Question 1

NTP allows you to set the clocks on your systems very accurately, to within 100ms and sometimes-even 10ms. Knowing the exact time is extremely important for enterprise security. Various security protocols depend on an accurate source of time information in order to prevent 'playback' attacks. These protocols tag their communications with the current time, to prevent attackers from replaying the same communications, e.g., a login/password interaction or even an entire communication, at a later date. One can circumvent this tagging, if the clock can be set back to the time the communication was recorded. An attacker attempts to try corrupting the clocks on devices on your network. You run Wireshark to detect the NTP traffic to see if there are any irregularities on the network. What port number you should enable in Wireshark display filter to view NTP packets?

Options :

A : TCP Port 124

B : UDP Port 125

C : UDP Port 123

D : TCP Port 126

Answer: C

Question 2

In the following example, which of these is the 'exploit'?

Today, Microsoft Corporation released a security notice. It detailed how a person could bring down the Windows 2003 Server operating system, by sending malformed packets to it. They detailed how this malicious process had been automated using basic scripting. Even worse, the new automated method for bringing down the server has already been used to perform denial of service attacks on many large commercial websites. Select the best answer.

Options :

A : Microsoft Corporation is the exploit.

B : The security 'hole' in the product is the exploit.

C : Windows 2003 Server

D : The exploit is the hacker that would use this vulnerability.

E : The documented method of how to use the vulnerability to gain unprivileged access.

Answer: A

Question 3

Shayla is an IT security consultant, specializing in social engineering and external penetration tests. Shayla has been hired on by Treks Avionics, a subcontractor for the Department of Defense. Shayla has been given authority to perform any and all tests necessary to audit the company's network security. No employees for the company, other than the IT director, know about Shayla's work she will be doing. Shayla's first step is to obtain a list of employees through company website contact pages. Then she befriends a female employee of the company through an online chat website. After meeting with the female employee numerous times, Shayla is able to gain her trust and they become friends. One day, Shayla steals the employee's access badge and uses it to gain unauthorized access to the Treks Avionics offices. What type of insider threat would Shayla be considered?

Options :

A : She would be considered an Insider Affiliate

B : Because she does not have any legal access herself, Shayla would be considered an Outside Affiliate

C : Shayla is an Insider Associate since she has befriended an actual employee

D : Since Shayla obtained access with a legitimate company badge; she would be considered a Pure Insider

Answer: A

Question 4

Exhibit:

Based on the following extract from the log of a compromised machine, what is the hacker really trying to steal?

Options :

A : har.txt

B : SAM file

C : wwwroot

D : Repair file

Answer: B

Question 5

What is the essential difference between an 'Ethical Hacker' and a 'Cracker'?

Options :

A : The ethical hacker does not use the same techniques or skills as a cracker.

B : The ethical hacker does it strictly for financial motives unlike a cracker

C : The ethical hacker has authorization from the owner of the target.

D : The ethical hacker is just a cracker who is getting paid.

Answer: C

Confidently Practice Online with Free CPEH-001 Exam Cram

Buying Options: