A penetration tester is attempting to evade a network-based IDS that uses both signature matching and stateful protocol analysis. The IDS is placed inline and can reassemble fragments. The tester needs to send a known exploit payload to a target server. Which technique is most likely to evade both detection methods?

Encrypt the payload using a protocol that the IDS cannot decrypt, such as TLS, and send it to the target's HTTPS port.

Fragment the payload into small pieces and send them out of order.

Use source port manipulation to make the traffic appear as DNS.

Send the payload slowly over a long period to avoid triggering the IDS's rate-based anomaly detection.

Which tool is specifically designed to test honeypot effectiveness by simulating attacks and verifying that the honeypot detects and logs them correctly?

Honeypot testing frameworks like Honeynet Project tools

Which firewall type inspects the full application-layer payload and can make decisions based on the content of the traffic, such as blocking a specific SQL injection pattern?

Next-generation firewall (NGFW)

EC-CouncilCertified Ethical Hacker

Domain 4Objective 5

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 9)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 41–45

41expert · hard
A penetration tester is attempting to evade a network-based IDS that uses both signature matching and stateful protocol analysis. The IDS is placed inline and can reassemble fragments. The tester needs to send a known exploit payload to a target server. Which technique is most likely to evade both detection methods?
Select an answer first
42foundation · easy
Which IDS evasion technique involves encoding or altering the payload in a way that the IDS signature does not match, while the target system still interprets it as malicious?
Select an answer first
43foundation · easy
Which tool is specifically designed to test honeypot effectiveness by simulating attacks and verifying that the honeypot detects and logs them correctly?
Select an answer first
44foundation · easy
Which firewall type inspects the full application-layer payload and can make decisions based on the content of the traffic, such as blocking a specific SQL injection pattern?
Select an answer first
45application · medium
A penetration tester needs to test whether the organization's IDS can be evaded by sending specially crafted packets that are fragmented and have modified TCP headers. Which tool is specifically designed for crafting and sending such packets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Evading IDS, Firewalls and Honeypots CEH Practice Questions (Page 9)

Questions 41–45

Which IDS evasion technique involves encoding or altering the payload in a way that the IDS signature does not match, while the target system still interprets it as malicious?

Which tool is specifically designed to test honeypot effectiveness by simulating attacks and verifying that the honeypot detects and logs them correctly?

Which firewall type inspects the full application-layer payload and can make decisions based on the content of the traffic, such as blocking a specific SQL injection pattern?

A penetration tester needs to test whether the organization's IDS can be evaded by sending specially crafted packets that are fragmented and have modified TCP headers. Which tool is specifically designed for crafting and sending such packets?

Keep studying — Network and Perimeter Hacking