Practice Test 3

Question 1

“The term ““URL hijacking”” (a.k.a. ““Typosquatting””) refers to a practice of registering misspelled domain name closely resembling other well established and popular domain name in hopes of getting Internet traffic from users who would make errors while typing in the URL in their web browsers.”

True
False

Answer 1

True

Question 2

A modification introduced to a computer code that changes its external behavior (e.g. to maintain compatibility between a newer OS and an older version of application software) is called:

Shimming
DLL injection
Refactoring
Backdoor

Answer 2

Shimming

Question 3

The practice of optimizing existing computer code without changing its external behavior is known as:

DLL injection
Shimming
Data Execution Prevention (DEP)
Refactoring

Answer 3

Refactoring

Question 4

Which of the terms listed below refer(s) to software/hardware driver manipulation technique(s) that might be used to enable malware injection? (Select all that apply)

Refactoring
Sandboxing
Fuzz testing
Shimming 
Sideloading

Answer 4

Refactoring

Shimming

Question 5

IP spoofing and MAC spoofing rely on falsifying what type of address?

Broadcast address
Source address
Loopback address
Destination address

Answer 5

Source address

Question 6

Which of the following security protocols is the least susceptible to wireless replay attacks?

WPA2-CCMP 
WPA-TKIP
WPA2-PSK
WPA-CCMP
WPA2-TKIP

Answer 6

WPA2-CCMP

Question 7

A type of wireless attack designed to exploit vulnerabilities of WEP is known as:

MITM attack
Smurf attack
IV attack
Xmas attack

Answer 7

IV attack

Question 8

“The term ““Evil twin”” refers to a rogue Wireless Access Point (WAP) set up for eavesdropping or stealing sensitive user data. Evil twin replaces the legitimate access point and by advertising its own presence with the same Service Set Identifier (SSID, a.k.a. network name) appears as a legitimate access point to connecting hosts.”

True
False

Answer 8

True

Question 9

A wireless jamming attack is a type of:

Cryptographic attack
Denial of Service (Dos) attack
Brute-force attack
Downgrade attack

Answer 9

Denial of Service (Dos) attack

Question 10

A solution that simplifies configuration of new wireless networks by allowing non-technical users to easily configure network security settings and add new devices to an existing network is known as:

WPA
WPS
WEP
WAP

Answer 10

WPS

Question 11

Which of the wireless technologies listed below are deprecated and should not be used due to their known vulnerabilities? (Select 2 answers)

WPS 
WAP
WPA2
WAF
WEP

Answer 11

WPS

WEP

Question 12

The practice of sending unsolicited messages over Bluetooth is called:

SPIM
Bluejacking
Vishing
Bluesnarfing

Answer 12

Bluejacking

Question 13

Gaining unauthorized access to a Bluetooth device is referred to as:

Phishing
Bluejacking
Tailgating
Bluesnarfing

Answer 13

Bluesnarfing

Question 14

Which of the following wireless technologies enables identification and tracking of tags attached to objects?

WTLS
GPS
RFID
WAF

Answer 14

RFID

RFID(radio frequency identification) is a form of wireless communication that incorporates the use of electromagnetic or electrostatic coupling in the radio frequency portion of the electromagnetic spectrum to uniquely identify an object, animal or person.

Question 15

What is the name of a technology used for contactless payment transactions?

NFC
SDN
PED
WAP

Answer 15

NFC

Near Field Communication (NFC) is a short-range wireless connectivity standard (Ecma-340, ISO/IEC 18092) that uses magnetic field induction to enable communication between devices when they’re touched together, or brought within a few centimeters of each other.

Question 16

A wireless disassociation attack is a type of:

Downgrade attack
Brute-force attack
Denial of Service (Dos) attack
Cryptographic attack

Answer 16

Denial of Service (Dos) attack

A Wi-Fideauthentication attackis a type of denial-of-serviceattackthat targets communication between a user and a Wi-Fiwirelessaccess point.

Question 17

Which cryptographic attack relies on the concepts of probability theory?

KPA
Brute-force
Dictionary
Birthday

Answer 17

Birthday

Question 18

Which of the acronyms listed below refers to a cryptographic attack where the attacker has access to both the plaintext and its encrypted version?

KEK
POODLE
KPA
CSRF

Answer 18

KPA

The known-plaintext attack (KPA) is an attack model for cryptanalysis where the attacker has access to both the plaintext (called a crib), and its encrypted version (ciphertext). These can be used to reveal further secret information such as secret keys and code books.

Question 19

Rainbow tables are lookup tables used to speed up the process of password guessing.

True
False

Answer 19

True

Question 20

Which of the following answers refers to the contents of a rainbow table entry?

Hash/Password
IP address/Domain name
Username/Password
Account name/Hash

Answer 20

Hash/Password

Question 21

Which password attack takes advantage of a predefined list of words?

Birthday attack
Replay attack
Dictionary attack
Brute-force attack

Answer 21

Dictionary attack

Question 22

An attack against encrypted data that relies heavily on computing power to check all possible keys and passwords until the correct one is found is known as:

Replay attack
Brute-force attack
Dictionary attack
Birthday attack

Answer 22

Brute-force attack

Question 23

One of the measures for bypassing the failed logon attempt account lockout policy is to capture any relevant data that might contain the password and brute force it offline.

True
False

Answer 23

True

Question 24

A situation where cryptographic hash function produces two different digests for the same data input is referred to as hash collision.

True
False

Answer 24

False

Question 25

Which of the following answers lists an example of a cryptographic downgrade attack?

MITM
KPA
POODLE
XSRF

Answer 25

POODLE

APOODLEattack is an exploit that takes advantage of the way some browsers deal with encryption.POODLE(Padding Oracle On Downgraded Legacy Encryption) is the name of thevulnerabilitythat enables the exploit.