Practice Exam Flashcards
A social engineering technique whereby attackers under the disguise of a legitimate request attempt to gain access to confidential information is commonly referred to as:
- Phishing
- Privilege escalation
- Backdoor access
- Shoulder surfing
Phishing
Which of the following answers refer to smishing? (Select 2 answers):
- Social engineering technique
- Email communication
- Spam over Internet Telephony (SPIT)
- Text messaging
- Spam over Internet Messaging
Social engineering technique
Text messaging
The practice of using a telephone system to manipulate user into disclosing confidential information is known as:
- Whaling
- Spear phishing
- Vishing
- Pharming
Vishing
Which of the following terms is commonly used to describe an unsolicited advertising message?:
- Spyware
- Adware
- Malware
- Spam
Spam
What type of spam relies on text-based communication?:
- Vishing
- SPIM
- Bluesnarfing
- SPIT
SPIM
Phishing scams targeting a specific group of people are referred to as:
- Vishing
- Spear phishing
- Spoofing
- Whaling
Spear phishing
In computer security, the term “Dumpster diving” is used to describe a practice of sifting through trash for discarded documents containing sensitive data. Found documents containing names and surnames of the employees along with the information about positions held in the company and other data can be used to facilitate social engineering attacks. Having the documents shredded or incinerated before disposal makes dumpster diving less effective and mitigates the risk of social engineering attacks.
True or False
True
A situation in which an unauthorized person can view another user’s display or keyboard to learn their password or other confidential information is referred to as:
- Spear phishing
- Tailgating
- Shoulder surfing
- Spoofing
Shoulder surfing
Which of the following answers refer to the characteristic features of pharming? (Select 3 answers):
- Domain hijacking
- Traffic redirection
- Fraudulent website
- Password attack
- Credential harvesting
Traffic redirection
Fraudulent website
Credential harvesting
What is tailgating?:
- Acquiring unauthorized access to confidential data
- Looking over someone’s shoulder to get information
- Gaining unauthorized access to restricted areas by following another person
- Manipulating a user into disclosing confidential information
Gaining unauthorized access to restricted areas by following another person
In social engineering, the term “Elicitation” describes the use of casual conversation to extract non-public information from people without giving them the feeling they are being interrogated.
True or False
True
What is Bracketing?
Providing a high and low estimate in order to entice a more specific number
What is confidential bait?
Pretending to divulge confidential information in hopes of receiving confidential information in return
What do deliberate false statements entail?
Saying something wrong in the hopes that the person will correct the statement with true information
What is feined ignorance?
Pretending to be ignorant of a topic in order to exploit the person’s tendency to educate
What is denial of the obvious?
Saying something wrong in the hopes that the person will correct the statement with true information
What does flattery involve in cyber security?
Using praise to coax a person into providing information
Phishing scams targeting people holding high positions in an organization or business are known as:
- Vishing
- Smishing
- Whaling
- Pharming
Whaling
Which of the following is used in data URL phishing?:
- Prepending
- Typosquatting
- Pretexting
- Domain hijacking
Prepending
An email message containing a warning related to a non-existent computer security threat, asking a user to delete system files falsely identified as malware, and/or prompting them to share the message with others would be an example of:
- Vishing
- Impersonation
- Virus hoax
- Phishing
Virus Hoax
Which social engineering attack relies on identity theft?
Impersonation
The term “URL hijacking” (a.k.a. “Typosquatting”) refers to a practice of registering misspelled domain name closely resembling other well established and popular domain name in hopes of getting Internet traffic from users who would make errors while typing in the URL in their web browsers.
True or False
True
Which of the terms listed below refers to a platform used for watering hole attacks?
- Mail gateways
- Websites
- PBX systems
- Web browsers
Websites
An attacker impersonates a company’s managing staff member to manipulate a lower rank employee into disclosing confidential data. The attacker informs the victim that the information is essential for a task that needs to be completed within the business hours on the same day and mentions potential financial losses for the company in case the victim refuses to comply. Which social engineering principles apply to this attack scenario? (Select 3 answers):
- Urgency
- Familiarity
- Authority
- Consensus
- Intimidation
- Scarcity
Urgency
Authority
Intimidation
While conducting a web research that would help in making a better purchasing decision, a user visits series of Facebook pages and blogs containing fake reviews and testimonials in favor of a paid app intentionally infected with malware. Which social engineering principle applies to this attack scenario?
Consensus
An attacker impersonating a software beta tester replies to a victim’s post in a forum thread discussing the best options for affordable productivity software. A while later, he/she follows up by sending the victim private message mentioning the discussion thread and offering free access to a closed beta version of a fake office app. Which social engineering principles apply to this attack scenario? (Select 3 answers)
- Authority
- Intimidation
- Consensus
- Scarcity
- Familiarity
- Trust
- Urgency
Scarcity
Familiarity
Trust
Harmful programs used to disrupt computer operation, gather sensitive information, or gain unauthorized access to computer systems are commonly referred to as:
Malware
Malware that restricts access to a computer system by encrypting files or locking the entire system down until the user performs requested action is known as:
Ransomware
What is Trojan Horse?
A type of software that performs unwanted and harmful actions in disguise of a legitimate and useful program is known as a Trojan horse. This type of malware may act like a legitimate program and have all the expected functionalities, but apart from that it will also contain a portion of malicious code that the user is unaware of.
A standalone malicious computer program that typically propagates itself over a computer network to adversely affect system resources and network bandwidth is called:
Worm
What is a PUP? (Potentially Unwanted Program):
- A type of computer program not explicitly classified as malware by AV software
- An application downloaded and installed without the user’s consent
- A type of software that may adversely affect the computer’s security and performance, compromise user’s privacy, or display unsolicited ads
- An application downloaded and installed with the user’s consent
- A type of computer program explicitly classified as malware by AV applications
- A type of free, utility software often bundled with a paid app
A type of computer program not explicitly classified as malware by AV software
A type of software that may adversely affect the computer’s security and performance, compromise user’s privacy, or display unsolicited ads
An application downloaded and installed with the user’s consent
What type of malware resides ONLY in RAM?
Fileless Virus
What is the function of a C2 Server
Botnet Control
A malware-infected network host under remote control of a hacker is commonly referred to as:
Bot
Which of the following applies to a collection of intermediary compromised systems that can be used as a platform for a DDoS attack?
- Botnet
- Intranet
- Honeynet
- Extranet
Botnet
Which of the following is an example of cryptomalware?:
- Backdoor
- Ransomware
- Keylogger
- Rootkit
Ransomware
What is a logic bomb?
Malicious code activated by specific event
Explain spyware
Malicious software collecting information about users without their knowledge/consent
Which of the following is an example of spyware?:
- Keylogger
- Vulnerability scanner
- Computer worm
- Packet sniffer
Keylogger
Which type of Trojan enables unauthorized remote access to a compromised system?
RAT (Remote Access Trojan)
A collection of software tools used by a hacker to mask intrusion and obtain administrator-level access to a computer or computer network is known as:
Rootkit
Explain backdoor
An undocumented (and often legitimate) way of gaining access to a program, online service, or an entire computer system
Which password attack bypasses account-lockout policies?
Spraying attack
Which password attack takes advantage of a predefined list of words?
Dictionary attack
One of the measures for bypassing the failed logon attempt account lockout policy is to capture any relevant data that might contain the password and brute force it offline.
True or False
True
A short list of commonly used passwords tried against large number of user accounts is a characteristic feature of:
Spraying attack
What are Rainbow Tables?
Lookup tables used to speed up the process of password guessing
An attack against encrypted data that relies heavily on computing power to check all possible keys and passwords until the correct one is found is known as:
Brute-force attack
Which of the following refers to the contents of a rainbow table entry?:
- Hash/Password
- IP address/Domain name
- Username/Password
- Account name/Hash
Hash / Password
What does ‘Plaintext’ refer to in Cryptography?
Data in unencrypted form
The practice of making an unauthorized copy of a payment card is referred to as
Cloning
Due to added functionality in its plug, malicious USB cable can be used for:
- GPS tracking
- Capturing keystrokes
- Sending and receiving commands
- Delivering and executing malware
- Any of the above
Any of the above
What practice / attack refers to the theft of personal data from a payment card?
Skimming
An AI feature that enables it to accomplish tasks based on training data without explicit human instructions is called:
ML (Machine Learning)
A situation where a cryptographic hash function produces two different digests for the same data input is referred to as a hash collision.
True or False
False
Which cryptographic attack relies on the concepts of probability theory?
Birthday attack
What is a downgrade attack?
A type of cryptographic attack that forces a network protocol to revert to its older, less secure version
Which of the following facilitate(s) privilege escalation attacks? (Select all that apply):
- System/application vulnerability
- Principle of least authority
- Social engineering techniques
- Mandatory Access Control (MAC)
- System/application misconfiguration
System/application vulnerability
Social engineering techniques
System/application misconfiguration
Which of the following answers can be used to describe characteristics of a cross-site scripting attack? (Select 3 answers):
- Exploits the trust a user’s web browser has in a website
- A malicious script is injected into a trusted website
- User’s browser executes attacker’s script
- Exploits the trust a website has in the user’s web browser
- A user is tricked by an attacker into submitting unauthorized web requests
- Website executes attacker’s requests
Exploits the trust a user’s web browser has in a website
A malicious script is injected into a trusted website
User’s browser executes attacker’s script
What is DLL (Dynamic Link Library)
Collection of precompiled functions designed to be used by more than one Microsoft Windows application simultaneously to save system resources
What application attack relies on executing a library of code?
DLL Injection
Which of the following terms describes an attempt to read a variable value from an invalid address?:
- Buffer Overflow
- Null-pointer dereference
- Integer overflow
- Memory leak
Null-pointer dereference
