Practice Exams 2 Flashcards
An organization is currently accepting bids for a contract that will involve penetration testing and reporting. The organization is asking all bidders to provide proof of previous penetration testing and reporting experience. One contractor decides to print out a few reports from some previous penetration tests that they performed. What could have occurred as a result of this contractor’s actions?
A. The contractor will have their bid accepted with a special pay bonus because of their excellent work on previous penetration tests
B. The contractor may have inadvertently exposed numerous vulnerabilities they had found at other companies on previous assessments
C. The organization accepting the bids will want to use the reports as an example of the format for all bidders to use in the future
D. The company accepting the bids will hire the contractor because of the quality of the reports he submitted with his bid
B. The contractor may have inadvertently exposed numerous vulnerabilities they had found at other companies on previous assessments
Explanation
OBJ-1.1: Pentesters should never disclose any information from previous penetration tests to anyone outside of the assessed organization since this could expose the vulnerability found. This non-disclosure is usually outlined in the original contract and scope of work. If the contractor wishes to provide a sample report, then the report should be created specifically for the contract and only include information from a sample/test network, not a previous customer’s assessment. This could also be in breach of the NDA between the pentester and the organization, as well.
An internet marketing company decided that they didn’t want to follow the rules for GDPR because it would create too much work for them. They wanted to buy insurance, but no insurance company would write them a policy to cover any fines received. They considered how much the fines might be and decided to ignore the regulation and its requirements. Which of the following risk strategies did the company choose?
A. Transference
B. Mitigation
C. Acceptance
D. Avoidance
C. Acceptance
Explanation
OBJ-1.1: The internet marketing company initially tried to transfer the risk (buy insurance) but then decided to accept the risk. To avoid the risk, the company would have changed how it did business or would prevent European customers from signing up on their mailing list using geolocation blocks.
Dion Training wants to require students to logon using multifactor authentication in an effort to increase the security of the authorization and authentication process. Currently, students login to diontraining.com using a username and password. What proposed solution would best meet the goal of enabling multifactor authentication for the student login process?
A. Require students to enter a cognitive password requirement (such as ‘What is your dog’s name?’)
B. Require students to enter a unique six-digit number that is sent to them by SMS after entering their username and password
C. Require students to create a unique pin that is entered after their username and password are accepted
D. Require students to choose an image to serve as a secondary password after logon
B. Require students to enter a unique six-digit number that is sent to them by SMS after entering their username and password
Explanation
OBJ-1.1: All of the options presented are knowledge factors (something you know) except the six-digit number sent by SMS to your smartphone. This SMS sent number is an example of a possession factor or something you have. In this case, it verifies you have your smartphone. By combining this possession factor with the already in use knowledge factor (username and password), you can establish multifactor security for the login process.
What must be developed to show security improvements over time?
A. Reports
B. Testing tools
C. Metrics
D. Taxonomy of vulnerabilities
C. Metrics
Explanation
OBJ-1.1: Metrics are a method of measuring something over time. If you wish to show the effect of security improvements over time, creating metrics would be a good option. For example, you may wish to look at the number of unpatched and known vulnerabilities. As this number decreases, your network would be considered to have improved security. Reports and testing tools alone cannot show progress. You must have measurable results using metrics.
Your company is setting up a system to accept credit cards in their retail and online locations. Which of the following compliance types should you be MOST concerned with dealing with credit cards?
A. PHI
B. PCI-DSS
C. GDPR
D. PII
B. PCI-DSS
Explanation
OBJ-1.1: The Payment Card Industry Data Security Standard (PCI DSS) applies to companies of any size that accept credit card payments. If your company intends to accept card payment and store, process, and transmit cardholder data, you need to securely host your data and follow PCI compliance requirements.
A project lead reviews the statement of work for an upcoming project that is focused on identifying potential weaknesses in the organization’s internal and external network infrastructure. As part of the project, a team of external contractors will attempt to employ various attacks against the organization. The work statement specifically addresses the utilization of an automated tool to probe network resources in an attempt to develop logical diagrams indicating weaknesses in the infrastructure. Based on this scope of work, what type of activity is to be performed?
A. Session hijacking
B. Vulnerability scanning
C. Social engineering
D. Penetration testing
D. Penetration testing
Explanation
OBJ-1.1: Penetration testing is the act of using a computer system, an individual network, or another application to find vulnerabilities that an attacker could use to compromise your systems. Penetration testing can also find endpoints with vulnerabilities, which makes the attack surface greater.
Dion Training has contracted you to conduct a penetration test of its web application hosted within AWS Lamba. Part of the assessment will include stress testing the web application using a simulated DDoS attack. Which of the following entities would be the proper signing authority for this penetration test?
A. Dion Training’s representative since they hired you
B. Amazon’s representative since they host the servers
C. Both organization’s representatives since one is your client and the other hosts the servers
D. Neither organization’s representatives since you are simulating a DDoS
C. Both organization’s representatives since one is your client and the other hosts the servers
Explanation
OBJ-1.1: Written authorization documents help control the amount of liability incurred by the penetration tester. You must ensure you have the correct authorization in place before beginning your engagement. You ALWAYS need written authorization from your client. If the client uses a third-party service provider, then you may need to also get proper authorization from them in writing too. During your engagement planning, you should contact the third-party service provider to determine if written consent is required. In the case of Amazon, there are a handful of services that do not require prior authorization before conducting a penetration test on behalf of your client. DoS and DDoS attacks and simulations do require written authorization from both your client and Amazon. If you do not have this, you could be held liable for any negative consequences to Amazon and its client’s servers or even be charged with criminal computer hacking.
Which of the following policies should be created to provide employees with the guidelines and limitations they must follow when using company-provided email, computers, and network access?
A. DLP
B. PII
C. AUP
D. GDPR
C. AUP
Explanation
OBJ-1.1: An acceptable use policy (AUP) governs employees’ use of company equipment and Internet services. Enforcing an acceptable use policy is important to protect the organization from the security and legal implications of employees (or customers) misusing its equipment. Typically, the policy will forbid the use of equipment to defraud, defame, or obtain illegal material. It is also likely to prohibit unauthorized hardware or software installation and to forbid actual or attempted intrusion (snooping) explicitly. An organization’s acceptable use policy may forbid the use of Internet tools outside of work-related duties or restrict such use to break times.
Which of the following is a DNS record type?
A. TTL
B. DHCP
C. PTR
D. LDAP
C. PTR
Explanation
OBJ-2.1: There are several types of DNS records, including A, AAAA, CNAME, PTR, SVR, and TXT. PTR records are used for the Reverse DNS (Domain Name System) lookup. Using the IP address, you can get the associated domain/hostname. An A record should exist for every PTR record.
Jason is conducting a penetration test against an organization’s Windows network. He then enters a command into the shell and receives the following output:
-=-=-=-=-=-
C:\Users\jason\Desktop> wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v “C:\Windows\” | findstr /i /v “””
Based on the output above, which of the following types of vulnerabilities does this Windows system contain?
A. Writeable services
B. Clear text credentials in LDAP
C. Unquoted service path
D. Unsecure file/folder permissions
C. Unquoted service path
Explanation
OBJ-2.3: This Windows machine contains an unquoted service path vulnerability, as shown in the output. If a service is created with an executable path that contains spaces and is not enclosed within quotes, then an unquoted service path vulnerability exists. In Windows, if the service is not enclosed within quotes and is having spaces, it would handle the space as a break and pass the rest of the service path as an argument. If the service involved has SYSTEM privileges, an attacker could exploit this vulnerability and gain SYSTEM level access. This command finds the service name, executable path, the display name of the service, and auto starts in all the directories except C:\Windows\ (since by default there is no such service that has spaces and is unquoted in this folder). As shown in the output, the service called “VulnerableService” has an unquoted service path.
Stephane was asked to assess the technical impact of a reconnaissance performed against his organization. He has discovered that a third party has been performing reconnaissance by querying the organization’s WHOIS data. Which category of technical impact should he classify this as?
A. Critical
B. High
C. Medium
D. Low
D. Low
Explanation
OBJ-2.1: This would be best classified as a low technical impact. Since WHOIS data about the organization’s domain name is publicly available, it is considered a low impact. This is further mitigated by the fact that your company gets to decide what information is actually published in the WHOIS data. Since only publicly available information is being queried and exposed, this can be considered a low impact.
Which of the following techniques listed below are not appropriate to use during a passive reconnaissance exercise against a specific target company?
A. WHOIS lookups
B. Banner grabbing
C. BGP looking glass usage
D. Registrar checks
B. Banner grabbing
Explanation
OBJ-2.1: Banner grabbing requires a connection to the host to grab the banner successfully. This is an active reconnaissance activity. All other options are considered passive processes and typically use information retrieved from third-parties that do not directly connect to an organization’s remote host.
What nmap switch would you use to determine which UDP ports are open on a targeted network?
A. -sN
B. -sP
C. -sS
D. -sU
D. -sU
Explanation
OBJ-2.2: In nmap, the -sU flag is used to scan UDP ports. The -sS flag will only scan TCP ports using an SYN scan. The -sP flag is a legacy (and depreciated) command for a ping scan. The -sN flag is used to conduct a TCP NULL scan.
You have been given access to a Windows system located on an Active Directory domain as part of a white box penetration test. Which of the following commands would provide information about other systems on this network?
A. net use
B. net user
C. net group
D. net config
A. net use
Explanation
OBJ-2.3: The net use command will list network shares that the workstation is using. This will help to identify file servers and print servers on the network. The net group command can only be used on domain controllers. The net config command will allow servers and workstations services to be controlled once they have already been identified. The net user command would show any user accounts on the local Windows workstation you are using.
You have conducted a Google search for the “site:diontraining.com -site:sales.diontraining.com financial.” What results do you expect to receive?
A. Google results matching all words in the query
B. Google results matching “financial” in domain webserver.com, but no results from the site sales.webserver.com
C. Google results for keyword matches from the site sales.diontraining.com that are in the domain diontraining.com but do not include the word financial
D. Google results for keyword matches on diontraining.com and sales.diontraining.com that include the word “financial”
B. Google results matching “financial” in domain webserver.com, but no results from the site sales.webserver.com
Explanation
OBJ-2.1: When conducting a Google search, using site:AAA in the query will return results only from that website (AAA). If you use –site:AAA, you will get results not explicitly on the website (AAA). In the case of this question, no results should show up from sales.diontraining.com. All results should only come from diontraining.com.
A technician just completed the second phase of their scans using Firewalk and the following output was displayed on their terminal:
-=-=-=-=- TCP port 21 – no response TCP port 22 – no response TCP port 23 – Time-to-live exceeded -=-=-=-=-
Based on these scan results, which of the following statements are true?
A. Firewall is blocking ports 21 through 23 and a service on the target is listening on port 23
B. No response from port 21 and 22 indicates services are not running on the target
C. Port 23 was not blocked at the firewall because the scan on port 23 passed through the filtering device
D. A TTL response error indicates port 23 was able to make a connection to the target
C. Port 23 was not blocked at the firewall because the scan on port 23 passed through the filtering device
Explanation
OBJ-2.2: Firewalk is a scanning tool that sends TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets and no response will be sent. Therefore, if a TTL exceeded message is received, this indicates that the associated port is being filtered by a firewall and not the gateway itself.
A system administrator wants to verify that external IP addresses cannot collect software versioning from servers on the network. Which of the following should the system administrator do to confirm the network is protected?
A. Analyze packet captures
B. Utilize netstat to locate active connections
C. Use nmap to query known ports
D. Review the ID3 logs on the network
A. Analyze packet captures
Explanation
OBJ-2.3: Captured packets show you the information that was traveling through certain files, etc. Packet sniffers detail the information they’ve received, so working through those shows if the external network shows or details software versions.
You conducted a security scan and found that port 389 is being used when connecting to LDAP for user authentication instead of port 636. The security scanning software recommends that you remediate this by changing user authentication to port to 636 wherever possible. What should you do?
A. Conduct remediation actions to update encryption keys on each server to match port 636
B. Mark this as a false positive in your audit report since the services that typically run on ports 389 and 636 are identical
C. Change all devices and servers that support it to port 636 since encrypted services run by default on port 636
D. Change all devices and servers that support it to port 636 since port 389 is a reserved port that requires root access and can expose the server to privilege escalation attacks
C. Change all devices and servers that support it to port 636 since encrypted services run by default on port 636
Explanation
OBJ-2.3: LDAP can be run on either port 389 or port 636. Port 389 is the standard port for LDAP but typically runs unencrypted LDAP services over this port. Instead, you should change all devices and servers that can technically support the change to port 636 since LDAP services over port 636 are encrypted by default.
Dion Training has publicly hosted web applications and an internal Intranet server that is protected by a firewall. Which of the following techniques would help them protect themselves against enumeration?
A. Reject all invalid emails received over SMTP
B. Allow full DNS zone transfer
C. Remove A records for any internal hosts
D. Enable null session pipeson their intranet
C. Remove A records for any internal hosts
Explanation
OBJ-2.3: Any internal server names and IPs should have their A records removed from the external DNS server because only internal users need to access the in ternal records. Dion Training’s internal servers should only have A records on their internal DNS server. Those A records should not be forwarded outside of the firewall boundary to prevent reconnaissance and enumeration by attackers.
A coworker is conducting open-source intelligence gathering for an upcoming penetration test against Dion Training. You look over their shoulder and saw them enter the following URL, https://www.google.com/search?q=*%40diontraining.com. Which of the following is true about the results of this search?
A. Returns no useful results for an attacker
B. Returns all web pages containing the text diontraining.com
C. Returns all web pages containing an email address affiliated with diontraining.com
D. Returns all web pages hosted at diontraining.com
C. Returns all web pages containing an email address affiliated with diontraining.com
Explanation
OBJ-2.1: Google interprets this statement as @diontraining.com and understands that the user is searching for email addresses since %40 is the hex code for the @ symbol. The * is a wild card character meaning that any text could be substituted for the * in the query. This type of search would provide an attacker with a list of email addresses associated with diontraining.com, which could be used as part of a spear-phishing campaign. To return all web pages hosted at diontraining.com, you should use the “site:” modifier in the query. To return all web pages with the text diontraining.com, enter “diontraining.com” into the Google search bar with no modifiers to return those results.
If you cannot ping a target because you are receiving no response or a response that states the destination is unreachable, then ICMP may be disabled on the remote end. If you wanted to elicit a response from a host using TCP, what tool would you use?
A. Hping
B. Traceroute
C. Ptunnel
D. Broadcast ping
A. Hping
Explanation
OBJ-2.2: Hping is a handy little utility that assembles and sends custom ICMP, UDP, or TCP packets and then displays any replies. It was inspired by the ping command but offered far more control over the probes sent. It also has a handy traceroute mode and supports IP fragmentation. Hping is particularly useful when trying to traceroute/ping/probe hosts behind a firewall that blocks attempts using the standard utilities. Hping also allows you to map out firewall rule sets. It is also great for learning more about TCP/IP and experimenting with IP protocols. Hping does not support IPv6, though, so the NMAP creators have created Nping to fill this gap and serve as an updated variant of Hping. Traceroute and tracert are computer network diagnostic commands for displaying the route and measuring packets’ transit delays across an Internet Protocol network. Traceroute uses ICMP and not TCP. Broadcast ping is simply pinging the subnet’s broadcast IP using the ping command, but if a regular ping does not work, neither will a broadcast ping. Ptunnel is an application that allows you to reliably tunnel TCP connections to a remote host using ICMP echo request and reply packets, commonly known as ping requests and replies. Ptunnel is used as a covert channel, not to elicit a response from a host using TCP.
A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URL, https://www.google.com/search?q=password+filetype%3Axls+site%3Adiontraining.com&pws=0&filter=p. Which of the following is true about the results of this search? (SELECT THREE)
A. All search filters are deactivated
B. Returns only files hosted at diontraining.com
C. Returns only Microsoft Excel spreadsheets
D. Find sites related to diontraining.com
E. Excludes Microsoft Excel spreadsheets
F. Personalization is turned off
B. Returns only files hosted at diontraining.com
C. Returns only Microsoft Excel spreadsheets
F. Personalization is turned off
Explanation
OBJ-2.1: The above example searches for files with the name “password” in them (q=password) and (+) have a filetype equal to xls (filetype%3Axls, %3A is the hex-code for ‘:’) and (+) limits the results to files hosted on diontraining.com (site%3Adiontraining.com) and (&) disables personalization (pws=0) and (&) deactivates the directory filtering function (filter=p). If you wanted to exclude Microsoft Excel spreadsheets, this would be done by typing -filetype%3Axls as part of the search query. To find related websites or pages, you would include the “related:” term to the query. To deactivate all filters from the search, the “filter=0” should be used. To deactivate the directory filtering function, the “filter=p” is used.
A coworker sent you the following snippet of a Ruby script to use during an upcoming engagement for Dion Training’s corporate network:
-=-=-=-=-=-
if client.platform == ‘windows’
db_ok = client.framework.db.active
client.core.use(“priv”) if not client.respond_to?(“priv”)
client.core.use(“incognito”) if not client.respond_to?(“incognito”)
hashes = client.priv.sam_hashes addr = client.sock.peerhost
print_good “Working…”
hashes.each do |hash|
data = {}
data[:host] = addr
data[:port] = 445
data[:sname] = 'smb'
data[:user] = hash.user_name
data[:pass] = hash.lanman + ":" + hash.ntlm
data[:type] = "smb_hash"
data[:active] = true
print_line " Extracted: #{data[:user]}:#{data[:pass]}"
client.framework.db.report_auth_info(data) if db_ok end -=-=-=-=-=-
During the upcoming engagement, what should you use this script to perform?
A. Network enumeration
B. Credential harvesting
C. Proxying a connection
D. Establishing a bind shell
B. Credential harvesting
Explanation
OBJ-2.3: This snippet of a Ruby script comes from the Metasploit framework as part of its credcollect.rb script. Most of the meterpreter scripts in Metasploit are written in Ruby, as it quickly became one of the favorite languages of penetration testers. Even if you cannot read and understand this entire script, you should identify some keywords and phrases to guess the correct answer. For example, line 6 mentions sam_hashes, which is used in Windows authentication. The script then extracts the data from the sam_hases for each username and password it could find and stores it in the client (Metasploit) database. For the exam, you need to read a script and understand its basic workflow and functions.
Which of the following tools can NOT be used to conduct a banner grab from a web server on a remote host?
A. netcat
B. telnet
C. wget
D. ftp
D. ftp
Explanation
OBJ-2.1: FTP cannot be used to conduct a banner grab. A cybersecurity analyst or penetration tester uses a banner grab to gain information about a computer system on a network and the services running on its open ports. Administrators can use this to take inventory of the systems and services on their network. This is commonly done using telnet, wget, or netcat.
The management at Steven’s work is concerned about rogue devices being attached to the network. Which of the following solutions would quickly provide the most accurate information that Steve could use to identify rogue devices on a wired network?
A. A discovery scan using a port scanner
B. Router and switch-based MAC address reporting
C. A physical survey
D. Reviewing a central administration tool like a SCCM
B. Router and switch-based MAC address reporting
Explanation
OBJ-2.1: The best option is MAC address reporting from a source device like a router or a switch. If the company uses a management system or inventory process to capture these addresses, then a report from one of these devices will show what is connected to the network even when they are not currently in the inventory. This information could then be used to track down rogue devices based on the physical port connected to a network device.
Your organization’s networks contain 4 subnets: 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0. Using nmap, how can you scan all 4 subnets using a single command?
A. nmap -Pn 10.0.0-3.0
B. nmap -Pn 10.0.0.0/23
C. nmap -Pn 10.0.0.0,1.0,2.0,3.0
D. nmap -Pn 10.0.0.0/25
A. nmap -Pn 10.0.0-3.0
Explanation
OBJ-2.2: The simplest way to scan multiple subnets adjacent to each other is to use the -Pn tells the command to conduct a host-only scan of every IP in this target space without using ping. Using the dash (-) in the IP address means to scan “this network through this network.” So, 10.0.0-3.0 will scan every IP from 10.0.0.0 through 10.0.3.255.
A coworker is conducting open-source intelligence gathering for an upcoming penetration test against Dion Training. You look over their shoulder and saw them enter the following URL, https://www.google.com/search?q=password+filetype%3Axls+site%3Adiontraining.com&pws=0&filter=p. Which of the following is true about the results of this search? (SELECT THREE)
A. All search filters are deactivated
B. Returns only files hosted at diontraining.com
C. Returns only Microsoft Excel spreadsheets
D. Find sites related to diontraining.com
E. Excludes Microsoft Excel spreadsheets
F. Personalization is turned off
B. Returns only files hosted at diontraining.com
C. Returns only Microsoft Excel spreadsheets
F. Personalization is turned off
Explanation
OBJ-2.1: The above example searches for files with the name “password” in them (q=password) and (+) have a filetype equal to xls (filetype%3Axls, %3A is the hex-code for ‘:’) and (+) limits the results to files hosted on diontraining.com (site%3Adiontraining.com) and (&) disables personalization (pws=0) and (&) deactivates the directory filtering function (filter=p). If you wanted to exclude Microsoft Excel spreadsheets, this would be done by typing -filetype%3Axls as part of the search query. To find related websites or pages, you would include the “related:” term to the query. To deactivate all filters from the search, the “filter=0” should be used. To deactivate the directory filtering function, the “filter=p” is used.
A pentester is trying to map the organization’s internal network. The analyst enters the following command (nmap -n -sS -T4 -p 80 10.0.3.0/24). What type of scan is this?
A. Quick Scan
B. Intense Scan
C. Stealth Scan
D. Comprehensive Scan
C. Stealth Scan
Explanation
OBJ-2.2: In nmap, the -sS flag signifies a stealth scan. This is also known as an SYN scan and is the most popular scan option for good reasons. It can be performed quickly, scanning thousands of ports per second on a fast network, and is not hampered by restrictive firewalls. It is also relatively unobtrusive and stealthy since it never completes TCP connections.
After issuing the command “telnet diontraining.com 80” and connecting to the server, what command conducts the banner grab?
A. HEAD / HTTP/1.1
B. PUT / HTTP/1.1
C. HEAD / HTTP/2.0
D. PUT / HTTP/2.0
A. HEAD / HTTP/1.1
Explanation
OBJ-2.1: To conduct a banner grab using telnet, you first must connect to the server using “telnet webserver 80”. Once the connection establishes, you will receive a blank prompt, and you then issue the command “HEAD / HTTP/1.1”. It requests the document header from the server and provides information such as the server software version and the server’s operating system.
You have been asked to create an allow statement on the firewall’s ACL to allow NTP traffic to pass into the network. Which port should be included?
A. 69
B. 123
C. 143
D. 636
B. 123
Explanation
OBJ-2.3: The correct port for NTP is 123. Port 69 is used for TFTP. Port 143 is used for IMAP. Port 636 is used for LDAPS.
What method might a system administrator use to replicate the DNS information from one DNS server to another, but could also be used maliciously by an attacker?
A. Zone transfers
B. DNS registration
C. CNAME
D. DNSSEC
A. Zone transfers
Explanation
OBJ-2.3: Zone transfers provide an easy way to send all the DNS information from one DNS server to another, but an attacker could also use it for reconnaissance against your organization. For this reason, most administrators disable zone transfers from untrusted servers. DNSSEC strengthens authentication in DNS using digital signatures based on public-key cryptography. CNAME is a Canonical Name Record or Alias Record. A type of resource record in the Domain Name System (DNS) specifies that one domain name is an alias of another canonical domain name. DNS registration is a service, which allows the owner of a domain name to use their name servers, which can match the domain name in question.
Dion Training has just installed a new web server and created an A record for DionTraining.com. When users try entering www.DionTraining.com, though, they get an error. You tell their network administrator that the problem is because he forgot to add the appropriate DNS record to create an alias for www to the domain’s root. Which type of DNS record should be added to fix this issue?
A. PTR
B. NS
C. CNAME
D. AAAA
C. CNAME
Explanation
OBJ-2.1: CNAME records can be used to alias one name to another. CNAME stands for Canonical Name. A common example is when you have both diontraining.com and www.diontraining.com pointing to the same application and hosted by the same server.
You are scanning a target as part of a penetration test. You discovered that the network uses Snort configured as a network-based IDS. Which of the following occurs when an alert rule has been matched in Snort during your scan?
A. The packet matching the rule will be dropped and the IDS will continue scanning new packets
B. The entire packet will be evaluated until all of the IDS alert rules have been checked and the packet is allowed to continue its journey
C. The IDS will send an alert, stop checking the rest of the rules, and allow the packet to continue its journey
D. The source IP address will be blocked and its connection with the network terminated
B. The entire packet will be evaluated until all of the IDS alert rules have been checked and the packet is allowed to continue its journey
Explanation
OBJ-2.3: If Snort is operating as an IDS, it will not block the connection or drop the packet. Instead, Snort will evaluate the entire packet and check all the alert rules, logging any matches it finds, and then allow it to continue onward to its destination.
A recent threat has been announced in the cybersecurity world, stating a critical vulnerability in a particular operating system’s kernel. Unfortunately, your company has not maintained a current asset inventory, so you are unsure of how many your servers may be affected. What should you do to find all of the affected servers within your network?
A. Manually review the syslog server’s logs
B, Conduct an OS fingerprinting scan across the network
C. Conduct a packet capture of data traversing the server network
D. Conduct a service discovery scan on the network
B, Conduct an OS fingerprinting scan across the network
Explanation
OBJ-2.2: By utilizing operating system fingerprinting using a tool like nmap, you can identify the servers running each version of an operating system. This will give you an accurate list of the possibly affected servers. Once you have this list, you can focus your attention on just those servers that need further inspection and scanning. Manually review the Syslog server’s log would take too long, and would not find servers that don’t send their logs to the Syslog server. Conducting a packet capture would only allow you to find the server actively transmitting data during the period of time you are capturing. Conducting a service discovery scan would not identify which servers are running which operating systems effectively. For example, if you see that the Apache web service is running on port 80, it doesn’t indicate running Linux or Windows as the underlying server.
What type of weakness is John the Ripper used to test during a technical assessment?
A. Usernames
B. File permissions
C. Firewall rulesets
D. Passwords
D. Passwords
Explanation
OBJ-3.2: John the Ripper is a free, open-source password cracking software tool. It tests the strength of passwords during a technical assessment. John the Ripper supports both dictionary and brute force attacks.
You are reverse engineering a piece of malware recovered from a retailer’s network for analysis. They found that the malicious code was extracting track data from their customer’s credit cards during processing. Which of the following types of threats would you classify this malware as?
A. Rootkit
B. Keylogger
C. Ransomware
D. POS malware
D. POS malware
Explanation OBJ-3.3: Point-of-sale malware (POS malware) is usually a type of malicious software (malware) that is used by cybercriminals to target point of sale (POS) and payment terminals with the intent to obtain credit card and debit card information, a card's track 1 or track 2 data and even the CVV code, by various man-in-the-middle attacks, that is the interception of the processing at the retail checkout point of sale system. Ransomware is a type of malware that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid. Keyloggers are a type of monitoring software designed to record keystrokes made by a user. These keyloggers can record the information you type into a website or application and send to back to an attacker. A rootkit is a malware class that modifies system files, often at the kernel level, to conceal its presence.
You have run a vulnerability scan and received the following output:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
CVE-2011-3389
QID 42366 - SSLv3.0/TLSv1.0 Protocol weak
CBC mode Server side vulnerability
Check with: openssl s_client -connect login.diontraining.com:443 - tls -cipher “AES:CAMELLISA:SEED:3DES:DES”
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Which of the following categories should this be classified as?
A. PKI transfer vulnerability
B. Active Directory encryption vulnerability
C. Web application cryptography vulnerability
D. VPN tunnel vulnerability
C. Web application cryptography vulnerability
Explanation
OBJ-3.1: This vulnerability should be categories as a web application cryptographic vulnerability. This is shown by the weak SSLv3.0/TLSv1.0 protocol being used in cipher block chaining (CBC) mode. Specifically, the use of the 3DES and DES algorithms during negotiation is a significant vulnerability. A stronger protocol should be used, such as forcing the use of AES.
Which of the following is the most difficult to confirm with an external vulnerability scan?
A. Cross-site scripting (XSS)
B. Cross-site request forgery (XSRF/CSRF)
C. Blind SQL injection
D. Unpatched web server
C. Blind SQL injection
Explanation
OBJ-3.1: Vulnerability scanners typically cannot confirm that a blind SQL injection with the execution of code has previously occurred. XSS and CSRF/XSRF are typically easier to detect because the scanner can pick up information that proves a successful attack. The banner information can usually identify unpatched servers.
Which of the following is a best practice that should be followed when scheduling vulnerability scans of an organization’s data center?
A. Schedule scans to be conducted evenly throughout the day
B. Schedule scans to run during periods of low activity
C. Schedule scans to begin at the same time every day
D. Schedule scans to run during peak times to simulate performance under load
B. Schedule scans to run during periods of low activity
Explanation
OBJ-3.1: For the best results, the scans should be scheduled during periods of low activity. This will help to reduce the negative impact of scanning on business operations. The other three options all carry a higher risk of causing disruptions to the network or its business operations.
You have been tasked to create some baseline system images to remediate vulnerabilities found in different operating systems. Before any of the images can be deployed, they must be scanned for malware and vulnerabilities. You must ensure the configurations meet industry-standard benchmarks and that the baselining creation process can be repeated frequently. What vulnerability option would BEST create the process requirements to meet the industry-standard benchmarks?
A. Utilizing an operating system SCAP plugin
B. Utilizing an authorized credential scan
C. Utilizing a non-credential scan
D. Utilizing a known malware plugin
A. Utilizing an operating system SCAP plugin
Explanation
OBJ-3.1: Security Content Automation Protocol (SCAP) is a multi-purpose framework of specifications supporting automated configuration, vulnerability and patch checking, technical control compliance activities, and security measurement. It is an industry-standard and support testing for compliance. The other options will not allow for a truly repeatable process since individual scans would occur each time instead of comparing against a known good baseline.
A software developer has just finished writing a new application. You have been contracted to conduct a scan to determine what vulnerabilities may exist. The developer provides you with the source code and the binary for the application. Which of the following should you perform FIRST?
A. Vulnerability scan
B. Dynamic application scan
C. Static application scan
D. Compliance scan
C. Static application scan
Explanation
OBJ-3.1: A static application scan, or static code analysis, is the process of reviewing the source code while it is not executing. This requires the source code of the application, which in this scenario was provided. Static analysis can help you discover how the application functions and will allow you to find mistakes caused by poor programming practices, such as the failure to conduct input validation. If you have the source code and understand how to read the language used in it, you should first conduct a static code analysis. Once completed, you can move on to a dynamic application scan.
On your lunch break, you walked down to the coffee shop on the corner. You open your laptop and connect to their wireless network. After a few minutes of surfing the Internet, a pop-up is displayed on your screen. You close the pop-up, finish your lunch break, shut down the laptop, and put it back into your backpack. When you get back to the office, you take out the laptop and turn it on, but instead of your normal desktop background, you are greeted by a full-screen image with a padlock and a message stating you have to pay 1 BTC to regain access to your personal files. What type of malware has infected your laptop?
A. Trojan
B. Spyware
C. Ransomware
D. Rootkit
C. Ransomware
Explanation
OBJ-3.3: This scenario is describing a ransomware attack. Your personal files are being held hostage and will not be released unless you pay a ransom (in this case, 1 BTC). You should restore your machine from a known good backup and restore your personal files from the backup, as well. You should not pay the ransom since the attackers usually still will not unlock your files.
Which of the following types of attackers are sophisticated and highly organized people or teams typically sponsored by a nation-state?
A. Script kiddies
B. Hacktivists
C. Advanced Persistent Threat
D. Ethical hacker
C. Advanced Persistent Threat
Explanation
OBJ-3.3: Advanced Persistent Threat (APT) attackers are sophisticated and have access to financial and technical resources typically provided by a government. An APT is an attacker with the ability to obtain, maintain, and diversify access to network systems using exploits and malware. A hacktivist is an attacker that is motivated by a social issue or political cause. A script kiddie has little skill or sophistication and uses publicly available tools and techniques. An ethical hacker specializes in penetration testing and in other testing methodologies that ensure the security of an organization’s information systems. An ethical hacker is also known as a white hat hacker.
The Security Operations Center Director for Dion Training received a pop-up message on his workstation that said, “You will regret firing me; just wait until Christmas!” He suspects the message came from a disgruntled former employee who may have set up a piece of software to create this pop-up on his machine. The director is now concerned that other code might be lurking within the network that could negatively affect Christmas. He directs his team of cybersecurity analysts to begin searching the network for this suspicious code. What type of malware should they be searching for?
A. Worm
B. Trojan
C. Adware
D. Logic bomb
D. Logic bomb
Explanation
OBJ-3.3: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. The director is concerned that a logic bomb may have been created and installed on his system or across the network before the analyst was fired.
A vulnerability scanner has reported that a vulnerability exists in the system. Upon validating the report, the analyst determines that this reported vulnerability does not exist on the system. What is the proper term for this situation?
A. False positive
B. False negative
C. True positive
D. True negative
A. False positive
Explanation
OBJ-3.1: A false positive occurs when a scanner detects a vulnerability, but the vulnerability does not actually exist on the scanned system. A true positive occurs when a scanner detects a vulnerability, and the vulnerability exists on the scanned system. A true negative occurs when a scanner does not detect a vulnerability because the vulnerability does not exist on the scanned system. A false negative occurs when a scanner does not detect a vulnerability, but the vulnerability actually exists on the scanned system.
What command could be used to list the active services from the Windows command prompt?
A. sc query type= running
B. sc query \servername
C. sc query
D. sc config
C. sc query
Explanation
OBJ-3.2: Windows uses the sc query to display information about the running service. It is part of the Service Control command-line tool, known as sc. The sc config command will modify the value of a service’s entries in the registry and the Service Control Manager database. The sc query command will obtain and display information about the specified service, driver, type of service, or driver type. By entering just the sc query, the command will return the information on the active services only. By using the type=running option, only the information on the running service will be displayed. If the command sc query \servername is used, then the remote server’s active services (\servername) will be displayed.
You have noticed some unusual network traffic outbound from a certain host. The host is communicating with a known malicious server over port 443 using an encrypted TLS tunnel. You ran a full system anti-virus scan of the host with an updated anti-virus signature file, but the anti-virus did not find any infection signs. Which of the following has MOST likely occurred?
A. Zero-day attack
B. Password spraying
C. Session hijacking
D. Directory traversal
A. Zero-day attack
Explanation
OBJ-3.3: Since you scanned the system with the latest anti-virus signatures and did not find any signs of infection, it would most likely be evidence of a zero-day attack. A zero-day attack has a clear sign of compromise (the web tunnel being established to a known malicious server). The anti-virus doesn’t have a signature yet for this particular malware variant. Password spraying occurs when an attacker tries to log in to multiple different user accounts with the same compromised password credentials. Session hijacking is exploiting a valid computer session to gain unauthorized access to information or services in a computer system. Based on the scenario, it doesn’t appear to be session hijacking since the user would not normally attempt to connect to a malicious server. Directory traversal is an HTTP attack that allows attackers to access restricted directories and execute commands outside of the web server’s root directory. A directory traversal is usually indicated by a dot dot slash (../) in the URL being attempted.
What is the proper threat classification for a security breach that employs brute-force methods to compromise, degrade, or destroy systems?
A. Attrition
B. Impersonation
C. Improper usage
D. Loss or theft of equipment
A. Attrition
Explanation
OBJ-3.2: Attrition attacks employ brute-force methods to compromise, degrade, or destroy systems, networks, or services. An impersonation attack occurs when the attacker gains control of an employee’s account and uses it to convince other employees to perform fraudulent actions. Improper usage occurs when an employee or other authorized user utilizes the systems or networks not as intended or designed. The loss or theft of equipment usually relates to a smartphone, tablet, or laptop is lost or stolen, and then the data on it becomes compromised.
Due to new regulations, your organization’s CIO has the information security team institute a vulnerability management program. What framework would BEST support this program’s establishment?
A. NIST
B. OWASP
C. SDLC
D. SANS
A. NIST
Explanation
OBJ-3.1: NIST (National Institute of Standards and Technology) produced a useful patch and vulnerability management program framework in its Special Publication (NIST SP 800-40). It would be useful during the program’s establishment and provide a series of guidelines and best practices. SANS is a company specializing in cybersecurity and secure web application development training and sponsors the Global Information Assurance Certification (GIAC). The SDLC is the software development lifecycle. It is a method for dividing programming projects into separate phases. The Open Web Application Security Project (OWASP) is a community effort that provides free access to many secure programming resources. The resources provided include documentation on web app vulnerabilities and mitigation tactics, software tools used to identify and handle threats that target web applications, frameworks for secure development life cycle implementation, frameworks for penetration testing web apps, general secure coding best practices, guidelines for specific web-based languages, and more.
Cybersecurity analysts are experiencing some issues with their vulnerability scans aborting because the previous day’s scans are still running when the scanner attempts to start the current day’s scans. Which of the following recommendations is LEAST likely to resolve this issue?
A. Add another vulnerability scanner
B. Reduce the scope of scans
C. Reduce the sensitivity of scans
D. Reduce the frequency of scans
C. Reduce the sensitivity of scans
Explanation
OBJ-3.1: If the cybersecurity analyst were to reduce the scans’ sensitivity, it still would not decrease the time spent scanning the network and could alter the effectiveness of the results received. In this scenario, the scans, as currently scoped, are taking more than 24 hours to complete with the current resources. The analyst could reduce the scans’ scope, thereby scanning fewer systems or vulnerabilities signatures and taking less time to complete. Alternatively, the analyst could reduce the scans’ frequency by moving to a less frequent schedule, such as one scan every 48 hours or one scan per week. The final option would be to add additional vulnerability scanners to the process. This would allow the two scanners to work together to divide the workload and complete the task within the 24-hour scan frequency currently provided.
