Examen 3 Flashcards
Cross-site request forgery involves:
A. A request sent by a malicious user from a browser to a server
B. Modification of a request by a proxy between client and server
C. A browser making a request to a server without the user’s knowledge
D. A server making a request to another server without the user’s knowledge
C. A browser making a request to a server without the user’s knowledge
Which regulation defines security and privacy controls for Federal information systems and organizations? A. NIST-800-53 B. PCI-DSS C. EU Safe Harbor D. HIPAA
A. NIST-800-53
An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk assessments. A friend recently started a company and asks the hacker to perform a penetration test and vulnerability assessment of the new company as a favor. What should the hacker’s next step be before starting work on this job?
A. Start by foot printing the network and mapping out a plan of attack.
B. Ask the employer for authorization to perform the work outside the company.
C. Begin the reconnaissance phase with passive information gathering and then move into active information gathering.
D. Use social engineering techniques on the friend’s employees to help identify areas that may be susceptible to attack.
B. Ask the employer for authorization to perform the work outside the company.
Chandler works as a pen-tester in an IT-firm in New York. As a part of detecting viruses in the systems, he uses a detection method where the anti-virus executes the malicious codes on a virtual machine to simulate CPU and memory activities.
Which type of virus detection method did Chandler use in this context?
A. Heuristic Analysis
B. Code Emulation
C. Integrity checking
D. Scanning
B. Code Emulation
Bob, your senior colleague, has sent you a mail regarding a deal with one of the clients. You are requested to accept the offer and you oblige. After 2 days. Bob denies that he had ever sent a mail. What do you want to ""know"" to prove yourself that it was Bob who had send a mail? A. Authentication B. Confidentiality C. Integrity D. Non-Repudiation
D. Non-Repudiation
Which type of scan is used on the eye to measure the layer of blood vessels? A. Facial recognition scan B. Retinal scan C. Iris scan D. Signature kinetics scan
B. Retinal scan
A new wireless client that is 802.11 compliant cannot connect to a wireless network given that the client can see the network and it has compatible hardware and software installed. Upon further tests and investigation, it was found out that the Wireless Access Point (WAP) was not responding to the association requests being sent by the wireless client. What MOST likely is the issue on this scenario?
A. The client cannot see the SSID of the wireless network
B. The WAP does not recognize the client’s MAC address.
C. The wireless client is not configured to use DHCP.
D. Client is configured for the wrong channel
B. The WAP does not recognize the client’s MAC address.
Windows LAN Manager (LM) hashes are known to be weak.
Which of the following are known weaknesses of LM? (Choose three.)
A. Converts passwords to uppercase.
B. Hashes are sent in clear text over the network.
C. Makes use of only 32-bit encryption.
D. Effective length is 7 characters.
A. Converts passwords to uppercase.
B. Hashes are sent in clear text over the network.
D. Effective length is 7 characters.
Which element of Public Key Infrastructure (PKI) verifies the applicant? A. Certificate authority B. Validation authority C. Registration authority D. Verification authority
C. Registration authority
Which of the following algorithms can be used to guarantee the integrity of messages being sent, in transit, or stored? A. symmetric algorithms B. asymmetric algorithms C. hashing algorithms D. integrity algorithms
C. hashing algorithms
It is a widely used standard for message logging. It permits separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. This protocol is specifically designed for transporting event messages. Which of the following is being described? A. SNMP B. ICMP C. SYSLOG D. SMS
C. SYSLOG
When tuning security alerts, what is the best approach?
A. Tune to avoid False positives and False Negatives
B. Rise False positives Rise False Negatives
C. Decrease the false positives
D. Decrease False negatives
A. Tune to avoid False positives and False Negatives
What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?
A. Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail.
B. Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.
C. Symmetric encryption allows the server to securely transmit the session keys out-of-band.
D. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.
D. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.
A newly discovered flaw in a software application would be considered which kind of security vulnerability? A. Input validation flaw B. HTTP header injection vulnerability C. 0-day vulnerability D. Time-to-check to time-to-use flaw
C. 0-day vulnerability
When you are getting information about a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from the server. You can detect all these methods (GET, POST, HEAD, PUT, DELETE, TRACE) using NMAP script engine.
What nmap script will help you with this task?
A. http-methods
B. http enum
C. http-headers
D. http-git
A. http-methods
Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?
A. Produces less false positives
B. Can identify unknown attacks
C. Requires vendor updates for a new threat
D. Cannot deal with encrypted network traffic
B. Can identify unknown attacks
TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. Which of the following tools can be used for passive OS fingerprinting? A. nmap B. ping C. tracert D. tcpdump
D. tcpdump
Which of the following is considered the best way to protect Personally Identifiable Information (PII) from Web application vulnerabilities?
A. Use cryptographic storage to store all PII
B. Use encrypted communications protocols to transmit PII
C. Use full disk encryption on all hard drives to protect PII
D. Use a security token to log into all Web applications that use PII
B. Use encrypted communications protocols to transmit PII
What network security concept requires multiple layers of security controls to be placed throughout an IT infrastructure, which improves the security posture of an organization to defend against malicious attacks or potential vulnerabilities?
What kind of Web application vulnerability likely exists in their software?
A. Host-Based Intrusion Detection System
B. Security through obscurity
C. Defense in depth
D. Network-Based Intrusion Detection System
C. Defense in depth
Which of the following levels of algorithms does Public Key Infrastructure (PKI) use? A. RSA 1024 bit strength B. AES 1024 bit strength C. RSA 512 bit strength D. AES 512 bit strength
A. RSA 1024 bit strength
A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer's software and hardware without the owner's permission. Their intention can either be to simply gain knowledge or to illegally make changes. Which of the following class of hacker refers to an individual who works both offensively and defensively at various times? A. Suicide Hacker B. Black Hat C. White Hat D. Gray Hat
D. Gray Hat
Fingerprinting VPN firewalls is possible with which of the following tools? A. Angry IP B. Nikto C. Ike-scan D. Arp-scan
C. Ike-scan
What is a “Collision attack” in cryptography?
A. Collision attacks try to find two inputs producing the same hash.
B. Collision attacks try to break the hash into two parts, with the same bytes in each part to get the private key.
C. Collision attacks try to get the public key.
D. Collision attacks try to break the hash into three parts to get the plaintext value.
A. Collision attacks try to find two inputs producing the same hash.
It is a short-range wireless communication technology intended to replace the cables connecting portable of fixed devices while maintaining high levels of security. It allows mobile phones, computers and other devices to connect and communicate using a short-range wireless
connection. Which of the following terms best matches the definition?
A. Bluetooth
B. Radio-Frequency Identification
C. WLAN
D. InfraRed
A. Bluetooth
What is a NULL scan?
A. A scan in which all flags are turned off
B. A scan in which certain flags are off
C. A scan in which all flags are on
D. A scan in which the packet size is set to zero
E. A scan with an illegal packet size
A. A scan in which all flags are turned off
An attacker runs netcat tool to transfer a secret file between two hosts.
He is worried about information being sniffed on the network.
How would the attacker use netcat to encrypt the information before transmitting onto the wire?
A. Machine A: netcat -l -p -s password 1234 < testfileMachine B: netcat 1234
B. Machine A: netcat -l -e magickey -p 1234 < testfileMachine B: netcat 1234
C. Machine A: netcat -l -p 1234 < testfile -pw passwordMachine B: netcat 1234 -pw password
D. Use cryptcat instead of netcat
D. Use cryptcat instead of netcat
This phase will increase the odds of success in later phases of the penetration test. It is also the very first step in Information Gathering, and it will tell you what the "landscape" looks like. What is the most important phase of ethical hacking in which you need to spend a considerable amount of time? A. footprinting B. network mapping C. gaining access D. escalating privileges
A. footprinting
In IPv6 what is the major difference concerning application layer vulnerabilities compared to IPv4?
A. Implementing IPv4 security in a dual-stack network offers protection from IPv6 attacks too.
B. Vulnerabilities in the application layer are independent of the network layer. Attacks and mitigation techniques are almost identical.
C. Due to the extensive security measures built in IPv6, application layer vulnerabilities need not be addresses.
D. Vulnerabilities in the application layer are greatly different from IPv4.
B. Vulnerabilities in the application layer are independent of the network layer. Attacks and mitigation techniques are almost identical.
Pentest results indicate that voice over IP traffic is traversing a network. Which of the following tools will decode a packet capture and extract the voice conversations? A. Cain B. John the Ripper C. Nikto D. Hping
A. Cain
Which initial procedure should an ethical hacker perform after being brought into an
organization?
A. Begin security testing.
B. Turn over deliverables.
C. Sign a formal contract with non-disclosure.
D. Assess what the organization is trying to protect.
C. Sign a formal contract with non-disclosure.
What is the main security service a cryptographic hash provides?
A. Integrity and ease of computation
B. Message authentication and collision resistance
C. Integrity and collision resistance
D. Integrity and computational in-feasibility
D. Integrity and computational in-feasibility
A large company intends to use Blackberry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the corporate network. What tool should the analyst use to perform a Blackjacking attack? A. Paros Proxy B. BBProxy C. BBCrack D. Blooover
B. BBProxy
Which of the following is a vulnerability in GNU's bash shell (discovered in September of 2014) that gives attackers access to run remote commands on a vulnerable system? A. Shellshock B. Rootshell C. Rootshock D. Shellbash
A. Shellshock
You are working as a Security Analyst in a company XYZ that owns the whole subnet range of 23.0.0.0/8 and 192.168.0.0/8. While monitoring the data, you find a high number of outbound connections. You see that IP's owned by XYZ (Internal) and private IP's are communicating to a Single Public IP. Therefore, the Internal IP's are sending data to the Public IP. After further analysis, you find out that this Public IP is a blacklisted IP, and the internal communicating devices are compromised. What kind of attack does the above scenario depict? A. Botnet Attack B. Spear Phishing Attack C. Advanced Persistent Threats D. Rootkit Attack
A. Botnet Attack
What is the least important information when you analyze a public IP address in a security alert? A. ARP B. Whois C. DNS D. Geolocation
A. ARP
How can telnet be used to fingerprint a web server?
A. telnet webserverAddress 80HEAD / HTTP/1.0
B. telnet webserverAddress 80PUT / HTTP/1.0
C. telnet webserverAddress 80HEAD / HTTP/2.0
D. telnet webserverAddress 80PUT / HTTP/2.0
A. telnet webserverAddress 80HEAD / HTTP/1.0
If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TCP? A. Hping B. Traceroute C. TCP ping D. Broadcast ping
A. Hping
Which of the following tools would be the best choice for achieving compliance with PCI Requirement 11? A. Truecrypt B. Sub7 C. Nessus D. Clamwin
C. Nessus
An attacker is trying to redirect the traffic of a small office. That office is using their own mail server, DNS server and NTP server because of the importance of their job. The attacker gains access to the DNS server and redirects the direction www.google.com to his own IP address. Now when the employees of the office want to go to Google they are being redirected to the attacker machine. What is the name of this kind of attack? A. ARP Poisoning B. Smurf Attack C. DNS spoofing D. MAC Flooding
C. DNS spoofing
After trying multiple exploits, you've gained root access to a Centos 6 server. To ensure you maintain access, what would you do first? A. Create User Account B. Disable Key Services C. Disable IPTables D. Download and Install Netcat
A. Create User Account
If an e-commerce site was put into a live environment and the programmers failed to remove the secret entry point that was used during the application development, what is this secret entry point known as? A. SDLC process B. Honey pot C. SQL injection D. Trap door
D. Trap door
The following is an entry captured by a network IDS. You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor. You figure that the attacker is attempting a buffer overflow attack. You also notice “/bin/sh” in the ASCII part of the output. As an analyst what would you conclude about the attack?
A. The buffer overflow attack has been neutralized by the IDS
B. The attacker is creating a directory on the compromised machine
C. The attacker is attempting a buffer overflow attack and has succeeded
D. The attacker is attempting an exploit that launches a command-line shell
D. The attacker is attempting an exploit that launches a command-line shell
Security and privacy of/on information systems are two entities that requires lawful
regulations. Which of the following regulations defines security and privacy controls for Federal
information systems and organizations?
A. NIST SP 800-53
B. PCI-DSS
C. EU Safe Harbor
D. HIPAA
A. NIST SP 800-53
A circuit level gateway works at which of the following layers of the OSI Model? A. Layer 5 - Application B. Layer 4 - TCP C. Layer 3 - Internet protocol D. Layer 2 - Data link
B. Layer 4 - TCP
You need to deploy a new web-based software package for your organization. The package requires three separate servers and needs to be available on the Internet. What is the recommended architecture in terms of server placement?
A. All three servers need to be placed internally
B. A web server facing the Internet, an application server on the internal network, a database server on the internal network
C. A web server and the database server facing the Internet, an application server on the internal network
D. All three servers need to face the Internet so that they can communicate between themselves
B. A web server facing the Internet, an application server on the internal network, a database server on the internal network
What is the purpose of a demilitarized zone on a network?
A. To scan all traffic coming through the DMZ to the internal network
B. To only provide direct access to the nodes within the DMZ and protect the network behind it
C. To provide a place to put the honeypot
D. To contain the network devices you wish to protect
B. To only provide direct access to the nodes within the DMZ and protect the network behind it
Which of the following areas is considered a strength of symmetric key cryptography when compared with asymmetric algorithms? A. Scalability B. Speed C. Key distribution D. Security
B. Speed
A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago but has yet to get paid. The customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying. What actions should the CEH take?
A. Threaten to publish the penetration test results if not paid.
B. Follow proper legal procedures against the company to request payment.
C. Tell other customers of the financial problems with payments from this company.
D. Exploit some of the vulnerabilities found on the company webserver to deface it.
B. Follow proper legal procedures against the company to request payment.
Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?
A. Sarbanes-Oxley Act (SOX)
B. Gramm-Leach-Bliley Act (GLBA)
C. Fair and Accurate Credit Transactions Act (FACTA)
D. Federal Information Security Management Act (FISMA)
A. Sarbanes-Oxley Act (SOX)
Which of the following Nmap commands will produce the following output?
Output:
(saca algunos puertos UDP y TCP pero no todos)
A. nmap -sN -Ps -T4 192.168.1.1
B. nmap -sT -sX -Pn -p 1-65535 192.168.1.1
C. nmap -sS -Pn 192.168.1.1
D. nmap -sS -sU -Pn -p 1-65535 192.168.1.1
D. nmap -sS -sU -Pn -p 1-65535 192.168.1.1
