Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which defensive measure can help an IDS detect fragmented attacks that are designed to evade signature matching?

   • ADisabling packet reassembly on the IDS
   • BIncreasing the IDS signature update frequency only
   • CBlocking all fragmented traffic
   • DEnabling packet reassembly and normalization on the IDS
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security engineer is testing firewall rules. The firewall blocks all inbound traffic except for TCP port 53 (DNS) and TCP port 443 (HTTPS). The engineer needs to run a vulnerability scan against an internal host from the internet. Which technique is most likely to allow the scan traffic to pass through the firewall?

   • AIP address spoofing to make the scan appear to come from an internal IP
   • BEncrypting the scan traffic with TLS
   • CSource port manipulation to use source port 53 for the scan traffic
   • DUsing a tunneling protocol over ICMP
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement best describes the typical placement of a network-based intrusion detection system (NIDS) in a corporate network?

   • AOn the internal host's network stack
   • BIn series with the internet link, directly inline
   • COn the same segment as the firewall's management interface
   • DOn a span port or network tap that sees traffic of interest
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration tester is assessing a network protected by a stateful inspection firewall and a signature-based IDS. The tester needs to send a series of exploit attempts to a target web server without the IDS matching any known attack signature. The tester controls the source IP and can fragment packets at the IP layer. Which approach is most likely to evade the signature-based IDS while still reaching the target?

   • AIncrease the TCP window size to allow larger segments so the payload fits in one packet and the IDS cannot buffer it.
   • BEncrypt the entire TCP connection using TLS to the web server's HTTPS port, then send the exploit as plaintext inside the encrypted tunnel.
   • CSend the exploit payload in tiny IP fragments that the IDS does not reassemble, but the target host reassembles before processing.
   • DSpoof the source IP address to that of a trusted internal host and send the full payload in a single packet.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which type of honeypot provides a real operating system and applications, allowing an attacker to interact with a fully functional system, but at a higher risk of being compromised?

   • AHigh-interaction honeypot
   • BHoneynet
   • CLow-interaction honeypot
   • DMedium-interaction honeypot
   Reveal Solution Discussion Select an answer first