Examen 1 Flashcards
What type of vulnerability/attack is it when the malicious person forces the user's browser to send an authenticated request to a server? A. Cross-site request forgery B. Cross-site scripting C. Session hijacking D. Server side request forgery
A. Cross-site request forgery
Your next-door neighbor, that you do not get along with, is having issues with their network, so he yells to his spouse the network’s SSID and passowrd and you hear them both clearly. What do you do with this information?
A. Nothing but suggest to him to change the network’s SSID and password.
B. Sell his SSID and password to friends that come to your house, so it doesn’t slow down your network.
C. Log onto to his network, after all it’s his fault you can get in.
D. Only use his network when you have large downloads so you don’t tax your own network.
A. Nothing but suggest to him to change the network’s SSID and password.
Identify the web application attack where the attackers exploit vulnerabilities in dynamically generated web pages to inject client-side script into web pages viewed by other users. A. SQL injection attack B. Cross-Site Scripting (XSS) C. LDAP Injection attack D. Cross-Site Request Forgery (CSRF)
B. Cross-Site Scripting (XSS)
An Internet Service Provider (ISP) has a need to authenticate users connecting using analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Frame Relay network.
Which AAA protocol is most likely able to handle this requirement?
A. RADIUS
B. DIAMETER
C. Kerberos
D. TACACS+
A. RADIUS
A recent security audit revealed that there were indeed several occasions that the company's network was breached. After investigating, you discover that your IDS is not configured properly and therefore is unable to trigger alarms when needed. What type of alert is the IDS giving? A. True positive B. False negative C. False positive D. False positive
B. False negative
Which among the following is a Windows command that a hacker can use to list all the
shares to which the current user context has access?
A. NET FILE
B. NET USE
C. NET CONFIG
D. NET VIEW
B. NET USE
Which of the following prgramming languages is most vulnerable to buffer overflow attacks? A. Perl B. C++ C. Python D. Java
B. C++
Which of the following command line switch would you use ofr OS detection in Nmap? A. -D B. -O C. -P D. -X
B. -O
Which of the following processes of PKI (Public Key Infrastructure) ensures that a trust
relationship exists and that a certificate is still valid for specific operations?
A. Certificate issuance
B. Certificate validation
C. Certificate cryptography
D. Certificate revocation
B. Certificate validation
Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is the best protection that will work for her? A. Password protected files B. Hidden folders C. BIOS password D. Full disk encryption.
D. Full disk encryption.
Which of the following is a characteristic of Public Key Infrastructure (PKI)?
A. Public-key cryptosystems are faster than symmetric-key cryptosystems.
B. Public-key cryptosystems distribute public-keys within digital signatures.
C. Public-key cryptosystems do not require a secure key distribution channel.
D. Public-key cryptosystems do not provide technical non-repudiation via digital signatures
B. Public-key cryptosystems distribute public-keys within digital signatures.
The chance of a hard drive failure is once every three years. The cost to buy a new ard
drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will
require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1 (100%).
What is the closest approximate cost of this replacement and recovery operation per year?
A. $146
B. $1320
C. $440
D. $100
A. $146
Due to a slowdown of normal network operations, IT department decided to monitor
internet traffic for all of the employees. From a legal stand point, what would be troublesome to take this kind of measure?
A. All of the employees would stop normal work activities
B. IT department would be telling employees who the boss is
C. Not informing the employees that they are going to be monitored could be an invasion of privacy.
D. The network could still experience traffic slow down.
C. Not informing the employees that they are going to be monitored could be an invasion of privacy.
If executives are found liable for not properly protecting their company's assets and information systems, what type of law would apply in this situation? A. Civil B. International C. Criminal D. Common
A. Civil
What hacking attack is challenge/response authentication used to prevent?
A. Replay attacks
Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weaknesses and key loggers. Which of the following options best represents the means that Bob can adopt to retrieve passwords from his clients hosts and servers?
A. Hardware, Software, and Sniffing.
B. Hardware and Software Keyloggers.
C. Passwords are always best obtained using Hardware key loggers.
D. Software only, they are the most effective.
A. Hardware, Software, and Sniffing.
Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall? A. UDP 123 B. UDP 541 C. UDP 514 D. UDP 415
C. UDP 514
Code injection is a form of attack in which a malicious user:
A. Inserts text into a data field that gets interpreted as code
B. Gets the server to execute arbitrary code using a buffer overflow
C. Inserts additional code into the JavaScript running in the browser
D. Gains access to the codebase on the server and inserts new code
A. Inserts text into a data field that gets interpreted as code
Darius is analysing IDS logs. During the investigation, he noticed that there was nothing suspicious found and an alert was triggered on normal web application traffic. He can mark this alert as: A. False negative B. False positive C. True positive D. False signature
B. False positive
PGP, SSL, and IKE are all examples of which type of cryptography? A. Public key B. Secret Key C. Hash Algorithm D. Digest
A. Public key
B. Secret key
C. Hash Algorithm
D. Digest
The Payment Card Industry Data Security Standard (PCI DSS) contains six different categories of control objectives. Each objective contains one or more requirements, which must be followed to achieve compliance. Which of the following requirements would best fit under the objective, “implement stron access control measures”?
A. Regularly test security system and proccesses
B. Encrypt transmission of cardholder data across open, public networks
C. Assign a unique ID to each person with computer access.
D. Use and regularly update anti-virus software on all systems commonly affected by malware.
C. Assign a unique ID to each person with computer access.
The purpose of a \_\_\_\_\_\_\_\_\_\_ is to deny network access to local area networks and other information assets by unauthorized wireless devices. A. Wireless Intrusion Prevention System B. Wireless Access Point C. Wireless Access Control List D. Wireless Analyzer
A. Wireless Intrusion Prevention System
What is GINA?
A. Gateway Interface Network Application
B. GUI Installed Network Application CLASS
C. Global Internet National Authority
D. Graphical Identification and Authentication DLL
D. Graphical Identification and Authentication DLL
A network administrator received an administrative alert at 3:00 a.m. from the intrusion detection system. The alert was generated because a large number of packets were coming into the network over pots 20 and 21. During analysis, there were no signs of attack on the FTP servers. How should the administrator classify this situation? A. True negatives B. False negatives C. True positives D. False positives
D. False positives
A company recently hired your team of Ethical Hackers to test the security of their network systems. The company wants to have the attack be as realistic as possible. They did not provide any information besides the name of their company. What phase of security testing would your team jump in right away? A. Scanning B. Reconnaissance C. Escalation D. Enumeration
B. Reconnaissance
You are manually conducting Idle Scanning using Hping2. During your scanning you notice that almost every query increments the IPID regardless of the port being queried. One or two of the queries cause the IPID to increment more than one value. Why do you think this occurs?
A. The zombie you are using is not truly idle
B. A stateful inspection firewall is resetting your queries
C. Hping2 canot be used for idle scanning
D. These ports are actually open on the target system
A. The zombie you are using is not truly idle
A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd (cuentas de usuarios, asi como las claves de accesos y privilegios). How can he use it?
A. The password file does not contain the passwords themselves
B. He can open it and read the user ids and corresponding passwords
C. The file reveals the passwords to the root user only
D. He cannot read it because it is encrypted
A. The password file does not contain the passwords themselves.
Which of the following is a hashing algorithm? A. MD5 B. PGP C. DES D. ROT13
A. MD5
Which of the following is a successor of SSL? A. TLS B. RSA C. GRE D. IPSec
A. TLS
What would you type on the Windows command line in order to launch the Computer Management Console provided that you are logged in as an admin? A. c:\compmgmt.msc B. c:\gpedit C. c:\ncpa.cpl D. c:\services.msc
A. c:\compmgmt.msc
Switches maintain a CAM Table that maps individual MAC addresses on the network to
physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC addresses to physical ports. What happens when the CAM table becomes full?
A. Switch then acts as hub by broadcasting packets to all machines on the network
B. The CAM overflow table will cause the switch to crash causing Denial of Service
C. The switch replaces outgoing frame switch factory default MAC address of FF:FF:FF:FF:FF:FF
D. Every packet is dropped and the switch sends out SNMP alerts to the IDS port
A. Switch then acts as hub by broadcasting packets to all machines on the network
After gaining access to the password hashes used to protect access to a web based
application, knowledge of which cryptographic algorithms would be useful to gain access to the
application?
A. SHA1
B. Diffie-Helman
C. RSA
D. AES
A. SHA1
Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. Which of the following is the correct bit size of the Diffie-Hellman (DH) group 5? A. 768 bit key B. 1025 bit key C. 1536 bit key D. 2048 bit key
C. 1536 bit key
The establishment of a TCP connection involves a negotiation called 3 way handshake. What type of message sends the client to the server in order to begin this negotiation? A. RST B. ACK C. SYN-ACK D. SYN
D. SYN
What is the following command used for?
net use \targetipc$ “” /u:””
A. Grabbing the etc/passwd file
B. Grabbing the SAM
C. Connecting to a Linux computer through Samba.
D. This command is used to connect as a null session
E. Enumeration of Cisco routers
C. Connecting to a Linux computer through Samba.
A security engineer has been asked to depoloy a secure remote access solution that will allow employees to connect to the company's internal network. Which of the following can be implemented to minimize the opportunity for the man-in-the-middle attack to occur? A. SSL B. Mutual authentication C. IPSec D. Static IP addresses
C. IPSec
Peter, a Network Administrator, has come to you looking for advice on a tool that would help him perform SNMP enquires over the network. Which of these tools would do the SNMP enumeration he is looking for? Select the best answers. A. SNMPUtil B. SNScan C. SNMPScan D. Solarwinds IP Network Browser E. Nmap
A. SNMPUtil
B. SNScan
D. Solarwinds IP Network Browser
Which of the following tools will scan a network to perform vulnerability checks and compliance auditing? A. NMAP B. Metasploit C. Nessus D. BeEF (Browser Exploitation Framework)
C. Nessus
An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTMLcode to embed a malicious applet in all HTTP connections.
When users accessed any page, the applet ran and exploited many machines.
Which one of the following tools the hacker probably used to inject HTML code?
A. Wireshark
B. Ettercap
C. Aircrack-ng
D. Tcpdump
B. Ettercap
Which of the following describes the characteristics of a Boot Sector Virus?
A. Moves the MBR to another location on the hard disk and copies itself to the original location the MBR
B. Moves the MBR to another location on the RAM and copies itself to the original location of the MBR
C. Modifies directory table entries so that directory entries point to the virus code instead of the actual program
D. Overwrites the original MBR and only executes the new virus code
A. Moves the MBR to another location on the hard disk and copies itself to the original location the MBR
Which of the following resources does NMAP need to be used as a basic vulnerability scanner covering several vectors like SMB, HTTP and FTP? A. Metasploit scripting engine B. Nessus scripting engine C. NMAP scripting engine D. SAINT scripting engine
C. NMAP scripting engine
Supposed you are the Chief Network Engineer of a certain Telco. Your company is planning for a big business expansion and it requires that your network authenticate users connecting using analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over Frame Relay network. Which AAA protocol would you implement? A. TACACS+ B. DIAMETER C. Kerberos D. RADIUS
D. RADIUS
Which Open Web Application Security Project (OWASP) implements a web application full of known vulnerabilities? A. WebBugs B. WebGoat C. VULN_HTML D. WebScarab
B. WebGoat
Which protocol is used for setting up secured channels between two devices, typically in VPNs? A. IPSEC B. PEM C. SET D. PPP
A. IPSEC
A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all fo the packets in the network? A. Fraggle B. MAC Flood C. Smurf D. Tear Drop
B. MAC Flood
Sid is a judge for a programming contest. Before the code reaches him it goes through a restricted OS and is tested there. If it passes, then it moves onto Sid. What is this middle step called? A. Fuzzy-testing the code B. Third party running the code C. Sandboxing the code D. String validating the code
A. Fuzzy-testing the code
You jsut set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration?
alert tcp any any -> 192.168.100.0/24 (msg: “FTP on the network!”;)
A. An Intrusion Detection System
B. A firewall IPTable
C. A Router IPTable
D. FTP Server rule
A. An Intrusion Detection System
What is the name of the international standard that establishes a baseline level of confidence in the security functionality of IT products by providing a set of requirements for evaluation? A. Blue Book B. ISO 26029 C. Common Criteria D. The Wassenaar Agreement
C. Common Criteria
Joseph was the Web site administrator for the Mason Insurance in New York, who’s main Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to administer the Web site. One night, Joseph received an urgent phone call from his friend, Smith. According to Smith, the main Mason Insurance web site had been vandalized! All of its normal content was removed and replaced with an attacker’s message ‘‘Hacker Message: You are dead! Freaks!” From his office, which was directly connected to Mason Insurance’s internal network, Joseph surfed to the Web site using his laptop. In his browser, the Web site looked completely intact. No changes were apparent. Joseph called a friend of his at his home to help troubleshoot the problem. The Web site appeared defaced when his friend visited using his DSL connection. So, while Smith and his friend could see the defaced page, Joseph saw the intact Mason Insurance web site. To help make sense of this problem, Joseph decided to access the Web site using his dial-up ISP. He disconnected his laptop from the corporate internal network and used his modem to dial up the same ISP used by Smith. After his modem connected, he quickly typed www.masonins.com in his browser to reveal the following web page:
After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal
network, and used Secure Shell (SSH) to log in directly to the Web server. He ran Tripwire against the entire Web site and determined that every system file and all the Web content on the server were intact. How did the attacker accomplish this hack?
A. ARP spoofing
B. SQL injection
C. DNS poisoning
D. Routing table injection
C. DNS poisoning
Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering policy, procedure design, and implementation? A. Penetration testing B. Social engineering C. Vulnerability scanning D. Access control list reviews
A. Penetration testing
