Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. GAQM
  5. CPEH-001

GAQM CPEH-001 Exam
Certified Professional Ethical Hacker (CPEH) Exam (Page 3 )

Updated On: 1-Feb-2026
Page 3 of 177
PDF with 878 Questions

A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0.
What can you infer from this information?

  1. The packets were sent by a worm spoofing the IP addresses of 47 infected sites
  2. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
  3. All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
  4. 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0

Answer(s): B



Which of the following commands runs snort in packet logger mode?

  1. ./snort -dev -h ./log
  2. ./snort -dev -l ./log
  3. ./snort -dev -o ./log
  4. ./snort -dev -p ./log

Answer(s): B

Explanation:

Note: If you want to store the packages in binary mode for later analysis use ./snort -l ./log -b



Which of the following command line switch would you use for OS detection in Nmap?

  1. -D
  2. -O
  3. -P
  4. -X

Answer(s): B

Explanation:

OS DETECTION:
-O: Enable OS detection (try 2nd generation w/fallback to 1st) -O2: Only use the new OS detection system (no fallback) -O1: Only use the old (1st generation) OS detection system --osscan-limit: Limit OS detection to promising targets --osscan-guess: Guess OS more aggressively



You have initiated an active operating system fingerprinting attempt with nmap against a target system:



What operating system is the target host running based on the open ports shown above?

  1. Windows XP
  2. Windows 98 SE
  3. Windows NT4 Server
  4. Windows 2000 Server

Answer(s): D

Explanation:

The system is reachable as an active directory domain controller (port 389, LDAP)



Study the log below and identify the scan type.

  1. nmap -sR 192.168.1.10
  2. nmap -sS 192.168.1.10
  3. nmap -sV 192.168.1.10
  4. nmap -sO -T 192.168.1.10

Answer(s): D



Viewing page 3 of 177
Viewing questions 11 - 15 out of 878 questions



Post your Comments and Discuss GAQM CPEH-001 exam prep with other Community members:

Join the CPEH-001 Discussion