Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPSA > CPSA MQ1 > Flashcards

CPSA MQ1 Flashcards

1
Q

Why can remote access VPNs not use Main Mode for IKE Phase-1 if the authentication method is pre-shared key?

A

Because pre-shared key authentication with Main Mode requires that the peer’s IP is known before the connection is established.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the blocksize of the DES encryption cipher?

A

64 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is this: 16:23:57.094021 IP 192.168.124.204.137 > 192.168.124.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

A

A NetBIOS over TCP/IP name service broadcast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which is the least secure encryption cipher of those listed below?

A

DES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which file in a user’s home directory controls the trust relationships for Berkeley R services?

A

rhosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which operating system is most likely to be vulnerable to the TTYPROMPT vulnerability in the telnet service?

A

Solaris 8

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of the following algorithms could be used to negotiate a shared encryption key?

A

Diffie-Hellman

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why might a tester insert the string “alert(“it works”)” into a web form?

A

To check for a Cross-Site Scripting vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which protocols are associated with PPTP?

A

TCP port 1723 and IP protocol 47

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Where are the encrypted passwords stored on a Solaris system?

A

/etc/shadow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following statements about the rwho protocol is true?

A

The rwho daemon sends regular broadcasts to UDP port 513, and listens to broadcasts from other systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How would you establish a null session to a windows host from a windows command shell?

A

NET USE \hostname\ipc$ “” /u:””

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

If the account lockout threshold is set to 5, how many incorrect password attempts will cause the built in administrator account to be locked out on a Windows 2003 system?

A

The built in administrator account will never be locked out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What effect would an octal umask of 0027 have on the permissions of new files?

A

Remove group write access, and remove all permissions for others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the name given to the field concerned with the security implications of electronic eminations from communications equipment?

A

TEMPEST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of these is not a valid IPv6 address?

A

2001:0db8:1428:57ab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

You discover an Internet accessible anonymous FTP server on a client’s internal network, which is vulnerable to the FTP bounce attack. What is the impact of this vulnerability?

A

Attackers could exploit the vulnerability to port scan other systems on the client’s internal network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What would you expect the command “finger 0@hostname” (that is a zero) against a Solaris 8 system to display?

A

Users with an empty GCOS field in the password file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the four potential risk treatments

A

Avoid, Reduce, Accept and Transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does “export” signify for an SSL cipher

A

It is a weak cipher that was acceptable for export under the old US cryptography export regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of these protocols is not vulnerable to address spoofing if implemented correctly?

A

TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What effect does setting the RestrictAnonymous registry setting to 1 have on a Windows NT or 2000 system?

A

It prevents enumeration of SAM accounts and names.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What command would you use to list the installed packages on a Solaris system?

A

pkginfo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which protocols and ports are used by Telnet, SMTP and Finger?

A

TCP/23, TCP/25 and TCP/79.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What would an SNMP request to set OID 1.3.6.1.4.1.9.2.1.55.10.0.0.1 to “file” on a Cisco router using a community string with read/write access do?

A

Cause the target router to upload its configuration file to the TFTP server at 10.0.0.1 as a file called “file”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What RPC authentication mechanism does NFS v2 and v3 use?

A

AUTH_SYS, using Unix UID and GID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of these statements about the Windows built in administrator account is correct?

A

It always has RID 500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does the “Root Squash” option on an NFS export do?

A

Makes the root user on the NFS client access files as nobody on the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

With blind SQL injection, the results of the injection are not visible, and no errors are displayed. How can blind SQL injection be detected?

A

The web server behaviour changes when a successful injection is performed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What does the phrase “Inherent Risk” mean in risk management?

A

A risk that is implicitly associated with an activity or location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which of the following cipher modes use a block cipher to generate a key stream that can be used as a stream cipher?

A

CFB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the digest length for the SHA1 hash function?

A

160 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the default password for the DBSNMP user on Oracle 9i?

A

DBSNMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which of these groups of tools are commonly used for packet crafting?

A

hping2, hping3 and scapy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The active directory database file is:

A

NTDS.DIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which nmap flag enables OS TCP/IP stack fingerprinting?

A

-O

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which of the following is NOT an EAP method?

A

EAP-RSA

38
Q

What is the significance of the string “SEP” in the configuration filename of a Cisco IP phone?

A

It stands for Selsius Ethernet Phone, which was the original name of the Cisco IP phone.

39
Q

Which of these is an IP option?

A

Record Route

40
Q

Which of the following are all ONC/RPC services?

A

cmsd, kcms_server, sadmind, snmpXdmid.

41
Q

When was the Apache chunked encoding vulnerability fixed in version 1.3?

A

1.3.26

42
Q

An accepted limitation of Diffie-Hellman key agreement protocol is

A

It is vulnerable to a man-in-the-middle attack

43
Q

What are the privileged TCP and UDP ports, which only a privileged user can listen on?

A

0 - 1023 inclusive

44
Q

What attack can be used to force some switches to forward frames to all ports?

A

MAC flooding

45
Q

Which of the following protocols is the most secure?

A

WPA with CCMP (AES)

46
Q

What command would you use to display the version number of a Microsoft SQL Server database if you are connected with a command line client?

A

select @@version;

47
Q

A web server returns “Server: Microsoft-IIS/5.0” in the HTTP headers. What operating system is it probably using?

A

Windows 2000 Server

48
Q

Some older TCP implementations are vulnerable to a DoS attack that exploits the small queue for connections in progress?

A

SYN flood

49
Q

What is the function of the /etc/ftpusers file on a Unix FTP server?

A

It lists the users that are NOT permitted to use the FTP server.

50
Q

In active directory, what does FSMO (pronounced “Fizz-Mo”) stand for?

A

Flexible Single Master Operations

51
Q

What TCP port does Microsoft SQL Server listen on in hidden mode?

A

2433

52
Q

During a penetration test, you gain access to a database containing personal details of staff. What is the best course of action?

A

Note the issue but do not store any of the personal data on your system.

53
Q

When should the scope of work be defined?

A

Before testing is started

54
Q

Which of these techniques is commonly implemented in modern C compilers to prevent buffer overflow exploitation?

A

Canary values

55
Q

Which of the following encryption algorithms is an asymmetric cipher?

A

RSA

56
Q

What are the valid key lengths for the AES encryption cipher?

A

128, 192 and 256

57
Q

Which are the six base SIP methods?

A

REGISTER, INVITE, ACK, CANCEL, BYE, OPTIONS

58
Q

Which scan would be most likely to discover a firewall that blocks all traffic to itself from the interface connected to the network you are scanning from?

A

ARP scan

59
Q

You find a system that is offering the NFS RPC service. What is the logical next step?

A

Run “showmount -e” to list the NFS exports.

60
Q

What is this: password 7 052D131D33556C081D021200

A

A password encoded with the reversible Cisco vigenere algorithm

61
Q

What identifies the superuser on a Unix or Linux system?

A

Any user with UID 0 (zero) in the password file

62
Q

Which command will retrieve the version number from default installations of the BIND nameserver software?

A

dig @nameserver version.bind txt chaos

63
Q

The UK Government protective marking levels are, from lowest to highest protection:

A

NPM, PROTECT, RESTRICTED, CONFIDENTIAL, SECRET, TOP SECRET

64
Q

What are the SIP and RTP protocols used for in VoIP?

A

SIP is used for setting up and closing down calls, and RTP is used for audio data transmission.

65
Q

What is the primary legal reason for obtaining written permission before starting a test?

A

Because otherwise the penetration test might breach the Computer Misuse Act

66
Q

Which of the following statements about the time protocols “time”, “daytime” and “NTP” are correct?

A

“time” represents the time as a 32-bit value, “daytime” uses an ASCII string, and “NTP” uses a 64-bit value.

67
Q

Which of these is not a valid IP address?

A

192.168.300.1

68
Q

What command would you use to list the installed patches on a Solaris system?

A

showrev -a or showrev -p

69
Q

On a Unix system, what is the effect of the execute bit on a directory?

A

It allows the directory to be traversed

70
Q

What is this: 17:58:01.396446 CDPv2, ttl: 180s, Device-ID ‘chestnut.nta-monitor.com’, length 404

A

A CDP broadcast

71
Q

What are the four mandatory transform attributes for an IKE Phase-1 SA?

A

Encryption Algorithm, Hash Algorithm, Authentication Method, Diffie Hellman Group

72
Q

What command would you use to list the installed packages on a Redhat or Fedora system?

A

rpm -qa

73
Q

Where are the encrypted passwords stored on a FreeBSD system?

A

/etc/master.passwd

74
Q

You discover a vulnerability on an Internet accessible web server which allows you to execute commands as a non-privileged user. The web server is behind a firewall that allows only TCP
port 80 inbound and permits all outbound traffic. What technique could be used to get shell access to the webserver?

A

Run a shell on the webserver and connect its control channel back to a TCP port on your local system

75
Q

If you find TCP port 111 open on a Unix system, what is the next logical step to take?

A

Run “rpcinfo -p” to enumerate the RPC services.

76
Q

Which protocol and port does a normal DNS lookup use?

A

UDP port 53

77
Q

Which of the following web application technologies would you expect to be most secure?

A

A pure Java application.

78
Q

Which nmap command performs a half-open or “SYN” TCP portscan?

A

nmap -n -P0 -v -sS -p1-1024 hostname

79
Q

Which command will perform a DNS zone transfer of the domain “company.com” from the nameserver at 10.0.0.1?

A

dig @10.0.0.1 company.com axf

80
Q

What is this: 17:57:57.850175 802.1d config 8064.00:0c:85:f1:3f:80.8010 root 8064.00:0b:46:48:29:80 pathcost 19 age 1 max 20 hello 2 fdelay 15

A

A Spanning Tree Protocol broadcast

81
Q

Which of these is not an ICMP message type?

A

Host unreachable

82
Q

What version of NFS includes strong security, including strong authentication and encryption?

A

version 4

83
Q

The DNS entries for www.customer.com and www.example.com both point to the same IP address. How does the web server know which domain is being requested by the browser?

A

It uses the HTTP Host: header.

84
Q

If an attacker gained access to a Microsoft SQL server using the “sa” account, which stored procedure would he use to add a user account?

A

xp_cmdshell

85
Q

Which of these is an Ethernet multicast MAC address?

A

01:00:0c:cc:cc:cc

86
Q

what technique forwards traffic to an attacker’s system by associating the attacker’s MAC address with the IP address of the target system?

A

ARP spoofing or ARP poisoning

87
Q

Which of these methods is the best way to determine if a remote host is running an X Window server that allows remote connections from the local host?

A

Run “xdpyinfo -display remotehost:0.0”

88
Q

What is the default password for the SYS user on Oracle 10g?

A

CHANGE_ON_INSTALL

89
Q

UDP port 1434 is commonly used by which database?

A

Microsoft SQL Server

90
Q

AJAX is

A

Asynchronous Javascript and XML

CPSA (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions