Hustle 2 Flashcards by Sid Omar

Bob, a network administrator at BigUniversity, realized that some students are connecting their notebooks in the wired network to have Internet access. In the university campus, there are many Ethernet ports
available for professors and authorized visitors but not for students.
He identified this when the IDS alerted for malware activities in the network. What should Bob do to avoid this problem?
A. Disable unused ports in the switches
B. Separate students in a different VLAN
C. Use the 802.1x protocol
D. Ask students to use the wireless network

C. Use the 802.1x protocol

How well did you know this?

Not at all

Perfectly

A company’s policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols because the
employees do not like changes.
You have positioned a network sniffer to capture traffic from the laptops used by employees in the data ingest department. Using Wireshark to examine the captured traffic, which command can be used as display
filter to find unencrypted file transfers?
A. tcp.port = = 21
B. tcp.port = 23
C. tcp.port = = 21 | | tcp.port = =22
D. tcp.port ! = 21

A. tcp.port = = 21

How well did you know this?

Not at all

Perfectly

You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any -> 192.168.100.0/24 21 (msg: ““FTP
on the network!””;)
A. A firewall IPTable
B. FTP Server rule
C. A Router IPTable
D. An Intrusion Detection System

D. An Intrusion Detection System

How well did you know this?

Not at all

Perfectly

Which of the following program infects the system boot sector and the executable files at the same time?
A. Polymorphic virus
B. Stealth virus
C. Multipartite Virus
D. Macro virus

C. Multipartite Virus

How well did you know this?

Not at all

Perfectly

To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program.
What term is commonly used when referring to this type of testing?
A. Randomizing
B. Bounding
C. Mutating
D. Fuzzing

D. Fuzzing

How well did you know this?

Not at all

Perfectly

An Intrusion Detection System (IDS) has alerted the network administrator to a possibly malicious sequence of packets sent to a Web server in the network’s external DMZ. The packet traffic was captured by the IDS
and saved to a PCAP file. What type of network tool can be used to determine if these packets are genuinely malicious or simply a false positive?
A. Protocol analyzer
B. Network sniffer
C. Intrusion Prevention System (IPS)
D. Vulnerability scanner

A. Protocol analyzer

How well did you know this?

Not at all

Perfectly

The Heartbleed bug was discovered in 2014 and is widely referred to under MITRE’s Common Vulnerabilities and Exposures (CVE) as CVE-2014-0160. This bug affects the OpenSSL implementation of the Transport
Layer Security (TLS) protocols defined in RFC6520.
What type of key does this bug leave exposed to the Internet making exploitation of any compromised system very easy?
A. Public
B. Private
C. Shared
D. Root

B. Private

How well did you know this?

Not at all

Perfectly

Why should the security analyst disable/remove unnecessary ISAPI filters?
A. To defend against social engineering attacks
B. To defend against webserver attacks
C. To defend against jailbreaking
D. To defend against wireless attacks

B. To defend against webserver attacks

How well did you know this?

Not at all

Perfectly

Which of the following is a component of a risk assessment?
A. Administrative safeguards
B. Physical security
C. DMZ
D. Logical interface

A. Administrative safeguards

How well did you know this?

Not at all

Perfectly

CompanyXYZ has asked you to assess the security of their perimeter email gateway. From your office in New York, you craft a specially formatted email message and send it across the Internet to an employee of
CompanyXYZ. The employee of CompanyXYZ is aware of your test. Your email message looks like this:
From: jim_miller@companyxyz.com
To: michelle_saunders@companyxyz.com Subject: Test message
Date: 4/3/2017 14:37
The employee of CompanyXYZ receives your email message.
This proves that CompanyXYZ’s email gateway doesn’t prevent what?
A. Email Masquerading
B. Email Harvesting
C. Email Phishing
D. Email Spoofing

D. Email Spoofing

How well did you know this?

Not at all

Perfectly

Bob, a system administrator at TPNQM SA, concluded one day that a DMZ is not needed if he properly configures the firewall to allow access just to servers/ports, which can have direct internet access, and block the access to workstations.Bob also concluded that DMZ makes sense just when a stateful firewall is available, which is not the case of TPNQM SA.
In this context, what can you say?
A. Bob can be right since DMZ does not make sense when combined with stateless firewalls
B. Bob is partially right. He does not need to separate networks if he can create rules by destination IPs, one by one
C. Bob is totally wrong. DMZ is always relevant when the company has internet servers and workstations
D. Bob is partially right. DMZ does not make sense when a stateless firewall is available

C. Bob is totally wrong. DMZ is always relevant when the company has internet servers and workstations

How well did you know this?

Not at all

Perfectly

Bob is acknowledged as a hacker of repute and is popular among visitors of “underground” sites.
Bob is willing to share his knowledge with those who are willing to learn, and many have expressed their interest in learning from him. However, this knowledge has a risk associated with it, as it can be used for
malevolent attacks as well.
In this context, what would be the most effective method to bridge the knowledge gap between the “black” hats or crackers and the “white” hats or computer security professionals? (Choose the test answer.)
A. Educate everyone with books, articles and training on risk analysis, vulnerabilities and safeguards.
B. Hire more computer security monitoring personnel to monitor computer systems and networks.
C. Make obtaining either a computer security certification or accreditation easier to achieve so more individuals feel that they are a part of something larger than life.
D. Train more National Guard and reservist in the art of computer security to help out in times of emergency or crises.

A. Educate everyone with books, articles and training on risk analysis, vulnerabilities and safeguards.

How well did you know this?

Not at all

Perfectly

Peter extracts the SIDs lists from Windows 2000 Server machine using the hacking tool “SIDExtractor”
s-1-5-21-1125394485-807628933-54978560-100Johns
s-1-5-21-1125394485-807628933-54978560-652Rebecca
s-1-5-21-1125394485-807628933-54978560-412Sheela
s-1-5-21-1125394485-807628933-54978560-999Shawn
s-1-5-21-1125394485-807628933-54978560-777Somia
s-1-5-21-1125394485-807628933-54978560-500chang
s-1-5-21-1125394485-807628933-54978560-555Micah
Here is the output of the SIDs:
From the above list identify the user account with System Administrator privileges.
A. John
B. Rebecca
C. Sheela
D. Shawn
E. Somia
F. Chang
G. Micah

F. Chang

How well did you know this?

Not at all

Perfectly

Which address translation scheme would allow a single public IP address to always correspond to a single machine on an internal network, allowing “server publishing”?
A. Overloading Port Address Translation
B. Dynamic Port Address Translation
C. Dynamic Network Address Translation
D. Static Network Address Translation

D. Static Network Address Translation

How well did you know this?

Not at all

Perfectly

What is the following command used for? net use \targetipc$ “” /u:””
A. Grabbing the etc/passwd file
B. Grabbing the SAM
C. Connecting to a Linux computer through Samba.
D. This command is used to connect as a null session
E. Enumeration of Cisco routers

D. This command is used to connect as a null session

How well did you know this?

Not at all

Perfectly

What is the proper response for a NULL scan if the port is closed?
A. SYN
B. ACK
C. FIN
D. PSH
E. RST
F. No response

E. RST

How well did you know this?

Not at all

Perfectly

One of your team members has asked you to analyze the following SOA record.
What is the TTL? Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.)
A. 200303028
B. 3600
C. 604800
D. 2400
E. 60
F. 4800

D. 2400

How well did you know this?

Not at all

Perfectly

One of your team members has asked you to analyze the following SOA record. What is the version? Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.) (Choose four.)
A. 200303028
B. 3600
C. 604800
D. 2400
E. 60
F. 4800

A. 200303028

How well did you know this?

Not at all

Perfectly

MX record priority increases as the number increases. (True/False.)
A. True
B. False

B. False

How well did you know this?

Not at all

Perfectly

Which of the following tools can be used to perform a zone transfer?
A. NSLookup
B. Finger
C. Dig
D. Sam Spade
E. Host
F. Netcat
G. Neotrace

A. NSLookup
C. Dig
D. Sam Spade
E. Host

How well did you know this?

Not at all

Perfectly

Under what conditions does a secondary name server request a zone transfer from a primary name server?
A. When a primary SOA is higher that a secondary SOA
B. When a secondary SOA is higher that a primary SOA
C. When a primary name server has had its service restarted
D. When a secondary name server has had its service restarted
E. When the TTL falls to zero

A. When a primary SOA is higher that a secondary SOA

How well did you know this?

Not at all

Perfectly

What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?
A. 110
B. 135
C. 139
D. 161
E. 445
F. 1024

B. 135
C. 139
E. 445

How well did you know this?

Not at all

Perfectly

What is a NULL scan?
A. A scan in which all flags are turned off
B. A scan in which certain flags are off
C. A scan in which all flags are on
D. A scan in which the packet size is set to zero
E. A scan with an illegal packet size

A. A scan in which all flags are turned off

How well did you know this?

Not at all

Perfectly

What is the proper response for a NULL scan if the port is open?
A. SYN
B. ACK
C. FIN
D. PSH
E. RST
F. No response

F. No response

How well did you know this?

Not at all

Perfectly

Which of the following statements about a zone transfer is correct? (Choose three.) A. A zone transfer is accomplished with the DNS B. A zone transfer is accomplished with the nslookup service C. A zone transfer passes all zone information that a DNS server maintains D. A zone transfer passes all zone information that a nslookup server maintains E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections F. Zone transfers cannot occur on the Internet

A. A zone transfer is accomplished with the DNS C. A zone transfer passes all zone information that a DNS server maintains E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections

You have the SOA presented below in your Zone. Your secondary servers have not been able to contact your primary server to synchronize information. How long will the secondary servers attempt to contact the primary server before it considers that zone is dead and stops responding to queries? collegae.edu.SOA, cikkye.edu ipad.college.edu. (200302028 3600 3600 604800 3600) A. One day B. One hour C. One week D. One month

C. One week

Tess King is using the nslookup command to craft queries to list all DNS information (such as Name Servers, host names, MX records, CNAME records, glue records (delegation for child Domains), zone serial number, TimeToLive (TTL) records, etc) for a Domain. What do you think Tess King is trying to accomplish? Select the best answer. A. A zone harvesting B. A zone transfer C. A zone update D. A zone estimate

B. A zone transfer

A zone file consists of which of the following Resource Records (RRs)? A. DNS, NS, AXFR, and MX records B. DNS, NS, PTR, and MX records C. SOA, NS, AXFR, and MX records D. SOA, NS, A, and MX records

D. SOA, NS, A, and MX records

Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B. How do you prevent DNS spoofing? A. Install DNS logger and track vulnerable packets B. Disable DNS timeouts C. Install DNS Anti-spoofing D. Disable DNS Zone Transfer

C. Install DNS Anti-spoofing

Which DNS resource record can indicate how long any "DNS poisoning" could last? A. MX B. SOA C. NS D. TIMEOUT

B. SOA

Joseph was the Web site administrator for the Mason Insurance in New York, who's main Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to administer the Web site. One night, Joseph received an urgent phone call from his friend, Smith. According to Smith, the main Mason Insurance web site had been vandalized! All of its normal content was removed and replaced with an attacker's message ''Hacker Message: You are dead! Freaks!" From his office, which was directly connected to Mason Insurance's internal network, Joseph surfed to the Web site using his laptop. In his browser, the Web site looked completely intact. No changes were apparent. Joseph called a friend of his at his home to help troubleshoot the problem. The Web site appeared defaced when his friend visited using his DSL connection. So, while Smith and his friend could see the defaced page, Joseph saw the intact Mason Insurance web site. To help make sense of this problem, Joseph decided to access the Web site using hisdial-up ISP. He disconnected his laptop from the corporate internal network and used his modem to dial up the same ISP used by Smith. After his modem connected, he quickly typed www.masonins.com in his browser to reveal the following web page: **H@cker Mess@ge: Y0u @re De@d! Fre@ks!** After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal network, and used Secure Shell (SSH) to log in directly to the Web server. He ran Tripwire against the entire Web site, and determined that every system file and all the Web content on the server were intact. How did the attacker accomplish this hack? A. ARP spoofing B. SQL injection C. DNS poisoning D. Routing table injection

C. DNS poisoning

Which of the following tools are used for enumeration? (Choose three.) A. SolarWinds B. USER2SID C. Cheops D. SID2USER E. DumpSec

B. USER2SID D. SID2USER E. DumpSec

What did the following commands determine? **C: user2sid \earth guest s-1-5-21-343818398-789336058-1343024091-501 C: sid2user 5 21 343818398 789336058 1343024091 500 Name is Joe Domain is EARTH** A. That the Joe account has a SID of 500 B. These commands demonstrate that the guest account has NOT been disabled C. These commands demonstrate that the guest account has been disabled D. That the true administrator is Joe E. Issued alone, these commands prove nothing

D. That the true administrator is Joe

Which definition among those given below best describes a covert channel? A. A server program using a port that is not well known. B. Making use of a protocol in a way it is not intended to be used. C. It is the multiplexing taking place on a communication link. D. It is one of the weak channels used by WEP which makes it insecure

B. Making use of a protocol in a way it is not intended to be used.

Susan has attached to her company's network. She has managed to synchronize her boss's sessions with that of the file server. She then intercepted his traffic destined for the server, changed it the way she wanted to and then placed it on the server in his home directory. What kind of attack is Susan carrying on? A. A sniffing attack B. A spoofing attack C. A man in the middle attack D. A denial of service attack

C. A man in the middle attack

Eric has discovered a fantastic package of tools named Dsniff on the Internet. He has learnt to use these tools in his lab and is now ready for real world exploitation. He was able to effectively intercept communications between the two entities and establish credentials with both sides of the connections. The two remote ends of the communication never notice that Eric is relaying the information between the two. What would you call this attack? A. Interceptor B. Man-in-the-middle C. ARP Proxy D. Poisoning Attack

B. Man-in-the-middle

Eve is spending her day scanning the library computers. She notices that Alice is using a computer whose port 445 is active and listening. Eve uses the ENUM tool to enumerate Alice machine. From the command prompt, she types the following command. For /f "tokens=1 %%a in (hackfile.txt) do net use* \\10.1.2.3\c$ /user: "Administrator" %%a What is Eve trying to do? A. Eve is trying to connect as a user with Administrator privileges B. Eve is trying to enumerate all users with Administrative privileges C. Eve is trying to carry out a password crack for user Administrator D. Eve is trying to escalate privilege of the null user to that of Administrator

C. Eve is trying to carry out a password crack for user Administrator

Which of the following represents the initial two commands that an IRC client sends to join an IRC network? A. USER, NICK B. LOGIN, NICK C. USER, PASS D. LOGIN, USER

A. USER, NICK

Study the following log extract and identify the attack. A. Hexcode Attack B. Cross Site Scripting C. Multiple Domain Traversal Attack D. Unicode Directory Traversal Attack

D. Unicode Directory Traversal Attack

Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on your network? A. 137 and 139 B. 137 and 443 C. 139 and 443 D. 139 and 445

D. 139 and 445

The following is an entry captured by a network IDS. You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor. You figure that the attacker is attempting a buffer overflow attack. You also notice "/bin/sh" in the ASCII part of the output. As an analyst what would you conclude about the attack? A. The buffer overflow attack has been neutralized by the IDS B. The attacker is creating a directory on the compromised machine C. The attacker is attempting a buffer overflow attack and has succeeded D. The attacker is attempting an exploit that launches a command-line shell

D. The attacker is attempting an exploit that launches a command-line shell

Based on the following extract from the log of a compromised machine, what is the hacker really trying to steal? A. har.txt B. SAM file C. wwwroot D. Repair file

B. SAM file

As a securing consultant, what are some of the things you would recommend to a company to ensure DNS security? A. Use the same machines for DNS and other applications B. Harden DNS servers C. Use split-horizon operation for DNS servers D. Restrict Zone transfers E. Have subnet diversity between DNS servers

B. Harden DNS servers C. Use split-horizon operation for DNS servers D. Restrict Zone transfers E. Have subnet diversity between DNS servers

Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for? A. To determine who is the holder of the root account B. To perform a DoS C. To create needless SPAM D. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail E. To test for virus protection

D. To illicit a response back that will reveal information about email servers and how they treat undeliverable mail

What tool can crack Windows SMB passwords simply by listening to network traffic? A. This is not possible B. Netbus C. NTFSDOS D. L0phtcrack

D. L0phtcrack

A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers. A. Use port security on his switches. B. Use a tool like ARPwatch to monitor for strange ARP activity. C. Use a firewall between all LAN segments. D. If you have a small network, use static ARP entries. E. Use only static IP addresses on all PC's.

A. Use port security on his switches. B. Use a tool like ARPwatch to monitor for strange ARP activity. D. If you have a small network, use static ARP entries.

Peter, a Network Administrator, has come to you looking for advice on a tool that would help him perform SNMP enquires over the network. Which of these tools would do the SNMP enumeration he is looking for? Select the best answers. A. SNMPUtil B. SNScan C. SNMPScan D. Solarwinds IP Network Browser E. NMap

A. SNMPUtil B. SNScan D. Solarwinds IP Network Browser

If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible? A. Birthday B. Brute force C. Man-in-the-middle D. Smurf

B. Brute force

Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weaknesses and key loggers. Which of the following options best represents the means that Bob can adopt to retrieve passwords from his clients hosts and servers? A. Hardware, Software, and Sniffing. B. Hardware and Software Keyloggers. C. Passwords are always best obtained using Hardware key loggers. D. Software only, they are the most effective.

A. Hardware, Software, and Sniffing.

Study the snort rule given below: From the options below, choose the exploit against which this rule applies. A. WebDav B. SQL Slammer C. MS Blaster D. MyDoom

C. MS Blaster

What do Trinoo, TFN2k, WinTrinoo, T-Sight, and Stracheldraht have in common? A. All are hacking tools developed by the legion of doom B. All are tools that can be used not only by hackers, but also security personnel C. All are DDOS tools D. All are tools that are only effective against Windows E. All are tools that are only effective against Linux

C. All are DDOS tools

How can you determine if an LM hash you extracted contains a password that is less than 8 characters long? A. There is no way to tell because a hash cannot be reversed B. The right most portion of the hash is always the same C. The hash always starts with AB923D D. The left most portion of the hash is always the same E. A portion of the hash will be all 0's

B. The right most portion of the hash is always the same

When discussing passwords, what is considered a brute force attack? A. You attempt every single possibility until you exhaust all possible combinations or discover the password B. You threaten to use the rubber hose on someone unless they reveal their password C. You load a dictionary of words into your cracking program D. You create hashes of a large number of words and compare it with the encrypted passwords E. You wait until the password expires

A. You attempt every single possibility until you exhaust all possible combinations or discover the password

Which of the following are well known password-cracking programs? A. L0phtcrack B. NetCat C. Jack the Ripper D. Netbus E. John the Ripper

A. L0phtcrack E. John the Ripper

Password cracking programs reverse the hashing process to recover passwords. (True/False.) A. True B. False

B. False

While examining audit logs, you discover that people are able to telnet into the SMTP server on port 25. You would like to block this, though you do not see any evidence of an attack or other wrong doing. However, you are concerned about affecting the normal functionality of the email server. From the following options choose how best you can achieve this objective? A. Block port 25 at the firewall. B. Shut off the SMTP service on the server. C. Force all connections to use a username and password. D. Switch from Windows Exchange to UNIX Sendmail. E. None of the above.

E. None of the above.

Windows LAN Manager (LM) hashes are known to be weak. Which of the following are known weaknesses of LM? (Choose three.) A. Converts passwords to uppercase. B. Hashes are sent in clear text over the network. C. Makes use of only 32-bit encryption. D. Effective length is 7 characters.

A. Converts passwords to uppercase. B. Hashes are sent in clear text over the network. D. Effective length is 7 characters.

You have retrieved the raw hash values from a Windows 2000 Domain Controller. Using social engineering, you come to know that they are enforcing strong passwords. You understand that all users are required to use passwords that are at least 8 characters in length. All passwords must also use 3 of the 4 following categories: lower case letters, capital letters, numbers and special characters. With your existing knowledge of users, likely user account names and the possibility that they will choose the easiest passwords possible, what would be the fastest type of password cracking attack you can run against these hash values and still get results? A. Online Attack B. Dictionary Attack C. Brute Force Attack D. Hybrid Attack

D. Hybrid Attack

An attacker runs netcat tool to transfer a secret file between two hosts. * Machine A: netcat -1 -p 1234 < secretfile * Machine B: netcat 192.168.3.4 > 1234 He is worried about information being sniffed on the network. How would the attacker use netcat to encrypt the information before transmitting onto the wire? A. Machine A: netcat -l -p -s password 1234 < testfileMachine B: netcat 1234 B. Machine A: netcat -l -e magickey -p 1234 < testfileMachine B: netcat 1234 C. Machine A: netcat -l -p 1234 < testfile -pw passwordMachine B: netcat 1234 -pw password D. Use cryptat instead of netcat.

D. Use cryptcat instead of netcat

What is GINA? A. Gateway Interface Network Application B. GUI Installed Network Application CLASS C. Global Internet National Authority (G-USA) D. Graphical Identification and Authentication DLL

D. Graphical Identification and Authentication DLL

Fingerprinting an Operating System helps a cracker because: A. It defines exactly what software you have installed B. It opens a security-delayed window based on the port being scanned C. It doesn't depend on the patches that have been applied to fix existing security holes D. It informs the cracker of which vulnerabilities he may be able to exploit on your system

D. It informs the cracker of which vulnerabilities he may be able to exploit on your system

In the context of Windows Security, what is a 'null' user? A. A user that has no skills B. An account that has been suspended by the admin C. A pseudo account that has no username and password D. A pseudo account that was created for security administration purpose

C. A pseudo account that has no username and password

What does the following command in netcat do? nc -l -u -p55555 < /etc/passwd A. logs the incoming connections to /etc/passwd file B. loads the /etc/passwd file to the UDP port 55555 C. grabs the /etc/passwd file when connected to UDP port 55555 D. deletes the /etc/passwd file when connected to the UDP port 55555

C. grabs the /etc/passwd file when connected to UDP port 55555

What hacking attack is challenge/response authentication used to prevent? A. Replay attacks B. Scanning attacks C. Session hijacking attacks D. Password cracking attacks

A. Replay attacks

In this attack, a victim receives an e-mail claiming from PayPal stating that their account has been disabled and confirmation is required before activation. The attackers then scam to collect not one but two credit card numbers, ATM PIN number and other personal details. Ignorant users usually fall prey to this scam. Which of the following statement is incorrect related to this attack? A. Do not reply to email messages or popup ads asking for personal or financial information B. Do not trust telephone numbers in e-mails or popup ads C. Review credit card and bank account statements regularly D. Antivirus, anti-spyware, and firewall software can very easily detect these type of attacks E. Do not send credit card numbers, and personal or financial information via email.

D. Antivirus, anti-spyware, and firewall software can very easily detect these type of attacks

Bob is going to perform an active session hijack against Brownies Inc. He has found a target that allows session oriented connections (Telnet) and performs the sequence prediction on the target operating system. He manages to find an active session due to the high level of traffic on the network. What is Bob supposed to do next? A. Take over the session B. Reverse sequence prediction C. Guess the sequence numbers D. Take one of the parties offline

C. Guess the sequence numbers

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. What is this technique called? A. Polymorphic Virus B. Metamorphic Virus C. Dravidic Virus D. Stealth Virus

A. Polymorphic Virus

**"Testing the network using the same methodologies and tools employed by attackers"** Identify the correct terminology that defines the above statement. A. Vulnerability Scanning B. Penetration Testing C. Security Policy Implementation D. Designing Network Security

B. Penetration Testing

Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result? A. The switches will drop into hub mode if the ARP cache is successfully flooded. B. If the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to attacks. C. Depending on the switch manufacturer, the device will either delete every entry in its ARP cache or reroute packets to the nearest switch. D. The switches will route all traffic to the broadcast address created collisions.

A. The switches will drop into hub mode if the ARP cache is successfully flooded.

You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c char shellcode [ ] = **"\x31\xc0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0\" "\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d" "\x53\x0c\xcd\x80\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73" "\x68";** What is the hexadecimal value of NOP instruction? A. 0x60 B. 0x80 C. 0x70 D. 0x90

D. 0x90

This TCP flag instructs the sending system to transmit all buffered data immediately. A. SYN B. RST C. PSH D. URG E. FIN

C. PSH

The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below: You are hired to conduct security testing on their network. You successfully brute-force the SNMP community string using a SNMP crack tool. The access-list configured at the router prevents you from establishing a successful connection. You want to retrieve the Cisco configuration from the router. How would you proceed? A. Use the Cisco's TFTP default password to connect and download the configuration file B. Run a network sniffer and capture the returned traffic with the configuration file from the router C. Run Generic Routing Encapsulation (GRE) tunneling protocol from your computer to the router masking your IP address D. Send a customized SNMP set request with a spoofed source IP address in the range -192.168.1.0

B. Run a network sniffer and capture the returned traffic with the configuration file from the router D. Send a customized SNMP set request with a spoofed source IP address in the range -192.168.1.0

You work for Acme Corporation as Sales Manager. The company has tight network security restrictions. You are trying to steal data from the company's Sales database (Sales.xls) and transfer them to your home computer. Your company filters and monitors traffic that leaves from the internal network to the Internet. How will you achieve this without raising suspicion? A. Encrypt the Sales.xls using PGP and e-mail it to your personal gmail account B. Package the Sales.xls using Trojan wrappers and telnet them back your home computer C. You can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent looking email or file transfer using Steganography techniques D. Change the extension of Sales.xls to sales.txt and upload them as attachment to your hotmail account

C. You can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent looking email or file transfer using Steganography techniques

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";) A. An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111 B. An alert is generated when any packet other than a TCP packet is seen on the network and destined for the 192.168.1.0 subnet C. An alert is generated when a TCP packet is originated from port 111 of any IP address to the 192.168.1.0 subnet D. An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111

D. An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111

What port number is used by LDAP protocol? A. 110 B. 389 C. 464 D. 445

B. 389

Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a session with his computer. How can Fred accomplish this? A. Fred can accomplish this by sending an IP packet with the RST/SIN bit and the source address of his computer. B. He can send an IP packet with the SYN bit and the source address of his computer. C. Fred can send an IP packet with the ACK bit set to zero and the source address of the switch. D. Fred can send an IP packet to the switch with the ACK bit and the source address of his machine.

D. Fred can send an IP packet to the switch with the ACK bit and the source address of his machine.

Within the context of Computer Security, which of the following statements describes Social Engineering best? A. Social Engineering is the act of publicly disclosing information B. Social Engineering is the means put in place by human resource to perform time accounting C. Social Engineering is the act of getting needed information from a person rather than breaking into a system D. Social Engineering is a training program within sociology studies

C. Social Engineering is the act of getting needed information from a person rather than breaking into a system

In Trojan terminology, what is a covert channel? A. A channel that transfers information within a computer system or network in a way that violates the security policy B. A legitimate communication path within a computer system or network for transfer of data C. It is a kernel operation that hides boot processes and services to mask detection D. It is Reverse tunneling technique that uses HTTPS protocol instead of HTTP protocol to establishconnections

A. A channel that transfers information within a computer system or network in a way that violates the security policy

When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK. How would an attacker exploit this design by launching TCP SYN attack? A. Attacker generates TCP SYN packets with random destination addresses towards a victim host B. Attacker floods TCP SYN packets with random source addresses towards a victim host C. Attacker generates TCP ACK packets with random source addresses towards a victim host D. Attacker generates TCP RST packets with random source addresses towards a victim host

B. Attacker floods TCP SYN packets with random source addresses towards a victim host

Yancey is a network security administrator for a large electric company. This company provides power for over 100, 000 people in Las Vegas. Yancey has worked for his company for over 15 years and has become very successful. One day, Yancey comes in to work and finds out that the company will be downsizing and he will be out of a job in two weeks. Yancey is very angry and decides to place logic bombs, viruses, Trojans, and backdoors all over the network to take down the company once he has left. Yancey does not care if his actions land him in jail for 30 or more years, he just wants the company to pay for what they are doing to him. What would Yancey be considered? A. Yancey would be considered a Suicide Hacker B. Since he does not care about going to jail, he would be considered a Black Hat C. Because Yancey works for the company currently; he would be a White Hat D. Yancey is a Hacktivist Hacker since he is standing up to a company that is downsizing

A. Yancey would be considered a Suicide Hacker

You receive an e-mail like the one shown below. When you click on the link contained in the mail, you are redirected to a website seeking you to download free Anti-Virus software. Dear valued customers, We are pleased to announce the newest version of Antivirus 2010 for Windows which will probe you with total security against the latest spyware, malware, viruses, Trojans and other online threats. Simply visit the link below and enter your antivirus code: or you may contact us at the following address: Media Internet Consultants, Edif. Neptuno, Planta Baja, Ave. Ricardo J. Alfaro, Tumba Muerto, n/a Panama How will you determine if this is Real Anti-Virus or Fake Anti-Virus website? A. Look at the website design, if it looks professional then it is a Real Anti-Virus website B. Connect to the site using SSL, if you are successful then the website is genuine C. Search using the URL and Anti-Virus product name into Google and lookout for suspicious warnings against this site D. Download and install Anti-Virus software from this suspicious looking site, your Windows 7 will prompt you and stop the installation if the downloaded file is a malware E. Download and install Anti-Virus software from this suspicious looking site, your Windows 7 will prompt you and stop the installation if the downloaded file is a malware

C. Search using the URL and Anti-Virus product name into Google and lookout for suspicious warnings against this site

Every company needs a formal written document which spells out to employees precisely what they are allowed to use the company's systems for, what is prohibited, and what will happen to them if they break the rules. Two printed copies of the policy should be given to every employee as soon as possible after they join the organization. The employee should be asked to sign one copy, which should be safely filed by the company. No one should be allowed to use the company's computer systems until they have signed the policy in acceptance of its terms. What is this document called? A. Information Audit Policy (IAP) B. Information Security Policy (ISP) C. Penetration Testing Policy (PTP) D. Company Compliance Policy (CCP)

B. Information Security Policy (ISP)

Take a look at the following attack on a Web Server using obstructed URL: http://www.certifiedhacker.com/script/ext? template=%2e%2e%2e%2e%2e%2e%2e%2e%2f this request is made up of: **%2e%2e%2f%2f%2f%2f = ../ ../ ../ %65%74%63 = etc %2f = / %70%61%73%73%77%64 = passwd** How would you protect from these attacks? A. Configure the Web Server to deny requests involving "hex encoded" characters B. Create rules in IDS to alert on strange Unicode requests C. Use SSL authentication on Web Servers D. Enable Active Scripts Detection at the firewall and routers

B. Create rules in IDS to alert on strange Unicode requests

Which type of sniffing technique is generally referred as MiTM attack? A. Password Sniffing B. ARP Poisoning C. Mac Flooding D. DHCP Sniffing

B. ARP Poisoning

Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC addresses to physical ports. What happens when the CAM table becomes full? A. Switch then acts as hub by broadcasting packets to all machines on the network B. The CAM overflow table will cause the switch to crash causing Denial of Service C. The switch replaces outgoing frame switch factory default MAC address of FF:FF:FF:FF:FF:FF D. Every packet is dropped and the switch sends out SNMP alerts to the IDS port

A. Switch then acts as hub by broadcasting packets to all machines on the network

You went to great lengths to install all the necessary technologies to prevent hacking attacks, such as expensive firewalls, antivirus software, anti-spam systems and intrusion detection/prevention tools in your company's network. You have configured the most secure policies and tightened every device on your network. You are confident that hackers will never be able to gain access to your network with complex security system in place. Your peer, Peter Smith who works at the same department disagrees with you. He says even the best network security technologies cannot prevent hackers gaining access to the network because of presence of "weakest link" in the security chain. What is Peter Smith talking about? A. Untrained staff or ignorant computer users who inadvertently become the weakest link in your security chain B. "zero-day" exploits are the weakest link in the security chain since the IDS will not be able to detect these attacks C. "Polymorphic viruses" are the weakest link in the security chain since the Anti-Virus scanners will not be able to detect these attacks D. Continuous Spam e-mails cannot be blocked by your security system since spammers use different techniques to bypass the filters in your gateway

A. Untrained staff or ignorant computer users who inadvertently become the weakest link in your security chain

How does a denial-of-service attack work? A. A hacker prevents a legitimate user (or group of users) from accessing a service B. A hacker uses every character, word, or letter he or she can think of to defeat authentication C. A hacker tries to decipher a password by using a system, which subsequently crashes the network D. A hacker attempts to imitate a legitimate user by confusing a computer or even another person

A. A hacker prevents a legitimate user (or group of users) from accessing a service

You are trying to break into a highly classified top-secret mainframe computer with highest security system in place at Merclyn Barley Bank located in Los Angeles. You know that conventional hacking doesn't work in this case, because organizations such as banks are generally tight and secure when it comes to protecting their systems. In other words, you are trying to penetrate an otherwise impenetrable system. How would you proceed? A. Look for "zero-day" exploits at various underground hacker websites in Russia and China and buy the necessary exploits from these hackers and target the bank's network B. Try to hang around the local pubs or restaurants near the bank, get talking to a poorly-paid or disgruntled employee, and offer them money if they'll abuse their access privileges by providing you with sensitive information C. Launch DDOS attacks against Merclyn Barley Bank's routers and firewall systems using 100, 000 or more "zombies" and "bots" D. Try to conduct Man-in-the-Middle (MiTM) attack and divert the network traffic going to the Merclyn Barley Bank's Webserver to that of your machine using DNS Cache Poisoning techniques

B. Try to hang around the local pubs or restaurants near the bank, get talking to a poorly-paid or disgruntled employee, and offer them money if they'll abuse their access privileges by providing you with sensitive information

This is an attack that takes advantage of a web site vulnerability in which the site displays content that includes un-sanitized user-provided data. See foobar What is this attack? A. Cross-site-scripting attack B. SQL Injection C. URL Traversal attack D. Buffer Overflow attack

A. Cross-site-scripting attack

Which utility will tell you in real time which ports are listening or in another state? A. Netstat B. TCPView C. Nmap D. Loki

B. TCPView

During an Xmas scan what indicates a port is closed? A. No return response B. RST C. ACK D. SYN

B. RST

Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp's lobby. He checks his current SID, which is S-1-5-21-1223352397-1872883824-861252104- 501. What needs to happen before Matthew has full administrator access? A. He must perform privilege escalation. B. He needs to disable antivirus protection. C. He needs to gain physical access. D. He already has admin privileges, as shown by the "501" at the end of the SID.

A. He must perform privilege escalation.

An LDAP directory can be used to store information similar to a SQL database. LDAP uses a _____ database structure instead of SQL's _____ structure. Because of this, LDAP has difficulty representing many-to-one relationships. A. Relational, Hierarchical B. Strict, Abstract C. Hierarchical, Relational D. Simple, Complex

C. Hierarchical, Relational

Elliot is in the process of exploiting a web application that uses SQL as a back-end database. He's determined that the application is vulnerable to SQL injection, and has introduced conditional timing delays into injected queries to determine whether they are successful. What type of SQL injection is Elliot most likely performing? A. Error-based SQL injection B. Blind SQL injection C. Union-based SQL injection D. NoSQL injection

B. Blind SQL injection

John is an incident handler at a financial institution. His steps in a recent incident are not up to the standards of the company. John frequently forgets some steps and procedures while handling responses as they are very stressful to perform. Which of the following actions should John take to overcome this problem with the least administrative effort? A. Create an incident checklist. B. Select someone else to check the procedures. C. Increase his technical skills. D. Read the incident manual every time it occurs.

C. Increase his technical skills.

You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain, if the DNS server is at 192.168.10.2 and the domain name is PLUScorp.local, what command would you type at the nslookup prompt to attempt a zone transfer? A. list server=192.168.10.2 type=all B. is-d PLUScorp.local C. Iserver 192.168.10.2-t all D. List domain=PLUScorp.local type=zone

B. is-d PLUScorp.local

OpenSSL on Linux servers includes a command line tool for testing TLS. What is the name of the tool and the correct syntax to connect to a web server? A. openssl s_client -site www.website.com:443 B. openssl_client -site www.website.com:443 C. openssl s_client -connect www.website.com:443 D. openssl_client -connect www.website.com:443

C. openssl s_client -connect www.website.com:443

What is the purpose of DNS AAAA record? A. Authorization, Authentication and Auditing record B. Address prefix record C. Address database record D. IPv6 address resolution record

D. IPv6 address resolution record

Tremp is an IT Security Manager, and he is planning to deploy an IDS in his small company. He is looking for an IDS with the following characteristics: - Verifies success or failure of an attack - Monitors system activities Detects attacks that a network-based IDS fails to detect - Near real-time detection and response - Does not require additional hardware - Lower entry cost Which type of IDS is best suited for Tremp's requirements? A. Gateway-based IDS B. Network-based IDS C. Host-based IDS D. Open source-based

C. Host-based IDS

What kind of detection techniques is being used in antivirus softwares that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it's made on the premiers environment- A. VCloud based B. Honypot based C. Behaviour based D. Heuristics based

A. VCloud based

Hustle 2 Flashcards

(100 cards)