GAQM CEH-001 問題集

質問 1：
More sophisticated IDSs look for common shellcode signatures. But even these systems can be bypassed, by using polymorphic shellcode. This is a technique common among virus writers ?it basically hides the true nature of the shellcode in different disguises.
How does a polymorphic shellcode work?
A. They encrypt the shellcode by XORing values over the shellcode, using loader code to decrypt the shellcode, and then executing the decrypted shellcode
B. They reverse the working instructions into opposite order by masking the IDS signatures
C. They compress shellcode into normal instructions, uncompress the shellcode using loader code and then executing the shellcode
D. They convert the shellcode into Unicode, using loader to convert back to machine code then executing them
正解：A

質問 2：
What is the default Password Hash Algorithm used by NTLMv2?
A. DES
B. SHA-1
C. MD5
D. MD4
正解：C

質問 3：
Jim's organization has just completed a major Linux roll out and now all of the organization's systems are running the Linux 2.5 kernel. The roll out expenses has posed constraints on purchasing other essential security equipment and software. The organization requires an option to control network traffic and also perform stateful inspection of traffic going into and out of the DMZ.
Which built-in functionality of Linux can achieve this?
A. IP Sniffer
B. IP ICMP
C. IP Tables
D. IP Chains
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
The traditional traceroute sends out ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets take to reach the destination.
The problem is that with the widespread use of firewalls on the Internet today, many of the packets that traceroute sends out end up being filtered, making it impossible to completely trace the path to the destination.

How would you overcome the Firewall restriction on ICMP ECHO packets?
A. Firewalls will permit inbound TCP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
B. \> JOHNTHETRACER www.eccouncil.org -F -evade
C. Firewalls will permit inbound UDP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
D. Firewalls will permit inbound UDP packets to specific ports that hosts sitting behind the firewall are listening for connections. By sending out TCP SYN packets instead of ICMP ECHO packets, traceroute can bypass the most common firewall filters.
E. Do not use traceroute command to determine the path packets take to reach the destination instead use the custom hacking tool JOHNTHETRACER and run with the command
正解：A

質問 5：
Why would an attacker want to perform a scan on port 137?
A. To disrupt the NetBIOS SMB service on the target host
B. To check for file and print sharing on Windows systems
C. To discover proxy servers on a network
D. To discover information about a target host using NBTSTAT
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c

What is the hexadecimal value of NOP instruction?
A. 0x60
B. 0x90
C. 0x70
D. 0x80
正解：B