Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS6262 Final > Quiz Questions from Lessons > Flashcards

Quiz Questions from Lessons Flashcards

1
Q

Subnet Spoofing

A

Generate random addresses within

a given address space.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Random Spoofing

A

Generate 32-bit numbers and stamp

packets with them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Fixed Spoofing

A

The spoofed address is the address

of the target.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Server Application DOS attack

A

The attack is targeted to a specific

application on a server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Network Access DOS attack

A

The attack is used to overload or
crash the communication mechanism of a
network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Infrastructure DOS attack

A

The motivation of this attack is a
crucial service of a global internet
operation, for example core router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Random Scanning

A

Each compromised computer probes

random addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Permutation Scanning

A

All compromised computers share a
common pseudo-random permutation of the
IP address space.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Signpost Scanning

A

Uses the communication patterns of the

compromised computer to find new target.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Hitlist Scanning

A

A portion of a list of targets is supplied to

a compromised computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of these are reasons why the UDP-based NTP

protocol is particularly vulnerable to amplification attacks?

A

A small command can generate a large response.
Vulnerable to source IP spoofing.
It is difficult to ensure computers communicate only with legitimate NTP severs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The server must reject all TCP options because the server discards the SYN queue entry. T or F?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

With regards to a UDP flood attack, which of the

following statements are true:

A

Attackers can spoof the IP address of their UDP packets
Firewalls cannot stop a flood because the firewall is
susceptible to flooding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Client puzzles should be stateless

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Puzzle complexity should increase as the strength of the

attack increases.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following are assumptions that can be

made about Traceback?

A

Attackers may work alone or in groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Select all the statements that are true for edge

sampling:

A

Multiple attackers can be identified since edge identifies splits in reverse path
Requires space in the IP packet header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Self defense against reflector attacks should

incorporate:

A

Server redundancy - servers should be located in multiple networks and locations.
Traffic limiting - traffic from a name server should be limited
to reasonable thresholds.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Deep web

A

It is not indexed by standard search

engines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Dark web

A

Web content that exists on darknets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Surface web

A

Readily available to the public, and

searchable with standard search engines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Doorway pages

A

A webpage that lists many keywords, in
hopes of increasing search engine
ranking. Scripts on the page redirect to
the attackers page.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Crypters

A

A program that hides malicious code

from anti-virus software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Blackhat Search Engine Optimizer

A

It increases traffic to the attacker’s site

by manipulating search engines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Trojan Download Manager

A

Software that allows an attacker to
update or install malware on a victim’s
computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the two defining characteristics of internet spam?

A

Inappropriate or irrelevant

Large number of recipients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Name the top three countries where spam directed visitors

added items to their shopping cart:

A

United States
Canada
Philippines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which events should trigger a penetration test?

A

Applications are added or modified
End user policies are changed
Security patches are installed
Infrastructure is added or modified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

List the steps attackers used to access RSA’s Adobe Flash software:

A 
Identify employees that are
vulnerable
Craft an email subject line that
entices an employee to open it
Hide an executable file in the
email that will install onto the
victim's computer when the
email is opened
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Flash or CD Autoplay Attack

A

A flash is created that has a program that

creates a connection to the exploit server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Reverse Shell Applet Attack

A

A signed Java applet is sent to the user, if they
accept it, a shell is sent back to the exploit
server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Click Logger Attack

A

Used to determine which users click on links in

emails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Download Connection Attack

A

An email contains an attachment. When the
attachment is downloaded an connection is made
to the exploit server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

On this pie chart, what are the top three industries that were targets
of cyber attacks in 2016?

A

Defense contractor
Restaurant
Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Tier One

A

A network can reach every other network

through peering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Tier Two

A

A network that peers some of its network

access and purchases some of it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Tier Three

A

A network that purchases all transit from

other networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

IP provides only best effort delivery, it is not

guaranteed.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Due the connectionless nature of IP, data
corruption, packet loss, duplication, and
out-of-order delivery can occur.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Network layer controls can protect the data within the

packets as well as the IP information for each packet.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

IP information cannot be protected by transport layer controls.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Address Resolution Protocol (ARP)

A

protocol designed to map IP network
addresses to the hardware addresses
used by a data link protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Open Shortest Path First (OSPF)

A

protocol uses a link state routing
algorithm and falls into the group of
interior routing protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Border Gateway Protocol (BGP)

A 
protocol designed to exchange routing
and reachability information among
autonomous systems (AS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Denial of Service

A

Create a false route or kill a legitimate one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Sniffing

A

The attacker must control a device along

the victim’s communication path.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Routing to Endpoints in Malicious

Networks

A

The first step is to hijack traffic from a

legitimate host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Creating Route Instabilities

A

Not yet used by hackers because damage
cannot be contained. It can blowback to the
attacker.

49
Q

Revelation of Network Topologies

A

Unmasking the AS relationships by hacking

the routing table

50
Q

Domain name

A

A name in the DNS format

51
Q

DNS zone

A

A set of names under the same

authority (ie “.com”)

52
Q

Delegation

A

Transfer of authority for/to a subdomain

53
Q

Changing a domain name into an IP address involves a large
number of steps. To save time, the records are <>
on a local server for reuse later

A

cached

54
Q

Each record has a <> that states how long a record

can be kept for future use.

A

TTL

55
Q

All domain names and IP addresses are stored at the

Central Registry.

A

True

56
Q

It can take several days for information to propagate

to all DNS servers.

A

True

57
Q

The attacker’s server responds with a short TTL
record. The attacker needs to register a domain and
delegate it to a server under his control. The attacker exploits the same origin policy

A

True

58
Q

Using Components with Known Vulnerabilities

A

Uses unpatched third party components.

59
Q

Missing Function Level Access Control

A

Privilege functionality is hidden rather than

enforced through access controls

60
Q

Sensitive Data Exposure

A

Abuses lack of data encryption

61
Q

Security Misconfiguration

A

Exploits misconfigured servers.

62
Q

Insecure Direct Object References

A

Attackers modify file names

63
Q

Cross Site Scripting

A

Inserts Javascript into trusted sites.

64
Q

Broken Authentication and Session

A

Program flaws allow bypass of authentication

methods.

65
Q

Injection

A

Modifies back-end statement through user input

66
Q

Given the list of attributes, which 2 should not be combined?
Put a check next to the 2 attributes that should not be combined in sandbox

A

allow-same-origin

allow-scripts

67
Q

CSP will allow third party widgets (e.g. Google

+1 button) to be embedded on your site.

A

True

68
Q

If you have third party forum software that has

inline script, CSP cannot be used

A

false

69
Q

CORS allows cross-domain communication from the browser

CORS requires coordination between the server and client

A

true

70
Q

CORS is not widely supported by browsers
The CORS header can be used to secure resources on a
website

A

false

71
Q

The token must be stored somewhere
Tokens expire, but there should still be mechanisms to
revoke them if necessary

A

true

72
Q

Active session hijacking involves disconnecting the
user from the server once that user is logged on.
Social engineering is required to perform this
type of hijacking.

A

true

73
Q

Select all of the items that can be encrypted by HTTPS

A

Request URL
Query parameters
Headers
Cookies

74
Q

Which of the following are real disadvantages

to using HTTPS

A

You need to buy an SSL certificate
Mixed modes issue- loading insecure content on a
secure site
Proxy caching problems- public caching cannot occur

75
Q

According to Wikipedia, which of these devices is a mobile device?

A

Smart phone held by person
Self Driving car
Robot

76
Q

List the four areas of the C based toolchain where hardening

can occur

A

Configuration
Preprocessor
Compiler
Linker

77
Q

A Botnet is a of bots controlled by a
.
It is a key platform for and other
exploits.
network
Bot Master
fraud for-profit
More precisely, a coordinated group of malware
instances that are controlled via command and
control (C&C) channels. C&C architectures:
centralized (e.g., IRC, HTTP), distributed (e.g., P2P)
attacker

A

true

78
Q

Which of these behaviors are indicative of botnets?

A 
Linking to an established C&amp;C server
Generating Internet Relay Chat (IRC) traffic using a
specific range of ports
Generating SMTP emails/traffic
Reducing
Generating SIMULTANEOUS
IDENTICAL DNS requests is suspicious
79
Q

hat can botnets do to evade C-plane clustering?

A

Manipulate communication patterns.
Introduce noise (in the form of random packets) to reduce similarity
between C&C flows

80
Q

What can botnets do to evade A-plane monitoring?

A

Perform slow spamming
Use undetectable activities (spam sent with Gmail, download exe
from HTTPS server)

81
Q

Which of the information should be considered in order to identify the
source (perpetrator) of an APT attack?

A

Source IP address of TCP-based attack packets
Coding style of malware
Inclusion of special libraries with known authors
Motives of the attack
Language encoding

82
Q

Footprinting (FP)

A

The attacker gathers information about a target.
The kind of information gathered is: DNS, email
servers, and the IP address range.

83
Q

Scanning (S)

A

The attacker uses the internet to obtain information
on specific IP addresses. The kind of information
gathered is: O.S., services, and architecture of the
target system

84
Q

Enumeration (E)

A

The attacker gathers information on network user
and group names, routing tables, and simple
network management protocol.

85
Q

Which protocol is used to break data into packets?

Which protocol reassembles the data packets?

A

TCP

86
Q

Which protocol is used to move packets from router to

router?

A

IP

87
Q

Why does ZMap find more hosts than Nmap?

A

Statelessness leads to both
higher performance and
increased coverage

88
Q

With regards to computing, what is entropy?
Randomness for use in cryptography or other applications that
require random data.
What are the two sources of entropy?
Hardware sources and randomness generators
A lack of entropy will have a negative impact on performance
and security.

A

True

89
Q

NoBL DNSBL level

A

This IP address does not send spam, and should not

be blacklisted. But it is not fully trustworthy.

90
Q

Grey DNSBL level

A

This IP address is not directly involved in spamming

but is associated with spam-like behaviors

91
Q

Yellow DNSBL level

A

This IP address is known to produce spam and nonspam

email

92
Q 
C Botnets(B),
A Spyware(S),
B Adware(A)
A

A. Anonymously registered domains
B. Disposable domains
C. Short lived domains

93
Q

List the types of characters a malicious domain name detection
program should look for in a domain name.

A

Number of characters
Number of hyphens
Number of digits

94
Q

C Network-based features(N),
B Zone-based features(Z),
A Evidence-based features (E)

A

A. The number of distinct malware samples
that connected to any of the IPs.
B. The average length of domain names,
the occurrence frequency of different
characters, etc.
C. Quantities such as the total number of
IPs historically associated with the
diversity of their geographical locations,
the number of distinct autonomous
systems, etc.

95
Q

A dynamic malware-related domain

detection system should

A

Have global visibility into DNS request and response
messages
Not require data from other networks
Be able to detect malware-related domains even if there is
no reputation data

96
Q

A proven method to stop botnets requires isolating the C&C
domain from the botnet

A

true

97
Q

Hash functions do not have a key
Hash functions are also called one-way encryption
Hash functions are primarily used for message integrity

A

True

98
Q

The security of crypto currency ledgers depends on

the honesty of its miners.

A

True

99
Q

With regards to Bitcoin, which of the following statements

are true?

A

Proof of work is costly and time consuming to
produce
Changing a block requires regenerating all
successors and redoing the work they contain.

100
Q

With regards to Sybil attacks, check all true statements

A

The attacker creates a lot of fake identities and
uses them to change voting outcomes or control the
network
A Sybil attack is designed to attack reputation
systems in a peer-to-peer network
Sybil attack can be stopped if users are willing to
give up anonymity.

101
Q

Two Merkle trees can be compared if they have the same
.
If two Merkle trees have the same root hashes, then their
data blocks can be considered to be .
In a bitcoin block, the is stored in the block
header.
hash depth
the same
Merkle root

A

True

102
Q

A time-stamping service prevents people from

double spending Bitcoins

A

True

103
Q

the main task is to find patterns, structures, or knowledge in
unlabeled data

A

Unsupervised

104
Q

the task is to find a function or model that explains the data

A

Supervised

105
Q

some of the data is labeled during acquisition

A

Semi-supervised

106
Q

Select the true statements with regards to decision tree based
detection models:

A

Can supplement honeypot analysis
Can supplement penetration testing
Can detect previously unknown network anomalies

107
Q

A polymorphic attack can change its appearance with
every instance.
A polymorphic attack has no predictable signature for
the attack.

A

True

108
Q

Each instance of polymorphic code has different, but

normal, appearance.

A

false

109
Q

Which of the following are true statements with regards to a

polymorphic blending attack?

A

The process should not result in an abnormally large
attack size
The blending needs to be economical in time and space

110
Q

List the goals of a successful poison attack:

A

Is undetected
• Continues for a period of time
• Cause damage to data

111
Q

If we can completely control the process of generating or
collecting the training data and ascertain the authenticity
and integrity of the dataset, we don’t have to worry
about data poisoning attacks

A

true

112
Q

If the training data is obtained in an open environment,
e.g., the Web, there is always the potential of poisoning
attacks (i.e., such attacks can’t be eliminated)

A

true

113
Q

List some of the characteristics that all four cloud models share:

A 
Massive scale
Homogeneity
Virtualization
Resilient computing
Low cost software
Geographic distribution
Service orientation
Advanced security technologies
114
Q 
Broad Network Access 
Rapid Elasticity
Measured Service
On Demand Self-Service
Resource Pooling
A

True for cloud

115
Q

Most data in transit is encrypted

A

true

116
Q

Disconnect the VM from the internet when opening

questionable files.

A

true

117
Q

Select the statements that are true with regards to ORAM

A

Client must have a private source of randomness
Each access to the remote storage must have a read
and a write

118
Q

What is a major weakness of the Naive Secret Sharing scheme?

A

The major weakness of naive secret sharing is the more shares
you have of the secret, the less work you have to do to guess the
secret.

CS6262 Final (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions