Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. GAQM
  5. CPEH-001

GAQM CPEH-001 Exam
Certified Professional Ethical Hacker (CPEH) Exam (Page 23 )

Updated On: 1-Feb-2026
Page 23 of 177
PDF with 878 Questions

Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weaknesses and key loggers.
Which of the following options best represents the means that Bob can adopt to retrieve passwords from his clients hosts and servers?

  1. Hardware, Software, and Sniffing.
  2. Hardware and Software Keyloggers.
  3. Passwords are always best obtained using Hardware key loggers.
  4. Software only, they are the most effective.

Answer(s): A

Explanation:

Different types of keylogger planted into the environment would retrieve the passwords for Bob.



Which of the following represents the initial two commands that an IRC client sends to join an IRC network?

  1. USER, NICK
  2. LOGIN, NICK
  3. USER, PASS
  4. LOGIN, USER

Answer(s): A

Explanation:

A "PASS" command is not required for either client or server connection to be registered, but it must precede the server message or the latter of the NICK/USER combination. (RFC 1459)



An Nmap scan shows the following open ports, and nmap also reports that the OS guessing results to match too many signatures hence it cannot reliably be identified:
21 ftp
23 telnet
80 http
443 https
What does this suggest?

  1. This is a Windows Domain Controller
  2. The host is not firewalled
  3. The host is not a Linux or Solaris system
  4. The host is not properly patched

Answer(s): D

Explanation:

If the answer was A nmap would guess it, it holds the MS signature database, the host not being firewalled makes no difference.The host is not linux or solaris, well it very well could be. The host is not properly patched? That is the closest; nmaps OS detection architecture is based solely off the TCP ISN issued by the operating systems TCP/IP stack, if the stack is modified to show output from randomized ISN's or if your using a program to change the ISN then OS detection will fail. If the TCP/IP IP ID's are modified then os detection could also fail, because the machine would most likely come back as being down.



John has scanned the web server with NMAP. However, he could not gather enough information to help him identify the operating system running on the remote host accurately.
What would you suggest to John to help identify the OS that is being used on the remote web server?

  1. Connect to the web server with a browser and look at the web page.
  2. Connect to the web server with an FTP client.
  3. Telnet to port 8080 on the web server and look at the default page code.
  4. Telnet to an open port and grab the banner.

Answer(s): D

Explanation:

Most people don't care about changing the banners presented by applications listening to open ports and therefore you should get fairly accurate information when grabbing banners from open ports with, for example, a telnet application.



You are having problems while retrieving results after performing port scanning during internal testing. You verify that there are no security devices between you and the target system.
When both stealth and connect scanning do not work, you decide to perform a NULL scan with NMAP. The first few systems scanned shows all ports open.
Which one of the following statements is probably true?

  1. The systems have all ports open.
  2. The systems are running a host based IDS.
  3. The systems are web servers.
  4. The systems are running Windows.

Answer(s): D

Explanation:

The null scan turns off all flags, creating a lack of TCP flags that should never occur in the real world. If the port is closed, a RST frame should be returned and a null scan to an open port results in no response. Unfortunately Microsoft (like usual) decided to completely ignore the standard and do things their own way. Thus this scan type will not work against systems running Windows as they choose not to response at all. This is a good way to distinguish that the system being scanned is running Microsoft Windows.



Viewing page 23 of 177
Viewing questions 111 - 115 out of 878 questions



Post your Comments and Discuss GAQM CPEH-001 exam prep with other Community members:

Join the CPEH-001 Discussion