Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. GAQM
  5. CPEH-001

GAQM CPEH-001 Exam
Certified Professional Ethical Hacker (CPEH) Exam (Page 2 )

Updated On: 1-Feb-2026
Page 2 of 177
PDF with 878 Questions

Which of the following countermeasure can specifically protect against both the MAC Flood and MAC Spoofing attacks?

  1. Configure Port Security on the switch
  2. Configure Port Recon on the switch
  3. Configure Switch Mapping
  4. Configure Multiple Recognition on the switch

Answer(s): A



While performing ping scans into a target network you get a frantic call from the organization's security team. They report that they are under a denial of service attack.
When you stop your scan, the smurf attack event stops showing up on the organization's IDS monitor. How can you modify your scan to prevent triggering this event in the IDS?

  1. Scan more slowly.
  2. Do not scan the broadcast IP.
  3. Spoof the source IP address.
  4. Only scan the Windows systems.

Answer(s): B

Explanation:

Scanning the broadcast address makes the scan target all IP addresses on that subnet at the same time.



Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned. As a security professional, what would you infer from this scan?

  1. It is a network fault and the originating machine is in a network loop
  2. It is a worm that is malfunctioning or hardcoded to scan on port 500
  3. The attacker is trying to detect machines on the network which have SSL enabled
  4. The attacker is trying to determine the type of VPN implementation and checking for IPSec

Answer(s): D

Explanation:

Port 500 is used by IKE (Internet Key Exchange). This is typically used for IPSEC-based VPN software, such as Freeswan, PGPnet, and various vendors of in-a-box VPN solutions such as Cisco. IKE is used to set up the session keys. The actual session is usually sent with ESP (Encapsulated Security Payload) packets, IP protocol 50 (but some in-a-box VPN's such as Cisco are capable of negotiating to send the encrypted tunnel over a UDP channel, which is useful for use across firewalls that block IP protocols other than TCP or UDP).



A distributed port scan operates by:

  1. Blocking access to the scanning clients by the targeted host
  2. Using denial-of-service software against a range of TCP ports
  3. Blocking access to the targeted host by each of the distributed scanning clients
  4. Having multiple computers each scan a small number of ports, then correlating the results

Answer(s): D

Explanation:

Think of dDoS (distributed Denial of Service) where you use a large number of computers to create simultaneous traffic against a victim in order to shut them down.



An nmap command that includes the host specification of 202.176.56-57.* will scan _______ number of hosts.

  1. 2
  2. 256
  3. 512
  4. Over 10, 000

Answer(s): C

Explanation:

The hosts with IP address 202.176.56.0-255 & 202.176.56.0-255 will be scanned (256+256=512)



Viewing page 2 of 177
Viewing questions 6 - 10 out of 878 questions



Post your Comments and Discuss GAQM CPEH-001 exam prep with other Community members:

Join the CPEH-001 Discussion