Day 2 1-86

Question 1

2.1 When dealing with a particular hashing algorithm, which property makes it less likely the algorithm will create the same hash result for multiple different source messages?

A. Collision resistance
B. Bit length
C. Key strength
D. Entropy

Answer 1

Answer: A Collision resistance

Question 2

2.2 What does a firewall inspect to stop specific ports and programs from sending traffic in to your company?

A. Application layer port numbers and the transport layer headers
B. Network layer headers and the session layer port numbers
C. Presentation layer headers and the session layer port numbers
D. Transport layer port numbers and the application layer headers

Answer 2

Answer: D. Transport layer port numbers and the application layer headers

Question 3

2.3 Bob has obtained a session ID from another user’s website session. Bob spoofs his IP address and re-plays the session ID trying to impersonate the other user. Why is Bob not able to get an interactive session here?

A. Bob cannot spoof his IP address over TCP network
B. The scenario is incorrect as Bob can spoof his IP and get responses
C. The server will send replies back to the spoofed IP address
D. Bob can establish an interactive session only if he uses a NAT

Answer 3

Answer: C. The server will send replies back to the spoofed IP address

Question 4

2.4 What must you develop to show that security at your company has improved over the last year?

A. Reports
B. Testing tools
C. Metrics
D. Taxonomy of vulnerabilities

Answer 4

Answer: C Metrics

Question 5

2.5 Which type of password attack pulls passwords from a list of commonly used passwords until the correct password is found or the list is exhausted?

A. Man-in-the-middle attack
B. Brute-force attack
C. Dictionary attack
D. Session hijacking

Answer 5

Answer: C. Dictionary attack

Question 6

2.6 Which of these is the best solution for sending encrypted e-mails if you don’t want to have to pay any money or manage a server?

A. IP Security (IPSEC)
B. Multipurpose Internet Mail Extensions (MIME)
C. Pretty Good Privacy (PGP)
D. Hyper Text Transfer Protocol with Secure Socket Layer (HTTPS)

Answer 6

Answer: C Pretty Good Privacy (PGP)

Question 7

2.7 How would you classify an operating-system fingerprinting method where you send traffic to the remote device and analyze the responses?

A. Passive
B. Reflective
C. Active
D. Distributive

Answer 7

Answer: C Active

Question 8

2.8 A Certificate Authority (CA) creates a pair of keys to secure data in-transit. The integrity of the encrypted data depends on the security of which of these?

A. Public key
B. Private key
C. Modulus length
D. Email server certificate

Answer 8

Answer: B Private key

Question 9

2.9 WiFi most commonly uses which antenna?

A. Omnidirectional
B. Parabolic
C. Uni-directional
D. Bi-directional

Answer 9

Answer: A Omnidirectional

Question 10

2.10 Which of these PKI components actually verifies the applicant?

A. Certificate authority
B. Validation authority
C. Registration authority
D. Verification authority

Answer 10

Answer: C Registration authority

Question 11

2.11 Which of these is the most solid example of IP spoofing?

A. SQL injections
B. Man-in-the-middle
C. Cross-site scripting
D. ARP poisoning

Answer 11

Answer: D ARP poisoning

Question 12

2.12 Which protocol do smart-cards use to transfer certificates?

A. Extensible Authentication Protocol (EAP)
B. Point to Point Protocol (PPP)
C. Point to Point Tunneling Protocol (PPTP)
D. Layer 2 Tunneling Protocol (L2TP)

Answer 12

Answer: A Extensible Authentication Protocol (EAP)

Question 13

2.13 Which of these programming languages is commonly vulnerable to buffer overflows?

A. Perl
B. C++
C. Python
D. Java

Answer 13

Answer: B . C++

Question 14

2.14 Which of the following is a symmetric cryptographic standard?

A. DSA
B. PKI
C. RSA
D. 3DES

Answer 14

Answer: D 3DES

Question 15

2.15 What is the primary drawback to using advanced encryption standard (AES) algorithm with a 256 bit key to share sensitive data?

A. Due to the key size, the time it will take to encrypt and decrypt the message hinders efficient communication.

B. To get messaging programs to function with this algorithm requires complex configurations.

C. It has been proven to be a weak cipher, therefore, should not be trusted to protect sensitive data.

D. It is a symmetric key algorithm, meaning each recipient must receive the key through a different channel than the message.

Answer 15

Answer: D It is a symmetric key algorithm, meaning each recipient must receive the key through a different channel than the message.

Question 16

2.16 Which of the following processes of PKI (Public Key Infrastructure) ensures that a trust relationship exists and that a certificate is still valid for specific operations?

A. Certificate issuance
B. Certificate validation
C. Certificate cryptography
D. Certificate revocation

Answer 16

Answer: B Certificate validation

Question 17

2.17 Advanced Encryption Standard is an algorithm used for which of the following?

A. Data integrity
B. Key discovery
C. Bulk data encryption
D. Key recovery

Answer 17

Answer: C Bulk data encryption

Question 18

2.18 While checking the settings on the internet browser, a technician finds that the proxy server settings have been checked and a computer is trying to use itself as a proxy server. What specific octet within the subnet does the technician see?

A. 10.10.10.10
B. 127.0.0.1
C. 192.168.1.1
D. 192.168.168.168

Answer 18

Answer: B 127.0.0.1

Question 19

2.19 After gaining access to the password hashes used to protect access to a web based application, knowledge of which cryptographic algorithms would be useful to gain access to the application?

A. SHA1
B. Diffie-Helman
C. RSA
D. AES

Answer 19

Answer: A . SHA1

Question 20

2.20 One advantage of an application-level firewall is the ability to..

A. filter packets at the network level.
B. filter specific commands, such as http:post.
C. retain state information for each packet.
D. monitor tcp handshaking.

Answer 20

Answer: B filter specific commands, such as http:post.

Question 21

2.21 A hacker was able to sniff packets on a company’s wireless network. The following information was discovered.
The Key 10110010 01001011
The Cyphertext 01100101 01011010

Using the Exlcusive OR, what was the original message?

A. 00101000 11101110
B. 11010111 00010001
C. 00001101 10100100
D. 11110010 01011011

Answer 21

Answer: B 11010111 00010001

Question 22

2.22 Which of the following techniques will identify if computer files have been changed?

A. Network sniffing
B. Permission sets
C. Integrity checking hashes
D. Firewall alerts

Answer 22

Answer: C Integrity checking hashes

Question 23

2.23 Why shouldn’t we just use the longest possible key and strongest possible algorithm when selecting an encryption algorithm?

A. Overhead

B. If an algorithm such as Rijndael is chosen for AES it has been cracked and is probably useless.

C. The longest possible unbreakable key is a “one- time pad”, but the length of a message is not always known in advance, therefore the best solution is a passphrase that makes a longer key.

D. This question cannot be answered because there are so many variables and complicated factors involved and there just isn’t enough information provided.

Answer 23

Answer: A Overhead

Question 24

2.24 How does traceroute map the route a packet travels from point A to point B?

A. Uses a TCP timestamp packet that will elicit a time exceeded in transit message
B. Manipulates the value of the time to live (TTL) within packet to elicit a time exceeded in transit message
C. Uses a protocol that will be rejected by gateways on its way to the destination
D. Manipulates the flags within packets to force gateways into generating error messages

Answer 24

Answer: B Manipulates the value of the time to live (TTL) within packet to elicit a time exceeded in transit message

Question 25

2.25 Which of the following countermeasures can specifically protect against both the MAC Flood and MAC Spoofing attacks? A. Configure Port Security on the switch B. Configure Port Recon on the switch C. Configure Switch Mapping D. Configure Multiple Recognition on the switch

Answer 25

Answer: A Configure Port Security on the switch

Question 26

2.26 What does ICMP (type 11, code 0) denote? A. Source Quench B. Destination Unreachable C. Time Exceeded D. Unknown Type

Answer 26

Answer: C Time Exceeded

Question 27

2.27 How do you defend against DHCP Starvation attack? A. Enable ARP-Block on the switch B. Enable DHCP snooping on the switch C. Configure DHCP-BLOCK to 1 on the switch D. Install DHCP filters on the switch to block this attack

Answer 27

Answer: B Enable DHCP snooping on the switch

Question 28

2.28 Neil is a network administrator working in Istanbul. Neil wants to setup a protocol analyzer on his network that will receive a copy of every packet that passes through the main office switch. What type of port will Neil need to setup in order to accomplish this? A. Neil will have to configure a Bridged port that will copy all packets to the protocol analyzer. B. Neil will need to setup SPAN port that will copy all network traffic to the protocol analyzer. C. He will have to setup an Ether channel port to get a copy of all network traffic to the analyzer. D. He should setup a MODS port which will copy all network traffic.

Answer 28

Answer: B Neil will need to setup SPAN port that will copy all network traffic to the protocol analyzer.

Question 29

2.29 Attackers footprint target Websites using Google Hacking techniques. (creating complex search string queries) The configuration file contains both a username and a password for an SQL database. Most sites with forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN access to the database. WordPress uses config.php that stores the database Username and Password. Which of the below Google search string brings up sites with "config.php" files? A. Search:index config/php B. Wordpress:index config.php C. intitle:index.of config.php D. Config.php:index list

Answer 29

Answer: C intitle:index.of config.php

Question 30

2.30 Which of the following Exclusive OR transforms bits is NOT correct? A. 0 xor 0 = 0 B. 1 xor 0 = 1 C. 1 xor 1 = 1 D. 0 xor 1 = 1

Answer 30

Answer: C 1 xor 1 = 1

Question 31

2.31 What is a successful method for protecting a router from potential smurf attacks? A. Placing the router in broadcast mode B. Enabling port forwarding on the router C. Installing the router outside of the network's firewall D. Disabling the router from accepting broadcast ping messages

Answer 31

Answer: D Disabling the router from accepting broadcast ping messages

Question 32

2.32 How do you defend against ARP Spoofing? Select three. A. Use ARPWALL system and block ARP spoofing attacks B. Tune IDS Sensors to look for large amount of ARP traffic on local subnets C. Use private VLANS D. Place static ARP entries on servers, workstations, and routers

Answer 32

Answer: A, C, D A. Use ARPWALL system and block ARP spoofing attacks C. Use private VLANS D. Place static ARP entries on servers, workstations, and routers

Question 33

2.33 Which of the following statements about vulnerability scanners is NOT correct? A. Vulnerability scanners attempt to identify vulnerabilities in the hosts scanned. B. Vulnerability scanners can help identify out-of-date software versions, missing patches, or system upgrades C. They can validate compliance with or deviations from the organization's security policy D. Vulnerability scanners can identify weakness and automatically fix and patch the vulnerabilities without user intervention

Answer 33

Answer: D Vulnerability scanners can identify weakness and automatically fix and patch the vulnerabilities without user intervention

Question 34

2.34 How can you prevent MAC spoofing and/or ARP poisoning on all the Cisco switches in your network? A. Use the command ip binding set. B. Use the command no ip spoofing. C. Use the command no dhcp spoofing. D. Use the command ip dhcp snooping binding.

Answer 34

Answer: D Use the command ip dhcp snooping binding.

Question 35

``` 2.35 How many bits is the hash value of SHA-1? A. 64 bits B. 128 bits C. 256 bits D. 160 bits ```

Answer 35

Answer: D 160 bits

Question 36

2.36 What is a sniffing performed on a switched network called? A. Spoofed sniffing B. Passive sniffing C. Direct sniffing D. Active sniffing

Answer 36

Answer: D Active sniffing

Question 37

2.37 While logging traffic on your network you notice a number of packets being directed to an internal IP from an outside IP where the packets are ICMP and their size is around 65,536 bytes. What is going on? A. The ICMP packets are being sent in a manner that is attempting IP spoofing. B. This is a Smurf attack. C. This is not unusual; ICMP packets can be of any size. D. This is a Ping Of Death attack.

Answer 37

Answer: D This is a Ping Of Death attack.

Question 38

2.38 In an ARP packet, what is the destination MAC address of the broadcast frame? A. 0xFFFFFFFFFFFF B. 0xDDDDDDDDDDDD C. 0xAAAAAAAAAAAA D. 0xBBBBBBBBBBBB

Answer 38

Answer: A 0xFFFFFFFFFFFF

Question 39

2.39 While performing a ping sweep of a local subnet you receive an ICMP reply of Type 3/Code 13 for all the pings you have sent out. What is the most likely cause of this? A. The firewall is dropping the packets B. An in-line IDS is dropping the packets C. A router is blocking ICMP D. The host does not respond to ICMP packets

Answer 39

Answer: C A router is blocking ICMP

Question 40

2.40 Which is a type of encryption algorithm that transforms a fixed-length block of plaintext data into a block of ciphertext data of the same length? A. Stream Cipher B. Block Cipher C. Bit Cipher D. Hash Cipher

Answer 40

Answer: B Block Cipher

Question 41

2.41 What type of encryption does WPA2 use? A. DES 64 bit B. AES-CCMP 128 bit C. MD5 48 bit D. SHA 160 bit

Answer 41

Answer: B AES-CCMP 128 bit

Question 42

2.42 A digital signature is simply a message that is encrypted with the public key instead of the private key. A. true B. false

Answer 42

Answer: B false

Question 43

2.43 Which type of sniffing technique is generally referred to as a MiTM attack? Choose the BEST answer. A. Password Sniffing B. ARP Poisoning C. Mac Flooding D. DHCP Sniffing

Answer 43

Answer: B ARP Poisoning

Question 44

2.44 Which of the following encryption is NOT based on block cipher? A. DES B. Blowfish C. AES (Rijndael) D. RC4

Answer 44

Answer: D RC4

Question 45

2.45 What is the length of an MD5 hash? A. 32 character B. 64 byte C. 48 char D. 128 kb

Answer 45

Answer: A 32 character

Question 46

2.46 How do you defend against ARP Poisoning attack? (Select 2 answers) A. Enable DHCP Snooping Binding Table B. Restrict ARP Duplicates C. Enable Dynamic ARP Inspection D. Enable MAC snooping Table

Answer 46

Answer: A,C A. Enable DHCP Snooping Binding Table C. Enable Dynamic ARP Inspection

Question 47

2.47 A hacker gained entry into a building and was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network? A. Fraggle B. MAC Flood C. Smurf D. Tear Drop

Answer 47

Answer: B MAC Flood

Question 48

2.48 Which of the following techniques can be used to mitigate the risk of an on-site attacker from connecting to an unused network port and gaining full access to the network? (Choose three.) ``` A. Port Security B. IPSec Encryption C. Network Admission Control (NAC) D. 802.1q Port Based Authentication E. 802.1x Port Based Authentication F. Intrusion Detection System (IDS) ```

Answer 48

Answer: A, C, E A. Port Security C. Network Admission Control (NAC) E. 802.1x Port Based Authentication

Question 49

2.49 How is sniffing broadly categorized? A. Active and passive B. Broadcast and unicast C. Unmanaged and managed D. Filtered and unfiltered

Answer 49

Answer: A Active and passive

Question 50

2.50 Which of the following is a protocol that is prone to a man-in-the-middle (MITM) attack and maps a 32-bit address to a 48-bit address? A. ICPM B. ARP C. RARP D. ICMP

Answer 50

Answer: B ARP

Question 51

2.51 Which of the following is an example of an asymmetric encryption implementation? A. SHA1 B. PGP C. 3DES D. MD5

Answer 51

Answer: B. PGP

Question 52

2.52 Which of the following is a characteristic of Public Key Infrastructure (PKI)? A. Public-key cryptosystems are faster than symmetric-key cryptosystems. B. Public-key cryptosystems distribute public-keys with digital signatures. C. Public-key cryptosystems do not require a secure key distribution channel. D. Public-key cryptosystems do not provide technical non-repudiation via digital signatures.

Answer 52

Answer: B Public-key cryptosystems distribute public-keys with digital signatures.

Question 53

2.53 Symmetric key cryptography uses which of the following? A. Multiple keys for non-repudiation of bulk data B. Different keys on both ends of the transport medium C. Bulk encryption for data transmission over fiber D. The same key on each end of the transmission medium

Answer 53

Answer: D . The same key on each end of the transmission medium

Question 54

2.54 What is it called when a copy of your private key is stored so that it can be restored if you happen to lose it, and to also provides your employer with access in case you should leave the company? A. Key registry B. Recovery agent C. Directory D. Key escrow

Answer 54

Answer: D Key escrow

Question 55

2.53 Symmetric key cryptography uses which of the following? A. Multiple keys for non-repudiation of bulk data B. Different keys on both ends of the transport medium C. Bulk encryption for data transmission over fiber D. The same key on each end of the transmission medium

Answer 55

Answer: D The same key on each end of the transmission medium

Question 56

2.54 What is it called when a copy of your private key is stored so that it can be restored if you happen to lose it, and to also provides your employer with access in case you should leave the company? A. Key registry B. Recovery agent C. Directory D. Key escrow

Answer 56

Answer: D Key escrow

Question 57

2.56 TCP packets transmitted in either direction after the initial three-way handshake will have which of the following bit set? A. SYN flag B. ACK flag C. FIN flag D. XMAS flag

Answer 57

Answer: B ACK flag

Question 58

2.57 Your company uses wireless MAC filtering to only allow company laptops to connect to the wireless network. You find that an employee has connected his personal laptop to the corporate wireless network. You perform a site survey and find no new wireless network signals. How was he able to connect to the company wireless network? A. He brute forced the MAC address ACLs His laptop shares a hardware address with a company B. laptop C. He connected to a rogue access point D. He spoofed the MAC address of a company laptop

Answer 58

Answer: D He spoofed the MAC address of a company laptop

Question 59

2.58 How can an attacker perform a DOS with a TCP SYN attack against a victim? A. Attacker generates TCP SYN packets with random destination addresses towards a victim host B. Attacker floods TCP SYN packets with random source addresses towards a victim host C. Attacker generates TCP ACK packets with random source addresses towards a victim host D. Attacker generates TCP RST packets with random source addresses towards a victim host

Answer 59

Answer: B Attacker floods TCP SYN packets with random source addresses towards a victim host

Question 60

2.59 Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC addresses to physical ports. What happens when the CAM table becomes full? A. Switch then acts as hub by broadcasting packets to all machines on the network B. The CAM overflow table will cause the switch to crash causing Denial of Service C. The switch replaces outgoing frame switch factory default MAC address of FF:FF:FF:FF:FF:FF D. Every packet is dropped and the switch sends out SNMP alerts to the IDS port

Answer 60

Answer: A Switch then acts as hub by broadcasting packets to all machines on the network

Question 61

2.60 Which key does the Heartbleed bug leave exposed on a web server? A. Root B. Public C. Private D. Shared

Answer 61

Answer: C Private

Question 62

2.61 Which of these is designed to verify and authenticate the identity of individuals taking part in a data exchange? A. SOA B. Single sign-on C. PKI D. biometrics

Answer 62

Answer: C PKI

Question 63

2.62 PGP, SSL, and IKE are all examples of which type of cryptography? A. Public Key B. Secret Key C. Hash Algorithm D. Digest

Answer 63

Answer: A Public Key

Question 64

2.63 Which device is the best example of operating using the concept of “separation of duties”? A. Intrusion Detection System B. Bastion host C. Honeypot D. Firewall

Answer 64

Answer: B Bastion host

Question 65

2.64 Which asymmetric algorithm factors the product of two large prime numbers? A. RC5 B. MD5 C. RSA D. SHA

Answer 65

Answer: C. RSA

Question 66

2.65 Your wireless NIC can see the wireless network, but can’t connect. You sniff the wireless traffic and can see that the WAP is not responding to the association requests being sent by the wireless NIC. What could the problem be? A. The client cannot see the SSID of the wireless network B. The wireless client is not configured to use DHCP C. The WAP does not recognize the client’s MAC address D. Client is configured for the wrong channel

Answer 66

Answer: C The WAP does not recognize the client’s MAC address

Question 67

2.66 What is a "Collision attack”? A. Collision attacks try to break the hash into two parts, with the same bytes in each part to get the private key B. Collision attacks try to break the hash into three parts to get the plaintext value C. Collision attacks try to find two inputs producing the same hash D. Collision attacks try to get the public key

Answer 67

Answer: C Collision attacks try to find two inputs producing the same hash

Question 68

2.67 If you want to use IPSec within your LAN, and you want to assure the confidentiality of the data being transmitted, which mode should you use? A. ESP transport mode B. ESP confidential C. AH Tunnel mode D. AH permiscuous

Answer 68

Answer: A . ESP transport mode

Question 69

2.68 Which wireless security protocol was made useless back in 2007 by capturing wireless packets and discovering the key in just a few seconds? A. Temporal Key Integrity Protocol (TKIP) B. Wired Equivalent Privacy (WEP) C. Wi-Fi Protected Access (WPA) D. Wi-Fi Protected Access 2 (WPA2)

Answer 69

Answer: B Wired Equivalent Privacy (WEP)

Question 70

2.69 Which protocol would let you guess a sequence number to become a man-in-the-middle? A. UPX B. TCP C. ICMP D. UDP

Answer 70

Answer: B TCP

Question 71

2.70 Hacker Joe tries to send IRC traffic out of the company over TCP port 80. This traffic gets blocked, however, HTTP traffic is allowed out through the firewall. What type of firewall is inspecting this traffic? A. Circuit B. Stateful C. Application D. Packet Filtering

Answer 71

Answer: C Application If both IRC and HTTP are using port 80, but the IRC is blocked and HTTP allowed, something must be inspecting the payload itself and not just the port numbers. An Application-layer (layer 7) firewall can do this.

Question 72

2.71 What kind of firewall checks to make sure that incoming packets are part of an established session? A. Circuit-level firewall B. Application-level firewall C. Switch-level firewall D. Stateful inspection firewall

Answer 72

Answer: D Stateful inspection firewall

Question 73

2.72 Which tool is being described here? It’s an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the PTW attack, thus making the attack much faster compared to other WEP cracking tools.  A. Airguard B. WLAN-crack C. Wificracker D. Aircrack-ng

Answer 73

Answer: D Aircrack-ng The above description is right from http://www.aircrack-ng.org/

Question 74

2.73 Which of these is the newer replacement for SSL? A. TLS B. IPSec C. GRE D. RSA

Answer 74

Answer: A TLS

Question 75

2.74 You’ve configured your web browser to automatically delete browser cookies when you close the browser. Which attack attempt are you trying to mitigate here? A. ..to access the user and password information stored in the company SQL database B. ..to determine the user’s web browser usage patterns, including when sites were visited and for how long C. ..to access passwords stored on the user’s computer without the user’s knowledge D. ..to access web sites that trust the web browser’s user by stealing the user’s authentication credentials

Answer 75

Answer: D ..to access web sites that trust the web browser’s user by stealing the user’s authentication credentials

Question 76

2.75 While doing online banking your URL bar has this string: “http://www.Bank.com/account?id=11256&Xamount=5265&Yamount=98” You do some testing and figure out that if you alter the Xamount and Yamount values, the web page reflects the changes. Which of these vulnerabilities does this web site have? A. Web parameter tampering B. SQL injection C. XSS reflection D. Cookie tampering

Answer 76

Answer: A . Web parameter tampering

Question 77

2.76 Which of these commands will let you search for files using Google? A. inurl: target.com filename:xls username password email B. Site: target.com filetype:xls username password email C. Site: target.com file:xls username password email D. Domain: target.com archive:xls username password email

Answer 77

Answer: B Site: target.com filetype:xls username password email

Question 78

2.77 Which is the best description for how ARP (Address Resolution Protocol) works? A. It sends request packets to all the network elements, asking for the MAC address from a specific IP B. It sends a reply packet for a specific IP, asking for the MAC address C. It sends a request packet to all the network elements, asking for the domain name from a specific IP D. It sends a reply packet to all the network elements, asking for the MAC address from a specific IP

Answer 78

Answer: A It sends request packets to all the network elements, asking for the MAC address from a specific IP

Question 79

2.78 Your large company wants to implement biometric authentication. Which of these is the least likely physical attribute to use for this? A. Fingerprints B. Height and Weight C. Voice D. Iris patterns

Answer 79

Answer: B Height and Weight

Question 80

2.79 XOR these two binary values and select the cipher-text from the answers.10110001 00111010 A. 10111100 B. 10011101 C. 11011000 D. 10001011

Answer 80

Answer: D 10001011

Question 81

2.80 Which does hashing provide? A. Confidentiality B. Integrity C. Availability D. Authentication

Answer 81

Answer: B Integrity

Question 82

2.81 Which of these is a popular short-range wireless technology that allows mobile devices like phones, tablets, and laptops to communicate, while still remaining relatively secure? A. Radio-Frequency Identification (RFID) B. Infrared C. Bluetooth D. WLAN

Answer 82

Answer: C Bluetooth

Question 83

2.82 Which of these programs could infect both your boot sector and your executable files at the same time? ``` A. Macro virus B. Stealth virus C. Multipartite virus D. Polymorphic virus E. Metamorphic virus ```

Answer 83

Answer: C Multipartite virus

Question 84

2.83 After establishing a TCP session, computers A & B are exchanging data. You use tcpdump to intercept a packet going from A to B. The packet contains the following data: Seq.no. 17768729 (next seq.no. 17768885) Ack.no. 82980070 Window 8700 LEN = 156 bytes of data What are the next sequence and acknowledgement numbers that B will send back to A? A. Sequence number: 82980070 Acknowledgement number: 17768885 B. Sequence number: 17768729 Acknowledgement number: 82980070 C. Sequence number: 87000070 Acknowledgement number: 85320085 D. Sequence number: 82980010 Acknowledgement number: 17768885

Answer 84

Answer: A Sequence number: 82980070 Acknowledgement number: 17768885

Question 85

2.84 IPSec is a suite of protocols that does all of the following except.. A. Authenticate B. Protect the payload and the headers C. Work at the Data Link layer D. Encrypt

Answer 85

Answer: C Work at the Data Link layer IPSec can work in either AH mode or ESP mode. In the older AH mode, it authenticates the sender and provides an integrity check for the data. ESP mode does all of this, but also adds encryption to the mix to protect the payload as well as the headers (if it’s in Tunnel mode).

Question 86

2.85 Passive network sniffing can achieve all of the following except which? A. Capturing network traffic for analysis B. Collecting unencrypted information about usernames and passwords C. Modifying and replaying captured network traffic D. Identifying operating systems, services, protocols, and devices

Answer 86

Answer: C Modifying and replaying captured network traffic When you modify and then re-play the traffic back onto the wire, you’ve moved past passive sniffing and now you are doing “active” actions. Passive is merely “watching” and recording, and does not involve sending any traffic.

Question 87

2.86 Digital signatures must meet which conditions? A. Must be unforgeable and has to be authentic B. Must be unique and have special characters C. Has to be the same number of characters as a physical signature and must be unique D. Has to be legible and neat

Answer 87

Answer: Must be unforgeable and has to be authentic