Security+ Practice Test 2

Question 1

Privacy filter (a.k.a. privacy screen) is a protective overlay placed on the computer screen that narrows the viewing angle, so the screen content is only visible directly in front of the monitor and cannot be seen by others nearby. Privacy filter is one of the countermeasures against shoulder surfing. (True or False)

Answer 1

True

Question 2

An email message containing a warning related to a non-existent computer security threat, asking a user to delete system files falsely identified as malware, and/or prompting them to share the message with others would be an example of:

Answer 2

Virus hoax

Question 3

Which of the terms listed below refers to a platform used for watering hole attacks?
Mail gateways
Websites
PBX systems
Web browsers

Answer 3

Websites

Question 4

Which social engineering principles apply to the following attack scenario?
An attacker impersonates a company’s managing staff member to manipulate a lower rank employee into disclosing confidential data. The attacker informs the victim that the information is essential for a task that needs to be completed within the business hours on the same day and mentions potential financial losses for the company in case the victim refuses to comply.

Answer 4

Urgency
Authority
Intimidation

Question 5

Which social engineering principles apply to the following attack scenario?
An attacker impersonating a software beta tester replies to a victim’s post in a forum thread discussing the best options for affordable productivity software. A while later, he/she follows up by sending the victim private message mentioning the discussion thread and offering free access to a closed beta version of a fake office app.

Answer 5

Scarcity
Familiarity
Trust

Question 6

Which social engineering principle applies to the following attack scenario? While conducting a web research that would help in making a better purchasing decision, a user visits series of Facebook pages and blogs containing fake reviews and testimonials in favor of a paid app intentionally infected with malware.

Answer 6

Consensus

Question 7

An attempt to flood the bandwidth or resources of a targeted system so that it becomes overwhelmed with false requests and in result doesn’t have time or resources to handle legitimate requests is called:

Answer 7

DoS attack

Question 8

As opposed to the simple Denial of Service (DoS) attacks that usually are performed from a single system, a Distributed Denial of Service (DDoS) attack uses multiple compromised computer systems to perform the attack against its target. The intermediary systems that are used as platform for the attack are the secondary victims of the DDoS attack; they are often referred to as zombies, and collectively as a botnet.

Answer 8

True

Question 9

Which of the following attacks relies on intercepting and altering data sent between two networked hosts?
Zero-day attack
MITM attack
Watering hole attack
Replay attack

Answer 9

MITM attack

Question 10

A type of exploit that relies on overwriting contents of memory to cause unpredictable results in an application is known as:

Answer 10

Buffer overflow

Question 11

Entry fields of web forms lacking input validation are vulnerable to what kind of attacks?

Answer 11

SQL injection attacks

Question 12

Which of the answers below refers to a common target of cross-site scripting (XSS)?
Physical security
Alternate sites
Dynamic web pages
Removable storage

Answer 12

Dynamic web pages

Question 13

Cross-site request forgery (CSRF/XSRF) is a security exploit that allows for infecting a website with malicious code. The malicious code, often in the form of JavaScript, can then be sent to the unsuspecting user and executed via the user’s web browser application.

Answer 13

False

Question 14

Which type of attack allows for tricking a user into sending unauthorized commands to a web application?

Answer 14

CSRF

XSRF

Question 15

Which of the following facilitates privilege escalation attacks?

Answer 15

System/application vulnerability
Social engineering techniques
System/application misconfiguration

Question 16

An attacker managed to associate his/her MAC address with the IP address of the default gateway. In result, a targeted host is sending network traffic to the attacker’s IP address instead of the IP address of the default gateway. Based on the given info, which type of attack is taking place in this scenario?

Answer 16

ARP poisoning

Question 17

Which of the attack types listed below relies on the amplification effect?
Zero-day attack
DDoS attack
Brute force attack
MITM attack

Answer 17

DDoS attack

Question 18

Remapping a domain name to a rogue IP address is an example of what kind of exploit?

Answer 18

DNS poisoning

Question 19

The term “Domain hijacking” refers to a situation in which a domain registrant due to unlawful actions of third parties loses control over his/her domain name. (True of False)

Answer 19

True

Question 20

Which of the terms listed below refers to a computer security exploit that takes advantage of vulnerabilities in a user's web browser application?
MTTR
MITM
MTFB
MITB

Answer 20

MITB

Question 21

A type of attack aimed at exploiting vulnerability that is present in already released software but unknown to the software developer is called:

Answer 21

Zero-day attack

Question 22

A replay attack occurs when an attacker intercepts data and tries to use this information later to impersonate the user to obtain unauthorized access to resources on a network. (True or False)

Answer 22

True

Question 23

A technique that allows an attacker to authenticate to a remote server without extracting a cleartext password from the digest and use the digest instead of a password credential is known as:

Answer 23

Pass the hash

Question 24

In computer security, the term “Clickjacking” refers to a malicious technique of tricking a user into clicking on something different from what the user thinks they are clicking on. (True or False)

Answer 24

True

Question 25

In a session hijacking attack, a hacker takes advantage of the session ID stored in:

Answer 25

Cookie