CEH - Chap 3

1. To remove malware from the network before it gets to the endpoint, you would use which of the following?

• A. Packet filter
• B. Application layer gateway
• C. Unified threat management appliance
• D. Stateful firewall

2. If you were on a client engagement and discovered that you left an external hard drive with essential data on it at home, which security principle would you be violating?

• A. Confidentiality
• B. Integrity
• C. Nonrepudiation
• D. Availability

3. How would you calculate risk?

• A. Probability * loss value
• B. Probability * mitigation factor
• C. (Loss value + mitigation factor) * (loss value/probability)
• D. Probability * mitigation factor

4. Which of the following is one factor of a defense-in-depth approach to network design?

• A. Switches
• B. Using Linux on the desktop
• C. Optical cable connections
• D. Access control lists on routers

5. How would you ensure that confidentiality is implemented in an organization?

• A. Watchdog processes
• B. Encryption
• C. Cryptographic hashes
• D. Web servers

6. An intrusion detection system can perform which of the following functions?

• A. Block traffic
• B. Filter traffic based on headers
• C. Generate alerts on traffic
• D. Log system messages

7. Which of these would be an example of a loss of integrity?

• A. User making changes to a file and saving it
• B. Bad blocks flagged on disk
• C. Credit cards passed in cleartext
• D. Memory failures causing disk drivers to run incorrectly

8. What would you use a security information event manager for?

• A. Aggregating and providing search for log data
• B. Managing security projects
• C. Escalating security events
• D. Storing open source intelligence

9. Why is it important to store system logs remotely?

• A. Local systems can’t handle it.
• B. Bandwidth is faster than disks.
• C. Attackers might delete local logs.
• D. It will defend against attacks.

10. What would be necessary for a TCP conversation to be considered established by a state-ful firewall?

• A. Final acknowledgment message
• B. Three-way handshake complete
• C. Sequence numbers aligned
• D. SYN message received