs, but has a short range

131
Q

What is NB-IoT?

A

Narrowband-IoT. A cellular WAN tech used to power cellular services that do not operate on LTE. Can be considered a cellular implementation of LPWAN

132
Q

What is MQTT?

A

Message Queuing Telemetry Transport. a TCP/IP publish/subsribe network used to send messages between devices. Intended for use in remote environments with limited bandwidth. Involves message brokers (servers) and clients.

133
Q

What is LPWAN?

A

Low-Power Wide Area Network. A wireless comm protocol used to communicate over long distances at a low bit rate. Low cost to implement and maintain

134
Q

What is juice jacking?

A

A type of malware attack that exploits USB power delivery systems to inject malware into a phone or tablet

135
Q

What is XML-RPC?

A

an HTTP-based call method which returns a single result in XML format

136
Q

What year was XML-RPC first developed?

A

1998

137
Q

What is NSTX?

A

A tool that is used to tunnel IP traffic within DNS packets

138
Q

What is Bitvisie?

A

a windows-based tool used to tunnel packets over SSH

139
Q

What is Loki?

A

A tool used to tunnel traffic over ICMP

140
Q

What is Super Network Tunnel?

A

A tool used to tunnel packets over HTTP

141
Q

What is a Mirai attack?

A

Very pervasive IoT malware. Spreads by scanning for vulnerable IoT devices, typically through port 48101

142
Q

What is a Heartbleed attack?

A

An OpenSSL vulnerability that allows an attacker to obtain approximately 65kb of information from a server’s memory at regular intervals. Allows attackers to obtain a server’s private key, enabling the decryption of communications

143
Q

What is a Gobuster attack?

A

a command line tool that can be used to enumerate applications, directories, and files, including hidden ones, on internet connected web servers

144
Q

What is a Dragonblood attack?

A

a vulnerability in WPA3 that allows attackers to steal passwords and crash WAPs. Caused by design flaws in the Dragonfly key exchange mechanism used by WPA3

145
Q

What are the 4 components of a risk assessment?

A

Technical, Organizational, Physical, and Administrative safeguards

146
Q

Describe a counter-based authentication system

A

Authentication system which creates one time passwords that are encrypted with secret keys. A counter value kept on the authenticating server is also used to generate the OTP

147
Q

What is blackjacking?

A

hijacking a blackberry connection, usually with the BBProxy tool

148
Q

What are the names of two vulnerabilities in modern processors such as Intel, AMD, and ARM using speculative execution?

A

Spectre and Meltdown

149
Q

Which nmap parameter is used to change the scan speed?

A

-Tx

x is replaced with numbers 0-5

150
Q

What is tcpdump?

A

A command-line packet analyzer that can be used for OS fingerprinting

151
Q

What is hping?

A

an open-source packet generator and analyzer for TCP/IP protocol. Inspired by ping unix command, but not limited to ICMP echo

152
Q

Which SMTP command is used to transmit email over TLS?

A

STARTTLS

153
Q

What is nessus?

A

a vulnerability scanner

154
Q

What is code emulation?

A

a virus detection technique in which a virtual machine is implemented to simulate CPU and memory management to mimic code execution. Malicious code is simulated in the virtual machine and no virus code is executed by the real processor

155
Q

What is a Markov Chain?

A

A password cracking technique in which attackers assemble a password database, split each password, and calculate the probability of placing characters in a quasi-brute attack

156
Q

What is PRINCE?

A

Probability Infinite Chained Elements. Uses an algorithm to try the most likely password candidates with a refined combinator attack. Creates chains of combined words using a single dictionary

157
Q

At which layer do sniffers operate?

A

Layer 2

158
Q

Which open port indicates a network device is likely a printer?

A

515

159
Q

Which IPSec mode should be used to ensure integrity and confidentiality of data on the same LAN?

A

ESP Transport

160
Q

Which IPSec mode should be used to ensure the integrity of LAN data?

A

AH transport

161
Q

Which IPSec mode should be used to ensure integrity and confidentiality of data between networks?

A

ESP tunnel mode

162
Q

Which IPSec mode should be used to ensure integrity of data between networks?

A

AH tunnel

163
Q

Which linux command is used to resolve a domain name into an IP address?

A

host -t a

164
Q

What is crypter?

A

a type of software that can encrypt, obfuscate, and manipulate malware to make it harder to detect by security programs

165
Q

What is dropper?

A

a program that secretly installs malicious programs

166
Q

What is global deduction?

A

attacker discovers a functionally equivalent algorithm for encryption and decryption, without learning the key

167
Q

What is instance (local) deduction?

A

attacker discovers additional plaintext (or cipherteexts) not previously known

168
Q

hat is information deduction?

A

attacker gains some Shannon information about plaintexts or ciphertexts not previously known

169
Q

What is ettercap?

A

a free and open soruuce network security tool for MITM attacks on LAN

170
Q

Where does active sniffing occur vs passive sniffing?

A

active is on switch, passive is on hub

171
Q

What is the min number of network connections in a multihomed firewall?

A

2

172
Q

What is nikto?

A

a free software command-line vulnerability scanner for webservers

173
Q

What is chntpw?

A

a linux-based software utility for resetting or blanking local passwords on windows.

174
Q

Which nmap parameter can be used to help evade IDS systems?

A

-T (0 and 1 option)

CEH (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions