Pass the GAQM Information Systems Security CPEH-001 Questions and answers with ExamsMirror

If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?

You want to do an ICMP scan on a remote computer using hping2. What is the proper syntax?

Which of these is capable of searching for and locating rogue access points?

Cryptography is the practice and study of techniques for secure communication in the presence of third parties (called adversaries.) More generally, it is about constructing and analyzing protocols that overcome the influence of adversaries and that are related to various aspects in information security such as data confidentiality, data integrity, authentication, and non-repudiation. Modern cryptography intersects the disciplines of mathematics, computer science, and electrical engineering. Applications of cryptography include ATM cards, computer passwords, and electronic commerce.

Basic example to understand how cryptography works is given below:

Which of the following choices is true about cryptography?

To maintain compliance with regulatory requirements, a security audit of the systems on a network must be performed to determine their compliance with security policies. Which one of the following tools would most likely be used in such an audit?

Risks = Threats x Vulnerabilities is referred to as the:

Which method of password cracking takes the most time and effort?

Todd has been asked by the security officer to purchase a counter-based authentication system. Which of the following best describes this type of system?

Emil uses nmap to scan two hosts using this command.

nmap -sS -T4 -O 192.168.99.1 192.168.99.7

He receives this output:

What is his conclusion?

An Intrusion Detection System (IDS) has alerted the network administrator to a possibly malicious sequence of packets sent to a Web server in the network's external DMZ. The packet traffic was captured by the IDS and saved to a PCAP file.

What type of network tool can be used to determine if these packets are genuinely malicious or simply a false positive?

The "white box testing" methodology enforces what kind of restriction?

Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack of a built-in-bounds checking mechanism?

Output:

Segmentation fault

To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program.

What term is commonly used when referring to this type of testing?

Bob learned that his username and password for a popular game has been compromised. He contacts the company and resets all the information. The company suggests he use two-factor authentication, which option below offers that?

Which of the following is one of the most effective ways to prevent Cross-site Scripting (XSS) flaws in software applications?