ethical hacking exam Flashcards
1 (a) List four attributes/skills which a security tester should possess. (4 marks)
Programming skills, knowledge of OS, Problem-solving, technical expertise, analytical mindset, attention to detail, communication skills, ethics, teamwork, time management.
(b) Define the following terms:
i. Hacker (3 marks)
ii. Penetration Tester (3 marks)
iii. Penetration Tests
iv. vulnerability assessment
v. security tests.
i. Hacker (3 marks)
is a person that uses their skills to gain unauthorized access to networks for malicious purposes or for personal gain.
ii. Penetration Tester (3 marks)
a security professional that simulates an attack on networks to identify vulnerabilities and exploits.
iii. Penetration Tests
penetration tests is a type of testing in which a security professional simulates an attack on networks to identify vulnerabilities on the system.
iv. vulnerability assessment
is a process of identifying and assessing vulnerabilities in a system or networks to determine potential security risks.
v. security tests.
Is a set of tests that are performed to identify and evaluate the security controls of a network to ensure that they are effective in protecting against potential threats.
(c) What is the main difference between an ethical hacker and a hacker.
the ethical hacker works with permission to identify vulnerabilities and improve a system or network security, while a hacker uses their skills to gain unauthorized access for personal gain or to cause harm.
(d) Why should a security professional or student learning hacking techniques be aware of the country’s laws that apply to their field of study?
To avoid legal implications, ensure ethical considerations, protect their professional reputation, and comply with organizational requirements.
(e) Why are Ethical hackers employed or contracted by a company to conduct vulnerability assessments, penetration tests, and security tests?
They are employed for many reasons, to identify vulnerabilities in the system or network, to enhance security measures, for compliance requirements, for a cost-effective solution (is cheaper to hire a ethical hacker than to recover from security breaches).
(f) Describe 2 actions which security testers cannot perform legally. [10]
Performing tests without authorization, access unauthorized systems, stealing data, breaching confidentiality, interfering with system performance.
(g) Why are employees sometimes not told that the company’s computer systems are being monitored
To ensure the employees do not act differently than they normally would, and also it can help companies detect and prevent any insider threats or malicious activities that may put the company data and assets at risk.
a) Define the following terms: “ethical hacking” and “security testing”, making clear the
distinction between them. (8 marks)
ethical hacking is identifying vulnerabilities or security threats with permission, while security testing is a broader range of techniques used to evaluate the effectiveness of security measures in a network.
(b) Describe the three models used by penetration or security testers to conduct tests.
Black-box: is a testing model in which the tester has no prior knowledge of the system or network being tested.
White-box: is a testing model in which the tester has full knowledge of the system being tested, including source code, network architecture, and security controls.
Grey-box: falls somewhere in between black and white-box. The test has some but not all knowledge of a system or network.
2 (a) What are TCP flags and why are they used? (3 marks)
SYN is used to initiate a TPC connection.
ACK is used to confirm that data has been received and accepted by the receiver.
FIN is used to termina a TPC connection.
RST is used to reset a connection in an event of an error.
PSH is used to request that data is sent to the receiver.
URG is used to identify urgent data that needs to be processed before any other data.
(b) What is session hijacking and how is it achieved? (3 marks)
Session hijacking is a type of attack where the attacker takes control of a valid session between a user and a server to perform unauthorized actions or gain access to sensitive data. This can be achieved through session prediction, session sniffin, XSS, or man-in-the-middle attacks.
(c) What is ICMP used for? How network professionals troubleshoot network connectivity problems with ICMP. Explain with an example.
ICMP is a network protocol used for diagnostic purposes, network professionals use ICMP tools like ping and traceroute to test network connectivity and track the path of packets. ICMP is also used to send error messages to notify network admin of network problems.
(d) What is the use of DNS? Where can DNS servers be located?
DNS translates human-readable domain name into machine-readable IP addresses. DNS servers can be located in companies data center.
(e) What steps are involved in TCP’s three-way handshake?
It involves a client sending a SYN packet to a server to initiate a connection. Then the server respond with a SYN-ACK packet to acknowledge the client request and establish a connection. Then client then sends a last ACK to confirm that the connection has been established.
(f) List 4 critical components of a TCP header?
Source port – the port number on the sender’s device.
Destination port – the port number on the receiver’s device.
Sequence number (ISN) – the sequence number of the first data byte.
Acknowledge number – contains a value of the next sequence number.
(g) Why should security testers be concerned with TCP header components? Give an example. (8 marks)
Because the header plays a crucial role in establishing and maintaining a secure and reliable connection between two endpoints. For example the security tester can analyse a TCP header and identify that the source and destination ports are a well-know port number associated with a vulnerability service, this ports can be a target of an exploit for an attack. Similarly if a unexpected sequence number or acknowledgement number is identified it could indicate a man-in-the-middle attack.
3 (a) What is the difference between spyware and adware? (4 marks)
Spyware collects sensitive information without permission, and adware displays unwanted ads.
(b) Describe the following terms:
i. Denial of Service (DoS) (3 marks)
ii. Botnet (or Zombies) (3 marks)
iii. DDoS Attack, how it work, example
iv. Trojan programs operate
v. Ping of death
i. Denial of Service (DoS) (3 marks)
is a type of attack that aims to make a website or network unavailable to users by overwhelming traffic into that service
ii. Botnet (or Zombies) (3 marks)
botnet is the term to describe a network of compromised computers (zombies) that are controlled by a control server to carry out malicious activities such as DDoS.
iii. DDoS Attack, how it work, example
Distributed Denial of Service is a type of DoS attack that uses botnet, a network of compromised computers to flood a system with traffic requests and makes the service unavailable to legitimate users.
iv. Trojan programs operate
is a type of malware that appears to be a legitimate software but it actually contains malicious code to damage or steal data from computer systems.
v. Ping of death
a type of network attack that sends a maliciously ping packet to a target device causing it to crash or become unresponsive.
(c) Explain how a basic computer virus operates and how it uses other host programs.
a basic virus infects a host program or file and replicates itself to spread to other files or systems.
It can modify its code to include the virus code. When this infected program is executed, the virus is also executed allowing it to replicate it self and infect other programs or systems
(d) How do buffer overflow attack? Explain with an example.
Buffer overflow occurs when a program writes more data to a buffer that it can handle causing the extra data to overflow into adjacent memory regions.
(e) What is the difference between a computer virus and worm? Your answer should explain how each replicates itself and propagates through a network. (8 marks)
Computer virus infects a host (file/softwares) and require these hosts to spread, while worms are standalone viruses that can spread independently.
4 (a) Social engineers use many different tactics in their attempt to gain information from unsuspected people. Using suitable examples describe each of the following common tactics:
i. Urgency (2 marks)
ii. Quid pro quo (2 marks)
iii. Status quo (2 marks)
iv. Kindness (2 marks)
v. Position (2 marks)
i. Urgency (2 marks)
they use a sense of urgency to pressure the victims into making quick and bad decisions without thinking. An attacker may impersonate a technical support agent and tell a victim that their computer has a critical security issue that needs to be fix, and the attack may ask for login details
ii. Quid pro quo (2 marks)
social engineers offer something in exchange for information like login credentials or access to a victims system. An attacker may offer a free service or program in exachange for their login details.
iii. Status quo (2 marks)
social engineers use the status quo bias to convince victims to maintain the current state of affairs. An attacker may send a phishing email that appears to be from a legitimate source and instructions for the victim to confirm their acc details to prevent it from being suspended.
iv. Kindness (2 marks)
use kindness to gain a victims trust and compliance. An attacker may pose as a charity worker and ask for donations or personal information
v. Position (2 marks)
use their perceived authority or position to convince victims to comply with their request. An attacker may impersonate a police officer or a senior executive and ask a victim to provide sensitive information or access to a system.
(b) What type of information is usually gathered by social engineering? Give 2 examples.
Usernames and passwords. Attackers may convince their victim to give them login details
Personal information. Attackers may ask for personal information such as name, date of birth, national issurance number.
Financial information. Attackers may request credit card information, bank account details and more.
(c) List 4 techniques used by social engineers in their attempts to gain information from unsuspecting people. Describe each with an example. [4]
Phishing: attackers may use email, text or phone calls that appear to be from a legitimate source such as bank or online service to trick victims into giving their personal information or login details.
Tailgating: attackers gain physical access to a building by following an authorized person without proper identification or authorization. For example they can ask for an employee to hold the door open pretending to be a new employee without an id card.
Dumpster diving: a physical form of attack that involves searching through trash or recycling bins to find sensitive information like discarded hard drives.
Impersonation: attacker may pretend to be someone else, such a colleague or a supplier, or even a law enforcement like police to gain the victim trust.
(d) A simple process like dumpster diving can be very effective when gathering information utilising social engineering. Explain with 2 examples.
Gathering confidential documents, an attacker can search through a companys trash to find unshredded documents contatining sensitive data, such as financial records, employee details, or customer information.
Discarded hard drives: attacker may find discarded hard drives or memory sticks or other computer equipment that contain sensitive information such as emails, documents or financial records.
