Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 3

Question 1

Which type of IDS analyzes network traffic patterns against a learned baseline to detect anomalies?

Accepted Answer

Anomaly-Based IDS

Answer

Anomaly-based IDS establishes a baseline of normal behavior and triggers alerts when traffic deviates significantly from that baseline.

Question 2

What is 'covert channel' communication in the context of firewall evasion?

Accepted Answer

Transmitting data through protocols not intended for data transfer

Answer

Covert channels exploit non-standard use of protocols (e.g., hiding data in ICMP ping payloads or DNS queries) to bypass firewalls that only filter known data channels.

Question 3

Which tool is used to perform session hijacking by capturing and replaying network packets?

Accepted Answer

Hamster and Ferret

Answer

Hamster and Ferret are tools used together to sidejack HTTP sessions by capturing cookies from wireless traffic and replaying them to impersonate victims.

Question 4

What firewall type inspects traffic at Layer 7 and can identify and block specific applications regardless of port?

Accepted Answer

Next-Generation Firewall (NGFW)

Answer

A Next-Generation Firewall (NGFW) performs deep packet inspection at the application layer, enabling it to identify and control specific applications independent of port or protocol.

Question 5

Which technique do attackers use to bypass firewalls by encapsulating malicious traffic within an allowed protocol such as DNS or ICMP?

Accepted Answer

Protocol Tunneling

Answer

Protocol tunneling encapsulates unauthorized traffic inside permitted protocols (like DNS or ICMP), allowing it to pass through firewalls that only filter by protocol type.

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 3