Examen 4 Flashcards
Which of the following is the BEST approach to prevent Cross-site Scripting (XSS) flaws?
A. Use digital certificates to authenticate a server prior to sending data.
B. Verify access right before allowing access to protected information and UI controls.
C. Verify access right before allowing access to protected information and UI controls.
D. Validate and escape all information sent to a server.
D. Validate and escape all information sent to a server.
Which of the following is a preventive control? A. Smart card authentication B. Security policy C. Audit trail D. Continuity of operations plan
A. Smart card authentication
To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program.
What term is commonly used when referring to this type of testing?
A. Fuzzing
B. Randomizing
C. Mutating
D. Bounding
A. Fuzzing
What is the broadcast address for the subnet 190.86.168.0/22? A. 190.86.168.255 B. 190.86.255.255 C. 190.86.171.255 D. 190.86.169.255
C. 190.86.171.255
Which of the following security operations is used for determining the attack surface of an organization?
A. Running a network scan to detect network services in the corporate DMZ
B. Training employees on the security policy regarding social engineering
C. Reviewing the need for a security clearance for each employee
D. Using configuration management to determine when and where to apply security patches
A. Running a network scan to detect network services in the corporate DMZ
Which tier in the N-tier application architecture is responsible for moving and processing data between the tiers? A. Application Layer B. Data tier C. Presentation tier D. Logic tier
D. Logic tier
The security administrator of ABC needs to permit Internet traffic in the host 10.0.0.2 and UDP traffic in the host 10.0.0.3. He also needs to permit all FTP traffic to the rest of the network and deny all other traffic. After he applied his ACL configuration in the router, nobody can access to the ftp, and the permitted hosts cannot access the Internet. According to the next configuration, what is happening in the network?
A. The ACL 104 needs to be first because is UDP
B. The ACL 110 needs to be changed to port 80
C. The ACL for FTP must be before the ACL 110
D. The first ACL is denying all TCP traffic and the other ACLs are being ignored by the router
D. The first ACL is denying all TCP traffic and the other ACLs are being ignored by the router
How can a policy help improve an employee’s security awareness?
A. By implementing written security procedures, enabling employee security training, and promoting the benefits of security
B. By using informal networks of communication, establishing secret passing procedures, and
immediately terminating employees
C. By sharing security secrets with employees, enabling employees to share secrets, and establishing a consultative help line
D. By decreasing an employee’s vacation time, addressing ad-hoc employment clauses, and ensuring that managers know employee strengths
A. By implementing written security procedures, enabling employee security training, and promoting the benefits of security
Company A and Company B have just merged and each has its own Public Key Infrastructure (PKI). What must the Certificate Authorities (CAs) establish so that the private PKIs for Company A and Company B trust one another and each private PKI can validate digital certificates from the other company? A. Poly key exchange B. Cross certification C. Poly key reference D. Cross-site exchange
B. Cross certification
Risks = Threats x Vulnerabilities is referred to as the: A. Risk equation B. Threat assessment C. BIA equation D. Disaster recovery formula
A. Risk equation
In 2007, this wireless security algorithm was rendered useless by capturing packets and discovering the passkey in a matter of seconds. This security flaw led to a network invasion of TJ Maxx and data theft through a technique known as wardriving.
Which Algorithm is this referring to?
A. Wired Equivalent Privacy (WEP)
B. Wi-Fi Protected Access (WPA)
C. Wi-Fi Protected Access 2 (WPA2)
D. Temporal Key Integrity Protocol (TKIP)
A. Wired Equivalent Privacy (WEP)
This kind of password cracking method uses word lists in combination with numbers and special characters: A. Hybrid B. Linear C. Symmetric D. Brute Force
A. Hybrid
Which of the following security policies defines the use of VPN for gaining access to an internal corporate network? A. Network security policy B. Remote access policy C. Information protection policy D. Access control policy
B. Remote access policy
Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion? A. Regulatory compliance B. Peer review C. Change management D. Penetration testing
C. Change management
Within the context of Computer Security, which of the following statements describes Social Engineering best?
A. Social Engineering is the act of publicly disclosing information
B. Social Engineering is the means put in place by human resource to perform time accounting
C. Social Engineering is the act of getting needed information from a person rather than breaking into a system
D. Social Engineering is a training program within sociology studies
C. Social Engineering is the act of getting needed information from a person rather than breaking into a system
What is a successful method for protecting a router from potential smurf attacks?
A. Placing the router in broadcast mode
B. Enabling port forwarding on the router
C. Installing the router outside of the network’s firewall
D. Disabling the router from accepting broadcast ping messages
D. Disabling the router from accepting broadcast ping messages
Attempting an injection attack on a web server based on responses to True/False questions is called which of the following? A. Blind SQLi B. DMS-specific SQLi C. Classic SQLi D. Compound SQLi
A. Blind SQLi
Your company performs penetration tests and security assessments for small and mediumsized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.
What should you do?
A. Immediately stop work and contact the proper legal authorities.
B. Copy the data to removable media and keep it in case you need it.
C. Confront the client in a respectful manner and ask her about the data.
D. Ignore the data and continue the assessment until completed as agreed.
A. Immediately stop work and contact the proper legal authorities.
Which of the following is a serious vulnerability in the popular OpenSSL cryptographic
software library? This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.
A. Heartbleed Bug
B. POODLE
C. SSL/TLS Renegotiation Vulnerability
D. Shellshock
A. Heartbleed Bug
Which of the following is not a Bluetooth attack? A. Bluedriving B. Bluejacking C. Bluesmacking D. Bluesnarfing
A. Bluedriving
Bob learned that his username and password for a popular game has been compromised. He contacts the company and resets all the information. The company suggests he use two-factor authentication, which option below offers that?
A. A new username and password
B. A fingerprint scanner and his username and password.
C. Disable his username and use just a fingerprint scanner.
D. His username and a stronger password.
B. A fingerprint scanner and his username and password.
Which of the following is considered an acceptable option when managing a risk? A. Reject the risk. B. Deny the risk. C. Mitigate the risk. D. Initiate the risk.
C. Mitigate the risk.
Which of the following examples best represents a logical or technical control? A. Security tokens B. Heating and air conditioning C. Smoke and fire alarms D. Corporate security policy
A. Security tokens
A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50
characters. What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?
A. if (billingAddress = 50) {update field} else exit
B. if (billingAddress != 50) {update field} else exit
C. if (billingAddress >= 50) {update field} else exit
D. if (billingAddress <= 50) {update field} else exit
D. if (billingAddress <= 50) {update field} else exit
A distributed port scan operates by:
A. Blocking access to the scanning clients by the targeted host
B. Using denial-of-service software against a range of TCP ports
C. Blocking access to the targeted host by each of the distributed scanning clients
D. Having multiple computers each scan a small number of ports, then correlating the results
D. Having multiple computers each scan a small number of ports, then correlating the results
The network team has well-established procedures to follow for creating new rules on the firewall. This includes having approval from a manager prior to implementing any new rules. While reviewing the firewall configuration, you notice a recently implemented rule but cannot locate manager approval for it. What would be a good step to have in the procedures for a situation like this?
A. Have the network team document the reason why the rule was implemented without prior
manager approval.
B. Monitor all traffic using the firewall rule until a manager can approve it.
C. Do not roll back the firewall rule as the business may be relying upon it but try to get manager approval as soon as possible.
D. Immediately roll back the firewall rule until a manager can approve it
D. Immediately roll back the firewall rule until a manager can approve it
Sam is working as a pen-tester in an organization in Houston. He performs penetration
testing on IDS in order to find the different ways an attacker uses to evade the IDS. Sam sends a large number of packets to the target IDS that generates alerts, which enable Sam to hide the real traffic. What type of method is Sam using to evade IDS?
A. Denial-of-Service
B. False Positive Generation
C. Insertion Attack
D. Obfuscating
B. False Positive Generation
What is the best defense against privilege escalation vulnerability?
A. Patch systems regularly and upgrade interactive login privileges at the system administrator level.
B. Run administrator and applications on least privileges and use a content registry for tracking.
C. Run services with least privileged accounts and implement multi-factor authentication and
authorization.
D. Review user roles and administrator privileges for maximum utilization of automation services.
C. Run services with least privileged accounts and implement multi-factor authentication and
authorization.
A botnet can be managed through which of the following? A. IRC B. E-Mail C. Linkedin and Facebook D. A vulnerable FTP server
A. IRC
Under the “Post-attack Phase and Activities”, it is the responsibility of the tester to restore the systems to a pre-test state.
Which of the following activities should not be included in this phase?
I. Removing all files uploaded on the system
II. Cleaning all registry entries
III. Mapping of network state
IV. Removing all tools and maintaining backdoor for reporting
A. III
B. IV
C. III and IV
D. All should be included.
A. III
III. Mapping of network state
The practical realities facing organizations today make risk response strategies essential.
Which of the following is NOT one of the five basic responses to risk?
A. Accept
B. Mitigate
C. Delegate
D. Avoid
C. Delegate
Internet Protocol Security IPSec is actually a suite of protocols. Each protocol within the suite provides different functionality. Collective IPSec does everything except. A. Protect the payload and the headers B. Authenticate C. Encrypt D. Work at the Data Link Layer
D. Work at the Data Link Layer
A penetration test was done at a company. After the test, a report was written and given to the company’s IT authorities. A section from the report is shown below:
According to the section from the report, which of the following choice is true?
A. MAC Spoof attacks cannot be performed.
B. Possibility of SQL Injection attack is eliminated.
C. A stateful firewall can be used between intranet (LAN) and DMZ.
D. There is access control policy between VLANs.
C. A stateful firewall can be used between intranet (LAN) and DMZ.
You want to analyze packets on your wireless network. Which program would you use? A. Wireshark with Airpcap B. Airsnort with Airpcap C. Wireshark with Winpcap D. Ethereal with Winpcap
A. Wireshark with Airpcap
Bluetooth uses which digital modulation technique to exchange information between paired devices? A. PSK (phase-shift keying) B. FSK (frequency-shift keying) C. ASK (amplitude-shift keying) D. QAM (quadrature amplitude modulation)
A. PSK (phase-shift keying)
Which of these is capable of searching for and locating rogue access points? A. HIDS B. WISS C. WIPS D. NIDS
C. WIPS
Study the snort rule given below and interpret the rule.
alert tcp any any –> 192.168.1.0/24
111 (content:”|00 01 86 a5|”; msG. “mountd access”;)
A. An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111
B. An alert is generated when any packet other than a TCP packet is seen on the network and
destined for the 192.168.1.0 subnet
C. An alert is generated when a TCP packet is originated from port 111 of any IP address to the
192.168.1.0 subnet
D. An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111
D. An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111
Which type of antenna is used in wireless communication? A. Omnidirectional B. Parabolic C. Uni-directional D. Bi-directional
A. Omnidirectional
You are the Network Admin, and you get a compliant that some of the websites are no
longer accessible. You try to ping the servers and find them to be reachable. Then you type the IP address and then you try on the browser, and find it to be accessible. But they are not accessible when you try using the URL.
What may be the problem?
A. Traffic is Blocked on UDP Port 53
B. Traffic is Blocked on UDP Port 80
C. Traffic is Blocked on UDP Port 54
D. Traffic is Blocked on UDP Port 80
A. Traffic is Blocked on UDP Port 53
How is the public key distributed in an orderly, controlled fashion so that the users can be sure of the sender's identity? A. Hash value B. Private key C. Digital signature D. Digital certificate
D. Digital certificate
What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?
A. Copy the system files from a known good system
B. Perform a trap and trace
C. Delete the files and try to determine the source
D. Reload from a previous backup
E. Reload from known good media
E. Reload from known good media
Which of the following is optimized for confidential communications, such as bidirectional voice and video? A. RC4 B. RC5 C. MD4 D. MD5
A. RC4
In the context of Windows Security, what is a ‘null’ user?
A. A user that has no skills
B. An account that has been suspended by the admin
C. A pseudo account that has no username and password
D. A pseudo account that was created for security administration purpose
C. A pseudo account that has no username and password
A hacker is attempting to see which IP addresses are currently active on a network. Which NMAP switch would the hacker use? A. -sO B. -sP C. -sS D. -sU
B. -sP
In Risk Management, how is the term “likelihood” related to the concept of “threat?”
A. Likelihood is the probability that a threat-source will exploit a vulnerability.
B. Likelihood is a possible threat-source that may exploit a vulnerability.
C. Likelihood is the likely source of a threat that could exploit a vulnerability.
D. Likelihood is the probability that a vulnerability is a threat-source.
A. Likelihood is the probability that a threat-source will exploit a vulnerability.
During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?
A. The tester must capture the WPA2 authentication handshake and then crack it.
B. The tester must use the tool inSSIDer to crack it using the ESSID of the network.
C. The tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
D. The tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key.
A. The tester must capture the WPA2 authentication handshake and then crack it.
What is the main disadvantage of the scripting languages as opposed to compiled programming languages?
A. Scripting languages are hard to learn.
B. Scripting languages are not object-oriented.
C. Scripting languages cannot be used to create graphical user interfaces.
D. Scripting languages are slower because they require an interpreter to run the code.
D. Scripting languages are slower because they require an interpreter to run the code.
A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company`s building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area. Which type of attack did the consultant perform? A. Man trap B. Tailgating C. Shoulder surfing D. Social engineering
B. Tailgating
You are about to be hired by a well-known Bank to perform penetration tests. Which of the following documents describes the specifics of the testing, the associated violations, and essentially protects both the bank's interest and your liabilities as a tester? A. Service Level Agreement B. Non-Disclosure Agreement C. Terms of Engagement D. Project Scope
C. Terms of Engagement
A person approaches a network administrator and wants advice on how to send encrypted email from home.
The end user does not want to have to pay for any license fees or manage server services. Which of the following is the most secure encryption protocol that the network administrator should recommend?
A. IP Security (IPSEC)
B. Multipurpose Internet Mail Extensions (MIME)
C. Pretty Good Privacy (PGP)
D. Hyper Text Transfer Protocol with Secure Socket Layer (HTTPS)
C. Pretty Good Privacy (PGP)
