- (Topic 2)
In which step Steganography fits in CEH System Hacking Cycle (SHC)

1. A. Step 2: Crack the password
2. B. Step 1: Enumerate users
3. C. Step 3: Escalate privileges
4. D. Step 4: Execute applications
5. E. Step 5: Hide files
6. F. Step 6: Cover your tracks

Correct Answer: E

- (Topic 5)
Which system consists of a publicly available set of databases that contain domain name registration contact information?

1. A. WHOIS
2. B. IANA
3. C. CAPTCHA
4. D. IETF

Correct Answer: A

- (Topic 2)
You have successfully gained access to a victim's computer using Windows 2003 Server SMB Vulnerability. Which command will you run to disable auditing from the cmd?

1. A. stoplog stoplog ?
2. B. EnterPol /nolog
3. C. EventViewer o service
4. D. auditpol.exe /disable

Correct Answer: D

- (Topic 8)
Rebecca has noted multiple entries in her logs about users attempting to connect on ports that are either not opened or ports that are not for public usage. How can she restrict this type of abuse by limiting access to only specific IP addresses that are trusted by using one of the built-in Linux Operating System tools?

1. A. Ensure all files have at least a 755 or more restrictive permissions.
2. B. Configure rules using ipchains.
3. C. Configure and enable portsentry on his server.
4. D. Install an intrusion detection system on her computer such as Snort.

Correct Answer: B
ipchains is a free software based firewall for Linux. It is a rewrite of Linux's previous IPv4 firewalling code, ipfwadm. In Linux 2.2, ipchains is required to administer the IP packet filters. ipchains was written because the older IPv4 firewall code used in Linux
2.0 did not work with IP fragments and didn't allow for specification of protocols other than TCP, UDP, and ICMP.

- (Topic 2)
Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?

1. A. The switches will drop into hub mode if the ARP cache is successfully flooded.
2. B. If the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to attacks.
3. C. Depending on the switch manufacturer, the device will either delete every entry in its ARP cache or reroute packets to the nearest switch.
4. D. The switches will route all traffic to the broadcast address created collisions.

Correct Answer: A