GAQM Exam CPEH-001 Topic 7 Question 101 Discussion

Actual exam question for GAQM's CPEH-001 exam

Question #: 101
Topic #: 7

During the intelligence gathering phase of a penetration test, you come across a press release by a security products vendor stating that they have signed a multi-million dollar agreement with the company you are targeting. The contract was for vulnerability assessment tools and network based IDS systems. While researching on that particular brand of IDS you notice that its default installation allows it to perform sniffing and attack analysis on one NIC and caters to its management and reporting on another NIC. The sniffing interface is completely unbound from the TCP/IP stack by default. Assuming the defaults were used, how can you detect these sniffing interfaces?

AUse a ping flood against the IP of the sniffing NIC and look for latency in the responses.

BSend your attack traffic and look for it to be dropped by the IDS.

CSet your IP to that of the IDS and look for it as it attempts to knock your computer off the network.

DThe sniffing interface cannot be detected.

Show Suggested Answer

Suggested Answer: D

When a Nic is set to Promiscuous mode it just blindly takes whatever comes through to it network interface and sends it to the Application layer. This is why they are so hard to detect. Actually you could use ARP requests and Send them to every pc and the one which responds to all the requests can be identified as a NIC on Promiscuous mode and there are some very special programs that can do this for you. But considering the alternatives in the question the right answer has to be that the interface cannot be detected.

by Gayla at Sep 13, 2024, 02:17 AM

Limited Time Offer

25%

Off

Get Premium CPEH-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Willetta

2 months ago

Haha, imagine if the sniffing interface was just invisible. Like, the security vendor was just trolling us the whole time! 'Can't detect it? That's the point!'

upvoted 0 times

...

3 months ago

I think the answer is to send your attack traffic and look for it to be dropped by the IDS. That's a clever way to detect the sniffing interface.

upvoted 0 times

Dolores

2 months ago

C) Set your IP to that of the IDS and look for it as it attempts to knock your computer off the network.

upvoted 0 times

...

Sarah

2 months ago

B) Send your attack traffic and look for it to be dropped by the IDS.

upvoted 0 times

...

Rosendo

2 months ago

A) Use a ping flood against the IP of the sniffing NIC and look for latency in the responses.

upvoted 0 times

...

Yvonne

3 months ago

I disagree, I believe the correct answer is B) Send your attack traffic and look for it to be dropped by the IDS.

upvoted 0 times

...

3 months ago

I think the answer is A) Use a ping flood against the IP of the sniffing NIC and look for latency in the responses.

upvoted 0 times

...