Mock Exam - 1 Flashcards
Describe the characteristics of a Boot Sector Virus?
Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR.
What is the most common method to exploit the “Bash Bug” or “ShellShock” vulnerability?
Through web servers utilization CGI (Common Gateway Interface) to send a malformed environment variable to a vulnerability web server
It’s important to enumerate which HTTP methods (GET POST HEAD PUT DELETE TRACE) a web server had available. Which nmap script will help you perform the task of finding out the methods?
http-methods
A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files and one is a binary file named nc (netcat). The logs show the user logged in anonymously uploaded. The files extracted the contents and ran the script using a function provided by the FTP server software. The PS command shows the NC file is running as a process and the netstat command shows the NC process is listening on the network port. What kind of vulnerability had to have existed to make this remote attack possible?
File System Permissions
A new wireless client is configured to join an 802.11 network. This client uses the same hardware and software as many of the other clients on the network. The client can see the network, but cannot connect to it. A wireless tool similar to Wireshark shows that the WAP is not responding to the association requests being sent by the client. What is the possible source of the problem?
The WAP does not recognize the client’s MAC address.
If you are with your colleagues and are all sharing files via Bluetooth and one of them starts getting unwanted advertising on their mobile, what attack is happening?
Bluejacking
Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN standards on a Linux platform?
a. Kismet
b. Nessus
c. Netstumbler
d. Abel
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and (with appropriate hardware) can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet also supports plugins which allow sniffing other media such as DECT.Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.
What is a collision attack in cryptography?
Collision attacks try to find two inputs that produce the same hash
An NMAP scan of a server shows port 25 is open. What risk could this pose?
Active mail relay since SMTP is open
Each of the following are methods to detect trojans except:
a. Scan for suspicious registry entries
b. Scan for suspicious modifications to OS files
c. Scan for suspicious open ports
d. Scan for suspicious log-in attempts
d. Scan for suspicious log-in attempts
- An attacker has installed a RAT on a host. The attacker now has control of the machine through the RAT. The attacker wants to now ensure that if the user attempts to go to www.BestBank.com that the user is directed to a phishing site. What file does the attacker need to modify to make this happen?
a. Sudoers
b. Networks
c. Hosts
d. Boot.ini
c. Hosts
Which of the following answers refer to a loss in wireless signal strength during transmission caused by increasing distance and obstacles encountered on the signal path?
a. Attenuation
b. Amplitude
c. Cross-talk
d. Channel bonding
Attentuation = the reduction of the amplitude of a signal
What is the purpose of an application security policy or standard?
To reduce risk created by company applications that access sensitive data
Which of the following is a protocol specifically designed for transporting event messages?
a. SYSLOG
b. MSI
c. SNMP
d. CMP
syslog
What is the process of logging, recording and resolving events that take place in an organization?
Incident Management
The purpose of a ____________ is to deny network access to LAN and other information assets by unauthorized wireless devices.
Wireless intrusion prevention system
What does a firewall check to prevent particular ports and applications from getting packets into an organization?
Transport layer port numbers and application layer headers
During a blackbox pentest you attempt to pass IRC traffic over port TCP port 80 from a compromised web enabled host. The traffic gets blocked. Outbound HTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic
Stateful
