A security analyst is investigating a series of alerts from an IDS. The IDS uses anomaly-based detection and has flagged a sudden increase in outbound traffic from a single workstation to an external IP address. The analyst needs to determine if this is a true positive or a false positive. Which additional information would be most useful in making this determination?

The firewall logs for the same time period

The signature of the traffic pattern

The source and destination IP addresses

The baseline of normal traffic for that workstation

A security administrator is concerned about attackers using IP spoofing to evade the network's firewall. The administrator wants to implement a countermeasure to detect and block spoofed traffic. Which action is most effective?

Increase the number of firewall rules

Deploy a network-based IDS to monitor for unusual traffic patterns

Enable ingress filtering on the firewall to block traffic with invalid source IP addresses

An attacker is scanning a network and encounters a system that responds to connection attempts on multiple ports but does not respond to ICMP ping. The attacker suspects it might be a honeypot. Which additional clue would most strongly confirm the honeypot suspicion?

The system's banner displays an outdated software version that is inconsistent with the OS it appears to run.

The system's MAC address is from a well-known network card vendor.

The system responds to TCP connections but not to UDP probes.

The system has a hostname that matches the organization's naming convention.

A security team is planning to deploy a honeynet to study attacker behavior. The team has a limited budget and needs to deploy the honeynet with minimal maintenance. Which type of honeypot is most appropriate for this scenario?

A high-interaction honeypot running a full operating system

A medium-interaction honeypot that simulates services with more depth

A honeynet with multiple high-interaction honeypots

A low-interaction honeypot that emulates a few services

EC-CouncilCertified Ethical Hacker

Domain 4Objective 5

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 5)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 21–25

21expert · hard
A security analyst is investigating a series of alerts from an IDS. The IDS uses anomaly-based detection and has flagged a sudden increase in outbound traffic from a single workstation to an external IP address. The analyst needs to determine if this is a true positive or a false positive. Which additional information would be most useful in making this determination?
Select an answer first
22application · medium
A security administrator is concerned about attackers using IP spoofing to evade the network's firewall. The administrator wants to implement a countermeasure to detect and block spoofed traffic. Which action is most effective?
Select an answer first
23foundation · easy
Which tool is commonly used to test firewall rules by sending crafted packets and analyzing responses, and can also be used to perform firewall evasion testing?
Select an answer first
24application · medium
An attacker is scanning a network and encounters a system that responds to connection attempts on multiple ports but does not respond to ICMP ping. The attacker suspects it might be a honeypot. Which additional clue would most strongly confirm the honeypot suspicion?
Select an answer first
25application · medium
A security team is planning to deploy a honeynet to study attacker behavior. The team has a limited budget and needs to deploy the honeynet with minimal maintenance. Which type of honeypot is most appropriate for this scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 5)

Questions 21–25

A security administrator is concerned about attackers using IP spoofing to evade the network's firewall. The administrator wants to implement a countermeasure to detect and block spoofed traffic. Which action is most effective?

Which tool is commonly used to test firewall rules by sending crafted packets and analyzing responses, and can also be used to perform firewall evasion testing?

An attacker is scanning a network and encounters a system that responds to connection attempts on multiple ports but does not respond to ICMP ping. The attacker suspects it might be a honeypot. Which additional clue would most strongly confirm the honeypot suspicion?

A security team is planning to deploy a honeynet to study attacker behavior. The team has a limited budget and needs to deploy the honeynet with minimal maintenance. Which type of honeypot is most appropriate for this scenario?

Keep studying — Network and Perimeter Hacking