Chapter 9 Flashcards
Different types of organizations have similar levels of network security risks.
False
The term malware is derived from a combination of the words malicious and software.
True
A hacker, in the original sense of the word, is someone with technical skills and malicious intent.
False
The day after Patch Tuesday is informally Exploit Wednesday.
True
A drop ceiling could be used by an intruder to gain access to a secured room.
True
Over a long distance connection, using SSH keys is more secure than using passwords.
True
The original version of the Secure Hash Algorithm was developed by MIT.
False
Sudden unexplained increases in file sizes and unusual error messages with no apparent cause are both potential symptoms of a viral infection.
True
Current research indicates that a long, random string of words, such as correct horse battery staple is much more secure than a random series of letters, numbers, and symbols that is short enough to be remembered.
True
It is ideal to use the same password for multiple different applications, provided the password is complex enough.
False
Which penetration testing tool combines known scanning and exploit techniques to explore potentially new attack routes?
metasploit
Which of the following statements correctly describes the malware characteristic of polymorphism?
Polymorphic malware can change its characteristics every time its transferred to a new system
A virus that remains dormant until a specific condition is met, such as the changing of a file or a match of the current date is known as what kind of malware?
Logic bomb
Which of the following statements describes a worm?
A program that runs independently of other software and travels between computers a across networks
If multiple honeypots are connected to form a larger network, what term is used to describe the network?
Honeynet
An attack that relies on redirected and captured secure transmissions as they occur is known as what type of attack?
Man-in-the-Middle attack
Which of the following scenarios represents a phishing attempt?
An email was sent to a manager at your company that appeared to be from the company’s CTO, asking for access
In a red team blue team exercise, what is the purpose of the blue team?
The blue team is charged with defending the network
Which of the following utilities performs sophisticated vulnerability scans, and can identify unencrypted data such as credit card numbers?
Nessus
If someone is offered a free gift or service in exchange for private information or access to a computer system, what type of social engineering is taking palce?
Quid pro quo
A person posing as an employee strikes up a conversation with a legitimate employee as they walk into a secured area, in an attempt to gain access. What kind of social engineering is this?
Tailgating
In the typical social engineering attack cycle, what occurs in Phase 3?
The attacker exploits an action undertaken by the victim in order to gain access
The concept of giving employees and contractors only enough access and privileges to do their jobs is known by what term?
Principle of least privilege
What statement regarding denial of service attacks is accurate?
A denial of service attack prevents legitimate users from accessing normal network resources
Utilized by China’s so called “Great Firewall”, what type of attack can prevent user access to web pages, or even redirect them to illegitimate web pages?
DNS poisoning
What is the Nmap utility used for?
It is a port scanning utility that can identify open ports on a host
How is a posture assessment performed on an organization?
A thorough examination of each aspect of the organization’s network is performed to determine how it might be compromised
What type of door access control is physical or electronic lock that requires a code to open the door?
Cipher lock
An RFID label on a box is an example of what type of physical security detection method?
Asset tracking tagging
What statement regarding the different versions of the SHA hashing algorithm is accurate?
SHA-2 and SHA-3 both support the same hash lengths
On a Linux based system, what command can you use to create a hash of a file using SHA-256?
sha256sum
What command can be used on a Windows system to create a hash of a file?
Get-FileHash
VMware’s AirWatch and Cisco’s Meraki Systems Manager are both examples of what type of software?
Mobile device management software
A variant of BYOD, what does CYOD allow employees or students to do?
They can choose a device from a limited number of options
Where would restrictions regarding what users can and cannot do while accessing a network’s resources be found?
Acceptable use policy document
What document addresses the specific concerns related to special access given to administrators and certain support staff?
Privileged user agreement
Which of the following scenarios would necessitate the use of a non disclosure agreement?
Your company needs to prevent a new contractor from sharing information with a potential competitor
How often should you require users to change their passwords?
Every 60 days
What type of attack forces clients off a wireless networ, creating a form of Wi-Fi DoS?
Deauthentication attack
Which type of DoS attack involves an attack that is bounced off uninfected computers before being directed at the target?
Distributed reflection denial of service attack
