CEH V12 (Certified Ethical Hacker) Exam Dumps 2022
CEH V12 (Certified Ethical Hacker) Exam Dumps 2022
Visit Official SkillCertPro Website :-
CEH V12 (Certified Ethical Hacker) Practice Tests 2022. Contains 500+ exam questions to pass the exam in first attempt.
For a full set of 500+ questions. Go to
https://skillcertpro.com/product/certified-ethical-hacker-ceh-v12-exam-questions/
SkillCertPro offers detailed explanations to each question which helps to understand the concepts better.
It is recommended to score above 85% in SkillCertPro exams before attempting a real exam.
SkillCertPro updates exam questions every 2 weeks.
You will get life time access and life time free updates
SkillCertPro assures 100% pass guarantee in first attempt.
Question 1:
Shortly after replacing the outdated equipment, John, the company‘s system administrator, discovered a leak of critical customer information. Moreover, among the stolen data was the new users information that excludes incorrect disposal of old equipment. IDS did not notice the intrusion, and the logging system shows that valid credentials were used. Which of the following is most likely the cause of this problem?
A. Industrial Espionage
B. Zero-day vulnerabilities
C. NSA backdoor
D. Default Credential
Answer: D
Explanation:
https://en.wikipedia.org/wiki/Default_Credential_vulnerability
A Default Credential vulnerability is a type of vulnerability that is most commonly found to affect the devices like modems, routers, digital cameras, and other devices having some pre-set (default) administrative credentials to access all configuration settings. The vendor or manufacturer of such devices uses a single pre-defined set of admin credentials to access the device configurations, and any potential hacker can misuse this fact to hack such devices, if those credentials are not changed by the consumers.
NOTE: Yeap, it‘s that simple. It is more likely that the problem is a simple mistake or incompetence of an employee, which was used by an ordinary fraudster, than a full-fledged attack by real hackers or a conspiracy.
Question 2:
In order to prevent collisions and protect password hashes from rainbow tables, Maria, the system administrator, decides to add random data strings to the end of passwords before hashing. What is the name of this technique?
A. Extra hashing
B. Stretching
C. Salting
D. Masking
Answer: C
Explanation:
https://en.wikipedia.org/wiki/Salt_(cryptography)
A salt is random data that is used as an additional input to a one-way function that hashes data, a password, or passphrase. Salts are used to safeguard passwords in storage. Historically a password was stored in plaintext on a system, but over time additional safeguards were developed to protect a user‘s password against being read from the system. A salt is one of those methods.
A new salt is randomly generated for each password. In a typical setting, the salt and the password (or its version after key stretching) are concatenated and processed with a cryptographic hash function, and the output hash value (but not the original password) is stored with the salt in a database. Hashing allows for later authentication without keeping and therefore risking exposure of the plaintext password in the event that the authentication data store is compromised.
Salts defend against a pre-computed hash attack, e.g. rainbow tables. Since salts do not have to be memorized by humans they can make the size of the hash table required for a successful attack prohibitively large without placing a burden on the users. Since salts are different in each case, they also protect commonly used passwords, or those users who use the same password on several sites, by making all salted hash instances for the same password different from each other.
Question 3:
John received this text message: “Hello, this is Jack Smith from the Gmail customer service. Kindly contact me about problems with your account: jacksmith@gmail.com“. Which statement below is true?
A. This is a scam as everybody can get a @gmail.com address, not the Gmail customer service employees.
B. John should write to jacksmith@gmail.com to verify the identity of Jack.
C. This is probably a legitimate message as it comes from a respectable organization.
D. This is a scam because John does not know Jack.
Answer: A
Explanation:
Anyone can register an email on yahoo, Gmail, etc. Scammers can easily use this to mislead the victim.
Question 4:
Identify the attack where the hacker uses the ciphertexts corresponding to a set of plaintexts of his own choosing?
A. Kasiski examination
B. Known-plaintext attack
C. Chosen-plaintext
D. Differential cryptanalysis
Answer: C
Explanation:
https://en.wikipedia.org/wiki/Chosen-plaintext_attack
A chosen-plaintext attack (CPA) is an attack model for cryptanalysis which presumes that the attacker can obtain the ciphertexts for arbitrary plaintexts. The goal of the attack is to gain information that reduces the security of the encryption scheme.
Question 5:
Shellshock is a serious bug in the Bash command-line interface shell that allows an attacker to execute commands by gaining unauthorized access to computer systems.
env x=′(){ :;};echo exploit′ bash -c ‘cat /etc/passwd‘
What is the result of executing this query on a vulnerable host?
A. Copying the contents of the passwd file
B. Deleting the passwd file.
C. Display of the contents of the passwd file.
D. Creating a passwd file.
Answer: C
Explanation:
https://blog.cloudflare.com/inside-shellshock/
To extract private information, attackers are using a couple of techniques. The simplest extraction attacks are in the form: () {:;}; /bin/cat /etc/passwd That reads the password file /etc/passwd, and adds it to the response from the web server. So an attacker injecting this code through the Shellshock vulnerability would see the password file dumped out onto their screen as part of the web page returned.
For a full set of 500+ questions. Go to
https://skillcertpro.com/product/certified-ethical-hacker-ceh-v12-exam-questions/
SkillCertPro offers detailed explanations to each question which helps to understand the concepts better.
It is recommended to score above 85% in SkillCertPro exams before attempting a real exam.
SkillCertPro updates exam questions every 2 weeks.
You will get life time access and life time free updates
SkillCertPro assures 100% pass guarantee in first attempt.
Question 6:
Lisandro is engaged in sending spam. To avoid blocking, he connects to incorrectly configured SMTP servers that allow e-mail relay without authentication (which allows Lisandro to fake information about the sender‘s identity). What is the name of such an SMTP server?
A. Weak SMTP.
B. Message transfer agent.
C. Open mail relay.
D. Public SMTP server.
Answer: C
Explanation:
https://en.wikipedia.org/wiki/Open_mail_relay
An open mail relay is an SMTP server that is configured to allow anyone on the Internet to send email through it, not just mail destined to or originating from known users. Email relay or open mail relay used to be the default configuration in many mail servers; certainly, it was the way the Internet was at first set up. Still, now open mail relays have become unpopular because of their exploitation by spammers and frauds. Moreover, many relays have been closed or were placed on blacklists by other servers.
Many Internet service providers use Domain Name System-based Blackhole Lists (DNSBL) to disallow mail from open relays. Once a mail server is detected or reported that allows third parties to send mail through them, they will be added to one or more such lists, and other e-mail servers using those lists will reject any mail coming from those sites. The relay must not actually be used to send spam to be blacklisted; instead, it may be blacklisted after a simple test that confirms open access.
This trend reduced the percentage of mail senders that were open relays from over 90% down to well under 1% over several years. This led spammers to adopt other techniques, such as using botnets of zombie computers to send spam.
Question 7:
What is the name of the practice of collecting information from published or otherwise publicly available sources?
A. Human intelligence
B. Artificial intelligence
C. Open-source intelligence
D. Social intelligence
Answer: C
Explanation:
https://en.wikipedia.org/wiki/Open-source_intelligence
Open-source intelligence (OSINT) is a multi-method (qualitative, quantitative) methodology for collecting, analyzing and making decisions about data accessible in publicly available sources to be used in an intelligence context. In the intelligence community, the term “open“ refers to overt, publicly available sources (as opposed to covert or clandestine sources). It is not related to open-source software or collective intelligence.
Question 8:
The fraudster Lisandro, masquerading as a large car manufacturing company recruiter, massively sends out job offers via e-mail with the promise of a good salary, a friendly team, unlimited coffee, and medical insurance. He attaches Microsoft Word or Excel documents to his letters into which he embeds a special virus written in Visual Basic that runs when the document is opened and infects the victim‘s computer. What type of virus does Lisandro use?
A. Multipart virus
B. Polymorphic code
C. Macro virus
D. Stealth virus
Answer: C
Explanation:
https://en.wikipedia.org/wiki/Macro_virus
A macro virus is a virus written in a macro language: a programming language embedded inside a software application (e.g., word processors and spreadsheet applications). Some applications, such as Microsoft Office, Excel, and PowerPoint, allow macro programs to be embedded in documents such that the macros are run automatically when the document is opened. This provides a distinct mechanism by which malicious computer instructions can spread. This is one reason it can be dangerous to open unexpected attachments in e-mails. Many antivirus programs can detect macro viruses; however, the macro virus‘ behaviour can still be difficult to detect.
Question 9:
The absolute majority of routers and switches use packet filtering firewalls. That kind of firewalls makes decisions about allowing traffic to pass into the network based on the information contained in the packet header. At what level of the OSI model do these firewalls work?
A. Network layer
B. Application layer
C. Session layer
D. Physical layer
Answer: A
Explanation:
https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter
Question 10:
Which of the following is a vulnerability in modern processors such as Intel, AMD and ARM using speculative execution?
A. Launch Daemon
B. Application Shimming
C. Named Pipe Impersonation
D. Spectre and Meltdown
Answer: D
Explanation:
https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)
https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)
Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware vulnerabilities allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.
Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider‘s infrastructure, it might be possible to steal data from other customers.
For a full set of 500+ questions. Go to
https://skillcertpro.com/product/certified-ethical-hacker-ceh-v12-exam-questions/
SkillCertPro offers detailed explanations to each question which helps to understand the concepts better.
It is recommended to score above 85% in SkillCertPro exams before attempting a real exam.
SkillCertPro updates exam questions every 2 weeks.
You will get life time access and life time free updates
SkillCertPro assures 100% pass guarantee in first attempt.