Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH v12 Exam Prep "Hard" > Module 13 - Hacking Web Servers ( EC Mode ) > Flashcards

Module 13 - Hacking Web Servers ( EC Mode ) Flashcards

1
Q

Which of the following is a web-server component that provides storage on a different machine or disk after the original disk is filled up?

A. Document root
B. Virtual document tree
C. Virtual hosting
D. Server root

A

Answer: B. Virtual document tree

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following is a type of attack in which the attacker alters or deletes the data of a web server and replaces the data with malware?

A. Website defacement
B. Data tampering
C. Compromise of user accounts
D. Data theft

A

Answer: A. Website defacement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following technologies belongs to the application layer and is used to generate dynamic web content?

A. Apache
B. PHP
C. MySQL
D. Linux

A

Answer: B. PHP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following techniques makes a web server vulnerable to attacks?

A. Running unhardened applications and servers
B. Blocking unrestricted internal and outbound traffic
C. Using different system administrator credentials everywhere
D. Regularly updating the web server with the latest patches

A

Answer: A. Running unhardened applications and servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following types of damage is caused when attackers access sensitive data such as financial records, future plans, and the source code of a program?

A. Data theft
B. Website defacement
C. Data tampering
D. Damage of the reputation of the company

A

Answer: A. Data theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Identify the component of the web server that provides storage on a different machine or a disk after the original disk is filled-up?

A. Document root
B. Virtual hosting
C. Virtual document tree
D. Server root

A

Answer: C. Virtual document tree

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of the following stores critical HTML files related to the webpages of a domain name that will be served in response to requests?

A. Document root
B. Virtual document tree
C. Web proxy
D. Server root

A

Answer: A. Document root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which of the following stores a server’s configuration, error, executable, and log files?

A. Web proxy
B. Server root
C. Virtual document tree
D. Document root

A

Answer: B. Server root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following provides storage on a different machine or disk after the original disk is filled up?

A. Virtual document tree
B. Document root
C. Server root
D. Virtual hosting

A

Answer: A. Virtual document tree

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In which of the following attack types does an attacker exploit the trust of an authenticated user to pass malicious code or commands to a web server?

A. Cross-site request forgery
B. Cross-site scripting
C. Unvalidated input and file injection
D. SQL injection attack

A

Answer: A. Cross-site request forgery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In which of the following attacks does an attacker attempt to access sensitive information by intercepting and altering communications between an end user and a web server?

A. Website defacement attack
B. HTTP response splitting attack
C. Phishing attack
D. Man-in-the-middle attack

A

Answer: D. Man-in-the-middle attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In which of the following attack types does an attacker alter the visual appearance of a web page by injecting code to add image popups or text?

A. Server-side request forgery
B. Website defacement
C. Web-server misconfiguration
D. Web cache poisoning

A

Answer: B. Website defacement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In which of the following attack types does an attacker flood an application with an excess amount of data so that the application may crash or exhibit vulnerable behavior?

A. Parameter/form tampering
B. Denial-of-service attack
C. Directory traversal
D. Buffer overflow attack

A

Answer: D. Buffer overflow attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In which of the following attack types does an attacker modify the content of a web page by examining its HTML code and identifying form fields that lack valid constraints?

A. Cross-site scripting (XSS) attack
B. Buffer overflow attack
C. Command injection attack
D. Directory traversal

A

Answer: C. Command injection attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An attacker sends numerous fake requests to the webserver from various random systems that results in the webserver crashing or becoming unavailable to the legitimate users. Which attack did the attacker perform?

A. DNS amplification attack
B. HTTP response splitting attack
C. DNS server hijacking
D. DoS attack

A

Answer: D. DoS attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

If an attacker compromises a DNS server and changes the DNS settings so that all the requests coming to the target webserver are redirected to his/her own malicious server, then which attack did he perform?

A. DNS server hijacking
B. DoS attack
C. DNS amplification attack
D. HTTP response splitting attack

A

Answer: A. DNS server hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following attacks allows an attacker to access sensitive information by intercepting and altering communications between an end user and webservers?

A. Directory traversal attack
B. DoS attack
C. Man-in-the-middle attack
D. HTTP response splitting attack

A

Answer: C. Man-in-the-middle attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following attacks occurs when an intruder maliciously alters the visual appearance of a webpage by inserting or substituting provocative, and frequently, offending data?

A. Directory traversal attack
B. Man-in-the-middle attack
C. Website defacement
D. HTTP response splitting attack

A

Answer: C. Website defacement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of the following is not a session hijacking technique?

A. Session fixation
B. DNS hijacking
C. Cross-site scripting
D. Session sidejacking

A

Answer: B. DNS hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The security analyst for Danels Company arrives this morning to his office and verifies the primary home page of the company. He notes that the page has the logo of the competition and writings that do not correspond to the true page. What kind of attack do the observed signals correspond to?

A. Phishing
B. DDoS
C. HTTP attack
D. Defacement

A

Answer: D. Defacement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of the following is a lookup database for default passwords, credentials, and ports?

A. Open Sez Me
B. ID Serve
C. Netcraft
D. NCollector Studio

A

Answer: A. Open Sez Me

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which of the following tools is a simple Internet server identification utility that is capable of performing reverse DNS lookup and HTTP server identification?

A. Dylib Hijack Scanner
B. ID Serve
C. OllyDbg
D. NCollector Studio

A

Answer: B. ID Serve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following tools is not used to perform webserver information gathering?

A. Netcraft
B. Whois
C. Wireshark
D. Nmap

A

Answer: C. Wireshark

24
Q

Which of the following commands does an attacker use to detect HTTP Trace?

A. nmap -p80 –script http-trace
B. nmap –script hostmap
C. nmap -p80 –script http-userdir -enum localhost
D. nmap –script http-enum -p80

A

Answer: A. nmap -p80 –script http-trace

25
Q

Which of the following command does an attacker use to enumerate common web applications?

A. nmap –script http-trace -p80 localhost
B. nmap –script http-enum -p80
C. nmap -p80 –script http-userdir -enum localhost
D. nmap -p80 –script http-trace

A

Answer: B. nmap –script http-enum -p80

26
Q

Which of the following tools is used by an attacker to perform website mirroring?

A. Netcraft
B. Hydra
C. Nessus
D. HTTrack

A

Answer: D. HTTrack

27
Q

An attacker wants to perform a session hijacking attack. What tool should he use to achieve his objective?

A. Hydra
B. Burp suite
C. Nessus
D. Netcraft

A

Answer: B. Burp suite

28
Q

An attacker wants to crack passwords using attack techniques like brute-forcing, dictionary attack, and password guessing attack. What tool should he use to achieve his objective?

A. Burp suite
B. Netcraft
C. THC Hydra
D. Nessus

A

Answer: C. THC Hydra

29
Q

Attackers use GET and CONNECT requests to use vulnerable web servers as which of the following?

A. DNS servers
B. None of the above
C. Application servers
D. Proxies

A

Answer: D. Proxies

30
Q

Which of the following is a web crawler optimized for searching and analyzing directories, and it can find interesting results if the server has the “index of” mode enabled?

A. Shadowsocks
B. Ettercap
C. Dirhunt
D. Hashcat

A

Answer: C. Dirhunt

31
Q

Which of the following is a web security testing tool that can be used by an attacker to predict and use the next possible session ID token to take over a valid session?

A. Burp Suite
B. Netcraft
C. NCollector Studio
D. Nikto2

A

Answer: A. Burp Suite

32
Q

Which of the following types of payload modules in the Metasploit framework is self-contained and completely stand-alone?

A. Exploit
B. Stagers
C. Singles
D. Stages

A

Answer: C. Singles

33
Q

Which of the following guidelines should be followed by application developers to defend against HTTP response-splitting attacks?

A. Share incoming TCP connections among different clients
B. Allow CR (%0d or \r) and LF (%0a or \n) characters
C. Parse all user inputs or other forms of encoding before using them in HTTP headers
D. Use the same TCP connection with the proxy for different virtual hosts

A

Answer: C. Parse all user inputs or other forms of encoding before using them in HTTP headers

34
Q

Which of the following is not a defensive measure for web server attacks?

A. Limit inbound traffic to port 80 for HTTP and port 443 for HTTPS (SSL)
B. Configure IIS to accept URLs with “../”
C. Encrypt or restrict intranet traffic
D. Ensure that protected resources are mapped to HttpForbiddenHandler and unused HttpModules are removed

A

Answer: B. Configure IIS to accept URLs with “../”

35
Q

Which of the following is NOT a best approach to protect your firm against web server attacks?

A. Remove unnecessary ISAPI filters from the web server
B. Allow remote registry administration
C. Apply restricted ACLs
D. Secure the SAM (Stand-alone Servers Only)

A

Answer: B. Allow remote registry administration

36
Q

Choose an ICANN accredited registrar and encourage them to set registrar-lock on the domain name in order to avoid which attack?

A. Denial-of-service attack
B. Session hijacking attack
C. Man-in-the-middle attack
D. DNS hijacking attack

A

Answer: D. DNS hijacking attack

37
Q

Which of the following tools is a web-application security scanner that searches for vulnerabilities to attacks such as clickjacking, SQL injection, and XSS?

A. N-Stalker X
B. Immunity Debugger
C. Vindicate
D. Mimikatz

A

Answer: A. N-Stalker X

38
Q

Which of the following countermeasures helps administrators in secure update and patch management of web servers?

A. Never make a detailed inventory of all the endpoints, services, and dependencies
B. Make a standardized patch management and security update methodology as part of the SDLC
C. Use default configurations dispatched with web servers
D. Enable all unused script extension mappings

A

Answer: B. Make a standardized patch management and security update methodology as part of the SDLC

39
Q

Which of the following practices helps administrators in secure update and patch management of web servers?

A. Reduce exposure to third-party risks by limiting the number of software versions you employ
B. Ensure that service packs, hotfixes, and security patch levels are non-consistent on all domain controllers (DCs)
C. Enable all unused script extension mappings
D. Never make a detailed inventory of all the endpoints, services, and dependencies

A

Answer: A. Reduce exposure to third-party risks by limiting the number of software versions you employ

40
Q

Which of the following practices helps administrators secure different protocols over the network?

A. Unblock all unnecessary ports, ICMP traffic, and unnecessary protocols such as NetBIOS and SMB
B. Integrate supporting servers such as LDAP servers from the local subnet
C. Isolate supporting servers such as LDAP servers from the local subnet
D. Ensure that identified FTP servers operate in an innocuous part of the directory tree

A

Answer: C. Isolate supporting servers such as LDAP servers from the local subnet

41
Q

Which of the following security practices makes user accounts on a web server vulnerable to various attacks?

A. Disable the Separation of Duties (SoD) feature on the server config settings
B. Disable unused default user accounts
C. Enable the user account locking feature
D. Implement 2FA or MFA for user accounts

A

Answer: A. Disable the Separation of Duties (SoD) feature on the server config settings

42
Q

Which of the following practices helps system administrators secure files and directories on a web server?

A. Retain unnecessary files within .jar files
B. Exclude meta characters while processing user inputs
C. Keep sensitive configuration information within the byte code
D. Enable the serving of directory listings

A

Answer: B. Exclude meta characters while processing user inputs

43
Q

Which of the following countermeasures should be followed for the secure update and patch management of web servers?

A. Use the default configurations that web servers are dispatched with
B. Never use virtual patches in the organization
C. Apply all updates, regardless of their type, on an “as-needed” basis
D. Enable all unused script extension mappings

A

Answer: C. Apply all updates, regardless of their type, on an “as-needed” basis

44
Q

Which of the following techniques is NOT a countermeasure for securing accounts?

A. Enable unused default user accounts
B. Remove all unused modules and application extensions
C. Eliminate unnecessary database users and stored procedures
D. Use secure web permissions, NTFS permissions, and .NET Framework access control mechanisms

A

Answer: A. Enable unused default user accounts

45
Q

Which of the following countermeasures should be followed to defend against DNS hijacking?

A. Include DNS hijacking into incident response and business continuity planning
B. Use the default router password included in the factory settings
C. Do not safeguard the registrant account information
D. Download audio and video codecs and other downloaders from untrusted websites

A

Answer: A. Include DNS hijacking into incident response and business continuity planning

46
Q

Which of the following is not a defensive measure for web server attacks?

A. Configure IIS to accept URLs with “../”
B. Ensure that protected resources are mapped to HttpForbiddenHandler and unused HttpModules are removed
C. Encrypt or restrict intranet traffic
D. Limit inbound traffic to port 80 for HTTP and port 443 for HTTPS (SSL)

A

Answer: A. Configure IIS to accept URLs with “../”

47
Q

Which of the following is not a webserver security tool?

A. Retina CS
B. Netcraft
C. Fortify WebInspect
D. NetIQ secure configuration manager

A

Answer: B. Netcraft

48
Q

Which of the following teams has the responsibility to check for updates and patches regularly?

A. Vulnerability assessment team
B. Patch management team
C. Red team
D. Security software development team

A

Answer: B. Patch management team

49
Q

Which of the following is not a patch management tool?

A. Burp suite
B. Software vulnerability manager
C. GFI LanGuard
D. Symantec client management suite

A

Answer: A. Burp suite

50
Q

Which of the following is considered as a repair job to a programming problem?

A. Patch
B. Penetration test
C. Vulnerability
D. Assessment

A

Answer: A. Patch

51
Q

Andrew, a software developer in CyberTech organization has released a security update that acts as defensive technique against the vulnerabilities in the software product the company has released earlier. Identify the technique used by Andrew to resolve the software vulnerabilities?

A. Patch Management
B. Vulnerability Management
C. Risk Management
D. Product Management

A

Answer: A. Patch Management

52
Q

Which of the following terms refers to a set of hotfixes packed together?

A. Hotfix pack
B. Service pack
C. Repair pack
D. Patch

A

Answer: B. Service pack

53
Q

A security administrator is looking for a patch management tool which scans organizational network and manages security and non-security patches. Which of the following patch management tool, he/she can use in order to perform the required task?

A. Nikto
B. Netscan Pro
C. GFI LanGuard
D. Burp suite

A

Answer: C. GFI LanGuard

54
Q

Which of the following is true for automated patch management process?

A. Assess -> detect -> acquire -> deploy -> test -> maintain
B. Detect -> assess -> acquire -> test -> deploy -> maintain
C. Acquire -> assess -> detect -> deploy -> test -> maintain
D. Acquire -> assess -> detect -> test -> deploy -> maintain

A

Answer: B. Detect -> assess -> acquire -> test -> deploy -> maintain

55
Q

Andrew, a software developer in CyberTech organization has released a security update that acts as defensive technique against the vulnerabilities in the software product the company has released earlier. Identify the technique used by Andrew to resolve the software vulnerabilities?

A. Risk Management
B. Product Management
C. Patch Management
D. Vulnerability Management

A

Answer: C. Patch Management

CEH v12 Exam Prep "Hard" (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions