GAQM GAQM CEH-001 PDF GAQM GAQM CEH-001 PDF Questions Available Here at: https://www.certification-exam.com/en/dumps/gaqm-exam/ceh-001-dumps/quiz.html Enrolling now you will get access to 575 questions in a unique set of GAQM CEH-001 Question 1 An organization hires a security professional to test their network defenses by simulating real-world attacks with full knowledge and written authorization from management. Which type of security testing does this describe? Options: A. Vulnerability assessment B. Penetration testing C. Risk assessment D. Security audit Answer: B Explanation: Penetration testing involves simulating real-world attacks against an organization's systems, networks, and applications to identify exploitable vulnerabilities. Unlike a vulnerability assessment, which only identifies and categorizes vulnerabilities without actively exploiting them, penetration testing goes further by attempting to exploit discovered weaknesses to determine the actual impact of a successful attack. The key characteristics that distinguish penetration testing include the active exploitation of vulnerabilities, the simulation of attacker techniques and methodologies, and the requirement for explicit written authorization from the organization's management before testing begins. A risk assessment is a broader process that evaluates the likelihood and impact of various threats to an organization's assets, while a security audit focuses on evaluating compliance with established policies, standards, and procedures. Penetration testing provides organizations with a realistic view of their security posture by demonstrating how an attacker could chain together vulnerabilities to compromise systems, escalate privileges, and access sensitive data. Question 2 GAQM GAQM CEH-001 PDF https://www.certification-exam.com/ An ethical hacker is performing passive reconnaissance against a target organization. Which of the following techniques would be classified as passive footprinting? Options: A. Sending crafted packets to the target's web server B. Querying public WHOIS databases for domain registration details C. Performing a port scan on the target's IP range D. Attempting to log into the target's VPN with default credentials Answer: B Explanation: Passive footprinting involves gathering information about a target without directly interacting with the target's systems in a way that could be detected. Querying public WHOIS databases is a classic passive reconnaissance technique because the information is publicly available and the query goes to a third-party WHOIS server, not to the target organization's infrastructure. WHOIS records can reveal domain registration details, registrant contact information, name servers, registration and expiration dates, and the registrar used. Other passive footprinting techniques include searching public records, reviewing social media profiles, analyzing job postings, examining cached web pages, and using search engine operators. In contrast, sending crafted packets to a web server, performing port scans, and attempting to log into services all involve direct interaction with the target's systems and are considered active reconnaissance techniques. Active reconnaissance carries a higher risk of detection because the target's intrusion detection systems, firewalls, and log monitoring tools may identify and alert on suspicious activity originating from the tester. Question 3 An ethical hacker performs an Nmap scan using the command "nmap -sS 192.168.1.0/24". What type of scan is being executed? Options: A. TCP Connect scan B. SYN stealth scan C. UDP scan D. FIN scan Answer: B Explanation: The -sS flag in Nmap initiates a TCP SYN scan, also known as a half-open or stealth scan. This is the most GAQM GAQM CEH-001 PDF https://www.certification-exam.com/ popular scanning technique because it is relatively fast and stealthy compared to a full TCP connect scan. During a SYN scan, Nmap sends a SYN packet to the target port as if initiating a normal TCP three-way handshake. If the port is open, the target responds with a SYN-ACK packet, and Nmap immediately sends a RST packet to tear down the connection before it is fully established, rather than completing the handshake with an ACK. If the port is closed, the target responds with a RST packet. Because the connection is never fully established, many older logging mechanisms do not record the connection attempt, making the scan less likely to be detected. A TCP Connect scan (-sT) completes the full three-way handshake and is more easily logged. A UDP scan (-sU) tests for open UDP ports. A FIN scan (-sF) sends packets with the FIN flag set to probe ports. The SYN scan requires root or administrator privileges because it uses raw sockets to craft packets. Question 4 An ethical hacker is attempting to extract user accounts, shares, and group information from a Windows target using null sessions. Which protocol is the hacker most likely exploiting? Options: A. SNMP B. SMTP C. NetBIOS/SMB D. LDAP Answer: C Explanation: NetBIOS (Network Basic Input/Output System) and SMB (Server Message Block) are the protocols most commonly exploited through null session attacks to enumerate Windows systems. A null session is an unauthenticated connection to a Windows system's IPC$ (Inter-Process Communication) share, established without providing a username or password. When successful, null sessions can reveal extensive information including user accounts, group memberships, shared resources, password policies, and security identifiers (SIDs). This technique exploits the default behavior of older Windows systems that allowed anonymous connections to the IPC$ share for inter-process communication. Tools like enum4linux, rpcclient, and the net use command can establish null sessions and extract this information. SNMP is used for network management and can leak information through default community strings but uses a different mechanism. SMTP enumeration focuses on email-related information through techniques like VRFY and EXPN commands. LDAP enumeration targets directory services and can reveal organizational structure and user attributes. Modern Windows systems have significantly restricted null session access through security policies and registry settings. Question 5 GAQM GAQM CEH-001 PDF https://www.certification-exam.com/ An organization wants to identify known vulnerabilities in their network infrastructure without exploiting them. Which approach should they use? Options: A. Penetration testing B. Vulnerability assessment C. Social engineering engagement D. Red team exercise Answer: B Explanation: A vulnerability assessment is a systematic process of identifying, quantifying, and prioritizing known vulnerabilities in systems, networks, and applications without actively exploiting them. The primary goal is to create a comprehensive inventory of weaknesses and their severity levels so the organization can prioritize remediation efforts. Vulnerability assessments typically use automated scanning tools like Nessus, Qualys, OpenVAS, or Nexpose to compare the target environment against databases of known vulnerabilities, misconfigurations, and missing patches. The output includes detailed reports with vulnerability descriptions, severity ratings using frameworks like CVSS, and recommended remediation steps. Penetration testing goes beyond identification by actively attempting to exploit vulnerabilities to demonstrate the real-world impact of successful attacks. Social engineering engagements specifically target the human element through techniques like phishing, pretexting, and physical intrusion attempts. Red team exercises are comprehensive adversarial simulations that combine multiple attack vectors including technical exploitation, social engineering, and physical security testing to evaluate an organization's overall defensive capabilities. Each approach serves a different purpose in an organization's security program. Question 6 An attacker has gained initial access to a system with a standard user account. What is the next logical step in the system hacking methodology? Options: A. Covering tracks B. Privilege escalation C. Maintaining access D. Cracking passwords Answer: B Explanation: GAQM GAQM CEH-001 PDF https://www.certification-exam.com/ The system hacking methodology follows a structured approach: gaining access, escalating privileges, maintaining access, and covering tracks. After obtaining initial access through a standard user account, the attacker's next logical step is privilege escalation to obtain higher-level permissions, typically administrator or root access. Privilege escalation is essential because standard user accounts usually have limited capabilities that restrict what the attacker can do within the system. Escalation can be achieved through various techniques including exploiting unpatched operating system vulnerabilities, misconfigured services running with elevated privileges, DLL hijacking, insecure file permissions, token impersonation, and exploiting vulnerable SUID/SGID binaries on Linux systems. There are two types of privilege escalation: vertical escalation, where a lower-privileged user gains higher privileges, and horizontal escalation, where a user gains access to another user's account at the same privilege level. Maintaining access comes after escalation because the attacker needs elevated privileges to install persistent backdoors effectively. Covering tracks is the final phase, performed to remove evidence of the intrusion and maintain stealth. Question 7 A user downloads a free screen recording application that appears to function normally but secretly installs a keylogger in the background. What type of malware has the user encountered? Options: A. Worm B. Virus C. Trojan horse D. Ransomware Answer: C Explanation: A Trojan horse is a type of malware that disguises itself as legitimate software to trick users into installing it. Unlike viruses and worms, Trojans do not replicate themselves; instead, they rely on social engineering to convince users to download and execute them voluntarily. The defining characteristic of a Trojan is its deceptive nature: it appears to perform a useful or desirable function while secretly carrying out malicious activities. In this scenario, the screen recording application serves as the legitimate-appearing wrapper that conceals the keylogger payload. Trojans come in many varieties including Remote Access Trojans (RATs) that provide unauthorized remote control, banking Trojans that steal financial credentials, downloader Trojans that install additional malware, and data-stealing Trojans that exfiltrate sensitive information. A worm is self-replicating malware that spreads across networks without requiring user interaction or a host file. A virus attaches itself to legitimate programs and requires user action to spread. Ransomware encrypts victim files and demands payment for the decryption key. Understanding these distinctions helps security professionals accurately identify threats and implement appropriate countermeasures for each malware category. GAQM GAQM CEH-001 PDF https://www.certification-exam.com/ Question 8 An attacker on a switched network wants to intercept traffic between two other hosts. Which technique would the attacker use to redirect traffic through their machine? Options: A. MAC flooding B. ARP spoofing C. DNS amplification D. ICMP tunneling Answer: B Explanation: ARP spoofing, also known as ARP poisoning, is a technique used to intercept network traffic on a switched network by manipulating the Address Resolution Protocol cache of target devices. The attacker sends falsified ARP replies to associate their MAC address with the IP address of another host, such as the default gateway. When the victim's ARP cache is poisoned, traffic destined for the legitimate host is redirected to the attacker's machine instead. By poisoning the ARP caches of both communicating parties, the attacker positions themselves in the middle, enabling a man-in-the-middle attack where they can capture, modify, or analyze all traffic passing between the two hosts before forwarding it to the intended destination. Tools commonly used for ARP spoofing include arpspoof, Ettercap, and Cain and Abel. MAC flooding is a different technique that overflows a switch's MAC address table, causing it to behave like a hub and broadcast all traffic, but it does not specifically redirect traffic between two hosts. DNS amplification is a DDoS technique, and ICMP tunneling is used for covert data exfiltration. Countermeasures against ARP spoofing include Dynamic ARP Inspection, static ARP entries, and network monitoring tools. Question 9 An attacker sends a carefully crafted email to a specific high-ranking executive, impersonating a trusted business partner and requesting an urgent wire transfer. Which type of social engineering attack is this? Options: A. Phishing B. Spear phishing C. Whaling D. Vishing Answer: C GAQM GAQM CEH-001 PDF https://www.certification-exam.com/ Explanation: Whaling is a highly targeted form of social engineering that specifically targets high-ranking executives and senior management, often referred to as "big fish" or "whales." Whaling attacks are meticulously crafted to appear as legitimate business communications relevant to the executive's role, often impersonating trusted business partners, legal authorities, or other executives. These attacks typically involve extensive research about the target, including their business relationships, communication style, and current projects. The scenario described involves targeting a high-ranking executive with a business-relevant pretext about a wire transfer, which is a classic whaling technique often used in Business Email Compromise (BEC) schemes. Standard phishing uses generic, mass-distributed messages that are not personalized to specific targets. Spear phishing targets specific individuals or groups but is not limited to executives and may target any employee in an organization. Vishing refers to voice phishing, which uses telephone calls to deceive victims into revealing sensitive information. Whaling attacks are particularly dangerous because executives often have the authority to approve financial transactions and access to the most sensitive organizational information, making successful attacks extremely costly. Question 10 What is the primary difference between a DoS attack and a DDoS attack? Options: A. DoS attacks target web applications while DDoS attacks target networks B. DoS attacks originate from a single source while DDoS attacks originate from multiple distributed sources C. DoS attacks are illegal while DDoS attacks are legal D. DoS attacks use encryption while DDoS attacks use plaintext Answer: B Explanation: The fundamental difference between a Denial of Service (DoS) attack and a Distributed Denial of Service (DDoS) attack is the number of sources generating the malicious traffic. A DoS attack originates from a single system or source, which sends a flood of requests or exploits a vulnerability to overwhelm the target and disrupt its availability. A DDoS attack uses multiple compromised systems, typically a botnet consisting of hundreds, thousands, or even millions of infected devices spread across different networks and geographic locations, to simultaneously attack the target. The distributed nature of DDoS attacks makes them significantly more difficult to mitigate because the attack traffic comes from many different IP addresses, making it harder to distinguish from legitimate traffic and impossible to stop by simply blocking a single source. DDoS attacks also generate much higher traffic volumes than single-source DoS attacks. Both attack types aim to disrupt the availability of services and can target any layer of the network stack, from network bandwidth saturation to application-layer resource exhaustion. Common DDoS mitigation strategies include traffic scrubbing services, content delivery networks, rate limiting, and upstream filtering by Internet service providers. GAQM GAQM CEH-001 PDF https://www.certification-exam.com/ Would you like to see more? Don't miss our GAQM CEH- 001 PDF file at: https://www.certification-exam.com/en/pdf/gaqm-pdf/ceh-001-pdf/ GAQM GAQM CEH-001 PDF https://www.certification-exam.com/