Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Pentest+ PT0-002 > Specialized and Fragile Systems > Flashcards

Specialized and Fragile Systems Flashcards

1
Q

What is the process of installing applications that are unapproved for the device or that came from a source that is unapproved?

A

Sideloading

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the process of exploiting a software vulnerability in a mobile OS that enables low-level execution with elevated privileges to bypass security mechanisms in a mobile OS?

A

Jailbreaking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the four classifications of a jailbroken device?

A
  1. Untethered - can be powered on and off without the help of a computer
  2. Tethered - a computer and software are required to boot the jailbroken device each time
  3. Semi-tethered - if the device is rebooted, you will need to jailbreak the device again to patch the kernel using a computer
  4. Semi-untethered - Same as semi-tethered but can be accomplished using the jailbreak app that is already installed on the device
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the difference between an emulator and a simulator for mobile devices?

A

An emulator will mimic the hardware and operating system for the application being tested, but a simulator will only mimic the software environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a tool Apple provides to allow researches to test iOS without having to defeat Apple’s protection mechanisms?

A

Apple Security Research Device (Apple SRD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What kind of devices are mobile devices typically built on?

A

System on Chip (SoC), which is an integrated circuit that connects together common components that makes up a mobile device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What kind of interface is a hardware mechanism used for debugging and connecting to embedded devices on a circuit board?

A

JTAG - Joint Test Action Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Though what feature does Apple mark memory locations as nonexecutable on its devices?

A

Execute Never (XN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

For iOS, how do third-party applications gain access to user information and extensions or other features?

A

Through dedicated entitlements, which are key-value pairs that allow authentication for applications outside of normal runtime parameters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

On which layer of a mobile Android voice do users interact?

A

Application layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the primary components of an Android application?

A
  1. Activities - parts of the application the user can see
  2. Fragments - A behavior that is placed in an activity
  3. Intents - Used for sending messages between other components
  4. Broadcast receivers - Allow an application to receive notifications from other apps
  5. Content providers - A SQLite database to store data in the form of a flat file
  6. Services - Used to start intents, send notifications, and process data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which layer of the Android operating system interacts with built-in hardware components on the device?

A

HAL - Hardware Abstraction Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which standard describes the common areas of concern to be evaluated during mobile pentests?

A

The OWASP Mobile App Security Checklist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the difference between hybrid and progressive web apps?

A

Hybrid apps are a combination of web and native applications. They use a web-to-native abstraction layer to use both web and native features. Progressive web apps load like web pages, but allow offline use and can access limited device functions depending on the platform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does Apple ensure only approved applications are run in iOS?

A

Using code signing via certificate validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What tool is a GUI used to install IPA files to an iDevice?

A

Cydia Impractor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the app store for “jailbroken” iDevices?

A

Cydia Package Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a modular framework designed for assessing the security of mobile apps on iOS, Android, Windows, Linux, macOS, and QNX?

A

Frida

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the three modes of Frida testing?

A

Injected, embedded, and preloaded

20
Q

What tool can you use to bypass SSL pinning, which is how applications sometimes communicate to external server back-ends?

A

Objection

21
Q

What is an all-in-one automated pentesting framework for mobile applications for Android, iOS, and Windows platforms?

A

MobSF (Mobile Security Framework)

22
Q

When you have physical access to your Android devices, what is the most reliable way to connect to it?

A

The Android Debug Bridge (ADB).

23
Q

What is a reverse-engineering framework for disassembling and rebuilding Android applications?

A

APK Studio

24
Q

If you receive an “Unsupported major.minor version…” error in the APK Studio console window when opening an APK, what is the likely reason?

A

You are running an older version of JRE and try installing a newer version of the Java SDK

25
Q

What is a security auditing framework for Android that can help pentesters identify vulnerabilities and validate them with exploitation?

A

Drozer

26
Q

What is a free tool for building and interacting with APIs?

A

Postman

27
Q

What is a free tool that can be used as an interception proxy, and can work independently or with Burp Suite to enumerate and attack API endpoints?

A

Postman

28
Q

Which part of a virtual machine handles hardware virtualization and resource management for each guest it hosts?

A

Hypervisor

29
Q

What are commercial systems that are considered high-value targets because their embedded controllers systems have direct control over the hardware of their host systems?

A

Intelligent Platform Management Interface (IPMI)

30
Q

What kind of systems relate to industry automation of all types, including manufacturing, power generation, water treatment and distribution systems?

A

Industrial Control Systems (ICS)

31
Q

Which component of ICS systems pulls data and coordinate transfer of data to a centralized place so it can be controlled?

A

Supervisory control and data acquisition (SCADA)

32
Q

What are the common components of a SCADA system?

A
  1. Supervisory workstation
  2. Remote terminal unit
  3. Programmable logic controller
  4. Communication infrastructure
  5. Human-machine interface
33
Q

What is an Nmap NSE script that enumerates SCADA modules and collects device and vendor information available?

A

modbus-discover, and it operates on port 502

34
Q

What kinds of systems are made up of a combination of computer hardware and software designed and programmed for a specific purpose?

A

Embedded systems

35
Q

What are the three kinds of Real-Time Operating Systems (RTOS)?

A

Hard, firm, and soft

36
Q

What is the name of the user interface framework that enables developers to build software applications on the iOS platform?

A

Cocoa Touch

37
Q

What is an advantage of developing a mobile application in Swift versus Objective-C?

A

Swift is a modern-day language that closely resembles English

38
Q

Apple users code signing to ensure only approved applications are installed on the iDevice. This is one of the core security features of iOS. Which method can you use on a supported iDevice to gain privileged-level access?

A

Jailbreaking

39
Q

The Android platform provides core components that are used to enhance the user’s experience with the product. Which type of component is sometimes visible to the user and helps provide a cohesive user experience in mobile applications?

A

Activities

40
Q

Older versions of the Android operating system (5.0 and earlier) do not use Android Runtime (ART); they use Dalvik Virtual Machine. Smali files, written in a type of assembly, are created during what process?

A

Disassembling DEX executables.

41
Q

An IEEE standard used to address the issue of debugging and connecting to embedded systems on a circuit board is called what?

A

JTAG

42
Q

SSH and iProxy are two ways of connecting to jailbroken iDevices. If the iDevice fails and you have to re-establish connectivity, what is the easiest way to ensure there are no iProxy processes still running on your MacOS laptop?

A

killall iproxy

43
Q

After installing a customer’s mobile application from the Google Play Store to your jailbroken iPhone, your next step is to dump the application bundle into an IPA using Clutch so you can use it to conduct static analysis. By default, where does Clutch store IPA files postprocessing?

A

/var/tmp/clutch

44
Q

Properly list (plist) files contain configuration data about an app installed on iOS. By default, Apple best security practices implement a security feature called App Transport Security (ATS) to improve data privacy and integrity. However, there is a way to bypass this within the application settings in the plist files. What is the name of the key used to control the behavior of http connections?

A

NSAppTransportSecurity

45
Q

What are two method you can use to install third-party applications to a jailbroken iDevice?

A

Cydia and Impractor tool

46
Q

What is the correct command option to use with the Android Debug Bridge (ADB) that enables you to download files from the Android device?

A

pull

47
Q

Using Drozer to conduct an Android assessment of two separate applications that share the same vendor, you can execute the command rum app package.list to list the permission of the application. You observe in the report that applications are permitted to read and write files on external storage. Which component of the application would you want to test for injection flaws?

A

Content provider. Content providers could provide an injection point from within the application. Some mobile applications share the same external storage locations. Thus, if an injection point could be exploited, it could enable a malicious user to read content outside of the sandbox environment of the application.

Pentest+ PT0-002 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions