Quiz
Preparatorio
Erstelle ein kostenloses Konto, um dieses Quiz zu beenden
Speichere deinen Fortschritt und sieh dir dein Endergebnis an.
oder mit deiner E-Mail registrieren
Schon ein Konto? Anmelden
Fragen in diesem Quiz (200)
1A security consultant decides to use multiple layers of anti-virus defense, such as end user
desktop anti-virus and E-mail gateway. This approach can be used to mitigate which kind of attack?- AForensic attack
- BARP spoofing attack
- CSocial engineering attack
- DScanning attack
2NO.3 Code injection is a form of attack in which a malicious user:
- AInserts text into a data field that gets interpreted as code
- BGets the server to execute arbitrary code using a buffer overflow
- CInserts additional code into the JavaScript running in the browser
- DGains access to the codebase on the server and inserts new code
3NO.4 Sid is a judge for a programming contest. Before the code reaches him it goes through a
restricted OS and is tested there. If it passes, then it moves onto Sid. What is this middle step called?- AFuzzy-testing the code
- BThird party running the code
- CSandboxing the code
- DString validating the code
4The Payment Card Industry Data Security Standard (PCI DSS) contains six different categories of
control objectives. Each objective contains one or more requirements, which must be followed in
order to achieve compliance. Which of the following requirements would best fit under the objective,
"Implement strong access control measures"?- ARegularly test security systems and processes.
- BEncrypt transmission of cardholder data across open, public networks.
- CAssign a unique ID to each person with computer access.
- DUse and regularly update anti-virus software on all systems commonly affected by malware.
5Which of the following act requires employer's standard national numbers to identify them on
standard transactions?- ASOX
- BHIPAA
- CDMCA
- DPCI-DSS
6Which of the following is an NMAP script that could help detect HTTP Methods such as GET,
POST, HEAD, PUT, DELETE, TRACE?- Ahttp-git
- Bhttp-headers
- Chttp enum
- Dhttp-methods
7Fred is the network administrator for his company. Fred is testing an internal switch.
From an external IP address, Fred wants to try and trick this switch into thinking it already has
established a session with his computer. How can Fred accomplish this?- AFred can accomplish this by sending an IP packet with the RST/SIN bit and the source address of his computer.
- BHe can send an IP packet with the SYN bit and the source address of his computer.
- CFred can send an IP packet with the ACK bit set to zero and the source address of the switch.
- DFred can send an IP packet to the switch with the ACK bit and the source address of his machine.
8What is the process of logging, recording, and resolving events that take place in an
organization?- AIncident Management Process
- BSecurity Policy
- CInternal Procedure
- DMetrics
9NO.10 A hacker has managed to gain access to a Linux host and stolen the password file from
/etc/passwd. How can he use it?- AThe password file does not contain the passwords themselves.
- BHe can open it and read the user ids and corresponding passwords.
- CThe file reveals the passwords to the root user only.
- DHe cannot read it because it is encrypted.
10What is the most secure way to mitigate the theft of corporate information from a laptop
IT Certification Guaranteed, The Easy Way! that was left in a hotel room?- ASet a BIOS password.
- BEncrypt the data on the hard drive.
- CUse a strong logon password to the operating system.
- DBack up everything on the laptop and store the backup in a safe place.
11You are manually conducting Idle Scanning using Hping2. During your scanning you notice
that almost every query increments the IPID regardless of the port being queried. One or two of the
queries cause the IPID to increment by more than one value. Why do you think this occurs?- AThe zombie you are using is not truly idle.
- BA stateful inspection firewall is resetting your queries.
- CHping2 cannot be used for idle scanning.
- DThese ports are actually open on the target system.
12Darius is analysing IDS logs. During the investigation, he noticed that there was nothing
suspicious found and an alert was triggered on normal web application traffic. He can mark this alert
as:- AFalse-Negative
- BFalse-Positive
- CTrue-Positive
- DFalse-Signature
13What is the proper response for a NULL scan if the port is closed?
- ASYN
- BACK
- CFIN
- DPSH
- ERST
- FNo response
14The Open Web Application Security Project (OWASP) is the worldwide not-for-profit
charitable organization focused on improving the security of software. What item is the primary
concern on OWASP's Top Ten Project Most Critical Web Application Security Risks?- AInjection
- BCross Site Scripting
- CCross Site Request Forgery
- DPath disclosure
15A recent security audit revealed that there were indeed several occasions that the company's
network was breached. After investigating, you discover that your IDS is not configured properly and
therefore is unable to trigger alarms when needed. What type of alert is the IDS giving?- ATrue Positive
- BFalse Negative
- CFalse Positive
- DTrue Negative
16A Network Administrator was recently promoted to Chief Security Officer at a local university.
One of employee's new responsibilities is to manage the implementation of an RFID card access
system to a new server room on campus. The server room will house student enrollment information
that is securely backed up to an off-site location.
During a meeting with an outside consultant, the Chief Security Officer explains that he is concerned
that the existing security controls have not been designed properly. Currently, the Network
Administrator is responsible for approving and issuing RFID card access to the server room, as well as
reviewing the electronic access logs on a weekly basis.
Which of the following is an issue with the situation?- ASegregation of duties
- BUndue influence
- CLack of experience
- DInadequate disaster recovery plan
17Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?
- AIncident response services to any user, company, government agency, or organization in
partnership with the Department of Homeland Security - BMaintenance of the nation's Internet infrastructure, builds out new Internet infrastructure, and decommissions old Internet infrastructure
- CRegistration of critical penetration testing for the Department of Homeland Security and public and private sectors
- DMeasurement of key vulnerability assessments on behalf of the Department of Defense (DOD) and State Department, as well as private sectors
- AIncident response services to any user, company, government agency, or organization in
18Which of the following is used to indicate a single-line comment in structured query language
(SQL)?- A--
- B||
- C%%
- D''
19Supposed you are the Chief Network Engineer of a certain Telco. Your company is planning
for a big business expansion and it requires that your network authenticate users connecting using
analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks
(VPN) over a Frame Relay network. Which AAA protocol would you implement?- ATACACS+
- BDIAMETER
- CKerberos
- DRADIUS
20Which of the following lists are valid data-gathering activities associated with a risk
assessment?- AThreat identification, vulnerability identification, control analysis
- BThreat identification, response identification, mitigation identification
- CAttack profile, defense profile, loss profile
- DSystem profile, vulnerability identification, security determination
21Which of the following command line switch would you use for OS detection in Nmap?
- A-D
- B-O
- C-P
- D-X
22A security consultant is trying to bid on a large contract that involves penetration testing and
reporting. The company accepting bids wants proof of work so the consultant prints out several
audits that have been performed. Which of the following is likely to occur as a result?- AThe consultant will ask for money on the bid because of great work.
- BThe consultant may expose vulnerabilities of other companies.
- CThe company accepting bids will want the same type of format of testing.
- DThe company accepting bids will hire the consultant because of the great work performed.
23What type of vulnerability/attack is it when the malicious person forces the user's browser to send an authenticated request to a server?
- ACross-site request forgery
- BCross-site scripting
- CSession hijacking
- DServer side request forgery
24Which of the following is a hashing algorithm?
- AMD5
- BPGP
- CDES
- DROT13
25A security engineer has been asked to deploy a secure remote access solution that will allow
employees to connect to the company's internal network. Which of the following can be
implemented to minimize the opportunity for the man-in-the-middle attack to occur?- ASSL
- BMutual authentication
- CIPSec
- DStatic IP addresses
26On a Linux device, which of the following commands will start the Nessus client in the
background so that the Nessus server can be configured?- Anessus +
- Bnessus *s
- Cnessus &
- Dnessus -d
27If an attacker uses the command SELECT*FROM user WHERE name = 'x' AND userid IS NULL;
--'; which type of SQL injection attack is the attacker performing?- AEnd of Line Comment
- BUNION SQL Injection
- CIllegal/Logically Incorrect Query
- DTautology
28A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer
program in a switched environment network. Which attack could the hacker use to sniff all of the
packets in the network?- AFraggle
- BMAC Flood
- CSmurf
- DTear Drop
29Least privilege is a security concept that requires that a user is
- Alimited to those functions required to do the job.
- Bgiven root or administrative privileges.
- Ctrusted to keep all data and access to that data under their sole control.
- Dgiven privileges equal to everyone else in the department.
30Which DNS resource record can indicate how long any "DNS poisoning" could last?
- AMX
- BSOA
- CNS
- DTIMEOUT
31During the process of encryption and decryption, what keys are shared?
- APrivate keys
- BUser passwords
- CPublic keys
- DPublic and private keys
32Using Windows CMD, how would an attacker list all the shares to which the current user
context has access?- ANET USE
- BNET CONFIG
- CNET FILE
- DNET VIEW
33What does the following command in netcat do?
nc -l -u -p55555 < /etc/passwd- Alogs the incoming connections to /etc/passwd file
- Bloads the /etc/passwd file to the UDP port 55555
- Cgrabs the /etc/passwd file when connected to UDP port 55555
- Ddeletes the /etc/passwd file when connected to the UDP port 55555
34Sandra is the security administrator of XYZ.com. One day she notices that the XYZ.com Oracle
database server has been compromised and customer information along with financial data has been
stolen. The financial loss will be estimated in millions of dollars if the database gets into the hands of
competitors. Sandra wants to report this crime to the law enforcement agencies immediately. Which
organization coordinates computer crime investigations throughout the United States?- ANDCA
- BNICP
- CCIRP
- DNPC
- ECIA
35Which of the following is a characteristic of Public Key Infrastructure (PKI)?
- APublic-key cryptosystems are faster than symmetric-key cryptosystems.
- BPublic-key cryptosystems distribute public-keys within digital signatures.
- CPublic-key cryptosystems do not require a secure key distribution channel.
- DPublic-key cryptosystems do not provide technical non-repudiation via digital signatures.
36A network administrator received an administrative alert at 3:00 a.m. from the intrusion
detection system. The alert was generated because a large number of packets were coming into the
network over ports 20 and 21.
During analysis, there were no signs of attack on the FTP servers. How should the administrator
classify this situation?- ATrue negatives
- BFalse negatives
- CTrue positives
- DFalse positives
37In the OSI model, where does PPTP encryption take place?
- ATransport layer
- BApplication layer
- CData link layer
- DNetwork layer
38Websites and web portals that provide web services commonly use the Simple Object Access Protocol SOAP.
Which of the following is an incorrect definition or characteristics in the protocol?- ABased on XML
- BProvides a structured model for messaging
- CExchanges data between web services
- DOnly compatible with the application protocol HTTP
39A common cryptographical tool is the use of XOR. XOR the following binary values:
10110001
00111010- A10001011
- B11011000
- C10011101
- D10111100
40Which of the following resources does NMAP need to be used as a basic vulnerability scanner
covering several vectors like SMB, HTTP and FTP?- AMetasploit scripting engine
- BNessus scripting engine
- CNMAP scripting engine
- DSAINT scripting engine
41During a recent security assessment, you discover the organization has one Domain Name
Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.
What is this type of DNS configuration commonly called?- ASplit DNS
- BDNSSEC
- CDynDNS
- DDNS Scheme
42A security administrator notices that the log file of the company's webserver contains
suspicious entries:
Based on source code analysis, the analyst concludes that the login.php script is vulnerable to
- Acommand injection.
- BSQL injection.
- Cdirectory traversal.
- DLDAP injection.
43PGP, SSL, and IKE are all examples of which type of cryptography?
- APublic Key
- BSecret Key
- CHash Algorithm
- DDigest
44Which of the following commands runs snort in packet logger mode?
- A./snort -dev -h ./log
- B./snort -dev -l ./log
- C./snort -dev -o ./log
- D./snort -dev -p ./log
45An Internet Service Provider (ISP) has a need to authenticate users connecting using analog
modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN)
over a Frame Relay network.
Which AAA protocol is most likely able to handle this requirement?- ARADIUS
- BDIAMETER
- CKerberos
- DTACACS+
46Smart cards use which protocol to transfer the certificate in a secure manner?
- AExtensible Authentication Protocol (EAP)
- BPoint to Point Protocol (PPP)
- CPoint to Point Tunneling Protocol (PPTP)
- DLayer 2 Tunneling Protocol (L2TP)
47Every company needs a formal written document which spells out to employees precisely
what they are allowed to use the company's systems for, what is prohibited, and what will happen to
them if they break the rules. Two printed copies of the policy should be given to every employee as
soon as possible after they join the organization. The employee should be asked to sign one copy,
which should be safely filed by the company. No one should be allowed to use the company's
computer systems until they have signed the policy in acceptance of its terms.
What is this document called?- AInformation Audit Policy (IAP)
- BInformation Security Policy (ISP)
- CPenetration Testing Policy (PTP)
- DCompany Compliance Policy (CCP)
48One way to defeat a multi-level security solution is to leak data via
- Aa bypass regulator.
- Bsteganography.
- Ca covert channel.
- Dasymmetric routing.
49Your next door neighbor, that you do not get along with, is having issues with their network,
so he yells to his spouse the network's SSID and password and you hear them both clearly. What do
you do with this information?- ANothing, but suggest to him to change the network's SSID and password.
- BSell his SSID and password to friends that come to your house, so it doesn't slow down your network.
- CLog onto to his network, after all it's his fault that you can get in.
- DOnly use his network when you have large downloads so you don't tax your own network.
50A security analyst is performing an audit on the network to determine if there are any
deviations from the security policies in place. The analyst discovers that a user from the IT
department had a dial-out modem installed. Which security policy must the security analyst check to
see if dial-out modems are allowed?- AFirewall-management policy
- BAcceptable-use policy
- CRemote-access policy
- DPermissive policy
51You just set up a security system in your network. In what kind of system would you find the
following string of characters used as a rule within its configuration?
alert tcp any any -> 192.168.100.0/24 21 (msg: "FTP on the network!";)- AAn Intrusion Detection System
- BA firewall IPTable
- CA Router IPTable
- DFTP Server rule
52Which of the following open source tools would be the best choice to scan a network for
potential targets?- ANMAP
- BNIKTO
- CCAIN
- DJohn the Ripper
53Which of the following is the successor of SSL?
- ATLS
- BRSA
- CGRE
- DIPSec
54Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN
standards on a linux platform?- AKismet
- BNessus
- CNetstumbler
- DAbel
55Joseph was the Web site administrator for the Mason Insurance in New York, who's main
Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to
administer the Web site. One night, Joseph received an urgent phone call from his friend, Smith.
According to Smith, the main Mason Insurance web site had been vandalized! All of its normal
content was removed and replaced with an attacker's message ''Hacker Message: You are dead!
Freaks!" From his office, which was directly connected to Mason Insurance's internal network, Joseph
surfed to the Web site using his laptop. In his browser, the Web site looked completely intact.
No changes were apparent. Joseph called a friend of his at his home to help troubleshoot the
problem. The Web site appeared defaced when his friend visited using his DSL connection. So, while
Smith and his friend could see the defaced page, Joseph saw the intact Mason Insurance web site. To
help make sense of this problem, Joseph decided to access the Web site using hisdial-up ISP. He
disconnected his laptop from the corporate internal network and used his modem to dial up the
same ISP used by Smith. After his modem connected, he quickly typed www.masonins.com in his
browser to reveal the following web page:
After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal
network, and used Secure Shell (SSH) to log in directly to the Web server. He ran Tripwire against the
entire Web site, and determined that every system file and all the Web content on the server were
intact. How did the attacker accomplish this hack?
- AARP spoofing
- BSQL injection
- CDNS poisoning
- DRouting table injection
56Under what conditions does a secondary name server request a zone transfer from a primary
name server?- AWhen a primary SOA is higher that a secondary SOA
- BWhen a secondary SOA is higher that a primary SOA
- CWhen a primary name server has had its service restarted
- DWhen a secondary name server has had its service restarted
- EWhen the TTL falls to zero
57Which of the following can take an arbitrary length of input and produce a message digest
output of 160 bit?- ASHA-1
- BMD5
- CHAVAL
- DMD4
58You went to great lengths to install all the necessary technologies to prevent hacking attacks,
such as expensive firewalls, antivirus software, anti-spam systems and intrusion detection/prevention
tools in your company's network. You have configured the most secure policies and tightened every
device on your network. You are confident that hackers will never be able to gain access to your
network with complex security system in place.
Your peer, Peter Smith who works at the same department disagrees with you.
He says even the best network security technologies cannot prevent hackers gaining access to the
network because of presence of "weakest link" in the security chain.
What is Peter Smith talking about?- AUntrained staff or ignorant computer users who inadvertently become the weakest link in your security chain
- B"zero-day" exploits are the weakest link in the security chain since the IDS will not be able to detect these attacks
- C"Polymorphic viruses" are the weakest link in the security chain since the Anti-Virus scanners will not be able to detect these attacks
- DContinuous Spam e-mails cannot be blocked by your security system since spammers use different techniques to bypass the filters in your gateway
59Which of the following types of firewalls ensures that the packets are part of the established
session?- AStateful inspection firewall
- BCircuit-level firewall
- CApplication-level firewall
- DSwitch-level firewall
60You are a Network Security Officer. You have two machines. The first machine (192.168.0.99)
has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a
syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from
snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi
syslog machine.
What wireshark filter will show the connections from the snort machine to kiwi syslog machine?- Atcp.dstport==514 && ip.dst==192.168.0.150
- Btcp.srcport==514 && ip.src==192.168.0.99
- Ctcp.dstport==514 && ip.dst==192.168.0.0/16
- Dtcp.srcport==514 && ip.src==192.168.150
61Which of the following can the administrator do to verify that a tape backup can be
recovered in its entirety?- ARestore a random file.
- BPerform a full restore.
- CRead the first 512 bytes of the tape.
- DRead the last 512 bytes of the tape.
62What would you type on the Windows command line in order to launch the Computer
Management Console provided that you are logged in as an admin?- Ac:\compmgmt.msc
- Bc:\gpedit
- Cc:\ncpa.cpl
- Dc:\services.msc
63What is the role of test automation in security testing?
- AIt can accelerate benchmark tests and repeat them with a consistent test setup. But it cannot replace manual testing completely.
- BIt is an option but it tends to be very expensive.
- CIt should be used exclusively. Manual testing is outdated because of low speed and possible test setup inconsistencies.
- DTest automation is not usable in security due to the complexity of the tests.
64Which of the following programming languages is most vulnerable to buffer overflow
attacks?- APerl
- BC++
- CPython
- DJava
65You want to do an ICMP scan on a remote computer using hping2. What is the proper syntax?
- Ahping2 host.domain.com
- Bhping2 --set-ICMP host.domain.com
- Chping2 -i host.domain.com
- Dhping2 -1 host.domain.com
66Which of the following tools is used to analyze the files produced by several packet-capture
programs such as tcpdump, WinDump, Wireshark, and EtherPeek?- Atcptrace
- Btcptraceroute
- CNessus
- DOpenVAS
67Which protocol is used for setting up secured channels between two devices, typically in
VPNs?- AIPSEC
- BPEM
- CSET
- DPPP
68What is the approximate cost of replacement and recovery operation per year of a hard drive
that has a value of $300 given that the technician who charges $10/hr would need 10 hours to
restore OS and Software and needs further 4 hours to restore the database from the last backup to
the new hard disk? Calculate the SLE, ARO, and ALE. Assume the EF = 1 (100%).- A$440
- B$100
- C$1320
- D$146
69A recently hired network security associate at a local bank was given the responsibility to
perform daily scans of the internal network to look for unauthorized devices. The employee decides
to write a script that will scan the network for unauthorized devices every morning at 5:00 am.
Which of the following programming languages would most likely be used?- APHP
- BC#
- CPython
- DASP.NET
70As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external
security assessment through penetration testing.
What document describes the specifics of the testing, the associated violations, and essentially
protects both the organization's interest and your liabilities as a tester?- ATerms of Engagement
- BProject Scope
- CNon-Disclosure Agreement
- DService Level Agreement
71When comparing the testing methodologies of Open Web Application Security Project
(OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is- AOWASP is for web applications and OSSTMM does not include web applications.
- BOSSTMM is gray box testing and OWASP is black box testing.
- COWASP addresses controls and OSSTMM does not.
- DOSSTMM addresses controls and OWASP does not.
72Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is the best protection that will work for her?
- Astolen. What is the best protection that will work for her?
- BHidden folders
- CBIOS password
- DFull disk encryption.
73The establishment of a TCP connection involves a negotiation called 3 way handshake. What
type of message sends the client to the server in order to begin this negotiation?- ARST
- BACK
- CSYN-ACK
- DSYN
74Which protocol is used for setting up secure channels between two devices, typically in
VPNs?- APPP
- BIPSEC
- CPEM
- DSET
75What term describes the amount of risk that remains after the vulnerabilities are classified
and the countermeasures have been deployed?- AResidual risk
- BInherent risk
- CDeferred risk
- DImpact risk
76Peter, a Network Administrator, has come to you looking for advice on a tool that would help
him perform SNMP enquires over the network.
Which of these tools would do the SNMP enumeration he is looking for? Select the best answers.- ASNMPUtil
- BSNScan
- CSNMPScan
- DSolarwinds IP Network Browser
- ENMap
77Which of the following represents the initial two commands that an IRC client sends to join an
IRC network?- AUSER, NICK
- BLOGIN, NICK
- CUSER, PASS
- DLOGIN, USER
78An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML
code to embed a malicious applet in all HTTP connections.
When users accessed any page, the applet ran and exploited many machines.
Which one of the following tools the hacker probably used to inject HTML code?- AWireshark
- BEttercap
- CAircrack-ng
- DTcpdump
79Which of the following is a wireless network detector that is commonly found on Linux?
- AKismet
- BAbel
- CNetstumbler
- DNessus
80Craig received a report of all the computers on the network that showed all the missing
patches and weak passwords. What type of software generated this report?- Aa port scanner
- Ba vulnerability scanner
- Ca virus scanner
- Da malware scanner
81Which of the following antennas is commonly used in communications for a frequency band
of 10 MHz to VHF and UHF?- AOmnidirectional antenna
- BDipole antenna
- CYagi antenna
- DParabolic grid antenna
82What is the name of the international standard that establishes a baseline level of confidence
in the security functionality of IT products by providing a set of requirements for evaluation?- ABlue Book
- BISO 26029
- CCommon Criteria
- DThe Wassenaar Agreement
83Switches maintain a CAM Table that maps individual MAC addresses on the network to
physical ports on the switch.
In MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source
MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC
addresses to physical ports. What happens when the CAM table becomes full?
- ASwitch then acts as hub by broadcasting packets to all machines on the network
- BThe CAM overflow table will cause the switch to crash causing Denial of Service
- CThe switch replaces outgoing frame switch factory default MAC address of FF:FF:FF:FF:FF:FF
- DEvery packet is dropped and the switch sends out SNMP alerts to the IDS port
84A company recently hired your team of Ethical Hackers to test the security of their network
systems. The company wants to have the attack be as realistic as possible. They did not provide any
information besides the name of their company. What phase of security testing would your team
jump in right away?- AScanning
- BReconnaissance
- CEscalation
- DEnumeration
85Study the snort rule given below:
From the options below, choose the exploit against which this rule applies.
- AWebDav
- BSQL Slammer
- CMS Blaster
- DMyDoom
86Which of the following programming languages is most susceptible to buffer overflow
attacks, due to its lack of a built-in-bounds checking mechanism?
Output:
Segmentation fault
- AC#
- BPython
- CJava
- DC++
87You have compromised a server and successfully gained a root access. You want to pivot and
pass traffic undetected over the network and evade any possible Intrusion Detection System.
What is the best approach?- AInstall Cryptcat and encrypt outgoing packets from this server.
- BInstall and use Telnet to encrypt all outgoing traffic from this server.
- CUse Alternate Data Streams to hide the outgoing packets from this server.
- DUse HTTP so that all traffic can be routed via a browser, thus evading the internal Intrusion
Detection Systems.
88If you want only to scan fewer ports than the default scan using Nmap tool, which option
would you use?- A-sP
- B-P
- C-r
- D-F
89The Heartbleed bug was discovered in 2014 and is widely referred to under MITRE's Common
Vulnerabilities and Exposures (CVE) as CVE-2014-0160. This bug affects the OpenSSL implementation
of the transport layer security (TLS) protocols defined in RFC6520.
What type of key does this bug leave exposed to the Internet making exploitation of any
compromised system very easy?- APrivate
- BPublic
- CShared
- DRoot
90Which of the following network attacks relies on sending an abnormally large packet size that
exceeds TCP/IP specifications?- APing of death
- BSYN flooding
- CTCP hijacking
- DSmurf attack
91Which of the following tools can be used for passive OS fingerprinting?
- Atcpdump
- Bnmap
- Cping
- Dtracert
92Which method can provide a better return on IT security investment and provide a thorough
and comprehensive assessment of organizational security covering policy, procedure design, and
implementation?- APenetration testing
- BSocial engineering
- CVulnerability scanning
- DAccess control list reviews
93You receive an e-mail like the one shown below. When you click on the link contained in the
mail, you are redirected to a website seeking you to download free Anti-Virus software.
Dear valued customers,
We are pleased to announce the newest version of Antivirus 2010 for Windows which will probe you
with total security against the latest spyware, malware, viruses, Trojans and other online threats.
Simply visit the link below and enter your antivirus code:
or you may contact us at the following address:
Media Internet Consultants, Edif. Neptuno, Planta
Baja, Ave. Ricardo J. Alfaro, Tumba Muerto, n/a Panama
How will you determine if this is Real Anti-Virus or Fake Anti-Virus website?
- ALook at the website design, if it looks professional then it is a Real Anti-Virus website
- BConnect to the site using SSL, if you are successful then the website is genuine
- CSearch using the URL and Anti-Virus product name into Google and lookout for suspicious
warnings against this site - DDownload and install Anti-Virus software from this suspicious looking site, your Windows 7 will prompt you and stop the installation if the downloaded file is a malware
94You've gained physical access to a Windows 2008 R2 server which has an accessible disc
drive. When you attempt to boot the server and log in, you are unable to guess the password. In your
tool kit you have an Ubuntu 9.10 Linux LiveCD. Which Linux based tool has the ability to change any
user's password or to activate disabled Windows accounts?- ACHNTPW
- BCain & Abel
- CSET
- DJohn the Ripper
95Which protocol and port number might be needed in order to send log messages to a log
analysis tool that resides behind a firewall?- AUDP 123
- BUDP 541
- CUDP 514
- DUDP 415
96Which of the following tools will scan a network to perform vulnerability checks and
compliance auditing?- ANMAP
- BMetasploit
- CNessus
- DBeEF
97Which of the following processes of PKI (Public Key Infrastructure) ensures that a trust
relationship exists and that a certificate is still valid for specific operations?- ACertificate issuance
- BCertificate validation
- CCertificate cryptography
- DCertificate revocation
98Which of the following describes the characteristics of a Boot Sector Virus?
- AMoves the MBR to another location on the hard disk and copies itself to the original location of the MBR
- BMoves the MBR to another location on the RAM and copies itself to the original location of the MBR
- CModifies directory table entries so that directory entries point to the virus code instead of the actual program
- DOverwrites the original MBR and only executes the new virus code
99Bob is doing a password assessment for one of his clients. Bob suspects that security policies
are not in place.
He also suspects that weak passwords are probably the norm throughout the company he is
evaluating. Bob is familiar with password weaknesses and key loggers.
Which of the following options best represents the means that Bob can adopt to retrieve passwords
from his clients hosts and servers?- AHardware, Software, and Sniffing.
- BHardware and Software Keyloggers.
- CPasswords are always best obtained using Hardware key loggers.
- DSoftware only, they are the most effective.
100The chance of a hard drive failure is once every three years. The cost to buy a new hard
drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will
require a further 4 hours to restore the database from the last backup to the new hard disk. The
recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1 (100%).
What is the closest approximate cost of this replacement and recovery operation per year?- A$146
- B$1320
- C$440
- D$100
101You are logged in as a local admin on a Windows 7 system and you need to launch the
Computer Management Console from command line.
Which command would you use?- Ac:\compmgmt.msc
- Bc:\services.msc
- Cc:\ncpa.cp
- Dc:\gpedit
102Which Open Web Application Security Project (OWASP) implements a web application full of
known vulnerabilities?- AWebBugs
- BWebGoat
- CVULN_HTML
- DWebScarab
103Identify the web application attack where the attackers exploit vulnerabilities in dynamically
generated web pages to inject client-side script into web pages viewed by other users.- ASQL injection attack
- BCross-Site Scripting (XSS)
- CLDAP Injection attack
- DCross-Site Request Forgery (CSRF)
104You have successfully gained access to a linux server and would like to ensure that the
succeeding outgoing traffic from this server will not be caught by a Network Based Intrusion
Detection Systems (NIDS).
What is the best way to evade the NIDS?- AEncryption
- BProtocol Isolation
- CAlternate Data Streams
- DOut of band signalling
105What do Trinoo, TFN2k, WinTrinoo, T-Sight, and Stracheldraht have in common?
- AAll are hacking tools developed by the legion of doom
- BAll are tools that can be used not only by hackers, but also security personnel
- CAll are DDOS tools
- DAll are tools that are only effective against Windows
- EAll are tools that are only effective against Linux
106The purpose of a __________ is to deny network access to local area networks and other
information assets by unauthorized wireless devices.- AWireless Intrusion Prevention System
- BWireless Access Point
- CWireless Access Control List
- DWireless Analyzer
107An attacker with access to the inside network of a small company launches a successful STP
manipulation attack. What will he do next?- AHe will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.
- BHe will activate OSPF on the spoofed root bridge.
- CHe will repeat the same attack against all L2 switches of the network.
- DHe will repeat this action so that it escalates to a DoS attack.
108Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange
process. Which of the following is the correct bit size of the Diffie-Hellman (DH) group 5?- A768 bit key
- B1025 bit key
- C1536 bit key
- D2048 bit key
109Which among the following is a Windows command that a hacker can use to list all the
shares to which the current user context has access?- ANET FILE
- BNET USE
- CNET CONFIG
- DNET VIEW
110If executives are found liable for not properly protecting their company's assets and
information systems, what type of law would apply in this situation?- ACivil
- BInternational
- CCriminal
- DCommon
111What is the following command used for?
net use \targetipc$ "" /u:""- AGrabbing the etc/passwd file
- BGrabbing the SAM
- CConnecting to a Linux computer through Samba.
- DThis command is used to connect as a null session
- EEnumeration of Cisco routers
112What hacking attack is challenge/response authentication used to prevent?
- AReplay attacks
- BScanning attacks
- CSession hijacking attacks
- DPassword cracking attacks
113Which of the following Secure Hashing Algorithm (SHA) produces a 160-bit digest from a
message with a maximum length of (264-1) bits and resembles the MD5 algorithm?- ASHA-2
- BSHA-3
- CSHA-1
- DSHA-0
114In order to show improvement of security over time, what must be developed?
- AReports
- BTesting tools
- CMetrics
- DTaxonomy of vulnerabilities
115Due to a slowdown of normal network operations, IT department decided to monitor
internet traffic for all of the employees. From a legal stand point, what would be troublesome to take
this kind of measure?- AAll of the employees would stop normal work activities
- BIT department would be telling employees who the boss is
- CNot informing the employees that they are going to be monitored could be an invasion of privacy.
- DThe network could still experience traffic slow down.
116These hackers have limited or no training and know how to use only basic techniques or
tools.
What kind of hackers are we talking about?- ABlack-Hat Hackers A
- BScript Kiddies
- CWhite-Hat Hackers
- DGray-Hat Hacker
117You are monitoring the network of your organizations. You notice that:
Which of the following solution will you suggest?- ABlock the Blacklist IP's @ Firewall
- BUpdate the Latest Signatures on your IDS/IPS
- CClean the Malware which are trying to Communicate with the External Blacklist IP's
- DBoth B and C
118What tool and process are you going to use in order to remain undetected by an IDS while
pivoting and passing traffic over a server you've compromised and gained root access to?- AInstall Cryptcat and encrypt outgoing packets from this server.
- BUse HTTP so that all traffic can be routed via a browser, thus evading the internal Intrusion Detection Systems.
- CUse Alternate Data Streams to hide the outgoing packets from this server.
119When discussing passwords, what is considered a brute force attack?
- AYou attempt every single possibility until you exhaust all possible combinations or discover the password
- BYou threaten to use the rubber hose on someone unless they reveal their password
- CYou load a dictionary of words into your cracking program
- DYou create hashes of a large number of words and compare it with the encrypted passwords
- EYou wait until the password expires
120Which of the following is one of the most effective ways to prevent Cross-site Scripting (XSS)
flaws in software applications?- AValidate and escape all information sent to a server
- BUse security policies and procedures to define and implement proper security settings
- CVerify access right before allowing access to protected information and UI controls
- DUse digital certificates to authenticate a server prior to sending data
121Emil uses nmap to scan two hosts using this command.
nmap -sS -T4 -O 192.168.99.1 192.168.99.7
He receives this output:
What is his conclusion?
- AHost 192.168.99.7 is an iPad.
- BHe performed a SYN scan and OS scan on hosts 192.168.99.1 and 192.168.99.7.
- CHost 192.168.99.1 is the host that he launched the scan from.
- DHost 192.168.99.7 is down.
122What is GINA?
- AGateway Interface Network Application
- BGUI Installed Network Application CLASS
- CGlobal Internet National Authority (G-USA)
- DGraphical Identification and Authentication DLL
123After gaining access to the password hashes used to protect access to a web based
application, knowledge of which cryptographic algorithms would be useful to gain access to the
application?- ASHA1
- BDiffie-Helman
- CRSA
- DAES
124A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur
on his network.
What are some things he can do to prevent it? Select the best answers.- AUse port security on his switches.
- BUse a tool like ARPwatch to monitor for strange ARP activity.
- CUse a firewall between all LAN segments.
- DIf you have a small network, use static ARP entries.
- EUse only static IP addresses on all PC's.
125A hacker has successfully infected an internet-facing server which he will then use to send
junk mail, take part in coordinated attacks, or host junk email content.
Which sort of trojan infects this server?- ABotnet Trojan
- BTurtle Trojans
- CBanking Trojans
- DRansomware Trojans
126You have initiated an active operating system fingerprinting attempt with nmap against a
target system:
What operating system is the target host running based on the open ports shown above?
- AWindows XP
- BWindows 98 SE
- CWindows NT4 Server
- DWindows 2000 Server
127In which phase of the ethical hacking process can Google hacking be employed? This is a
technique that involves manipulating a search string with specific operators to search for
vulnerabilities.
Example:
allintitle: root passwd- AMaintaining Access
- BGaining Access
- CReconnaissance
- DScanning and Enumeration
128A company's security policy states that all Web browsers must automatically delete their
HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?- AAttempts by attackers to access Web sites that trust the Web browser user by stealing the user's authentication credentials.
- BAttempts by attackers to access the user and password information stored in the company's SQL database.
- CAttempts by attackers to access passwords stored on the user's computer without the user's knowledge.
- DAttempts by attackers to determine the user's Web browser usage patterns, including when sites were visited and for how long.
129Which of the following are well known password-cracking programs?
- AL0phtcrack
- BNetCat
- CJack the Ripper
- DNetbus
- EJohn the Ripper
130One of your team members has asked you to analyze the following SOA record. What is the
version?
Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.) (Choose
four.)- A200303028
- B3600
- C604800
- D2400
- E60
- F4800
131LM hash is a compromised password hashing function. Which of the following parameters
describe LM Hash:?
I - The maximum password length is 14 characters.
II - There are no distinctions between uppercase and lowercase.
III - It's a simple algorithm, so 10,000,000 hashes can be generated per second.- AI
- BI, II, and III
- CII
- DI and II
132Which Nmap option would you use if you were not concerned about being detected and
wanted to perform a very fast scan?- A-T0
- B-T5
- C-O
- D-A
133Which of the following program infects the system boot sector and the executable files at
the same time?- AStealth virus
- BPolymorphic virus
- CMacro virus
- DMultipartite Virus
134If you are to determine the attack surface of an organization, which of the following is the
BEST thing to do?- ARunning a network scan to detect network services in the corporate DMZ
- BReviewing the need for a security clearance for each employee
- CUsing configuration management to determine when and where to apply security patches
- DTraining employees on the security policy regarding social engineering
135Which is the first step followed by Vulnerability Scanners for scanning a network?
- ATCP/UDP Port scanning
- BFirewall detection
- COS Detection
- DChecking if the remote host is alive
136While testing the company's web applications, a tester attempts to insert the following test
script into the search area on the company's web site:
< script>alert(" Testing Testing Testing ")</script>
Afterwards, when the tester presses the search button, a pop-up box appears on the screen with the
text:
"Testing Testing Testing". Which vulnerability has been detected in the web application?- ABuffer overflow
- BCross-site request forgery
- CDistributed denial of service
- DCross-site scripting
137Which system consists of a publicly available set of databases that contain domain name
registration contact information?- AWHOIS
- BIANA
- CCAPTCHA
- DIETF
138A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river
and library are required to allow the NIC to work in promiscuous mode?- ALibpcap
- BAwinpcap
- CWinprom
- DWinpcap
139You perform a scan of your company's network and discover that TCP port 123 is open.
What services by default run on TCP port 123?- ATelnet
- BPOP3
- CNetwork Time Protocol
- DDNS
140What does the option * indicate?
- As
- Bt
- Cn
- Da
141Which of the following is a command line packet analyzer similar to GUI-based Wireshark?
- Atcpdump
- Bnessus
- Cetherea
- DJack the ripper
142Bob, a network administrator at BigUniversity, realized that some students are connecting
their notebooks in the wired network to have Internet access. In the university campus, there are
many Ethernet ports available for professors and authorized visitors but not for students.
He identified this when the IDS alerted for malware activities in the network.
What should Bob do to avoid this problem?- ADisable unused ports in the switches
- BSeparate students in a different VLAN
- CUse the 802.1x protocol
- DAsk students to use the wireless network
143While performing ping scans into a target network you get a frantic call from the
organization's security team.
They report that they are under a denial of service attack. When you stop your scan, the smurf attack
event stops showing up on the organization's IDS monitor.
How can you modify your scan to prevent triggering this event in the IDS?- AScan more slowly.
- BDo not scan the broadcast IP.
- CSpoof the source IP address.
- DOnly scan the Windows systems.
144While doing a technical assessment to determine network vulnerabilities, you used the TCP
XMAS scan. What would be the response of all open ports?- AThe port will send an ACK
- BThe port will send a SYN
- CThe port will ignore the packets
- DThe port will send an RST
145Which of the following techniques will identify if computer files have been changed?
- ANetwork sniffing
- BPermission sets
- CIntegrity checking hashes
- DFirewall alerts
146Which tool would be used to collect wireless packet data?
- ANetStumbler
- BJohn the Ripper
- CNessus
- DNetcat
147You are a security officer of a company. You had an alert from IDS that indicates that one PC
on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address
was blacklisted just before the alert. You are staring an investigation to roughly analyze the severity
of the situation. Which of the following is appropriate to analyze?- AEvent logs on the PC
- BInternet Firewall/Proxy log
- CIDS log
- DEvent logs on domain controller
148The network administrator for a company is setting up a website with e-commerce
capabilities. Packet sniffing is a concern because credit card information will be sent electronically
over the Internet. Customers visiting the site will need to encrypt the data with HTTPS. Which type of
certificate is used to encrypt and decrypt the data?- AAsymmetric
- BConfidential
- CSymmetric
- DNon-confidential
149Log monitoring tools performing behavioral analysis have alerted several suspicious logins
on a Linux server occurring during non-business hours. After further examination of all login
activities, it is noticed that none of the logins have occurred during typical work hours. A Linux
administrator who is investigating this problem realizes the system time on the Linux server is wrong by more than twelve hours. What protocol used on Linux servers to synchronize the time has stopped
working?- ATime Keeper
- BNTP
- CPPP
- DOSPP
150Which command line switch would be used in NMAP to perform operating system
detection?- A-OS
- B-sO
- C-sP
- D-O
151Which Intrusion Detection System is best applicable for large environments where critical
assets on the network need extra security and is ideal for observing sensitive network segments?- ANetwork-based intrusion detection system (NIDS)
- BHost-based intrusion detection system (HIDS)
- CFirewalls
- DHoneypots
152Which tool can be used to silently copy files from USB devices?
- AUSB Grabber
- BUSB Dumper
- CUSB Sniffer
- DUSB Snoopy
153The following is part of a log file taken from the machine on the network with the IP address
of 192.168.1.106:
What type of activity has been logged?
- APort scan targeting 192.168.1.103
- BTeardrop attack targeting 192.168.1.106
- CDenial of service attack targeting 192.168.1.103
- DPort scan targeting 192.168.1.106
154How does a denial-of-service attack work?
- AA hacker prevents a legitimate user (or group of users) from accessing a service
- BA hacker uses every character, word, or letter he or she can think of to defeat authentication
- CA hacker tries to decipher a password by using a system, which subsequently crashes the network
- DA hacker attempts to imitate a legitimate user by confusing a computer or even another person
155Which type of security document is written with specific step-by-step details?
- AProcess
- BProcedure
- CPolicy
- DParadigm
156On performing a risk assessment, you need to determine the potential impacts when some
of the critical business process of the company interrupt its service. What is the name of the process
by which you can determine those critical business?- ARisk Mitigation
- BEmergency Plan Response (EPR)
- CDisaster Recovery Planning (DRP)
- DBusiness Impact Analysis (BIA)
157Why would an attacker want to perform a scan on port 137?
- ATo discover proxy servers on a network
- BTo disrupt the NetBIOS SMB service on the target host
- CTo check for file and print sharing on Windows systems
- DTo discover information about a target host using NBTSTAT
158Which of the following is an example of two factor authentication?
- APIN Number and Birth Date
- BUsername and Password
- CDigital Certificate and Hardware Token
- DFingerprint and Smartcard ID
159Which of the following is the BEST way to defend against network sniffing?
- AUsing encryption protocols to secure network communications
- BRegister all machines MAC Address in a Centralized Database
- CRestrict Physical Access to Server Rooms hosting Critical Servers
- DUse Static IP Address
160Bob finished a C programming course and created a small C application to monitor the
network traffic and produce alerts when any origin sends "many" IP packets, based on the average
number of packets sent by all origins and using some thresholds.
In concept, the solution developed by Bob is actually:- AJust a network monitoring tool
- BA signature-based IDS
- CA hybrid IDS
- DA behavior-based IDS
161An NMAP scan of a server shows port 25 is open. What risk could this pose?
- AOpen printer sharing
- BWeb portal data leak
- CClear text authentication
- DActive mail relay
162Which of the following problems can be solved by using Wireshark?
- ATracking version changes of source code
- BChecking creation dates on all webpages on a server
- CResetting the administrator password on multiple systems
- DTroubleshooting communication resets between two systems
163What kind of risk will remain even if all theoretically possible safety measures would be
applied?- AResidual risk
- BInherent risk
- CImpact risk
- DDeferred risk
164Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool
"SIDExtractor". Here is the output of the SIDs:
From the above list identify the user account with System Administrator privileges.
- AJohn
- BRebecca
- CSheela
- DShawn
- ESomia
- FChang
- GMicah
165When a normal TCP connection starts, a destination host receives a SYN (synchronize/start)
packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination
host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This
is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a
connection queue of finite size on the destination host keeps track of connections waiting to be
completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds
after the SYN ACK.
How would an attacker exploit this design by launching TCP SYN attack?- AAttacker generates TCP SYN packets with random destination addresses towards a victim host
- BAttacker floods TCP SYN packets with random source addresses towards a victim host
- CAttacker generates TCP ACK packets with random source addresses towards a victim host
- DAttacker generates TCP RST packets with random source addresses towards a victim host
166An NMAP scan of a server shows port 69 is open. What risk could this pose?
- AUnauthenticated access
- BWeak SSL version
- CCleartext login
- DWeb portal data leak
167Which of the following is the least-likely physical characteristic to be used in biometric
control that supports a large company?- AHeight and Weight
- BVoice
- CFingerprints
- DIris patterns
168Which component of IPsec performs protocol-level functions that are required to encrypt
and decrypt the packets?- AInternet Key Exchange (IKE)
- BOakley
- CIPsec Policy Agent
- DIPsec driver
169Your company was hired by a small healthcare provider to perform a technical assessment
on the network.
What is the best approach for discovering vulnerabilities on a Windows-based computer?- AUse a scan tool like Nessus
- BUse the built-in Windows Update tool
- CCheck MITRE.org for the latest list of CVE findings
- DCreate a disk image of a clean Windows installation
170Which mode of IPSec should you use to assure security and confidentiality of data within
the same LAN?- AESP transport mode
- BAH permiscuous
- CESP confidential
- DAH Tunnel mode
171Which of the following tools performs comprehensive tests against web servers, including
dangerous files and CGIs?- ANikto
- BSnort
- CJohn the Ripper
- DDsniff
172In the context of password security, a simple dictionary attack involves loading a dictionary
file (a text file full of dictionary words) into a cracking application such as L0phtCrack or John the
Ripper, and running it against user accounts located by the application. The larger the word and word
fragment selection, the more effective the dictionary attack is. The brute force method is the most
inclusive, although slow. It usually tries every possible letter and number combination in its automated exploration. If you would use both brute force and dictionary methods combined
together to have variation of words, what would you call such an attack?- AFull Blown
- BThorough
- CHybrid
- DBruteDics
173A company is using Windows Server 2003 for its Active Directory (AD). What is the most
efficient way to crack the passwords for the AD users?- APerform a dictionary attack.
- BPerform a brute force attack.
- CPerform an attack with a rainbow table.
- DPerform a hybrid attack.
174Initiating an attack against targeted businesses and organizations, threat actors compromise
a carefully selected website by inserting an exploit resulting in malware infection. The attackers run
exploits on well-known and trusted sites likely to be visited by their targeted victims. Aside from
carefully choosing sites to compromise, these attacks are known to incorporate zero-day exploits that
target unpatched vulnerabilities. Thus, the targeted entities are left with little or no defense against
these exploits.
What type of attack is outlined in the scenario?- AWatering Hole Attack
- BHeartbleed Attack
- CShellshock Attack
- DSpear Phising Attack
175Nedved is an IT Security Manager of a bank in his country. One day. he found out that there
is a security breach to his company's email server based on analysis of a suspicious connection from
the email server to an unknown IP Address.
What is the first thing that Nedved needs to do before contacting the incident response team?- ALeave it as it Is and contact the incident response te3m right away
- BBlock the connection to the suspicious IP Address from the firewall
- CDisconnect the email server from the network
- DMigrate the connection to the backup email server
176A tester has been using the msadc.pl attack script to execute arbitrary commands on a
Windows NT4 web server. While it is effective, the tester finds it tedious to perform extended
functions. On further research, the tester come across a perl script that runs the following msadc
functions:
Which exploit is indicated by this script?
- AA buffer overflow exploit
- BA chained exploit
- CA SQL injection exploit
- DA denial of service exploit
177From the two screenshots below, which of the following is occurring?
- A10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
- B10.0.0.253 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.
- C10.0.0.2 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
- D10.0.0.252 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.
178What tool can crack Windows SMB passwords simply by listening to network traffic?
- AThis is not possible
- BNetbus
- CNTFSDOS
- DL0phtcrack
179What is the difference between the AES and RSA algorithms?
- ABoth are asymmetric algorithms, but RSA uses 1024-bit keys.
- BRSA is asymmetric, which is used to create a public/private key pair; AES is symmetric, which is used to encrypt data.
- CBoth are symmetric algorithms, but AES uses 256-bit keys.
- DAES is asymmetric, which is used to create a public/private key pair; RSA is symmetric, which is used to encrypt data.
180What port number is used by LDAP protocol?
- A110
- B389
- C464
- D445
181Which of the following types of jailbreaking allows user-level access but does not allow
iboot-level access?- ABootrom Exploit
- BiBoot Exploit
- CSandbox Exploit
- DUserland Exploit
182Jack was attempting to fingerprint all machines in the network using the following Nmap
syntax:
invictus@victim_server:~$ nmap -T4 -0 10.10.0.0/24
TCP/IP fingerprinting (for OS scan) xxxxxxx xxxxxx xxxxxxxxx. QUITTING!
Obviously, it is not going through. What is the issue here?- AOS Scan requires root privileges
- BThe nmap syntax is wrong.
- CThe outgoing TCP/IP fingerprinting is blocked by the host firewall
- DThis is a common behavior for a corrupted nmap application
183What did the following commands determine?
- AThat the Joe account has a SID of 500
- BThese commands demonstrate that the guest account has NOT been disabled
- CThese commands demonstrate that the guest account has been disabled
- DThat the true administrator is Joe
- EIssued alone, these commands prove nothing
184Todd has been asked by the security officer to purchase a counter-based authentication
system. Which of the following best describes this type of system?- AA biometric system that bases authentication decisions on behavioral attributes.
- BA biometric system that bases authentication decisions on physical attributes.
- CAn authentication system that creates one-time passwords that are encrypted with secret keys.
- DAn authentication system that uses passphrases that are converted into virtual passwords.
185WPA2 uses AES for wireless data encryption at which of the following encryption levels?
- A64 bit and CCMP
- B128 bit and CRC
- C128 bit and CCMP
- D128 bit and TKIP
186While examining audit logs, you discover that people are able to telnet into the SMTP server
on port 25. You would like to block this, though you do not see any evidence of an attack or other
wrong doing. However, you are concerned about affecting the normal functionality of the email
server. From the following options choose how best you can achieve this objective?- ABlock port 25 at the firewall.
- BShut off the SMTP service on the server.
- CForce all connections to use a username and password.
- DSwitch from Windows Exchange to UNIX Sendmail.
- ENone of the above.
187You are programming a buffer overflow exploit and you want to create a NOP sled of 200
bytes in the program exploit.c
What is the hexadecimal value of NOP instruction?
- A0x60
- B0x80
- C0x70
- D0x90
188A virus that attempts to install itself inside the file it is infecting is called?
- ATunneling virus
- BCavity virus
- CPolymorphic virus
- DStealth virus
189Which NMAP command combination would let a tester scan every TCP port from a class C
network that is blocking ICMP with fingerprinting and service detection?- ANMAP -PN -A -O -sS 192.168.2.0/24
- BNMAP -P0 -A -O -p1-65535 192.168.0/24
- CNMAP -P0 -A -sT -p0-65535 192.168.0/16
- DNMAP -PN -O -sS -p 1-1024 192.168.0/8
190Port scanning can be used as part of a technical assessment to determine network
vulnerabilities. The TCP XMAS scan is used to identify listening ports on the targeted system.
If a scanned port is open, what happens?- AThe port will ignore the packets.
- BThe port will send an RST.
- CThe port will send an ACK.
- DThe port will send a SYN.
191Which type of security feature stops vehicles from crashing through the doors of a building?
- ATurnstile
- BBollards
- CMantrap
- DReceptionist
192Which of the following programs is usually targeted at Microsoft Office products?
- APolymorphic virus
- BMultipart virus
- CMacro virus
- DStealth virus
193An engineer is learning to write exploits in C++ and is using the exploit tool Backtrack. The
engineer wants to compile the newest C++ exploit and name it calc.exe. Which command would the
engineer use to accomplish this?- Ag++ hackersExploit.cpp -o calc.exe
- Bg++ hackersExploit.py -o calc.exe
- Cg++ -i hackersExploit.pl -o calc.exe
- Dg++ --compile -i hackersExploit.cpp -o calc.exe
194An Intrusion Detection System (IDS) has alerted the network administrator to a possibly
malicious sequence of packets sent to a Web server in the network's external DMZ. The packet traffic
was captured by the IDS and saved to a PCAP file.
What type of network tool can be used to determine if these packets are genuinely malicious or
simply a false positive?- AProtocol analyzer
- BIntrusion Prevention System (IPS)
- CNetwork sniffer
- DVulnerability scanner
195A server has been infected by a certain type of Trojan. The hacker intended to utilize it to
send and host junk mails. What type of Trojan did the hacker use?- ATurtle Trojans
- BRansomware Trojans
- CBotnet Trojan
- DBanking Trojans
196The security administrator of ABC needs to permit Internet traffic in the host 10.0.0.2 and
UDP traffic in the host 10.0.0.3. Also he needs to permit all FTP traffic to the rest of the network and
deny all other traffic. After he applied his ACL configuration in the router nobody can access to the
ftp and the permitted hosts cannot access to the Internet. According to the next configuration what
is happening in the network?
- AThe ACL 110 needs to be changed to port 80
- BThe ACL for FTP must be before the ACL 110
- CThe first ACL is denying all TCP traffic and the other ACLs are being ignored by the router
- DThe ACL 104 needs to be first because is UDP
197What results will the following command yield: 'NMAP -sS -O -p 123-153 192.168.100.3'?
- AA stealth scan, opening port 123 and 153
- BA stealth scan, checking open ports 123 to 153
- CA stealth scan, checking all open ports excluding ports 123 to 153
- DA stealth scan, determine operating system, and scanning ports 123 to 153
198What does a type 3 code 13 represent? (Choose two.)
- AEcho request
- BDestination unreachable
- CNetwork unreachable
- DAdministratively prohibited
- EPort unreachable
- FTime exceeded
199Which access control mechanism allows for multiple systems to use a central authentication
server (CAS) that permits users to authenticate once and gain access to multiple systems?- ARole Based Access Control (RBAC)
- BDiscretionary Access Control (DAC)
- CWindows authentication
- DSingle sign-on
200A hacker is attempting to see which ports have been left open on a network. Which NMAP
switch would the hacker use?- A-sO
- B-sP
- C-sS
- D-sU
Informationen
- Beschreibung
- CEH CEH Quiz am Preparatorio, erstellt von David Martinez Lora am 03/10/2020.
- Autor
- David Martinez Lora
- Sprache
- Español
- Aufrufe
- 3
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz