Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is preparing to test the security of a client's network. The client has a stateful firewall and a signature-based IDS. The tester wants to evade both the firewall and the IDS during the test. Which tool is specifically designed for this purpose?

   • AWireshark
   • BFragroute
   • CMetasploit
   • DNmap
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization has deployed a low-interaction honeypot that emulates a database service. Attackers are quickly identifying it as a honeypot and moving on. Which improvement is most likely to make the honeypot more convincing to attackers?

   • AIncrease the number of open ports on the honeypot to make it look busier.
   • BPlace the honeypot on a different subnet from the production network.
   • CAdd realistic banner information and emulate common database error messages and responses.
   • DDisable logging on the honeypot to avoid alerting attackers.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security analyst has deployed a honeypot and is monitoring it. The analyst notices that attackers are probing the honeypot but not interacting with it deeply. The analyst suspects the honeypot is being detected. Which action is most likely to improve the honeypot's realism and increase attacker interaction?

   • AAdd realistic user activity and network traffic to the honeypot
   • BRemove all logging from the honeypot to avoid detection
   • CIncrease the number of open ports on the honeypot
   • DUse a well-known honeypot tool without any customization
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security administrator is concerned about attackers using encrypted tunnels to evade the network's IDS. The administrator wants to implement a countermeasure to detect this type of evasion. Which action is most effective?

   • AIncrease the number of IDS signatures
   • BImplement SSL/TLS inspection at the network perimeter
   • CBlock all encrypted traffic at the firewall
   • DDeploy a network-based IDS that monitors for unusual traffic patterns
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security engineer is testing the firewall's rule set. The firewall is configured to allow inbound TCP traffic on port 443 (HTTPS) only. The engineer wants to send a management command to a device on the internal network that only listens on port 22 (SSH). Which technique is most likely to succeed?

   • ATunneling the SSH traffic inside an HTTPS connection to the internal device's port 443.
   • BSending the SSH traffic with a source port of 443.
   • CFragmenting the SSH packets so the firewall cannot see the destination port.
   • DSpoofing the source IP address to an internal IP address.
   Reveal Solution Discussion Select an answer first