Ch 9: Network Risk Management Flashcards
What penetration testing tool combines known scanning and exploit techniques to explore potentially new attack routes?
metasploit
Which of the following statements correctly describes the malware characteristic of polymorphism?
Polymorphic malware can change its characteristics every time it is transferred to a new system.
A virus that remains dormant until a specific condition is met, such as the changing of a file or a match of the current date is known as what type of malware?
logic bomb
Which of the following statements describes a worm?
A program that runs independently of other software and travels between computers and across networks.
If multiple honeypots are connected to form a larger network, what term is used to describe the network?
honeynet
An attack that relies on redirected and captured secure transmissions as they occur is known as what type of attack?
man-in-the-middle attack
Which of the following scenarios represents a phishing attempt?
An e-mail was sent to a manager at your company that appeared to be from the company’s CTO, asking for access.
In a red team-blue team exercise, what is the purpose of the blue team?
The blue team is charged with the defense of the network.
Which of the following utilities performs sophisticated vulnerability scans, and can identify unencrypted data such as credit card numbers?
Nessus
If someone is offered a free gift or service in exchange for private information or access to a computer system, what type of social engineering is taking place?
quid pro quo
A person posing as an employee strikes up a conversation with a legitimate employee as they walk into a secured area, in an attempt to gain access. What kind of social engineering is this?
tailgating
In the typical social engineering attack cycle, what occurs at Phase 3?
The attacker exploits an action undertaken by the victim in order to gain access.
The concept of giving employees and contractors only enough access and privileges to do their jobs is known by what term?
principle of least privilege
What statement regarding denial-of-service (DoS) attacks is accurate?
A denial-of-service attack prevents legitimate users from accessing normal network resources.
Utilized by China’s so-called “Great Firewall”, what type of attack can prevent user access to web pages, or even redirect them to illegitimate web pages?
DNS poisoning
