Day 4 39-75 Flashcards
4.39 The computer is able to transfer files locally to other machines, but cannot successfully reach the Internet. When the technician examines the IP address and default gateway they are both on the 192.168.1.0/24.
Which of the following has occurred?
A. The Gateway and the computer are not on the same network
B. The computer is not using a private IP address
C. The computer is using an invalid IP address
D. The gateway is not routing to a public IP address
D. The gateway is not routing to a public IP address
4.40 What results will the following command yield: ‘NMAP –sS –O –p 123-153 192.168.100.3?
A. A stealth scan, checking open ports 123 to 153
B. A stealth scan, checking all open ports excluding ports 123 to 153
C. A stealth scan, opening port 123 and 153
D. A stealth scan, determine operating system, and scanning ports 123 to 153
D. A stealth scan, determine operating system, and scanning ports 123 to 153
4.41 Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an appropriate method?
A. Hashing is faster compared to more traditional encryption algorithms
B. It is impossible to crack hashed user passwords unless the key used to encrypt them is obtained
C. Passwords stored using hashes are nonreversible, making finding the password much more difficult
D. If a user forgets the password, it can be easily retrieved using the hash key stored by administrators
C. Passwords stored using hashes are nonreversible, making finding the password much more difficult
4.42 A botnet can be managed through which of the following?
A. Email
B. LinkedIn and Facebook
C. A vulnerable FTP server
D. IRC
D. IRC
IRC = Internet Relay Chat. This is a protocol that allows you to relay text messages via discussion forums. IRC is often used as a means to control infected “bots” or “zombies”.
4.43 Fingerprinting VPN firewalls is possible with which of the following tools?
A. arp-scan
B. ike-scan
C. Nikto
D. Angry IP
B. ike-scan
http://sectools.org/tool/ike-scan/
4.44 What is the outcome of the command ”nc -l -p 3030 | nc 192.168.5.10 5555”?
A. Netcat will listen on the 192.168.5.10 interface for 5555 seconds on port 3030.
B. Netcat will listen on port 3030 and output anything received to a remote connection on 192.168.5.10 port 5555.
C. Netcat will listen for a connection from 192.168.5.10 on port 5555 and output anything received to port 3030.
D. Netcat will listen on port 3030 and then output anything received to local interface 192.168.5.10.
B. Netcat will listen on port 3030 and output anything received to a remote connection on 192.168.5.10 port 5555.
4.45 What information should an IT system analysis provide to the risk assessor?
A. Threat statement
B. Impact analysis
C. Security architecture
D. Management buy-in
C. Security architecture
4.46 Which security strategy requires using several, varying methods to protect IT systems against attacks?
A. Three-way handshake
B. Exponential backoff algorithm
C. Covert channels
D. Defense in depth
D. Defense in depth
4.47 Which of the following business challenges could be solved by using a vulnerability scanner?
A. Auditors want to discover if all systems are following a standard naming convention
B. There is an emergency need to remove administrator access from multiple machines for an employee that quit
C. A Web server was compromised and management needs to know if any further systems were compromised
D. There is a monthly requirement to test corporate compliance with host application usage and security policies
D. There is a monthly requirement to test corporate compliance with host application usage and security policies
4.48 If an e-commerce site was put into a live environment and the programmers failed to remove the secret entry point that was used during the application development, what is this secret entry point known as?
A. SDLC process
B. Honeypot
C. SQL injection
D. Trapdoor
D. Trapdoor
4.49 At midnight your firewall logs are at the expected size of 4MB. Exactly 2 hours later the size has decreased considerably. Another hour goes by and the log files have shrunk in size again. Which of the following actions should be taken?
A. Run an antivirus scan because it is likely the system is infected by malware
B. Log the event as suspicious activity, continue to investigate, and act according to the site’s security policy
C. Log the event as suspicious activity, call a manager, and report this as soon as possible
D. Log the event as suspicious activity and report this behavior to the incident response team immediately
B. Log the event as suspicious activity, continue to investigate, and act according to the site’s security policy
4.50 Which of the following open source tools would be the best choice to scan a network for potential targets?
A. NIKTO
B. CAIN
C. John the Ripper
D. NMAP
D. NMAP4.51 Which tool can be used to silently copy files to USB devices?
4.51 Which tool can be used to silently copy files to USB devices?
A. USB dumper
B. USB sniffer
C. USB grabber
D. USB Snoopy
C. USB grabber
4.52 How can a policy help improve an employee’s security awareness?
A. By implanting written security procedures, enabling employee’s security training, and promoting the benefits of security
B. By using informal networks of communication, establishing secret passing procedures, and immediately terminating employees
C. By sharing security secrets with employees, enabling employees to share secrets, and establishing a consultative helpline
D. By decreasing an employee’s vacation time, addressing ad hoc employment clauses, and ensuring that managers no employee strengths
A. By implanting written security procedures, enabling employee’s security training, and promoting the benefits of security
4.53 In the software security development lifecycle process, threat modeling occurs in which phase?
A. Design
B. Requirements
C. Verification
D. Implementation
A. Design
