Domain 6 Flashcards
- During a port scan, Susan discovers a system running services on TCP and UDP 137-139 and TCP 445, as well as TCP 1433. What type of system is she likely to find if she connects to the machine?
a. A Linux email server
b. A Windows SQL server
c. A Linux file server
d. A Windows workstation
B. TCP and UDP ports 137-139 are used for NetBIOS services, whereas 445 is used for Active Directory. TCP 1433 is the default port for Microsoft SQL, indicating that this is probably a Windows server providing SQL services.
- Which of the following is a method used to design new software tests and to ensure the quality of tests?
a. Code auditing
b. Static code analysis
c. Regression testing
d. Mutation testing
D. Mutation testing modifies a program in small ways, and then tests that mutant to determine if it behaves as it should or if it fails. This technique is used to design and test software tests through mutation. Static code analysis and regression testing are both means of testing code, whereas code auditing is an analysis of source code rather than a means of designing and testing software tests.
- During a port scan, Lauren found TCP port 443 open on a system. Which tool is best suited to scanning the service that is most likely running on that port?
a. zzuf
b. Nikto
c. Metasploit
d. sqlmap
B. TCP port 443 normally indicates an HTTPS server. Nikto is useful for vulnerability scanning web servers and applications and is the best choice listed for a web server. Metasploit includes some scanning functionality but is not a purpose-built tool for vulnerability scanning. zzuf is a fuzzing tool and isn’t relevant for vulnerability scans, whereas sqlmap is a SQL injection testing tool.
- What message logging standard is commonly used by network devices, Linux and Unix systems, and many other enterprise devices?
a. Syslog
b. Netlog
c. Eventlog
d. Remote Log Protocol (RLP)
A. Syslog is a widely used protocol for event and message logging. Eventlog, netlog, and Remote Log Protocol are all made-up terms.
- Alex wants to use an automated tool to fill web application forms to test for format string vulnerabilities. What type of tool should he use?
a. A black box
b. A brute-force tool
c. A buzzer
d. A static analysis tool
C. Fuzzers are tools that are designed to provide invalid or unexpected input to applications, testing for vulnerabilities like format string vulnerabilities, buffer overflow issues, and other problems. A static analysis relies on examining code without running the application or code, and thus would not fill forms as part of a web application. Brute-force tools attempt to bypass security by trying every possible combination for passwords or other values. A black box is a type of penetration test where the testers do not know anything about the environment.
- Susan needs to scan a system for vulnerabilities, and she wants to use an open source tool to test the system remotely. Which of the following tools will meet her requirements and allow vulnerability scanning?
a. Nmap
b. OpenVAS
c. MBSA
d. Nessus
B. OpenVAS is an open source vulnerability scanning tool that will provide Susan with a report of the vulnerabilities that it can identify from a remote, network-based scan. Nmap is an open source port scanner. Both the Microsoft Baseline Security Analyzer (MBSA) and Nessus are closed source tools, although Nessus was originally open source.
- NIST Special Publication 800-53A describes four major types of assessment objects that can be used to identify items being assessed. If the assessment covers IPS devices, which of the types of assessment objects is being assessed?
a. A specification
b. A mechanism
c. An activity
d. An individual
B. An IPS is an example of a mechanism like a hardware-, software-, or firmware-based control or system. Specifications are document-based artifacts like policies or designs, activities are actions that support an information system that involves people, and an individual is one or more people applying specifications, mechanisms, or activities.
- Jim has been contracted to perform a penetration test of a bank’s primary branch. In order to make the test as real as possible, he has not been given any information about the bank other than its name and address. What type of penetration test has Jim agreed to perform?
a. A crystal box penetration test
b. A gray box penetration test
c. A black box penetration test
d. A white box penetration test
C. Jim has agreed to a black box penetration test, which provides no information about the organization, its systems, or its defenses. A crystal or white box penetration test provides all of the information an attacker needs, whereas a gray box penetration test provides some, but not all, information.
- As part of a penetration test, Alex needs to determine if there are web servers that could suffer from the 2014 Heartbleed bug. What type of tool could he use, and what should he check to verify that the tool can identify the problem?
a. A vulnerability scanner, to see whether the scanner has a signature or test for the Heartbleed CVE number
b. A port scanner, to see whether the scanner properly identifies SSL connections
c. A vulnerability scanner, to see whether the vulnerability scanner detects problems with the Apache web server
d. A port scanner, to see whether the port scanner supports TLS connections
A. A vulnerability scanner that has a test (sometimes called a signature or plugin) that provides a detection method for CVE-2014-0160, also known as the Heartbleed bug, a vulnerability in OpenSSL will detect and report on the issue on any system it can connect to. Port scanners do not determine whether services are vulnerable, and Heartbleed was not a vulnerability in the Apache web server—but even without knowing this, the CVE number is a better indicator of whether the issue will be found than a generic detect for a service.
- In a response to a Request for Proposal, Susan receives a SAS-70 Type 1 report. If she wants a report that includes operating effectiveness detail, what should Susan ask for as followup and why?
a. An SAS-70 Type II, because Type I only covers a single point in time
b. An SOC Type 1, because Type II does not cover operating effectiveness
c. An SOC Type 2, because Type I does not cover operating effectiveness
d. An SAC-70 type 3, because Types 1 and 2 are outdated and no longer accepted
C. Service Organization Control (SOC) reports replaced SAS-70 reports in 2010. A Type 1 report only covers a point in time, so Susan needs an SOC Type 2 report to have the information she requires to make a design and operating effectiveness decision based on the report.
- During a wireless network penetration test, Susan runs aircrack-ng against the network using a password file. What might cause her to fail in her password-cracking efforts?
a. Use of WPA2 encryption
b. Running WPA2 in Enterprise mode
c. Use of WEP encryption
d. Running WPA2 in PSK mode
B. WPA2 enterprise uses RADIUS authentication for users rather than a preshared key. This means a password attack is more likely to fail as password attempts for a given user may result in account lock-out. WPA2 encryption will not stop a password attack, and WPA2’s preshared key mode is specifically targeted by password attacks that attempt to find the key. Not only is WEP encryption outdated, but it can also frequently be cracked quickly by tools like aircrack-ng.
- Which type of SOC report is best suited to provide assurance to users about an organization’s security, availability, and the integrity of their service operations?
a. An SOC 1 Type 2 report
b. An SOC 2 report
c. An SOC 3 report
d. An SOC 1 Type 1 report
C. SOC 3 reports are intended to be shared with a broad community, often with a website seal, and support the organization’s claims about their ability to provide integrity, availability, and confidentiality. SOC 1 reports report on controls over financial reporting, whereas SOC 2 reports cover security, availability, integrity, and privacy for business partners, regulators, and other similar organizations in detail that would not typically be provided to a broad audience.
- What type of testing is used to ensure that separately developed software modules properly exchange data?
a. Fuzzing
b. Dynamic testing
c. Interface testing
d. API checksums
C. Interface testing is used to ensure that software modules properly meet interface specifications and thus will properly exchange data. Dynamic testing tests software in a running environment, whereas fuzzing is a type of dynamic testing that feeds invalid input to running software to test error and input handling. API checksums are not a testing technique.
- Which of the following is not a potential problem with active wireless scanning?
a. Accidently scanning apparent rogue devices that actually belong to guests
b. Causing alarms on the organization’s wireless IPS
c. Scanning devices that belong to nearby organizations
d. Misidentifying rogue devices
B. Not only should active scanning be expected to cause wireless IPS alarms, but they may actually be desired if the test is done to test responses. Accidently scanning guests, neighbors, or misidentifying devices belonging to third parties are all potential problems with active scanning and require the security assessor to carefully verify the systems that she is scanning.
- Ben uses a fuzzing tool that develops data models and creates fuzzed data based on information about how the application uses data to test the application. What type of fuzzing is Ben doing?
a. Mutation
b. Parametric
c. Generational
d. Derivative
C. Generational fuzzing relies on models for application input and conducts fuzzing attacks based on that information. Mutation based fuzzers are sometimes called “dumb” fuzzers because they simply mutate or modify existing data samples to create new test samples. Neither parametric nor derivative is a term used to describe types of fuzzers.
- Saria wants to log and review traffic information between parts of her network. What type of network logging should she enable on her routers to allow her to perform this analysis?
a. Audit logging
b. Flow logging
c. Trace logging
d. Route logging
B. Flows, also often called network flows, are captured to provide insight into network traffic for security, troubleshooting, and performance management. Audit logging provides information about events on the routers, route logging is not a common network logging function, and trace logs are used in troubleshooting specific software packages as they perform their functions.
- Jim has been contracted to conduct a gray box penetration test, and his clients have provided him with the following information about their networks so that he can scan them.
Data center: 10.10.10.0/24
Sales: 10.10.11.0/24
Billing: 10.10.12.0/24
Wireless: 192.168.0.0/16
What problem will Jim encounter if he is contracted to conduct a scan from offsite?
a. The IP ranges are too large to scan efficiently.
b. The IP addresses provided cannot be scanned.
c. The IP ranges overlap and will cause scanning issues.
d. The IP addresses provided are RFC 1918 addresses.
D. The IP addresses that his clients have provided are RFC 1918 non-routable IP addresses, and Jim will not be able to scan them from offsite. To succeed in his penetration test, he will either have to first penetrate their network border or place a machine inside their network to scan from the inside. IP addresses overlapping is not a real concern for scanning, and the ranges can easily be handled by current scanning systems.
- Karen’s organization has been performing system backups for years but has not used the backups frequently. During a recent system outage, when administrators tried to restore from backups they found that the backups had errors and could not be restored. Which of the following options should Karen avoid when selecting ways to ensure that her organization’s backups will work next time?
a. Log review
b. MTD verification
c. Hashing
d. Periodic testing
B. Karen can’t use MTD verification because MTD is the Maximum Tolerable Downtime. Verifying it will only tell her how long systems can be offline without significant business impact. Reviewing logs, using hashing to verify that the logs are intact, and performing periodic tests are all valid ways to verify that the backups are working properly.
Questions 19, 20, and 21 refer to the following scenario.
The company that Jennifer works for has implemented a central logging infrastructure, as shown in the following image. Use this diagram and your knowledge of logging systems to answer the following questions.
Diagram shows a corporate network and a data center. Data center includes firewall, SIEM appliance, Linux web server and Linux database server. Corporate network includes Windows desktop systems and Wi-Fi access points.
Image
- Jennifer needs to ensure that all Windows systems provide identical logging information to the SIEM. How can she best ensure that all Windows desktops have the same log settings?
a. Perform periodic configuration audits.
b. Use Group Policy.
c. Use Local Policy.
d. Deploy a Windows syslog client.
B. Group Policy enforced by Active Directory can ensure consistent logging settings and can provide regular enforcement of policy on systems. Periodic configuration audits won’t catch changes made between audits, and local policies can drift due to local changes or differences in deployments. A Windows syslog client will enable the Windows systems to send syslog to the SIEM appliance but won’t ensure consistent logging of events.
Questions 19, 20, and 21 refer to the following scenario.
The company that Jennifer works for has implemented a central logging infrastructure, as shown in the following image. Use this diagram and your knowledge of logging systems to answer the following questions.
Diagram shows a corporate network and a data center. Data center includes firewall, SIEM appliance, Linux web server and Linux database server. Corporate network includes Windows desktop systems and Wi-Fi access points.
Image
- During normal operations, Jennifer’s team uses the SIEM appliance to monitor for exceptions received via syslog. What system shown does not natively have support for syslog events?
a. Enterprise wireless access points
b. Windows desktop systems
c. Linux web servers
d. Enterprise firewall devices
B. Windows systems generate logs in the Windows native logging format. To send syslog events, Windows systems require a helper application or tool. Enterprise wireless access points, firewalls, and Linux systems all typically support syslog.
Questions 19, 20, and 21 refer to the following scenario.
The company that Jennifer works for has implemented a central logging infrastructure, as shown in the following image. Use this diagram and your knowledge of logging systems to answer the following questions.
Diagram shows a corporate network and a data center. Data center includes firewall, SIEM appliance, Linux web server and Linux database server. Corporate network includes Windows desktop systems and Wi-Fi access points.
Image
- What technology should an organization use for each of the devices shown in the diagram to ensure that logs can be time sequenced across the entire infrastructure?
a. Syslog
b. NTP
c. Logsync
d. SNAP
B. Network Time Protocol (NTP) can ensure that systems are using the same time, allowing time sequencing for logs throughout a centralized logging infrastructure. Syslog is a way for systems to send logs to a logging server and won’t address time sequencing. Neither logsync nor SNAP is an industry term.
- During a penetration test, Danielle needs to identify systems, but she hasn’t gained sufficient access on the system she is using to generate raw packets. What type of scan should she run to verify the most open services?
a. A TCP connect scan
b. A TCP SYN scan
c. A UDP scan
d. An ICMP scan
A. When a tester does not have raw packet creation privileges, such as when they have not escalated privileges on a compromised host, a TCP connect scan can be used. TCP SYN scans require elevated privileges on most Linux systems due to the need to write raw packets. A UDP scan will miss most services that are provided via TCP, and an ICMP is merely a ping sweep of systems that respond to pings and won’t identify services at all.
23. During a port scan using nmap, Joseph discovers that a system shows two ports open that cause him immediate worry: 21/open 23/open What services are likely running on those ports? a. SSH and FTP b. FTP and Telnet c. SMTP and Telnet d. POP3 and SMTP
B. Joseph may be surprised to discover FTP (TCP port 21) and Telnet (TCP port 23) open on his network since both services are unencrypted and have been largely replaced by SSH, and SCP or SFTP. SSH uses port 22, SMTP uses port 25, and POP3 uses port 110.
- Saria’s team is working to persuade their management that their network has extensive vulnerabilities that attackers could exploit. If she wants to conduct a realistic attack as part of a penetration test, what type of penetration test should she conduct?
a. Crystal box
b. Gray box
c. White box
d. Black box
D. Black box testing is the most realistic type of penetration test because it does not provide the penetration tester with inside information about the configuration or design of systems, software, or networks. A gray box test provides some information, whereas a white or crystal box test provides significant or full detail.
- What method is commonly used to assess how well software testing covered the potential uses of a an application?
a. A test coverage analysis
b. A source code review
c. A fuzz analysis
d. A code review report
A. A test coverage analysis is often used to provide insight into how well testing covered the set of use cases that an application is being tested for. Source code reviews look at the code of a program for bugs, not necessarily at a use case analysis, whereas fuzzing tests invalid inputs. A code review report might be generated as part of a source code review.
- Testing that is focused on functions that a system should not allow are an example of what type of testing?
a. Use case testing
b. Manual testing
c. Misuse case testing
d. Dynamic testing
C. Testing how a system could be misused, or misuse testing, focuses on behaviors that are not what the organization desires or that are counter to the proper function of a system or application. Use case testing is used to verify whether a desired functionality works. Dynamic testing is used to determine how code handles variables that change over time, whereas manual testing is just what it implies: testing code by hand.
- What type of monitoring uses simulated traffic to a website to monitor performance?
a. Log analysis
b. Synthetic monitoring
c. Passive monitoring
d. Simulated transaction analysis
B. Synthetic monitoring uses emulated or recorded transactions to monitor for performance changes in response time, functionality, or other performance monitors. Passive monitoring uses a span port or other method to copy traffic and monitor it in real time. Log analysis is typically performed against actual log data but can be performed on simulated traffic to identify issues. Simulated transaction analysis is not an industry term.
- Which of the following vulnerabilities is unlikely to be found by a web vulnerability scanner?
a. Path disclosure
b. Local file inclusion
c. Race condition
d. Buffer overflow
C. Path disclosures, local file inclusions, and buffer overflows are all vulnerabilities that may be found by a web vulnerability scanner, but race conditions that take advantage of timing issues tend to be found either by code analysis or using automated tools that specifically test for race conditions as part of software testing.
- Jim uses a tool that scans a system for available services, then connects to them to collect banner information to determine what version of the service is running. It then provides a report detailing what it gathers, basing results on service fingerprinting, banner information, and similar details it gathers combined with CVE information. What type of tool is Jim using?
a. A port scanner
b. A service validator
c. A vulnerability scanner
d. A patch management tool
C. Vulnerability scanners that do not have administrative rights to access a machine or that are not using an agent scan remote machines to gather information, including fingerprints from responses to queries and connections, banner information from services, and related data. CVE information is Common Vulnerability and Exposure information, or vulnerability information. A port scanner gathers information about what service ports are open, although some port scanners blur the line between port and vulnerability scanners. Patch management tools typically run as an agent on a system to allow them to both monitor patch levels and update the system as needed. Service validation typically involves testing the functionality of a service, not its banner and response patterns.
- Emily builds a script that sends data to a web application that she is testing. Each time the script runs, it sends a series of transactions with data that fits the expected requirements of the web application to verify that it responds to typical customer behavior. What type of transactions is she using, and what type of test is this?
a. Synthetic, passive monitoring
b. Synthetic, use case testing
c. Actual, dynamic monitoring
d. Actual, fuzzing
B. Emily is using synthetic transactions, which can use recorded or generated transactions, and is conducting use case testing to verify that the application responds properly to actual use cases. Neither actual data nor dynamic monitoring is an industry term. Fuzzing involves sending unexpected inputs to a program to see how it responds. Passive monitoring uses a network tap or other capture technology to allow monitoring of actual traffic to a system or application.
- What passive monitoring technique records all user interaction with an application or website to ensure quality and performance?
a. Client/server testing
b. Real user monitoring
c. Synthetic user monitoring
d. Passive user recording
B. Real user monitoring (RUM) is a passive monitoring technique that records user interaction with an application or system to ensure performance and proper application behavior. RUM is often used as part of a predeployment process using the actual user interface. The other answers are all made up—synthetic monitoring uses simulated behavior, but synthetic user monitoring is not a testing method. Similarly, passive monitoring monitors actual traffic, but passive user recording is not an industry term or technique. Client/server testing merely describes one possible architecture.
- Earlier this year, the information security team at Jim’s employer identified a vulnerability in the web server that Jim is responsible for maintaining. He immediately applied the patch and is sure that it installed properly, but the vulnerability scanner has continued to flag the system as vulnerable even though Jim is sure the patch is installed. Which of the following options is Jim’s best choice to deal with the issue?
a. Uninstall and reinstall the patch.
b. Ask the information security team to flag the system as patched and not vulnerable.
c. Update the version information in the web server’s configuration.
d. Review the vulnerability report and use alternate remediation instructions if they are provided.
B. Jim should ask the information security team to flag the issue as resolved if he is sure the patch was installed. Many vulnerability scanners rely on version information or banner information, and may flag patched versions if the software provider does not update the information they see. Uninstalling and reinstalling the patch will not change this. Changing the version information may not change all of the details that are being flagged by the scanner, and may cause issues at a later date. Reviewing the vulnerability information for a workaround may be a good idea but should not be necessary if the proper patch is installed; it can create maintenance issues later.
- Angela wants to test a web browser’s handling of unexpected data using an automated tool. What tool should she choose?
a. Nmap
b. zzuf
c. Nessus
d. Nikto
B. zzuf is the only fuzzer on the list, and zzuf is specifically designed to work with tools like web browsers, image viewers, and similar software by modifying network and file input to application. Nmap is a port scanner, Nessus is a vulnerability scanner, and Nikto is a web server scanner.
- STRIDE, which stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege, is useful in what part of application threat modeling?
a. Vulnerability assessment
b. Misuse case testing
c. Threat categorization
d. Penetration test planning
C. An important part of application threat modeling is threat categorization. It helps to assess attacker goals that influence the controls that should be put in place. The other answers all involve topics that are not directly part of application threat modeling.
- Why should passive scanning be conducted in addition to implementing wireless security technologies like wireless intrusion detection systems?
a. It can help identify rogue devices.
b. It can test the security of the wireless network via scripted attacks.
c. Their short dwell time on each wireless channel can allow them to capture more packets.
d. They can help test wireless IDS or IPS systems.
A. Passive scanning can help identify rogue devices by capturing MAC address vendor IDs that do not match deployed devices, by verifying that systems match inventories of organizationally owned hardware by hardware address, and by monitoring for rogue SSIDs or connections.
Scripted attacks are part of active scanning rather than passive scanning, and active scanning is useful for testing IDS or IPS systems, whereas passive scanning will not be detected by detection systems. Finally, a shorter dwell time can actually miss troublesome traffic, so balancing dwell time versus coverage is necessary for passive wireless scanning efforts.
- During a penetration test, Lauren is asked to test the organization’s Bluetooth security. Which of the following is not a concern she should explain to her employers?
a. Bluetooth scanning can be time consuming.
b. Many devices that may be scanned are likely to be personal devices.
c. Bluetooth passive scans may require multiple visits at different times to identify all targets.
d. Bluetooth active scans can’t evaluate the security mode of Bluetooth devices.
D. Bluetooth active scans can determine both the strength of the PIN and what security mode the device is operating in. Unfortunately, Bluetooth scans can be challenging due to the limited range of Bluetooth and the prevalence of personally owned Bluetooth enabled devices. Passive Bluetooth scanning only detects active connections and typically requires multiple visits to have a chance of identifying all devices.
- What term describes software testing that is intended to uncover new bugs introduced by patches or configuration changes?
a. Nonregression testing
b. Evolution testing
c. Smoke testing
d. Regression testing
D. Regression testing, which is a type of functional or unit testing, tests to ensure that changes have not introduced new issues. Nonregression testing checks to see if a change has had the effect it was supposed to, smoke testing focuses on simple problems with impact on critical functionality, and evolution testing is not a software testing technique.
- Which of the tools cannot identify a target’s operating system for a penetration tester?
a. Nmap
b. Nessus
c. Nikto
d. sqlmap
D. Nmap, Nessus, and Nikto all have OS fingerprinting or other operating system identification capabilities. sqlmap is designed to perform automated detection and testing of SQL injection flaws, and does not provide OS detection.
- Susan needs to predict high-risk areas for her organization and wants to use metrics to assess risk trends as they occur. What should she do to handle this?
a. Perform yearly risk assessments.
b. Hire a penetration testing company to regularly test organizational security.
c. Identify and track key risk indicators.
d. Monitor logs and events using a SIEM device.
C. Key risk indicators are used to tell those in charge of risk management how risky an activity is and how much impact changes are having on that risk profile. Identifying key risk indicators and monitoring them can help to identify high-risk areas earlier in their life cycle. Yearly risk assessments may be a good idea, but only provide a point in time view, whereas penetration tests may miss out on risks that are not directly security related. Monitoring logs and events using a SIEM device can help detect issues as they occur but won’t necessarily show trends in risk.
- What major difference separates synthetic and passive monitoring?
a. Synthetic monitoring only works after problems have occurred.
b. Passive monitoring cannot detect functionality issues.
c. Passive monitoring only works after problems have occurred.
d. Synthetic monitoring cannot detect functionality issues.
C. Passive monitoring only works after issues have occurred because it requires actual traffic. Synthetic monitoring uses simulated or recorded traffic, and thus can be used to proactively identify problems. Both synthetic and passive monitoring can be used to detect functionality issues.
