CEH-001 試験問題を無料オンラインアクセス

Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?

• A.Gramm-Leach-Bliley Act (GLBA)
• B.Federal Information Security Management Act (FISMA)
• C.Sarbanes-Oxley Act (SOX)
• D.Fair and Accurate Credit Transactions Act (FACTA)

When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is

• A.OSSTMM addresses controls and OWASP does not.
• B.OSSTMM is gray box testing and OWASP is black box testing.
• C.OWASP addresses controls and OSSTMM does not.
• D.OWASP is for web applications and OSSTMM does not include web applications.

A security administrator notices that the log file of the company`s webserver contains suspicious entries:

Based on source code analysis, the analyst concludes that the login.php script is vulnerable to

• A.command injection.
• B.SQL injection.
• C.directory traversal.
• D.LDAP injection.

The SNMP Read-Only Community String is like a password. The string is sent along with each SNMP Get-Request and allows (or denies) access to a device. Most network vendors ship their equipment with a default password of "public". This is the so-called "default public community string". How would you keep intruders from getting sensitive information regarding the network devices using SNMP? (Select 2 answers)

• A.The default configuration provided by device vendors is highly secure and you don't need to change anything
• B.Use your company name as the public community string replacing the default 'public'
• C.Enable IP filtering to limit access to SNMP device
• D.Enable SNMPv3 which encrypts username/password authentication

An attacker is attempting to telnet into a corporation's system in the DMZ. The attacker doesn't want to get caught and is spoofing his IP address. After numerous tries he remains unsuccessful in connecting to the system. The attacker rechecks that the target system is actually listening on Port 23 and he verifies it with both nmap and hping2. He is still unable to connect to the target system. What could be the reason?

• A.He cannot spoof his IP and successfully use TCP
• B.He needs to use an automated tool to telnet in
• C.The firewall is blocking port 23 to that system
• D.He is attacking an operating system that does not reply to telnet even when open