A security team wants to deploy a honeypot to detect attackers who have already breached the perimeter. They need to capture detailed attacker actions and malware samples, but they have limited staff to monitor and maintain the system. Which type of honeypot best balances the need for detailed intelligence with the operational burden?

A high-interaction honeypot running a full operating system and services, with no restrictions on attacker activity.

A medium-interaction honeypot that emulates services and logs attacker commands, but does not provide a real shell.

A honeynet consisting of multiple high-interaction honeypots behind a gateway that controls outbound traffic.

A low-interaction honeypot that only emulates a few TCP ports and logs connection attempts.

A penetration tester is trying to evade a network-based IDS that uses signature matching. The tester wants to send a known exploit payload but modify it so the signature does not match. Which technique is most effective for this purpose?

Increasing the TTL value to make the packet appear to come from a different network.

Encoding the payload using a different character encoding than the IDS expects.

Using a different source port for the connection.

Sending the payload in a single large packet to overwhelm the IDS.

A network administrator wants to monitor traffic for signs of malicious activity and generate alerts, but does not want to block any traffic. Which type of device should be deployed?

Intrusion detection system (IDS)

Intrusion prevention system (IPS)

A security team wants to deploy a honeypot to gather intelligence on attacker tools and techniques. They have a limited budget and need to deploy the honeypot on a single server. The primary goal is to capture detailed attacker interactions, including commands and file uploads. Which type of honeypot is most appropriate for this goal?

A honeynet with multiple honeypots on separate servers

A medium-interaction honeypot that simulates services with more depth than low-interaction

A high-interaction honeypot running a real operating system and services

A low-interaction honeypot that emulates a few common services

A security engineer is testing the firewall's ability to block unauthorized traffic. The firewall is configured to block all inbound traffic except for TCP port 22 (SSH) and TCP port 443 (HTTPS). The engineer wants to test if the firewall can be bypassed using a covert channel. Which technique is most likely to succeed?

Using a tunneling protocol over ICMP

Using source port manipulation to use source port 22 for all traffic

Using IP address spoofing to appear as a trusted host

Using SSH tunneling to encapsulate other traffic

EC-CouncilCertified Ethical Hacker

Domain 4Objective 5

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 2)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 6–10

6application · medium
A security team wants to deploy a honeypot to detect attackers who have already breached the perimeter. They need to capture detailed attacker actions and malware samples, but they have limited staff to monitor and maintain the system. Which type of honeypot best balances the need for detailed intelligence with the operational burden?
Select an answer first
7application · medium
A penetration tester is trying to evade a network-based IDS that uses signature matching. The tester wants to send a known exploit payload but modify it so the signature does not match. Which technique is most effective for this purpose?
Select an answer first
8foundation · easy
A network administrator wants to monitor traffic for signs of malicious activity and generate alerts, but does not want to block any traffic. Which type of device should be deployed?
Select an answer first
9application · medium
A security team wants to deploy a honeypot to gather intelligence on attacker tools and techniques. They have a limited budget and need to deploy the honeypot on a single server. The primary goal is to capture detailed attacker interactions, including commands and file uploads. Which type of honeypot is most appropriate for this goal?
Select an answer first
10expert · hard
A security engineer is testing the firewall's ability to block unauthorized traffic. The firewall is configured to block all inbound traffic except for TCP port 22 (SSH) and TCP port 443 (HTTPS). The engineer wants to test if the firewall can be bypassed using a covert channel. Which technique is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 2)

Questions 6–10

A penetration tester is trying to evade a network-based IDS that uses signature matching. The tester wants to send a known exploit payload but modify it so the signature does not match. Which technique is most effective for this purpose?

A network administrator wants to monitor traffic for signs of malicious activity and generate alerts, but does not want to block any traffic. Which type of device should be deployed?

Keep studying — Network and Perimeter Hacking