Quiz
Chp8
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (99)
1If a hacker takes over an application program, he or she receives the permissions with which the program runs.
- ATrue
- BFalse
2The most popular way for hackers to take over hosts today is ________.
- Aby taking over the operating system
- Bby taking over an application
- C by guessing the root password
- Dby taking over the user interface
3Operating system hardening is more total work than application hardening.
- ATrue
- BFalse
4An attacker types more data in a field than the programmer expected. This is a(n) ________ attack.
- Adenial-of-service
- Bdirectory traversal
- Cbuffer overflow
- DXSS
5In a stack overflow attack, to where does the return address point?
- AA) To the beginning of the stack entry's data area
- BB) To the end of the stack entry's data area
- CC) To the next command in the program being hacked
- DD) To the return address entry in the stack entry
- AA) To the beginning of the stack entry's data area
6When executing attack code, if the attacker has skillfully overwritten the return address, the return address will not point back to "data" in the buffer.
- ATrue
- BFalse
77) Overall for firms, which is more time consuming to patch?
- AA) Applications
- BB) Operating systems
- CC) Both are about equally time consuming to patch
- DD) None of the above
- AA) Applications
8Experts advise firms to turn on most or all applications and then harden them.
- ATrue
- BFalse
9To prevent eavesdropping, applications should ________.
- AA) be updating regularly
- BB) use electronic signatures
- CC) use encryption for confidentiality
- DD) use encryption for authentication
- AA) be updating regularly
10Generally speaking, vendors use similar mechanisms for downloading and installing patches.
- ATrue
- BFalse
11The first task in security is to understand the environment to be protected
- ATrue
- BFalse
12Baselines are used to go beyond default installation configurations for high-value targets.
- ATrue
- BFalse
13When securing application configuration settings, default password settings should not be changed.
- ATrue
- BFalse
14Operating system account passwords provide limited protection.
- ATrue
- BFalse
15For all applications, a basic rule is ________.
- AA) always trust user input
- BB) sometimes trust user input
- CC) never trust user input
- DD) None of the above
- AA) always trust user input
16) Programmers can trust user input if the person is strongly authenticated.
- ATrue
- BFalse
17The user reaches a webpage before logging in. This is a(n) ________ attack.
- AA) login screen bypass
- BB) buffer overflow
- CC) XSS
- DD) SQL injection attack
- AA) login screen bypass
18In a(n) ________ attack, information that a user enters is sent back to the user in a webpage.
- AA) login screen bypass
- BB) buffer overflow
- CC) XSS
- DD) SQL injection attack
- AA) login screen bypass
19In a SQL injection attack, attackers may use lookup commands to obtain unauthorized information.
- ATrue
- BFalse
20In a(n) ________ attack, the user enters part of a database query instead of giving the expected input.
- AA) login screen bypass
- BB) buffer overflow
- CC) XSS
- DD) SQL injection attack
- AA) login screen bypass
21Custom programs generally are safe because attackers do not know the code.
- ATrue
- BFalse
22Attacks in which a user reaches a directory outside of the WWW root directory and its subdirectories is called a(n) ________ attack.
- AA) cross-site scripting
- BB) SQL injection
- CC) mobile code
- DD) directory traversal
- AA) cross-site scripting
23Blind SQL injection uses a series of SQL statements that produce different responses based on true/false questions, or timed responses.
- ATrue
- BFalse
24Which of the following are reasons to ensure WWW Service and E-Commerce security?
- AA) Cost of disruptions
- BB) Customer fraud
- CC) Exposure of sensitive private information
- DD) All of the above
- AA) Cost of disruptions
25Most firms do a satisfactory job overseeing the deployment of custom programs used to supplement packaged software.
- ATrue
- BFalse
26Website defacement occurs when attackers take over a computer and produce false web pages.
- ATrue
- BFalse
27In a URL, ".." (without the quotes) means ________.
- AA) move one directory up
- BB) move one directory down
- CC) move to the operating system's root directory
- DD) ignore the last entry
- AA) move one directory up
28E-commerce software is not complex and has few subsystems.
- ATrue
- BFalse
29Whisker is a popular tool for ________.
- AA) reading website error logs
- BB) providing a webserver proxy in front of the webserver
- CC) conducting vulnerability testing on webservers
- DD) All of the above
- AA) reading website error logs
30Developers have permissions on the ________.
- AA) development server
- BB) testing server
- CC) production server
- DD) Both A and B
- AA) development server
31 ________ errors may indicate that an attacker is trying to send invalid data to the server.
- AA) 404
- BB) 303
- CC) 500
- DD) 512
- AA) 404
32Testers have permissions on the ________.
- AA) development server
- BB) testing server
- CC) production server
- DD) Both A and B
- AA) development server
33Code on a webpage that is executed on the client PC is ________.
- AA) a Trojan horse
- BB) a Virus
- CC) mobile code
- DD) an XSS attack
- AA) a Trojan horse
34Java applets are large Java programs.
- ATrue
- BFalse
35Users usually must click on malicious links in order to execute them
- ATrue
- BFalse
36Cookies can used to track users at a website.
- ATrue
- BFalse
37) Accepting cookies is necessary to use many websites.
- ATrue
- BFalse
38Which of the following is the most dangerous because it can do more on a computer when it is executed?
- AA) Active-X
- BB) Java
- CD) VBscript
- AA) Active-X
39Compared to full programming languages, scripts are ________ in what they can do.
- AA) more limited
- BB) less limited
- CC) about as limited (but easier to use)
- DD) not limited at all
- AA) more limited
40JavaScript is a scripted form of Java.
- ATrue
- BFalse
41To take advantage of user typing errors, attackers register site names that are similar to those of legitimate domain names.
- ATrue
- BFalse
42On a compromised computer, if you mistype the name of a URL, you may be taken to a malicious website even if you set your browser security to high.
- ATrue
- BFalse
43Cookies are dangerous because they ________.
- AA) allow a website to track what pages you have visited
- BB) may contain sensitive private information about you
- CC) Both A and B
- DD) Neither A nor B
- AA) allow a website to track what pages you have visited
44Scripts do not have the ability to permanently change your computer registry.
- ATrue
- BFalse
45Under what Internet Options tabs are general security settings for websites controlled?
- AA) Privacy
- BB) Security
- CC) Protection
- DD) Advanced
- AA) Privacy
46With Active-X controls, active scripting is enabled by default.
- ATrue
- BFalse
47In Internet Explorer, the Security tab controls the website's pop-up blocker.
- ATrue
- BFalse
48Under what Internet Options tabs are cookies controlled?
- AA) Privacy
- BB) Security
- CC) Protection
- DD) Advanced
- AA) Privacy
49A down side of spam filtering is the deletion of some legitimate messages.
- ATrue
- BFalse
50E-mail filtering can be done at which of the following?
- AA) The user's PC
- BB) The corporate e-mail servers
- CC) E-mail managed service providers
- DD) All of the above
- AA) The user's PC
51Companies are responsible for filtering sexually or racially harassing messages and can be sued for not doing so.
- ATrue
- BFalse
52Spammers use sticky spam, which presents their message as a graphical image.
- ATrue
- BFalse
53The prevention of sensitive information from being sent out of a company is called ________.
- AA) unified threat management
- BB) antivirus filtering
- CC) attachment deletion
- DD) extrusion prevention
- AA) unified threat management
54Spammers are one reason that some companies have outsourced e-mail filtering.
- ATrue
- BFalse
55Encryption is heavily used in commercial e-mail.
- ATrue
- BFalse
56SSL/TLS provides security ________.
- AA) between the sender and his or her e-mail server
- BB) all the way between the sender and the receiver
- CC) Both A and B
- DD) Neither A nor B
- AA) between the sender and his or her e-mail server
57What e-mail standard provides end-to-end security?
- AA) SSL/TLS
- BB) S/MIME
- CC) Both A and B
- DD) Neither A nor B
- AA) SSL/TLS
58Which of the following uses a PKI?
- A) S/MIME
- BB) PGP
- CC) Both A and B
- DD) Neither A nor B
- A) S/MIME
59PKI uses circles of trust.
- ATrue
- BFalse
60Which comes third in a VoIP packet?
- AA) RTP header
- BB) UDP header
- CC) IP header
- DD) codec byte stream
- AA) RTP header
61RTP adds ________ to UDP.
- AA) security
- BB) sequence numbers
- CC) Both A and B
- DD) Neither A nor B
- AA) security
62RTP is used in ________.
- AA) signaling
- BB) transport
- CC) Both A and B
- DD) Neither A nor B
- AA) signaling
63RTP stands for ________.
- AA) Real Transfer Protocol
- BB) Real Time Protocol
- CC) Real Transport Protocol
- DD) None of the above
- AA) Real Transfer Protocol
64Which of the following is not a signaling protocol?
- AA) RTP
- BB) SIP
- CC) H.323
- DD) All of the above ARE signaling protocols.
- AA) RTP
65Signaling is the carriage of voice between two parties.
- ATrue
- BFalse
66Transport consists of communication to manage the network.
- ATrue
- BFalse
67Signaling does not consist of communication to manage the network.
- ATrue
- BFalse
68A VoIP caller wishing to contact another sends an INVITE message to ________.
- AA) the caller's H.323 proxy server
- BB) the receiver's H.323 proxy server
- CC) the receiver directly
- DD) None of the above
- AA) the caller's H.323 proxy server
69SIP proxy servers are used in ________.
- AA) transport transmissions
- BB) signaling transmissions
- CC) Both A and B
- DD) Neither A nor B
- AA) transport transmissions
70) Like the public switched telephone network, VoIP technology is a closed system.
- ATrue
- BFalse
71) A PSTN gateway translates between a VoIP network's ________ protocols and those of the public switched telephone network.
- AA) signaling
- BB) transport
- CC) Both A and B
- DD) Neither A nor B
- AA) signaling
72DoS attacks against VoIP can be successful even if they increase latency only slightly.
- ATrue
- BFalse
73Someone breaks into a corporate VoIP system to place free long-distance and international toll calls. This is referred to by security professionals as ________.
- AA) toll fraud
- B
B) VoIP hacking - CC) phone phreaking
- DD) blue boxing
- AA) toll fraud
74Spam over VoIP is called ________.
- AA) VAM
- BB) SOVI
- CC) SPIT
- DD) SPIP
- AA) VAM
75SPIT is where the attacker uses the corporate VoIP network to place free calls.
- ATrue
- BFalse
76SIP identity protocols are common on IP telephones
- ATrue
- BFalse
77SIP Identity protocols ________.
- AA) ensure that traffic is authenticated between two companies holding public/private keys
- BB) are uncommon on IP telephones
- CC) Both A and B
- DD) Neither A nor B
- AA) ensure that traffic is authenticated between two companies holding public/private keys
78Eavesdropping can be thwarted by encrypting ________.
- AA) signaling traffic
- BB) transport traffic
- CC) Both A and B
- DD) Neither A nor B
- AA) signaling traffic
79In VoIP, encryption may ________.
- AA) reduce throughput
- BB) increase jitter
- CC) increase latency
- DD) make traffic unreadable
- AA) reduce throughput
80) H.323 uses Ports 1719 and 1720
- ATrue
- BFalse
81In VoIP, firewalls are a problem because they tend to ________.
- AA) reduce throughput
- BB) increase jitter
- CC) increase latency
- DD) make traffic unreadable
- AA) reduce throughput
82) SIP requires port ________ to be open.
- AA) 47
- BB) 505
- CC) 3434
- DD) 5060
- AA) 47
83Firewall port openings are required for SIP/H.323 messages.
- ATrue
- BFalse
84NAT adds latency to VoIP packets.
- ATrue
- BFalse
85VoIP traffic and data traffic tend to be segregated from each other on a network for added security.
- AA) True.
- BB) False. This would increase costs too much.
- CC) False. This would negate the benefits of convergence.
- AA) True.
86) ________ is a VoIP service that currently offers free calling among its customers over the Internet and reduced-cost calling to and from Public Switched Telephone Network customers
- AA) Skype
- BB) SIP
- CC) SPIT
- DD) IM
- AA) Skype
87If NAT changes the Layer 3 IP destination addresses, the protocol will still work properly
- ATrue
- BFalse
88Skype's security protocols have been publicly studied and approved.
- ATrue
- BFalse
89Skype can decrypt and read user traffic.
- ATrue
- BFalse
90Which of the following statements accurately describes Skype?
- AA) Skype controls who can register a particular person's name.
- BB) Skype cannot decrypt or read user traffic.
- CC) Skype's proprietary software and protocols have not been publicly studied and approved.
- DD) None of the above
- AA) Skype controls who can register a particular person's name.
91The Skype protocol is relatively easy for corporate firewalls to filter.
- ATrue
- BFalse
92) Skype's file transfer generally does not work with antivirus programs.
- ATrue
- BFalse
93 In IM, ________ servers allow two users to locate each other.
- AA) index
- BB) relay
- CC) presence
- DD) All of the above
- AA) index
94In IM, all messages pass through a ________ server.
- AA) relay
- BB) presence
- CC) Both A and B
- DD) Neither A nor B
- AA) relay
95To satisfy legal retention and other compliance regulations, companies should use ________ in IM.
- AA) a presence server
- BB) a relay server
- CC) Either A or B
- DD) Neither A nor B
- AA) a presence server
96________ offers no security at all.
- AA) SNMP V1
- BB) SNMP V2
- CC) SNMP V3
- DD) All of the above offer security.
- AA) SNMP V1
97________ introduced community strings for security, in which a shared secret was used to authenticate messages.
- AA) SNMP V1
- BB) SNMP V2
- CC) SNMP V3
98 DNS, DHCP, and LDAP are examples of supervisory protocols in TCP/IP.
- ATrue
- BFalse
99Which version of SNMP allows the manager to have a different shared secret with each agent?
- AA) Version 1
- BB) Version 2
- CC) Version 3
- DD) All of the above
- AA) Version 1
Information
- Description
- Quiz on Chp8, created by Fonzirelli Lawso on 04/05/2015.
- Author
- Fonzirelli Lawso
- Language
- English
- Views
- 0
- Rating
- No ratings yet Rate this quiz