fc_two Flashcards
What is the main difference between a “Normal” SQL Injection and a “Blind” SQL Injection vulnerability?
A. The request to the web server is not visible to the administrator of the vulnerable application.
B. The attack is called “Blind” because, although the application properly filters user input, it is still
vulnerable to code injection.
C. The successful attack does not show an error message to the administrator of the affected application.
D. The vulnerable application does not display errors with information about the injection results to the
attacker.
Answer: D
During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the
following attacks should be used to obtain the key?
A. The tester must capture the WPA2 authentication handshake and then crack it.
B. The tester must use the tool inSSIDer to crack it using the ESSID of the network.
C. The tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
D. The tester must change the MAC address of the wireless network card and then use the AirTraf tool to
obtain the key.
Answer: A
Bluetooth uses which digital modulation technique to exchange information between paired devices? A. PSK (phase-shift keying) B. FSK (frequency-shift keying) C. ASK (amplitude-shift keying) D. QAM (quadrature amplitude modulation)
Answer: A
Which command lets a tester enumerate alive systems in a class C network via ICMP using native
Windows tools?
A. ping 192.168.2.
B. ping 192.168.2.255
C. for %V in (1 1 255) do PING 192.168.2.%V
D. for /L %V in (1 1 254) do PING -n 1 192.168.2.%V | FIND /I “Reply”,”
Answer: D
The use of alert thresholding in an IDS can reduce the volume of repeated alerts, but introduces which of
the following vulnerabilities?
A. An attacker, working slowly enough, can evade detection by the IDS.
B. Network packets are dropped if the volume exceeds the threshold.
C. Thresholding interferes with the IDS’ ability to reassemble fragmented packets.
D. The IDS will not distinguish among packets originating from different sources.
Answer: A
Which of the following open source tools would be the best choice to scan a network for potential targets? A. NMAP B. NIKTO C. CAIN D. John the Ripper
Answer: A
An attacker uses a communication channel within an operating system that is neither designed nor
intended to transfer information. What is the name of the communications channel?
A. Classified
B. Overt
C. Encrypted
D. Covert
Answer: D
What is the name of the international standard that establishes a baseline level of confidence in the security
functionality of IT products by providing a set of requirements for evaluation?
A. Blue Book
B. ISO 26029
C. Common Criteria
D. The Wassenaar Agreement
Answer: C
A penetration tester is attempting to scan an internal corporate network from the internet without alerting
the border sensor. Which is the most efficient technique should the tester consider using?
A. Spoofing an IP address
B. Tunneling scan over SSH
C. Tunneling over high port numbers
D. Scanning using fragmented IP packets
Answer: B
A pentester gains access to a Windows application server and needs to determine the settings of the
built-in Windows firewall. Which command would be used?
A. Netsh firewall show config
B. WMIC firewall show config
C. Net firewall show config
D. Ipconfig firewall show config
Answer: A
Which tool is used to automate SQL injections and exploit a database by forcing a given web application to
connect to another database controlled by a hacker?
A. DataThief
B. NetCat
C. Cain and Abel
D. SQLInjector
Answer: A
Which statement is TRUE regarding network firewalls preventing Web Application attacks?
A. Network firewalls can prevent attacks because they can detect malicious HTTP traffic.
B. Network firewalls cannot prevent attacks because ports 80 and 443 must be opened.
C. Network firewalls can prevent attacks if they are properly configured.
D. Network firewalls cannot prevent attacks because they are too complex to configure.
Answer: B
A pentester is using Metasploit to exploit an FTP server and pivot to a LAN. How will the pentester pivot
using Metasploit?
A. Issue the pivot exploit and set the meterpreter.
B. Reconfigure the network settings in the meterpreter.
C. Set the payload to propagate through the meterpreter.
D. Create a route statement in the meterpreter.
Answer: D
A covert channel is a channel that
A. transfers information over, within a computer system, or network that is outside of the security policy.
B. transfers information over, within a computer system, or network that is within the security policy.
C. transfers information via a communication path within a computer system, or network for transfer of data.
D. transfers information over, within a computer system, or network that is encrypted.
Answer: A
Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them? A. Detective B. Passive C. Intuitive D. Reactive
Answer: B
Smart cards use which protocol to transfer the certificate in a secure manner?
A. Extensible Authentication Protocol (EAP)
B. Point to Point Protocol (PPP)
C. Point to Point Tunneling Protocol (PPTP)
D. Layer 2 Tunneling Protocol (L2TP)
Answer: A
A bank stores and processes sensitive privacy information related to home loans. However, auditing has
never been enabled on the system. What is the first step that the bank should take before enabling the audit
feature?
A. Perform a vulnerability scan of the system.
B. Determine the impact of enabling the audit feature.
C. Perform a cost/benefit analysis of the audit feature.
D. Allocate funds for staffing of audit log review.
Answer: B
The following is a sample of output from a penetration tester’s machine targeting a machine with the IP
address of 192.168.1.106:
What is most likely taking place?
A. Ping sweep of the 192.168.1.106 network
B. Remote service brute force attempt
C. Port scan of 192.168.1.106
D. Denial of service attack on 192.168.1.106
Answer: B
What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?
A. tcp.src == 25 and ip.host == 192.168.0.125
B. host 192.168.0.125:25
C. port 25 and host 192.168.0.125
D. tcp.port == 25 and ip.host == 192.168.0.125
Answer: D
Which NMAP command combination would let a tester scan every TCP port from a class C network that is
blocking ICMP with fingerprinting and service detection?
A. NMAP -PN -A -O -sS 192.168.2.0/24
B. NMAP -P0 -A -O -p1-65535 192.168.0/24
C. NMAP -P0 -A -sT -p0-65535 192.168.0/16
D. NMAP -PN -O -sS -p 1-1024 192.168.0/8
Answer: B
What results will the following command yield: ‘NMAP -sS -O -p 123-153 192.168.100.3’?
A. A stealth scan, opening port 123 and 153
B. A stealth scan, checking open ports 123 to 153
C. A stealth scan, checking all open ports excluding ports 123 to 153
D. A stealth scan, determine operating system, and scanning ports 123 to 153
Answer: D
Which of the following scanning tools is specifically designed to find potential exploits in Microsoft Windows products? A. Microsoft Security Baseline Analyzer B. Retina C. Core Impact D. Microsoft Baseline Security Analyzer
Answer: D
Which of the following processes of PKI (Public Key Infrastructure) ensures that a trust relationship exists
and that a certificate is still valid for specific operations?
A. Certificate issuance
B. Certificate validation
C. Certificate cryptography
D. Certificate revocation
Answer: B
Which of the following is a common Service Oriented Architecture (SOA) vulnerability? A. Cross-site scripting B. SQL injection C. VPath injection D. XML denial of service issues
Answer: D
Which of the following levels of algorithms does Public Key Infrastructure (PKI) use? A. RSA 1024 bit strength B. AES 1024 bit strength C. RSA 512 bit strength D. AES 512 bit strength
Answer: A
An attacker sniffs encrypted traffic from the network and is subsequently able to decrypt it. The attacker can
now use which cryptanalytic technique to attempt to discover the encryption key?
A. Birthday attack
B. Plaintext attack
C. Meet in the middle attack
D. Chosen ciphertext attack
Answer: D
Employees in a company are no longer able to access Internet web sites on their computers. The network
administrator is able to successfully ping IP address of web servers on the Internet and is able to open web
sites by using an IP address in place of the URL. The administrator runs the nslookup command for
www.eccouncil.org and receives an error message stating there is no response from the server. What
should the administrator do next?
A. Configure the firewall to allow traffic on TCP ports 53 and UDP port 53.
B. Configure the firewall to allow traffic on TCP ports 80 and UDP port 443.
C. Configure the firewall to allow traffic on TCP port 53.
D. Configure the firewall to allow traffic on TCP port 8080.
Answer: A
Which of the following network attacks relies on sending an abnormally large packet size that exceeds TCP/IP specifications? A. Ping of death B. SYN flooding C. TCP hijacking D. Smurf attack
Answer: A
Which of the following tools would be the best choice for achieving compliance with PCI Requirement 11? A. Truecrypt B. Sub7 C. Nessus D. Clamwin
Answer: C
While testing the company’s web applications, a tester attempts to insert the following test script into the
search area on the company’s web site:
alert(“ Testing Testing Testing “)
Afterwards, when the tester presses the search button, a pop-up box appears on the screen with the text:
“Testing Testing Testing”. Which vulnerability has been detected in the web application?
A. Buffer overflow
B. Cross-site request forgery
C. Distributed denial of service
D. Cross-site scripting
Answer: D
The fundamental difference between symmetric and asymmetric key cryptographic systems is that
symmetric key cryptography uses which of the following?
A. Multiple keys for non-repudiation of bulk data
B. Different keys on both ends of the transport medium
C. Bulk encryption for data transmission over fiber
D. The same key on each end of the transmission medium
Answer: D
In the OSI model, where does PPTP encryption take place? A. Transport layer B. Application layer C. Data link layer D. Network layer
Answer: C
Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by
the network’s IDS?
A. Timing options to slow the speed that the port scan is conducted
B. Fingerprinting to identify which operating systems are running on the network
C. ICMP ping sweep to determine which hosts on the network are not available
D. Traceroute to control the path of the packets sent during the scan
Answer: A
Which of the following can take an arbitrary length of input and produce a message digest output of 160 bit? A. SHA-1 B. MD5 C. HAVAL D. MD4
Answer: A
What is the primary drawback to using advanced encryption standard (AES) algorithm with a 256 bit key to
share sensitive data?
A. Due to the key size, the time it will take to encrypt and decrypt the message hinders efficient
communication.
B. To get messaging programs to function with this algorithm requires complex configurations.
C. It has been proven to be a weak cipher; therefore, should not be trusted to protect sensitive data.
D. It is a symmetric key algorithm, meaning each recipient must receive the key through a different channel
than the message.
Answer: D
Which of the following network attacks takes advantage of weaknesses in the fragment reassembly
functionality of the TCP/IP protocol stack?
A. Teardrop
B. SYN flood
C. Smurf attack
D. Ping of death
Answer: A
A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company
almost two months ago, but has yet to get paid. The customer is suffering from financial problems, and the
CEH is worried that the company will go out of business and end up not paying. What actions should the
CEH take?
A. Threaten to publish the penetration test results if not paid.
B. Follow proper legal procedures against the company to request payment.
C. Tell other customers of the financial problems with payments from this company.
D. Exploit some of the vulnerabilities found on the company webserver to deface it.
Answer: B
International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by
outlining
A. guidelines and practices for security controls.
B. financial soundness and business viability metrics.
C. standard best practice for configuration management.
D. contract agreement writing standards.
Answer: A
Which of the following describes a component of Public Key Infrastructure (PKI) where a copy of a private
key is stored to provide third-party access and to facilitate recovery operations?
A. Key registry
B. Recovery agent
C. Directory
D. Key escrow
Answer: D
How can a policy help improve an employee’s security awareness?
A. By implementing written security procedures, enabling employee security training, and promoting the
benefits of security
B. By using informal networks of communication, establishing secret passing procedures, and immediately
terminating employees
C. By sharing security secrets with employees, enabling employees to share secrets, and establishing a
consultative help line
D. By decreasing an employee’s vacation time, addressing ad-hoc employment clauses, and ensuring that
managers know employee strengths
Answer: A
If a tester is attempting to ping a target that exists but receives no response or a response that states the
destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option
could the tester use to get a response from a host using TCP?
A. Hping
B. Traceroute
C. TCP ping
D. Broadcast ping
Answer: A
What are the three types of compliance that the Open Source Security Testing Methodology Manual
(OSSTMM) recognizes?
A. Legal, performance, audit
B. Audit, standards based, regulatory
C. Contractual, regulatory, industry
D. Legislative, contractual, standards based
Answer: D
An attacker has captured a target file that is encrypted with public key cryptography. Which of the attacks
below is likely to be used to crack the target file?
A. Timing attack
B. Replay attack
C. Memory trade-off attack
D. Chosen plain-text attack
Answer: D
When setting up a wireless network, an administrator enters a pre-shared key for security. Which of the
following is true?
A. The key entered is a symmetric key used to encrypt the wireless data.
B. The key entered is a hash that is used to prove the integrity of the wireless data.
C. The key entered is based on the Diffie-Hellman method.
D. The key is an RSA key used to encrypt the wireless data.
Answer: A
Which statement best describes a server type under an N-tier architecture?
A. A group of servers at a specific layer
B. A single server with a specific role
C. A group of servers with a unique role
D. A single server at a specific layer
Answer: C
SOAP services use which technology to format information? A. SATA B. PCI C. XML D. ISDN
Answer: C
A network security administrator is worried about potential man-in-the-middle attacks when users access a
corporate web site from their workstations. Which of the following is the best remediation against this type
of attack?
A. Implementing server-side PKI certificates for all connections
B. Mandating only client-side PKI certificates for all connections
C. Requiring client and server PKI certificates for all connections
D. Requiring strong authentication for all DNS queries
Answer: C
When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open
Source Security Testing Methodology Manual (OSSTMM) the main difference is
A. OWASP is for web applications and OSSTMM does not include web applications.
B. OSSTMM is gray box testing and OWASP is black box testing.
C. OWASP addresses controls and OSSTMM does not.
D. OSSTMM addresses controls and OWASP does not.
Answer: D
Which element of Public Key Infrastructure (PKI) verifies the applicant? A. Certificate authority B. Validation authority C. Registration authority D. Verification authority
Answer: C
A technician is resolving an issue where a computer is unable to connect to the Internet using a wireless
access point. The computer is able to transfer files locally to other machines, but cannot successfully reach
the Internet. When the technician examines the IP address and default gateway they are both on the
192.168.1.0/24. Which of the following has occurred?
A. The gateway is not routing to a public IP address.
B. The computer is using an invalid IP address.
C. The gateway and the computer are not on the same network.
D. The computer is not using a private IP address.
Answer: A
Which cipher encrypts the plain text digit (bit or byte) one by one? A. Classical cipher B. Block cipher C. Modern cipher D. Stream cipher
Answer: D
Which security strategy requires using several, varying methods to protect IT systems against attacks? A. Defense in depth B. Three-way handshake C. Covert channels D. Exponential backoff algorithm
Answer: A
Advanced encryption standard is an algorithm used for which of the following? A. Data integrity B. Key discovery C. Bulk data encryption D. Key recovery
Answer: C
Which type of security document is written with specific step-by-step details? A. Process B. Procedure C. Policy D. Paradigm
Answer: B
Which initial procedure should an ethical hacker perform after being brought into an organization?
A. Begin security testing.
B. Turn over deliverables.
C. Sign a formal contract with non-disclosure.
D. Assess what the organization is trying to protect.
Answer: C
Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?
A. Incident response services to any user, company, government agency, or organization in partnership
with the Department of Homeland Security
B. Maintenance of the nation’s Internet infrastructure, builds out new Internet infrastructure, and
decommissions old Internet infrastructure
C. Registration of critical penetration testing for the Department of Homeland Security and public and
private sectors
D. Measurement of key vulnerability assessments on behalf of the Department of Defense (DOD) and State
Department, as well as private sectors
Answer: A
When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform
external and internal penetration testing?
A. At least once a year and after any significant upgrade or modification
B. At least once every three years or after any significant upgrade or modification
C. At least twice a year or after any significant upgrade or modification
D. At least once every two years and after any significant upgrade or modification
Answer: A
A computer technician is using a new version of a word processing software package when it is discovered
that a special sequence of characters causes the entire computer to crash. The technician researches the
bug and discovers that no one else experienced the problem. What is the appropriate next step?
A. Ignore the problem completely and let someone else deal with it.
B. Create a document that will crash the computer when opened and send it to friends.
C. Find an underground bulletin board and attempt to sell the bug to the highest bidder.
D. Notify the vendor of the bug and do not disclose it until the vendor gets a chance to issue a fix.
Answer: D
Which of the following is an example of IP spoofing? A. SQL injections B. Man-in-the-middle C. Cross-site scripting D. ARP poisoning
Answer: B
Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion? A. Regulatory compliance B. Peer review C. Change management D. Penetration testing
Answer: C
The Open Web Application Security Project (OWASP) testing methodology addresses the need to secure
web applications by providing which one of the following services?
A. An extensible security framework named COBIT
B. A list of flaws and how to fix them
C. Web application patches
D. A security certification for hardened web applications
Answer: B
Which of the following is an advantage of utilizing security testing methodologies to conduct a security
audit?
A. They provide a repeatable framework.
B. Anyone can run the command line scripts.
C. They are available at low cost.
D. They are subject to government regulation.
Answer: A
Which of the following is a primary service of the U.S. Computer Security Incident Response Team
(CSIRT)?
A. CSIRT provides an incident response service to enable a reliable and trusted single point of contact for
reporting computer security incidents worldwide.
B. CSIRT provides a computer security surveillance service to supply a government with important
intelligence information on individuals travelling abroad.
C. CSIRT provides a penetration testing service to support exception reporting on incidents worldwide by
individuals and multi-national corporations.
D. CSIRT provides a vulnerability assessment service to assist law enforcement agencies with profiling an
individual’s property or company’s asset.
Answer: A
For messages sent through an insecure channel, a properly implemented digital signature gives the
receiver reason to believe the message was sent by the claimed sender. While using a digital signature, the
message digest is encrypted with which key?
A. Sender’s public key
B. Receiver’s private key
C. Receiver’s public key
D. Sender’s private key
Answer: D
Which of the following descriptions is true about a static NAT?
A. A static NAT uses a many-to-many mapping.
B. A static NAT uses a one-to-many mapping.
C. A static NAT uses a many-to-one mapping.
D. A static NAT uses a one-to-one mapping.
Answer: D
An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk
assessments. A friend recently started a company and asks the hacker to perform a penetration test and
vulnerability assessment of the new company as a favor. What should the hacker’s next step be before
starting work on this job?
A. Start by foot printing the network and mapping out a plan of attack.
B. Ask the employer for authorization to perform the work outside the company.
C. Begin the reconnaissance phase with passive information gathering and then move into active
information gathering.
D. Use social engineering techniques on the friend’s employees to help identify areas that may be
susceptible to attack.
Answer: B
Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial
Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?
A. Sarbanes-Oxley Act (SOX)
B. Gramm-Leach-Bliley Act (GLBA)
C. Fair and Accurate Credit Transactions Act (FACTA)
D. Federal Information Security Management Act (FISMA)
Answer: A
If an e-commerce site was put into a live environment and the programmers failed to remove the secret
entry point that was used during the application development, what is this secret entry point known as?
A. SDLC process
B. Honey pot
C. SQL injection
D. Trap door
Answer: D
Which of the following items is unique to the N-tier architecture method of designing software applications?
A. Application layers can be separated, allowing each layer to be upgraded independently from other
layers.
B. It is compatible with various databases including Access, Oracle, and SQL.
C. Data security is tied into each layer and must be updated for all layers when any upgrade is performed.
D. Application layers can be written in C, ASP.NET, or Delphi without any performance loss.
Answer: A
The intrusion detection system at a software development company suddenly generates multiple alerts
regarding attacks against the company’s external webserver, VPN concentrator, and DNS servers. What
should the security team do to determine which alerts to check first?
A. Investigate based on the maintenance schedule of the affected systems.
B. Investigate based on the service level agreements of the systems.
C. Investigate based on the potential effect of the incident.
D. Investigate based on the order that the alerts arrived in.
Answer: C
A certified ethical hacker (CEH) is approached by a friend who believes her husband is cheating. She offers
to pay to break into her husband’s email account in order to find proof so she can take him to court. What is
the ethical response?
A. Say no; the friend is not the owner of the account.
B. Say yes; the friend needs help to gather evidence.
C. Say yes; do the job for free.
D. Say no; make sure that the friend knows the risk she’s asking the CEH to take.
Answer: A
To reduce the attack surface of a system, administrators should perform which of the following processes to
remove unnecessary software, services, and insecure configuration settings?
A. Harvesting
B. Windowing
C. Hardening
D. Stealthing
Answer: C
Which of the following is optimized for confidential communications, such as bidirectional voice and video?
A. RC4
B. RC5
C. MD4
D. MD5
Answer: A
Which of the following defines the role of a root Certificate Authority (CA) in a Public Key Infrastructure
(PKI)?
A. The root CA is the recovery agent used to encrypt data when a user’s certificate is lost.
B. The root CA stores the user’s hash value for safekeeping.
C. The CA is the trusted root that issues certificates.
D. The root CA is used to encrypt email messages to prevent unintended disclosure of data.
Answer: C
Which of the following algorithms provides better protection against brute force attacks by using a 160-bit message digest? A. MD5 B. SHA-1 C. RC4 D. MD4
Answer: B
An IT security engineer notices that the company’s web server is currently being hacked. What should the
engineer do next?
A. Unplug the network connection on the company’s web server.
B. Determine the origin of the attack and launch a counterattack.
C. Record as much information as possible from the attack.
D. Perform a system restart on the company’s web server.
Answer: C
How do employers protect assets with security policies pertaining to employee surveillance activities?
A. Employers promote monitoring activities of employees as long as the employees demonstrate
trustworthiness.
B. Employers use informal verbal communication channels to explain employee monitoring activities to
employees.
C. Employers use network surveillance to monitor employee email traffic, network access, and to record
employee keystrokes.
D. Employers provide employees written statements that clearly discuss the boundaries of monitoring
activities and consequences.
Answer: D
Company A and Company B have just merged and each has its own Public Key Infrastructure (PKI). What
must the Certificate Authorities (CAs) establish so that the private PKIs for Company A and Company B
trust one another and each private PKI can validate digital certificates from the other company?
A. Poly key exchange
B. Cross certification
C. Poly key reference
D. Cross-site exchange
Answer: B
Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an
appropriate method?
A. It is impossible to crack hashed user passwords unless the key used to encrypt them is obtained.
B. If a user forgets the password, it can be easily retrieved using the hash key stored by administrators.
C. Hashing is faster compared to more traditional encryption algorithms.
D. Passwords stored using hashes are non-reversible, making finding the password much more difficult.
Answer: D
A Certificate Authority (CA) generates a key pair that will be used for encryption and decryption of email.
The integrity of the encrypted email is dependent on the security of which of the following?
A. Public key
B. Private key
C. Modulus length
D. Email server certificate
Answer: B
Which of the following guidelines or standards is associated with the credit card industry?
A. Control Objectives for Information and Related Technology (COBIT)
B. Sarbanes-Oxley Act (SOX)
C. Health Insurance Portability and Accountability Act (HIPAA)
D. Payment Card Industry Data Security Standards (PCI DSS)
Answer: D
A consultant has been hired by the V.P. of a large financial organization to assess the company’s security
posture. During the security testing, the consultant comes across child pornography on the V.P.’s computer.
What is the consultant’s obligation to the financial organization?
A. Say nothing and continue with the security testing.
B. Stop work immediately and contact the authorities.
C. Delete the pornography, say nothing, and continue security testing.
D. Bring the discovery to the financial organization’s human resource department.
Answer: B
Which method can provide a better return on IT security investment and provide a thorough and
comprehensive assessment of organizational security covering policy, procedure design, and
implementation?
A. Penetration testing
B. Social engineering
C. Vulnerability scanning
D. Access control list reviews
Answer: A
Which Open Web Application Security Project (OWASP) implements a web application full of known vulnerabilities? A. WebBugs B. WebGoat C. VULN_HTML D. WebScarab
Answer: B
Which of the following is a characteristic of Public Key Infrastructure (PKI)?
A. Public-key cryptosystems are faster than symmetric-key cryptosystems.
B. Public-key cryptosystems distribute public-keys within digital signatures.
C. Public-key cryptosystems do not require a secure key distribution channel.
D. Public-key cryptosystems do not provide technical non-repudiation via digital signatures.
Answer: B
You are performing a penetration test. You achieved access via a buffer overflow exploit and you proceed
to find interesting data, such as files with usernames and passwords. You find a hidden folder that has the
administrator’s bank account password and login information for the administrator’s bitcoin account.
What should you do?
A. Report immediately to the administrator
B. Do not report it and continue the penetration test.
C. Transfer money from the administrator’s account to another account.
D. Do not transfer the money but steal the bitcoins.
Answer: A
Which of the following is an extremely common IDS evasion technique in the web world? A. unicode characters B. spyware C. port knocking D. subnetting
Answer: A
You are logged in as a local admin on a Windows 7 system and you need to launch the Computer Management Console from command line. Which command would you use? A. c:\compmgmt.msc B. c:\services.msc C. c:\ncpa.cp D. c:\gpedit
Answer: A
Your team has won a contract to infiltrate an organization. The company wants to have the attack be as
realistic as possible; therefore, they did not provide any information besides the company name.
What should be the first step in security testing the client?
A. Reconnaissance
B. Enumeration
C. Scanning
D. Escalation
Answer: A
Which of the following is the BEST way to defend against network sniffing?
A. Using encryption protocols to secure network communications
B. Register all machines MAC Address in a Centralized Database
C. Restrict Physical Access to Server Rooms hosting Critical Servers
D. Use Static IP Address
Answer: A
When you are testing a web application, it is very useful to employ a proxy tool to save every request and
response. You can manually test every request and analyze the response to find vulnerabilities. You can
test parameter and headers manually to get more precise results than if using web vulnerability scanners.
What proxy tool will help you find web vulnerabilities?
A. Burpsuite
B. Maskgen
C. Dimitry
D. Proxychains
Answer: A
Which of the following is the least-likely physical characteristic to be used in biometric control that supports a large company? A. Height and Weight B. Voice C. Fingerprints D. Iris patterns
Answer: A
An attacker changes the profile information of a particular user (victim) on the target website. The attacker
uses this string to update the victim’s profile to a text file and then submit the data to the attacker’s
database.
What is this type of attack (that can use either HTTP GET or HTTP POST) called? A. Cross-Site Request Forgery B. Cross-Site Scripting C. SQL Injection D. Browser Hacking
Answer: A
