A security analyst has deployed a honeypot to attract attackers. However, attackers are quickly identifying the honeypot and avoiding it. The analyst needs to make the honeypot more realistic to improve its effectiveness. Which action is most likely to achieve this goal?

Use a well-known honeypot tool without any customization

Add realistic network traffic and user activity to the honeypot

Disable logging on the honeypot to avoid detection

Remove all network services from the honeypot to reduce the attack surface

An attacker notices that a system on the network responds to every port scan with the same banner and does not generate any normal background traffic. The attacker suspects it is a honeypot. Which technique is the attacker using to detect the honeypot?

Sending encrypted traffic to the honeypot

Fingerprinting the honeypot's behavior

Performing a denial-of-service attack on the honeypot

Using a firewall to block the honeypot

A network administrator is choosing an IDS for a network that frequently sees new, custom exploits that have no known signatures. The administrator wants to detect these novel attacks while minimizing false positives. Which IDS detection method is best suited for this requirement?

Stateful protocol analysis that tracks the state of network connections.

Signature-based detection with a frequently updated signature database.

A hybrid approach using only signature-based detection to avoid false positives.

Anomaly-based detection that establishes a baseline of normal traffic and alerts on deviations.

EC-CouncilCertified Ethical Hacker

Domain 4Objective 5

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 3)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 11–15

11expert · hard
A security analyst has deployed a honeypot to attract attackers. However, attackers are quickly identifying the honeypot and avoiding it. The analyst needs to make the honeypot more realistic to improve its effectiveness. Which action is most likely to achieve this goal?
Select an answer first
12foundation · easy
Which firewall evasion technique involves encapsulating one protocol inside another, such as sending HTTP traffic inside an SSH tunnel, to bypass firewall rules that only allow certain protocols?
Select an answer first
13foundation · easy
An attacker notices that a system on the network responds to every port scan with the same banner and does not generate any normal background traffic. The attacker suspects it is a honeypot. Which technique is the attacker using to detect the honeypot?
Select an answer first
14foundation · easy
An attacker sends packets from source port 53 (DNS) to bypass a firewall rule that only allows DNS traffic. Which firewall evasion technique is this?
Select an answer first
15application · medium
A network administrator is choosing an IDS for a network that frequently sees new, custom exploits that have no known signatures. The administrator wants to detect these novel attacks while minimizing false positives. Which IDS detection method is best suited for this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 3)

Questions 11–15

A security analyst has deployed a honeypot to attract attackers. However, attackers are quickly identifying the honeypot and avoiding it. The analyst needs to make the honeypot more realistic to improve its effectiveness. Which action is most likely to achieve this goal?

Which firewall evasion technique involves encapsulating one protocol inside another, such as sending HTTP traffic inside an SSH tunnel, to bypass firewall rules that only allow certain protocols?

An attacker notices that a system on the network responds to every port scan with the same banner and does not generate any normal background traffic. The attacker suspects it is a honeypot. Which technique is the attacker using to detect the honeypot?

An attacker sends packets from source port 53 (DNS) to bypass a firewall rule that only allows DNS traffic. Which firewall evasion technique is this?

A network administrator is choosing an IDS for a network that frequently sees new, custom exploits that have no known signatures. The administrator wants to detect these novel attacks while minimizing false positives. Which IDS detection method is best suited for this requirement?

Keep studying — Network and Perimeter Hacking