An attacker is scanning a network and encounters a system that responds to TCP connections on ports 22, 80, and 443. The system's banner on port 22 says 'OpenSSH 7.2', but the system's OS fingerprint suggests it is running Windows Server 2019. The attacker also notices that the system responds to ICMP echo requests, but the TTL value is 64, which is typical for Linux, not Windows. Which combination of clues most strongly indicates that this is a honeypot?

The TTL value of 64 is typical for Linux.

The system responds to ICMP echo requests.

The system has multiple open ports.

The OpenSSH banner is inconsistent with the Windows OS fingerprint.

Which best practice can reduce the risk of an attacker using source port manipulation to bypass firewall rules?

Configuring firewall rules to filter on both source and destination ports and not trusting source ports alone

Allowing all traffic from port 53

Disabling the firewall's logging feature

Using only stateless packet filtering

Which countermeasure can improve the realism of a honeypot and make it harder for attackers to detect?

Using the same default configuration as all other honeypots

Placing the honeypot on a separate network with no connection to the internet

Generating realistic background traffic and normal user activity on the honeypot

Disabling all logging on the honeypot

EC-CouncilCertified Ethical Hacker

Domain 4Objective 5

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 1)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 1–5

1expert · hard
An attacker is scanning a network and encounters a system that responds to TCP connections on ports 22, 80, and 443. The system's banner on port 22 says 'OpenSSH 7.2', but the system's OS fingerprint suggests it is running Windows Server 2019. The attacker also notices that the system responds to ICMP echo requests, but the TTL value is 64, which is typical for Linux, not Windows. Which combination of clues most strongly indicates that this is a honeypot?
Select an answer first
2foundation · easy
Which IDS detection method is most likely to generate a high number of false positives because it flags any deviation from a learned baseline of normal network behavior?
Select an answer first
3foundation · easy
Which best practice can reduce the risk of an attacker using source port manipulation to bypass firewall rules?
Select an answer first
4foundation · easy
Which countermeasure can improve the realism of a honeypot and make it harder for attackers to detect?
Select an answer first
5foundation · easy
An IDS uses a database of known attack patterns and compares incoming traffic against these patterns to generate alerts. Which detection method is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 1)

Questions 1–5

Which IDS detection method is most likely to generate a high number of false positives because it flags any deviation from a learned baseline of normal network behavior?

Which best practice can reduce the risk of an attacker using source port manipulation to bypass firewall rules?

Which countermeasure can improve the realism of a honeypot and make it harder for attackers to detect?

An IDS uses a database of known attack patterns and compares incoming traffic against these patterns to generate alerts. Which detection method is being used?

Keep studying — Network and Perimeter Hacking