CEH Round 2 Flashcards
What cryptography attack is usually performed without the use of a computer?
Rubber hose attack
Attacker sniffs encrypted traffic from the network and is able to decrypt it. What cryptanalytic technique can the attacker use now to discover the encryption key?
chosen ciphertext attack
Attacker has captured a target file that is encrypted with public key cryptography. What attack is likely to be used to crack the target file?
chosen plain text attack
What cryptanalysis is applicable to symmetric key algorithms?
Differential cryptanalysis
In what attack, can an attacker obtain ciphertexts encrypted under two different keys and gather plaintext and matching ciphertext?
Related-key attack
Attacker breaks an n bit key cipher into 2 n/2 number of operations in order to recover the key. What is the cryptography attack?
Chosen-key attack
What is a physical attack that is performed on a cryptographic device/cryptosystem to gain sensitive information?
Side channel attack
What attack mainly affects any hardware/software using an ANSI X9.31 random number generator (RNG)?
DUHK attack
What cryptographic algorithm uses multiple keys for encryption?
Meet-in-the-middle Attack
What contains a public key and the identity of the owner and the corresponding private key
Signed certificates
A person wants to send encrypted email from home and not pay any license fees. What should you recommend?
Pretty Good Privacy (PGP)
What element of PKI verifies the applicant?
Registration Authority
SDLC, Binary Analysis, Scanners, Web App Firewalls, Transactional Sec - are all at what layer of the cloud security control model?
Application
NIDS/NIPS, firewalls, DPI, Anti-DDoS, QoS, DNSSEC, and OAuth are at what layer of the cloud security control model?
Network Layer
DLP, CMF, Database activity monitoring and encryption are at what layer of cloud security control?
Information Layer
What mechanism should be incorporated into cloud services to facilitate networks and resources to improve the response time of a job with maximum throughput?
Load Balancing
What categories of security controls strengthens the system against incidents by minimizing or eliminating vulnerabilities?
Preventative Controls
What is an example of a detective security control?
Employing IDS and IPS
What cloud security control layer does DNSSEC, OAuth operate?
Network Layers
What is not a legitimate cloud computing attack?
Port Scanning
What is it called when an attacker try to control operations of other cloud customers to gain illegal access to the data?
Isolation Failure
What threat occurs when an attacker creates anonymous access to the cloud services to carry out various attacks such as password and key cracking, hosting malicious data, and DDoS attack?
Abuse and nefarious use of cloud services
What weakness is caused when a mistake in the access allocation system causes a customer third party, or employee to get more access rights than needed?
privilege escalation
What attack occurs when an attacker steals a CSP’s or client’s credentials by methods such as phishing, pharming, social engineering, and exploitation of software vulnerabilites?
Service Hijacking Using Social Engineering Attacks
What attack occurs when an attacker runs a virtual machine on the same physical host as the victim’s virtual machine and takes advantage of shared physical resources (processor cahce) to steal data (cryptographic key) from the victim?
Side Channel Attack
What attack occurs when an attacker rides an active computer session by sending an email or tricking the user into visiting a malicious web page while they are logged into the targeted site?
Session Hijacking Using Session Riding
What is not a type of DNS attack?
Session Hijacking
What is not a type of side-channel attack?
Cybersquatting
In what attack does an attacker diver a user to a spoofed website by poisoning the DNS server or the DNS cache on the user’s system?
DNS Poisoning
XYZ wants to perform a root cause anaysis and discover if any data was exfiltrated and if so, what type of information did it contain? How would XYZ inc find out this information?
Cloud Forensics
You are a security engineer for XYZ Corp. You are looking for a cloud-based e-mail provider to migrate the company’s legacy on-premise e-mail system to. What type of cloud service model will the new e-mail system be running on?
SaaS
You are a security engineer for a cloud-based startup, XYZ Partners LLC, and they would like you to choose the best platform to run their environment from. The company stores sensitive PII and must be SOC 2 compliant. They would like to run their Windows server VMs and directory services from the cloud. Which of the following services and deployment models would meet the company’s requirements?
IaaS and Private
What type of cloud computing services provides virtual machines and other abstracted hardware and operating systems (OSs) which may be controlled through a service API?
IaaS
In what cloud deployment models does the provider make services such as applications, servers, and data storage available to the public over the Internet?
Public Cloud
What is not a characteristic of virtualization in cloud computing technology?
Storage
Which type of virtualization is used in increasing space utilization and reducing the hardware maintenance cost?
Server Virtualization
In order to protect a device against insecure network services vulnerability, what solution should be implemented?
Disable UPnP
What TCP/UDP port is used by the infected devices to spread malicious files to other devices in the network?
Port 48101
What is a security consideration for the gateway component of IoT architecture?
Multi-directional encrypted communications, strong authentication of all the components, automatic updates
In order to prevent an illegitimate user from performing a brute force attack, what security mechanism should be implemented to the accounts?
lockout mechanism
What can be used to protect private data and home networks while preventing unauthorized access using PKI-based security solutions for IoT devices?
DigiCert IoT Security Solution
Encrypted communications, strong authentication credentials, secure web interface, encrypted storage, and automatic updates are the security considerations for which of the following components?
Cloud Platform
Secure update server, verify updates before installation, and sign updates are the solutions for what IoT device vulnerabilities?
Insecure Software / Firmware
An attacker can perform attacks such as CSRF, SQLi, and XSS attack by exploiting which of the following IoT device vulnerability?
Insecure web interface
Proper communication and storage encryption, no default credentials, strong passwords, and up-to-date components are the security considerations for which of the following component?
Edge
What tool offers SaaS technology and assists in operating IoT products in a reliable, scalable, and secure manner?
SeaCat.io
Second phase in IoT device hacking?
Vulnerability Scanning
If an attacker wants to gather information such as IP address, hostname, ISP, device’s location, and the banner of the target IoT device, which of the following tools should he use to do so?
Shodan
Which of the following tools can an attacker use to gather information such as open ports and services of IoT devices connected to the network?
Nmap
What tool is used to perform a rolling code attack by obtaining the rolling code?
RF crack
What tool can perform BlueBorne or airborne attacks such as replay, fuzzing, and jamming?
HackRF one
If an attacker wants to reconstruct malicious firmware from a legitimate firmware in order to maintain access to the victim device, which of the following tools can he use to do so?
Firmware Mod Kit
If an attacker wants to gather information such as IP address, hostname, ISP, device’s location, and the banner of the target IoT device, which of the following types of tools can he use to do so?
Information Gathering Tools
What tool can be used to find buffer overflow vulnerabilities present in the system?
beSTORM
What RFCrack command is used by an attacker to perform jamming?
python RFCrack.py -j -F 314000000
IoT vulnerability that gives rise to issues such as weak credentials, lack of account lockout mechanism, and account enumeration?
Insecure web interface
attack where an attacker uses multiple forged identities to create a strong illusion of traffic congestion, affecting communication between neighboring nodes and networks?
Sybil
Attack where attacker uses a malicious script to exploit poorly patched vulnerabilities in an IoT device?
Exploit Kits
What component in IoT is used to send some unwanted commands in order to trigger some events which are not planned?
Fake Server
Attack where attacker intercepts legitimate messages from a valid communication and continuously send the intercepted message to the target device to crash the target device?
Replay Attack
Nmap command used to identify IPv6 capabilities of an IoT device?
nmap -6 -n -Pn -sSU -pT:0-65535,U:0-65535 -v -A -oX
IoT technology that bridges the gap between the IoT device and the end user?
IoT gateway
IoT technology that collects data that undergoes data analysis, from the gateway?
cloud server/data storage
What IoT architecture layer consists of all the hardware parts like sensors, RFID tags, readers or other soft sensors, and the device itself
Edge technology layer
What IoT architecture layer carries out communication between two end points such as device-to-device, device-to-cloud, device-to-gateway, and back-end data-sharing?
Internet Layer
What IoT devices is included in the buildings service sector?
HVAC, transport, fire and safety, lighting, security, access, etc.
What protocol is a type of short-range wireless communication?
ZigBee
What protocol uses magnetic field introduction to enable communication between two electronic devices?
Near Field Communication
Communication model where the IoT devices use protocols such as ZigBee, Z-Wave or Bluetooth, to interact with each other?
Device-to-Device
Communication model where the IoT devices communicate with the cloud service through gateways?
Device-to-gateway communication model
Short range wireless communication protocol used for home automation that allows devices to communicate with each other on local wireless LAN?
Threat
What is not a feature of Mobile Device Management?
Sharing confidential data among devices and networks
What is a Mobile Device Management Software?
XenMobile
If you are responsible for securing a network from any type of attack and if you have found that one of your employees is able to access any website that may lead to clickjacking, attacks, what would you do to avoid the attacks?
Harden browser permission rules
In order to avoid data loss from a Mobile device, what Mobile Device Management security measures should you consider?
Perform periodic backup and synchronization
What is not a countermeasure for phishing attacks?
Disable the “block texts from the internet” feature from your provider
What refers to a policy allowing an employee to bring his or her personal devices such as laptops, smartphones, and tablets to the workplace and using them for accessing the organization’s resources as per their access privileges?
BYOD
What can pose a risk to mobile platform security?
Connecting two separate networks such as Wi-Fi and Bluetooth simultaneously
What browser applications encrypts your Internet traffic and then hides it by bouncing through a series of computers around the world?
ORBOT
What application allows attackers to identify the target devices and block the access of Wi-Fi to the victim devices in a network?
NetCut
What mobile application is used to perform Denial-of-Service Attacks?
Low Orbit Ion Cannon
What Jailbreaking techniques will make the mobile device jailbroken after each reboot?
Untethered Jailbreaking
What tool is not used for iOS Jailbreaking?
Unrevoked
What process is supposed to install a modified set of kernel patches that allows users to run third-party applications not signed by the OS vendor?
Jailbreaking
What statement is not true for securing iOS devices?
Disable Jailbreak detection
What technique helps protect mobile systems and users by limiting the resources the mobile application can access on the mobile platform?
Sandbox
What attack can be performed by Spam messages?
Phishing
What Bluetooth attacks enables an attacker to gain remote access to the victims mobile and use its features without the victim’s knowledge or consent?
Bluebugging
If an attacker is able to access the email contact list, text messages, photos, etc. on your mobile device, then what type of attack did the attacker employ?
Bluesnarfing
What is not a mobile platform risk?
Sandboxing
When Jason installed a malicious application on his mobile, the application modified the content in other applications on Jason’s mobile phone. What process did the malicious application perform?
Data Tampering
Mark is working as a penetration tester in InfoSEC, Inc. One day, he notices that the traffic on the internal wireless router suddenly increases by more than 50%. He knows that the company is using a wireless 802.11 a/b/g/n/ac network. He decided to capture live packets and browse the traffic to investigate the issue to find out the actual cause. Which tool should Mark use to monitor the wireless network?
CommView for WiFi
Andrew, a professional penetration tester, was hired by ABC Security, Inc., a small IT-based firm in the United States to conduct a test of the company’s wireless network. During the information-gathering process, Andrew discovers that the company is using the 802.11 g wireless standard. Using the NetSurveyor Wi-Fi network discovery tool, Andrew starts gathering information about wireless APs. After trying several times, he is not able to detect a single AP. What do you think is the reason behind this?
SSID broadcast feature must be disabled, so APs cannot be detected.
What countermeasure helps in defending against KRACK attack?
Turn On auto-updates for all the wireless devices and patch the device firmware
What device is used to analyze and monitor the RF spectrum?
WIDS
What layer of wireless security does per frame/packet authentication provide protection against MITM attacks?
Connection Security
What countermeasure helps in defending against WPA/WPA2 cracking?
Select a random passphrase that is not made up of dictionary words
What countermeasure helps in defending against Bluetooth hacking?
Use non-regular patterns as PIN keys while pairing a device. Use those key combinations that are non-sequential on the keypad.
What technique is used to detect rogue APs?
RF scanning
What technique is used by network management software to detect rogue APs?
Wired side inputs
What is to be used to keep certain default wireless messages from broadcasting the ID to everyone?
SSID Cloaking
What Bluetooth attack allows attacker to gain remote access to a target Bluetooth-enabled device without the victim being aware of it?
Bluebugging
Thomas is a cyber thief trying to hack Bluetooth-enabled devices at public places. He decided to hack Bluetooth-enabled devices by using a DoS attack. He started sending an oversized ping packet to a victim’s device, causing a buffer overflow and finally succeeded. What type of Bluetooth device attack is Thomas most likely performing?
Bluesmacking
What bluetooth mode filters out non-matched IACs and reveals itself only to those that matched?
Limited discoverable
What term is used to describe an attack in which an attacker gains remote access to a target Bluetooth-enabled device without the victim being aware of it?
Bluebugging
What protocol is used by BlueJacking to send anonymous messages to other Bluetooth-equipped devices?
OBEX
An attacker collects the make and model of target Bluetooth-enabled devices analyzes them in an attempt to find out whether the devices are in the range of vulnerability to exploit. Identify which type of attack is performed on Bluetooth devices.
Blueprinting
What attack does the attacker exploit the vulnerability in the Object Exchange (OBEX) protocol that Bluetooth uses to exchange information?
Bluesnarfing
In which type of bluetooth threat does an attacker trick Bluetooth users to lower security or disable authentication for Bluetooth connections in order to pair with them and steal information?
Social Engineering
A large company intends to use Blackberry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the corporate network. What tool should the analyst use to perform a Blackjacking attack?
BBProxy
What is the art of collecting information about Bluetooth enabled devices such as manufacturer, device model and firmware version.
Blueprinting
There is a WEP encrypted wireless AP with no clients connected. In order to crack the WEP key, a fake authentication needs to be performed. Which of the following steps need to be performed by the attacker for generating fake authentication?
Ensure association of source MAC address with the AP
What attack involves exploiting the CSMA/CA Clear Channel Assessment (CCA) mechanism to make a channel appear busy?
Denial-of-Service
John is a pen tester working with an information security consultant based in Paris. As part of a penetration testing assignment, he was asked to perform wireless penetration testing for a large MNC. John knows that the company provides free Wi-Fi access to its employees on the company premises. He sets up a rogue wireless access point with the same SSID as that of the company’s Wi-Fi network just outside the company premises. He sets up this rogue access point using the tools that he has and hopes that the employees might connect to it. What type of wireless confidentiality attack is John trying to do?
Evil Twin AP
This application is a Wi-Fi security tool for mobile devices, It works on both Root and Non-root devices, and it can prevent ARP spoofing attacks such as MITM attacks, which are used by some applications such as WifiKill, dSploit, and sniffers.
WiFiGuard
Steven, a wireless network administrator, has just finished setting up his company’s wireless network. He has enabled various security features such as changing the default SSID and enabling strong encryption on the company’s wireless router. Steven decides to test the wireless network for confidentiality attacks to check whether an attacker can intercept information sent over wireless associations, whether sent in clear text or encrypted by Wi-Fi protocols. As a part of testing, he tries to capture and decode unprotected application traffic to obtain potentially sensitive information using hardware or software tools such as Ettercap, Kismet, Wireshark, etc. What type of wireless confidentiality attack is Steven trying to do?
Eavesdropping
Kenneth, a professional penetration tester, was hired by the XYZ Company to conduct wireless network penetration testing. Kenneth proceeds with the standard steps of wireless penetration testing. He tries to collect lots of initialization vectors (IVs) using the injection method to crack the WEP key. He uses the aircrack-ng tool to capture the IVs from a specific AP. Which of the following aircrack-ng commands will help Kenneth to do this?
airodump-ng -c 9 – bssid 00:14:6C:7E:40:80 -w output ath0
Which of the following Wi-Fi discovery tools facilitates detection of Wireless LANs using the 802.11a/b/g WLAN standards and is commonly used for wardriving, verifying network configurations, finding locations with poor coverage and detecting rouge APs?
NetStumbler
