Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of a honeypot in network security?

   • ATo replace the need for a traditional firewall
   • BTo encrypt all network traffic to protect data in transit
   • CTo block all malicious traffic from entering the network
   • DTo act as a decoy system that attracts attackers and gathers information about their activities
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is attempting to evade a signature-based NIDS that flags a specific exploit string. The tester needs to deliver the exploit payload without triggering the signature. Which technique is most likely to succeed?

   • AFragment the payload across multiple packets with overlapping offsets
   • BUse a different source IP address for each packet
   • CSend the payload in a single large packet
   • DIncrease the TTL value on the packets
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An attacker splits a malicious payload across multiple small IP fragments so that the IDS cannot reassemble and inspect the full packet. Which IDS evasion technique is being used?

   • AFragmentation
   • BIP spoofing
   • CObfuscation
   • DEncryption
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is tuning an IDS that has been generating a high volume of false positives. The IDS is currently using signature-based detection. The analyst needs to reduce false positives while maintaining the ability to detect new, previously unseen attacks. Which approach best addresses this requirement?

   • ADisable the signature-based detection and rely solely on anomaly-based detection
   • BSwitch to stateful protocol analysis only
   • CKeep signature-based detection and add anomaly-based detection with a baseline of normal traffic
   • DIncrease the sensitivity of the signature-based detection rules
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has deployed a signature-based IDS and a stateful firewall. They are experiencing false positives from the IDS due to legitimate traffic that matches attack signatures. They want to reduce false positives without significantly increasing false negatives. Which approach is most effective?

   • ADisable the IDS and rely solely on the firewall.
   • BTune the IDS signatures to the specific applications and services used in the environment.
   • CIncrease the sensitivity of the IDS to catch more attacks.
   • DSwitch to an anomaly-based IDS without tuning the baseline.
   Reveal Solution Discussion Select an answer first