Chapter 1 Review Questions Flashcards
What is enumeration in hacking?
The phase where a hacker attempts to extract information such as usernames, computer names, network resources, shares, and services.
Which “threat actor” may cross ethical lines, but usually has good intentions?
Gray Hat
What is an Advanced Persistent Threat (APT)>
An attack where the hacker has inconspicuously implanted a means to continuously gain undetected daccess to a network.
What is Threat Modeling?
The process of analyzing the security of the organization and determining security holes.
Once a threat model is put together, the
organization can begin securing its systems and
data
What is the Permission to Test document?
The proof an ethical hacker has that they have permission to perform otherwise-illegal previously-approved-of activities to test the security of an organization’s network.
What is Penetration Testing?
the practice of finding vulnerabilities and risks with the purpose of securing a computer or network system.
Which “threat actor” uses their skills for defensive purposes?
White Hat
What is the Rules of Engagement document?
The form detailing the agreement on how to handle sensitive data and who to contact if something goes wrong.
What is the Open Source Security Testing Methodology Manual (OSSTMM)?
A framework that attempts to create a single accepted method for a thorough security test.
What are the five phases of the ethical hacking methodology?
Performing reconnaissance
Scanning and enumeration
Establishing access
Maintaining access
Clearing tracks
Which penetration testing type simulates an outside attack and is also the most expensive?
Black Box
Which of the following is NOT one of the four common methods for dealing with risk?
Acceptance
Avoidance
Transference
Ignorance
Ignorance
What does ISO/IEC 27001 regulate?
Defines the processes and requirements for an organization’s
information security management systems.
What does the Payment Card Industry Data Security Standards
(PCI-DSS) regulate?
Defines the security standards for any organization that
handles cardholder information for debit cards, credit cards,
prepaid cards, and other types of payment cards.
What does Health Insurance Portability and Accountability
Act (HIPAA) regulate?
A set of standards that ensures a person’s health information
is kept safe and only shared with the patient and medical
professionals that need it.
What is the Sarbanes Oxley Act (SOX)?
A law enacted in 2002 with the goal of implementing
accounting and disclosure requirements that would increase
transparency in corporate governance and financial
reporting and formalizing a system of internal checks and
balances.
What is the Digital Millennium Copyright Act (DMCA)?
A law is designed to protect copyrighted
works.
What is the Federal Information Security Management Act (FISMA)?
A law that defines how federal government data, operations, and
assets are handled.
What is an Objective-Based Penetration Test?
It is an objective-based test that focuses on the overall security of the organization and its data security.
What is the Performing Reconnaissance stage of the Ethical Hacking Methodology?
the hacker begins gathering information about the
target. This can include gathering publicly available information,
using social engineering techniques, or even dumpster diving
What is the Scanning and Enumeration stage of the Ethical Hacking Methodology?
Scanning is a natural extension of reconnaissance. The hacker uses
various tools to gather in-depth information about the network,
computer systems, live systems, open ports, and other features.
Extracting information such as usernames, computer names,
network resources, shares, and services is known as enumeration.
Enumeration is a part of the scanning step
What is the Establishing Access stage of the Ethical Hacking Methodology?
In this phase, the hacker uses all the information gathered through
reconnaissance and scanning to exploit any vulnerabilities found
and gain access.
What is the Maintaining Access stage of the Ethical Hacking Methodology?
Once the hacker has gained access, he can use backdoors, rootkits,
or Trojans to establish permanent access to the system.
What is the Clearing Tracks stage of the Ethical Hacking Methodology?
The final step in the hacking process is clearing tracks. The hacker
overwrites log files to hide the fact they were ever there.
What is the Open Web Application Security Project (OWASP)?
It describes techniques for testing the most common web
applications and web service security issues.
What is the NIST SP 800-115
a guide to the basic technical aspects of conducting
information security assessments.
Describe a Black Box attack.
An attack where the hacker has no starting information. It simulates outside threats, ignoring inside threats. It is the most expensive attack.
Describe a White Box attack.
A comprehensive test where the attacker has full knowledge of the target. Because of this it does not simulate a real world attack.
Describe a Gray Box attack.
An attack where the hacker has partial knowledge of the target, simulating an insider threat. Requires less reconnaissance than black box.
What is a Suicide Hacker?
Attacks targets for a cause. Getting caught is irrelevant.
What is a Cyber Terrorist?
Religious or political in motive. Goal is to create disruption or fear
What is a State Sponsored Hacker?
- Is employed by a government
- Retrieves top-secret information
- Hacks other governments’ devices
What is a Hacktivist?
Main purpose is to protest and get their views and opinions
out
Defaces websites
Attacks with DoS/DDoS
Script Kiddie
- Is extremely unskilled
- Uses pre-developed tools and scripts
- Has no desire to learn
What is Risk Assessment and what four methods deal with risk?
The purpose of a risk assessment is to identify areas of
vulnerability within the organization’s network.
There are four common methods for dealing with risk:
* Avoidance
* Transference
* Mitigation
* Acceptance
What is Scope Creep
This is when the client begins asking for small deviations
from the scope of work. This can cause the project to go off
track and increase the time and resources needed to
complete it.
What are the three types of testing?
Goal-based testing
Objective-based testing
Compliance-based testing
What is a Goal-Based Penetration Test?
A goal-based penetration test will focus on the end results.
The goals must be specific and well-defined before the test
can begin
