Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 3

Question 1

Which type of IDS analyzes network traffic patterns against a learned baseline to detect anomalies?

Accepted Answer

Anomaly-Based IDS

Answer

Signature-Based IDS

Answer

Host-Based IDS

Answer

Stateful IDS

Question 2

What is 'covert channel' communication in the context of firewall evasion?

Accepted Answer

Transmitting data through protocols not intended for data transfer

Answer

Encrypted VPN tunnels between trusted hosts

Answer

Using HTTPS to bypass DPI

Answer

Exfiltrating data via cloud storage APIs

Question 3

Which tool is used to perform session hijacking by capturing and replaying network packets?

Accepted Answer

Hamster and Ferret

Answer

Wireshark

Answer

Nessus

Answer

Burp Suite

Question 4

What firewall type inspects traffic at Layer 7 and can identify and block specific applications regardless of port?

Accepted Answer

Next-Generation Firewall (NGFW)

Answer

Packet Filtering Firewall

Answer

Stateful Inspection Firewall

Answer

Circuit-Level Gateway

Question 5

Which technique do attackers use to bypass firewalls by encapsulating malicious traffic within an allowed protocol such as DNS or ICMP?

Accepted Answer

Protocol Tunneling

Answer

Port Knocking

Answer

ARP Spoofing

Answer

Fragmentation

Question 6

What is 'ARP spoofing' primarily used for in session hijacking attacks on a LAN?

Accepted Answer

Associating the attacker's MAC with a legitimate IP to intercept traffic

Answer

Crashing the ARP cache of routers

Answer

Generating fake ARP broadcasts to flood the network

Answer

Bypassing 802.1X port authentication