Ethical 12b

Question 1

Which antiphishing tool is an enterprise-level solution that installs phishing sweeper clients throughout an organization?

Answer 1

Phishing Sweeper

Question 2

Besides using decimal IP addresses, what other formats can an attacker use to trick a user into visiting an IP address by way of URL?

Answer 2

Octal Hexadecimal Dword

Question 3

What two online services can be used to provide a shortened third-party URL link to a phishing web page?

Answer 3

smallurl.com tinurl.com

Question 4

A large enterprise-sized client has asked you to provide software that will work throughout their domain to counter the threat of phishing attacks by managing workstation behavior and providing a centralized monitoring capability. What anti-phishing software should you use?

Answer 4

Phishing Sweeper

Question 5

A user has come to you and indicated that their corporate credit card was compromised after the user attempted to check the balance on the card. The user says that he clicked a link on a 3rd party web page that appeared to be legitimate, but actually lead to a phishing site. What most likely occurred?

Answer 5

A phisher utilized content injection to make the site appear legitimate.

Question 6

Which of the following might be considered an antiphishing technique?

Answer 6

entering a URL in a browser manually

Question 7

What statement accurately describes how attackers exploit the use of IRC and instant messaging applications for phishing attempts?

Answer 7

Bots are utilized in popular channels and on popular applications to send fake information to many potential victims all at once.

Question 8

What type of social engineering attack tricks users with offers of money or other inducements in order to get users to give them personal information?

Answer 8

Phishing

Question 9

In malware-based phishing, what technique can be used to redirect legitimate URLs to a malicious address?

Answer 9

Hosts File Poisoning

Question 10

You are planning to perform content-injection phishing in order to grab login information from your client’s users in order to demonstrate a vulnerability on their network. What statements describe actual means by which you could perform this attack?

Answer 10

Legitimate content can be replaced by malicious content through the use of a security vulnerability on the client’s web servers.

Create a phishing site, compromise a single user’s PC, and then use their corporate contact list to spread the phishing site throughout the client’s domain.

Question 11

Which type of phishing attack involves friendly login URLs, host name obfuscation, or bad domain names?

Answer 11

URL obfuscation

Question 12

Which of the following is a reason for successful phishing?

Answer 12

lack of knowledge

Question 13

According to Kaspersky Lab’s Spam Statistics Report Q2 2013, which country had the highest percentage of phishing attacks?

Answer 13

China

Question 14

What is the first step that is performed when building a successful phishing site?

Answer 14

Register a fake domain name.

Question 15

Which type of phishing attack makes use of a proxy server?

Answer 15

Man-in-the-Middle Attacks

Question 16

What factors are most likely to lead to a successful phishing attempt?

Answer 16

Use of deceptive graphical imagery and mimicry.

Exploitation of lack of knowledge on the part of the end user.

Exploitation of carelessness on the part of the end user.

Question 17

What is the primary vector for a typical phishing attack against an individual user?

Answer 17

An e-mail with a link that leads to a phishing website.

Question 18

Which application is usually exploited to conduct phishing attacks?

Answer 18

E-mail

Question 19

Which type of attack might provide a false secured-HTTPS wrapper or hide the source address in the attacker’s content server?

Answer 19

hidden frames

Question 20

What type of attack is carried out by targeting customers through a third-party Web site in which phishers may put banner ads on reputable sites, redirecting potential customers to a fake site?

Answer 20

Web-based delivery