Hi,
i did actualtest paper and i found their answer rather suspicous.

Q1
Doug is conducting a port scan of a target network. He knows that his client target network
has a web server and that there is a mail server which is up and running. Dough has been sweeping the network but has not been able to elicit any response from the remote target.
Which of the following could be the most likely cause behind this lack of response?  Select 4

a. UDP is filtered by a gateway
b. The packet TTL value is too low and cannot reach the target
c. The host might be down
d. The destination network might be down
e. The TCP windows size does not match
f. ICMP is filterd by a gateway

ans: A,B,C,D

i thought the answer is A,C,D,F



Q2
You have the SOA presented below in you Zone. Your secondary servers have not been able to contact your primary server to synchronise information. How long will the secondary servers attempt to conact the primary server before it considers that zone is dead and stops responding to queries?
college.edu (200302028 3600 3600 6+4800 3600)

a. 1 day
b. 1 hour
c. 1 week
d. 1 month

Answer: C

i thought the answer is 1 hour??
60sec x 60 = 3600seconds


Q3
Joe worried that network adminstrator miht detect the wiretap program by querying
the interfaces to see of they are running in promiscuous mode.

a. Block output to the console whenever the user runs ifconfig command by running screen
capture utility
b. Run the wiretap program in stealth mode from being detected by the ifconfig command
c. Repalce original ifconfig utility with the rootkit version of ifconfig hiding
Promiscuous information being displayed on the console
d. You cannor disable Promiscuous mode detection on Linux Systems.

Answer given is D, and I thought answer should be C.

I thought we can disable it by entering -> ifconfig eth0 -promisc

Q 4
A following attack on web server using obstructed URL:
http://www.example.com/scri[t.ext?template%2e%2e%2e%2e%2e%2f%65%74%63%2f%7

how to protect information systems from these attacks

A. Configure web server to deny alerts from these attacks
B. Create rules in IDS to alert on strange Unicode requests
C. Use SSL authentication on Web Servers
D. Enable Active scri[ts detection at the firewall and routers.

Answer given is B

The only reason i thought of its IDS deployed infront of the web server (DMZ segment)

what about A? can we configure the webserver to deny unicode request?


5.
Bubba has just accessed he preferred ecommerce web site and has spotted an item that he would like to buy. Bubba considers the price a bit too steep. He looks at the source code of the webpage and decides to
save the page locally, so that he can modify the page variables. In the context of web application security,
what do you think Bubba has changes?

A. A hidden form field value.
B. A hidden price value.
C. An integer variable.
D. A page cannot be changed locally, as it is served by a web server.

Answer given is A.

I was thinking whether the answer could be D.
Even the entire page is downloaded into our PC, we changed the value locally, but it doesnt reflect in the server such via POST method...

I did a check and the answer is indeed 1 hour


I will look for the question once more.

* U need a DNS server to get the zone
* U use the tool nslookup to carry out the zone transfer.

So it all depends on how u interpret the word "accomplished". I would prefer B over A in this case. In the absence of B, the best answer would be A.

But ultimately the correct answer is what the EC council expects, and that only God knows   

Any comments are welcome from other members.

I cannot see the logic of how denying alerts from web server can help unicode attacks 



I dont know much about pop before smtp, but this method seems to work only in caseses designated users are allowed to relay mail though a specific mail server. But if I want to send a mail to dareth@xyz.com, u cannot enforce pop before smtp to me. U need to open the port smtp of xyz mail server.

If the port is open, u can telnet and grab the banner. But  there are probably methods to restrict manual telnet. ( eg implienting a quick timeouts )
 
So IMO E is the answer

3 thoughts on this:

1. Members are responsible and liable for their own posts not the owners of the site.
2. This was from ActualTests. He didn't claim it was from the real CEH exam. We could debate where they get their questions and answers, but I won't do that now. So as far as we know, this is simply a practice exam which is legal. He also didn't just ask for the answers. He gave what he thought the answer should be and why he thought it was wrong. So if anything, this once again proves that, although the legality of such products is debatable, they often have wrong answers, so the decision to use them is considered unwise.
3. Oyle has every right to question the validity of the post and warn against possible backlash from the cert org.

Please don't reply to these thoughts here. I am going to copy and paste them into a new thread for further discussion here:
http://www.ethicalhacker.net/component/option,com_smf/Itemid,49/topic,743.0/

Don

  I don’t think we need to insult the posters here and call them newbs, etc.. It seemed to me they had genuine concerns and had no malicious intent. Also, I think Don asked that we post about this on a new thread.   Perhaps it would be better in the future if someone had questions concerning mistakes in test preps or test cheats or whatever you want to call it, they just post a question and not copy and paste from materials like this. And don’t disclose where it came from. 

Thanks for everybosy's feedbacks
Skel: thanks for the feedbacks.
Negrita: i will read the RFCs..

I wish to apologise if i had caused any dis-comforts to anyone here... I do not wish to re-produce the question but i afraid i would have produced the questions wrongly, which act according to my thoughts.

moderator: u can erase this thread anytime.

I took the test and pass with rather good results.  Once again, i really appreciate those who help me to clarify some doubts along the way. A reminder to those who's taking, dont trust the answers too much, whether its TK,AT, etc..

cheers,
Dareth