Certified Ethical Hacker 4

Which of the following describes the characteristics of a Boot Sector Virus?

• Moves the MBR to another location on the hard disk and copies itself to the original location of

  the MBR

• Moves the MBR to another location on the RAM and copies itself to the original location of the MBR

• Modifies directory table entries so that directory entries point to the virus code instead of the actual program

• Overwrites the original MBR and only executes the new virus code

Identify the web application attack where the attackers exploit vulnerabilities in dynamically generated web pages to inject client-side script into web pages viewed by other users.

• SQL injection attack

• Cross-Site Scripting (XSS)

• LDAP Injection attack

• Cross-Site Request Forgery (CSRF)

An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

• He will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.

• He will activate OSPF on the spoofed root bridge.

• He will repeat the same attack against all L2 switches of the network.

• He will repeat this action so that it escalates to a DoS attack.

Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. Which of the following is the correct bit size of the Diffie-Hellman (DH) group 5?

• 768 bit key

• 1025 bit key

• 1536 bit key

• 2048 bit key

What is the following command used for?

net use \targetipc$ "" /u:""

• Grabbing the etc/passwd file

• Grabbing the SAM

• Connecting to a Linux computer through Samba.

• This command is used to connect as a null session

• Enumeration of Cisco routers

Which of the following Secure Hashing Algorithm (SHA) produces a 160-bit digest from a message with a maximum length of (264-1) bits and resembles the MD5 algorithm?

• SHA-2

• SHA-3

• SHA-1

• SHA-0

Emil uses nmap to scan two hosts using this command.

nmap -sS -T4 -O 192.168.99.1 192.168.99.7

He receives this output:

• Host 192.168.99.7 is an iPad

• He performed a SYN scan and OS scan on hosts 192.168.99.1 and 192.168.99.7.

• Host 192.168.99.1 is the host that he launched the scan from

• Host 192.168.99.7 is down.

A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers.

• Use port security on his switches.

• Use a tool like ARPwatch to monitor for strange ARP activity.

• Use a firewall between all LAN segments.

• If you have a small network, use static ARP entries.

• Use only static IP addresses on all PC's.

LM hash is a compromised password hashing function. Which of the following parameters describe LM Hash:?

I - The maximum password length is 14 characters. II - There are no distinctions between uppercase and lowercase.

III - It's a simple algorithm, so 10,000,000 hashes can be generated per second.

• I

• I, II, and III

• II

• I and II

Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor". Here is the output of the SIDs:

• John

• Rebecca

• Sheela

• Shawn

• Chang