Day 2 87-114 Flashcards
2.87 Which technique can reveal the OS of your target system?
A. UDP scanning
B. IDLE/IPID scanning
C. Banner grabbing
D. SSDP scanning
Answer: C Banner grabbing
2.88 Choose the best way to protect against network traffic sniffing.
A. Use static IP addresses.
B. Use encryption protocols to secure network communications.
C. Register all machine’s MAC addresses into a centralized database.
D. Restrict physical access to server rooms hosting critical servers.
Answer: B. Use encryption protocols to secure network communications.
2.89 Which protocol can secure communications between two devices using a VPN?
A. SET
B. PEM
C. IPSEC
D. PPP
Answer: C. IPSEC
2.90 Which component of IPSEC performs the functions necessary to encrypt & decrypt packets?
A. IPsec driver
B. Internet Key Exchange (IKE)
C. IPsec Policy agent
D. Oakley
Answer: B. Internet Key Exchange (IKE)
2.91 Your junior admin states that your company doesn’t need a DMZ if the firewall is configured to only allow access to servers and ports that can have direct internet access, and access to workstations is blocked. He says that a DMZ is only needed when a stateful firewall is used, and since your company only uses a stateless firewall, you don’t need a DMZ. Which is the true statement here:
A. He is completely wrong. A DMZ is always relevant when the company has internet servers and workstations.
B. He is partially right. You don’t need to separate networks if you can create rules by destination IP’s, one by one.
C. He is partially right. DMZ does not make sense when a stateless firewall is available.
D. He can be right since a DMZ does not make sense when combined with stateless firewalls.
Answer: A. He is completely wrong. A DMZ is always relevant when the company has internet servers and workstations.
Your junior admin needs more training. ANY time you let outside traffic in, you restrict it to the DMZ only. For example, if you employ answer B and only allow outside traffic to one IP, what if that server gets compromised? The attacker could then pivot and attack the rest of the network. By restricting outside traffic to the DMZ only, any compromise can’t reach the internal LAN.
2.92 Your admins and managers at your branch offices often plug in to the various ethernet ports at those offices. You don’t want regular employees to use these wired ethernet ports though. What is the BEST way to restrict access to these ethernet ports to only admins and authorized individuals?
A. Ask everyone else to only use the wireless network.
B. Disable unused ports in the switches.
C. Separate employees into a different VLAN.
D. Use the 802.1x protocol.
Answer: D. Use the 802.1x protocol.
With 802.1x you can control access to the network by authorizing only specific user accounts to access these ports.
2.93 What’s the best way to protect the data on your laptop while traveling?
A. Password protected files
B. Disk encryption
C. BIOS encryption
D. Hidden folders
Answer: B. Disk encryption
2.94 At which layer of the OSI model do sniffers operate?
A. Layer 1
B. Layer 2
C. Both layer 2 & Layer 3
D. Layer 3
Answer: B. Layer 2
Sniffers usually work at layer 2 of the OSI model. Your NIC grabs frames off the wire. While it’s true that you can then see all the upper layer protocols, the “grabbing” of packets works via your NIC, which is layer 2. There are other types of sniffers like network-taps that operate at layer 1, but most commonly sniffing occurs at layer 2.
2.95 SSL, IKE, and PGP are examples of which kind of cryptography?
A. Digest
B. Hash algorithm
C. Public Key
D. Secret Key
Answer: C. Public Key
2.96 With one method of cryptanalysis, an attacker is able to make a bunch of interactive queries, and then choose subsequent plaintexts based on the previous encryption results. Which type of crypto-attack is this describing?
A. Chosen-plaintext attack
B. Ciphertext-only attack
C. Known-plaintext attack
D. Adaptive chosen-plaintext attack
Answer: D. Adaptive chosen-plaintext attack
2.97 Which device can locate a rogue access point?
A. WIPS
B. WISS
C. NIDS
D. HIDS
Answer: A. WIPS
2.98 A hacker sets up a rogue wireless access point that appears to be a legitimate company WAP. Then the attacker tricks users into connecting to it so he can snoop on the victim’s communications. What type of attack is this?
A. Sinkhole attack
B. Collision attack
C. Signal jamming attack
D. Evil Twin attack
Answer: D. Evil Twin attack
2.99 There is a critical flaw with the OpenSSL cryptographic library. This flaw allows an attacker to break the encryption on data protected by the SSL/TLS encryption used to secure internet sites. What is this vulnerability called?
A. POODLE
B. Shellshock
C. Heartbleed Bug
D. SSL/TLS Renegotiation Vulnerability
Answer: C. Heartbleed Bug
2.100 Hacker Joe used a rogue WAP to do a MiTM attack, where he injected malicious HTTP code whenever users accessed web pages. Which tool is Hacker Joe most likely using to inject the HTML code?
A. Aircrack-ng
B. Ettercap
C. TCPDump
D. Wireshark
Answer: B. Ettercap
TCPDump and Wireshark are protocol analyzers that let you inspect traffic, but they’re not for modifying traffic. Aircrack-ng is a wireless tool that can monitor the wireless network, crack the encryption and authentication, and do other useful wireless activities.
Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.
2.101 Which of these Secure Hashing Algorithms (SHA) resembles MD5 and produces a 160-bit message digest?
A. SHA-0
B. SHA-1
C. SHA-2
D. SHA-3
Answer: B. SHA-1
