Test
Preparacion 3
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (175)
1Which of the following is a preventive control?
- ASmart card authentication
- BSecurity policy
- CAudit trail
- DContinuity of operations plan
2To determine if a software program properly handles a wide range of invalid input, a form of
automated testing can be used to randomly generate invalid input in an attempt to crash the
program.
What term is commonly used when referring to this type of testing?- AFuzzing
- BRandomizing
- CMutating
- DBounding
3What is the broadcast address for the subnet 190.86.168.0/22?
- A190.86.168.255
- B190.86.255.255
- C190.86.171.255
- D190.86.169.255
4Which of the following security operations is used for determining the attack surface of an
organization?- ARunning a network scan to detect network services in the corporate DMZ
- BTraining employees on the security policy regarding social engineering
- CReviewing the need for a security clearance for each employee
- DUsing configuration management to determine when and where to apply security patches
5Which tier in the N-tier application architecture is responsible for moving and processing
data between the tiers?- AApplication Layer
- BData tier
- CPresentation tier
- DLogic tier
6The security administrator of ABC needs to permit Internet traffic in the host 10.0.0.2 and
UDP traffic in the host 10.0.0.3. He also needs to permit all FTP traffic to the rest of the network and
deny all other traffic. After he applied his ACL configuration in the router, nobody can access to the
ftp, and the permitted hosts cannot access the Internet. According to the next configuration, what is
happening in the network?
- AThe ACL 104 needs to be first because is UDP
- BThe ACL 110 needs to be changed to port 80
- CThe ACL for FTP must be before the ACL 110
- DThe first ACL is denying all TCP traffic and the other ACLs are being ignored by the router
7How can a policy help improve an employee's security awareness?
- ABy implementing written security procedures, enabling employee security training, and promoting the benefits of security
- BBy using informal networks of communication, establishing secret passing procedures, and immediately terminating employees
- CBy sharing security secrets with employees, enabling employees to share secrets, and establishing a consultative help line
- DBy decreasing an employee's vacation time, addressing ad-hoc employment clauses, and ensuring that managers know employee strengths
8Company A and Company B have just merged and each has its own Public Key Infrastructure
(PKI). What must the Certificate Authorities (CAs) establish so that the private PKIs for Company A
and Company B trust one another and each private PKI can validate digital certificates from the other
company?- APoly key exchange
- BCross certification
- CPoly key reference
- DCross-site exchange
9Risks = Threats x Vulnerabilities is referred to as the:
- ARisk equation
- BThreat assessment
- CBIA equation
- DDisaster recovery formula
10In 2007, this wireless security algorithm was rendered useless by capturing packets and
discovering the passkey in a matter of seconds. This security flaw led to a network invasion of TJ
Maxx and data theft through a technique known as wardriving.
Which Algorithm is this referring to?- AWired Equivalent Privacy (WEP)
- BWi-Fi Protected Access (WPA)
- CWi-Fi Protected Access 2 (WPA2)
- DTemporal Key Integrity Protocol (TKIP)
11This kind of password cracking method uses word lists in combination with numbers and
special characters:- AHybrid
- BLinear
- CSymmetric
- DBrute Force
12Which of the following security policies defines the use of VPN for gaining access to an
internal corporate network?- ANetwork security policy
- BRemote access policy
- CInformation protection policy
- DAccess control policy
13Which of the following ensures that updates to policies, procedures, and configurations are
made in a controlled and documented fashion?- ARegulatory compliance
- BPeer review
- CChange management
- DPenetration testing
14Within the context of Computer Security, which of the following statements describes Social
Engineering best?- ASocial Engineering is the act of publicly disclosing information
- BSocial Engineering is the means put in place by human resource to perform time accounting
- CSocial Engineering is the act of getting needed information from a person rather than breaking into a system
- DSocial Engineering is a training program within sociology studies
15What is a successful method for protecting a router from potential smurf attacks?
- APlacing the router in broadcast mode
- BEnabling port forwarding on the router
- CInstalling the router outside of the network's firewall
- DDisabling the router from accepting broadcast ping messages
16Attempting an injection attack on a web server based on responses to True/False questions is called which of the following?
- ABlind SQLi
- BDMS-specific SQLi
- CClassic SQLi
- DCompound SQLi
17Your company performs penetration tests and security assessments for small and mediumsized
business in the local area. During a routine security assessment, you discover information that
suggests your client is involved with human trafficking.
What should you do?- AImmediately stop work and contact the proper legal authorities.
- BCopy the data to removable media and keep it in case you need it.
- CConfront the client in a respectful manner and ask her about the data.
- DIgnore the data and continue the assessment until completed as agreed.
18Which of the following is a serious vulnerability in the popular OpenSSL cryptographic
software library? This weakness allows stealing the information protected, under normal conditions,
by the SSL/TLS encryption used to secure the Internet.- AHeartbleed Bug
- BPOODLE
- CSSL/TLS Renegotiation Vulnerability
- DShellshock
19Which of the following is not a Bluetooth attack?
- ABluedriving
- BBluejacking
- CBluesmacking
- DBluesnarfing
20Bob learned that his username and password for a popular game has been compromised.
He contacts the company and resets all the information. The company suggests he use two-factor
authentication, which option below offers that?- AA new username and password
- BA fingerprint scanner and his username and password.
- CDisable his username and use just a fingerprint scanner.
- DHis username and a stronger password.
21Which of the following is considered an acceptable option when managing a risk?
- AReject the risk.
- BDeny the risk.
- CMitigate the risk.
- DInitiate the risk.
22Which of the following examples best represents a logical or technical control?
- ASecurity tokens
- BHeating and air conditioning
- CSmoke and fire alarms
- DCorporate security policy
23A developer for a company is tasked with creating a program that will allow customers to
update their billing and shipping information. The billing address field used is limited to 50
characters. What pseudo code would the developer use to avoid a buffer overflow attack on the
billing address field?- Aif (billingAddress = 50) {update field} else exit
- Bif (billingAddress != 50) {update field} else exit
- Cif (billingAddress >= 50) {update field} else exit
- Dif (billingAddress <= 50) {update field} else exit
24A distributed port scan operates by:
- ABlocking access to the scanning clients by the targeted host
- BUsing denial-of-service software against a range of TCP ports
- CBlocking access to the targeted host by each of the distributed scanning clients
- DHaving multiple computers each scan a small number of ports, then correlating the results
25The network team has well-established procedures to follow for creating new rules on the
firewall. This includes having approval from a manager prior to implementing any new rules. While
reviewing the firewall configuration, you notice a recently implemented rule but cannot locate
manager approval for it. What would be a good step to have in the procedures for a situation like
this?- AHave the network team document the reason why the rule was implemented without prior manager approval.
- BMonitor all traffic using the firewall rule until a manager can approve it.
- CDo not roll back the firewall rule as the business may be relying upon it, but try to get manager approval as soon as possible.
- DImmediately roll back the firewall rule until a manager can approve it
26Sam is working as s pen-tester in an organization in Houston. He performs penetration
testing on IDS in order to find the different ways an attacker uses to evade the IDS. Sam sends a large
amount of packets to the target IDS that generates alerts, which enable Sam to hide the real traffic.
What type of method is Sam using to evade IDS?- ADenial-of-Service
- BFalse Positive Generation
- CInsertion Attack
- DObfuscating
27What is the best defense against privilege escalation vulnerability?
- APatch systems regularly and upgrade interactive login privileges at the system administrator level.
- BRun administrator and applications on least privileges and use a content registry for tracking.
- CRun services with least privileged accounts and implement multi-factor authentication and authorization.
- DReview user roles and administrator privileges for maximum utilization of automation services.
28A botnet can be managed through which of the following?
- AIRC
- BE-Mail
- CLinkedin and Facebook
- DA vulnerable FTP server
29Under the "Post-attack Phase and Activities", it is the responsibility of the tester to restore
the systems to a pre-test state.
Which of the following activities should not be included in this phase? (see exhibit) Exhibit:
- AIII
- BIV
- CIII and IV
- DAll should be included.
30The practical realities facing organizations today make risk response strategies essential.
Which of the following is NOT one of the five basic responses to risk?- AAccept
- BMitigate
- CDelegate
- DAvoid
31Internet Protocol Security IPSec is actually a suite of protocols. Each protocol within the
suite provides different functionality. Collective IPSec does everything except.- AProtect the payload and the headers
- BAuthenticate
- CEncrypt
- DWork at the Data Link Layer
32A penetration test was done at a company. After the test, a report was written and given to
the company's IT authorities. A section from the report is shown below:
According to the section from the report, which of the following choice is true?- AMAC Spoof attacks cannot be performed.
- BPossibility of SQL Injection attack is eliminated.
- CA stateful firewall can be used between intranet (LAN) and DMZ.
- DThere is access control policy between VLANs.
33You want to analyze packets on your wireless network. Which program would you use?
- AWireshark with Airpcap
- BAirsnort with Airpcap
- CWireshark with Winpcap
- DEthereal with Winpcap
34Bluetooth uses which digital modulation technique to exchange information between paired
devices?- APSK (phase-shift keying)
- BFSK (frequency-shift keying)
- CASK (amplitude-shift keying)
- DQAM (quadrature amplitude modulation)
35Which of these is capable of searching for and locating rogue access points?
- AHIDS
- BWISS
- CWIPS
- DNIDS
36Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24
111 (content:"|00 01 86 a5|"; msG. "mountd access";)- AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111
- BAn alert is generated when any packet other than a TCP packet is seen on the network and destined for the 192.168.1.0 subnet
- CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the 192.168.1.0 subnet
- DAn alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111
37Which type of antenna is used in wireless communication?
- AOmnidirectional
- BParabolic
- CUni-directional
- DBi-directional
38You are the Network Admin, and you get a compliant that some of the websites are no
longer accessible. You try to ping the servers and find them to be reachable. Then you type the IP
address and then you try on the browser, and find it to be accessible. But they are not accessible
when you try using the URL.
What may be the problem?- ATraffic is Blocked on UDP Port 53
- BTraffic is Blocked on UDP Port 81
- CTraffic is Blocked on UDP Port 54
- DTraffic is Blocked on UDP Port 80
39How is the public key distributed in an orderly, controlled fashion so that the users can be sure of the sender's identity?
- AHash value
- BPrivate key
- CDigital signature
- DDigital certificate
40What is the BEST alternative if you discover that a rootkit has been installed on one of your
computers?- ACopy the system files from a known good system
- BPerform a trap and trace
- CDelete the files and try to determine the source
- DReload from a previous backup
- EReload from known good media
41Which of the following is optimized for confidential communications, such as bidirectional
voice and video?- ARC4
- BRC5
- CMD4
- DMD5
42In the context of Windows Security, what is a 'null' user?
- AA user that has no skills
- BAn account that has been suspended by the admin
- CA pseudo account that has no username and password
- DA pseudo account that was created for security administration purpose
43A hacker is attempting to see which IP addresses are currently active on a network. Which
NMAP switch would the hacker use?- A-sO
- B-sP
- C-sS
- D-sU
44In Risk Management, how is the term "likelihood" related to the concept of "threat?"
- ALikelihood is the probability that a threat-source will exploit a vulnerability.
- BLikelihood is a possible threat-source that may exploit a vulnerability.
- CLikelihood is the likely source of a threat that could exploit a vulnerability.
- DLikelihood is the probability that a vulnerability is a threat-source.
45During a wireless penetration test, a tester detects an access point using WPA2 encryption.
Which of the following attacks should be used to obtain the key?- AThe tester must capture the WPA2 authentication handshake and then crack it.
- BThe tester must use the tool inSSIDer to crack it using the ESSID of the network.
- CThe tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
- DThe tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key.
46What is the main disadvantage of the scripting languages as opposed to compiled
programming languages?- AScripting languages are hard to learn.
- BScripting languages are not object-oriented.
- CScripting languages cannot be used to create graphical user interfaces.
- DScripting languages are slower because they require an interpreter to run the code.
47A consultant is hired to do physical penetration testing at a large financial company. In the
first day of his assessment, the consultant goes to the company`s building dressed like an electrician
and waits in the lobby for an employee to pass through the main access gate, then the consultant
follows the employee behind to get into the restricted area. Which type of attack did the consultant
perform?- AMan trap
- BTailgating
- CShoulder surfing
- DSocial engineering
48You are about to be hired by a well-known Bank to perform penetration tests. Which of the
following documents describes the specifics of the testing, the associated violations, and essentially
protects both the bank's interest and your liabilities as a tester?- AService Level Agreement
- BNon-Disclosure Agreement
- CTerms of Engagement
- DProject Scope
49A person approaches a network administrator and wants advice on how to send encrypted
email from home.
The end user does not want to have to pay for any license fees or manage server services. Which of
the following is the most secure encryption protocol that the network administrator should
recommend?- AIP Security (IPSEC)
- BMultipurpose Internet Mail Extensions (MIME)
- CPretty Good Privacy (PGP)
- DHyper Text Transfer Protocol with Secure Socket Layer (HTTPS)
50MX record priority increases as the number increases. (True/False.)
- ATrue
- BFalse
51Which of the following is a low-tech way of gaining unauthorized access to systems?
- ASocial Engineering
- BSniffing
- CEavesdropping
- DScanning
52Bob is acknowledged as a hacker of repute and is popular among visitors of "underground"
sites.
Bob is willing to share his knowledge with those who are willing to learn, and many have expressed
their interest in learning from him. However, this knowledge has a risk associated with it, as it can be
used for malevolent attacks as well.
In this context, what would be the most effective method to bridge the knowledge gap between the
"black" hats or crackers and the "white" hats or computer security professionals? (Choose the test
answer.)- AEducate everyone with books, articles and training on risk analysis, vulnerabilities and safeguards.
- BHire more computer security monitoring personnel to monitor computer systems and networks.
- CMake obtaining either a computer security certification or accreditation easier to achieve so more individuals feel that they are a part of something larger than life.
- DTrain more National Guard and reservist in the art of computer security to help out in times of emergency or crises.
53What statement is true regarding LM hashes?
- ALM hashes consist in 48 hexadecimal characters.
- BLM hashes are based on AES128 cryptographic standard.
- CUppercase characters in the password are converted to lowercase.
- DLM hashes are not generated when the password length exceeds 15 characters.
54What information should an IT system analysis provide to the risk assessor?
- AManagement buy-in
- BThreat statement
- CSecurity architecture
- DImpact analysis
55An attacker has captured a target file that is encrypted with public key cryptography. Which
of the attacks below is likely to be used to crack the target file?- ATiming attack
- BReplay attack
- CMemory trade-off attack
- DChosen plain-text attack
56International Organization for Standardization (ISO) standard 27002 provides guidance for
compliance by outlining- Aguidelines and practices for security controls.
- Bfinancial soundness and business viability metrics.
- Cstandard best practice for configuration management.
- Dcontract agreement writing standards.
57Which of the following is the primary objective of a rootkit?
- AIt opens a port to provide an unauthorized service
- BIt creates a buffer overflow
- CIt replaces legitimate programs
- DIt provides an undocumented opening in a program
58The "gray box testing" methodology enforces what kind of restriction?
- AThe internal operation of a system is only partly accessible to the tester.
- BThe internal operation of a system is completely known to the tester.
- COnly the external operation of a system is accessible to the tester.
- DOnly the internal operation of a system is known to the tester.
59An attacker changes the profile information of a particular user (victim) on the target
website. The attacker uses this string to update the victim's profile to a text file and then submit the
data to the attacker's database.
< iframe src="http://www.vulnweb.com/updateif.php" style="display:none"></iframe> What is this
type of attack (that can use either HTTP GET or HTTP POST) called?- ACross-Site Request Forgery
- BCross-Site Scripting
- CSQL Injection
- DBrowser Hacking
60Which of the following tools are used for enumeration? (Choose three.)
- ASolarWinds
- BUSER2SID
- CCheops
- DSID2USER
- EDumpSec
61A pentester is using Metasploit to exploit an FTP server and pivot to a LAN. How will the
pentester pivot using Metasploit?- AIssue the pivot exploit and set the meterpreter.
- BReconfigure the network settings in the meterpreter.
- CSet the payload to propagate through the meterpreter.
- DCreate a route statement in the meterpreter.
62Which of the following describes the characteristics of a Boot Sector Virus?
- AMoves the MBR to another location on the RAM and copies itself to the original location of the MBR
- BMoves the MBR to another location on the hard disk and copies itself to the original location of the MBR
- CModifies directory table entries so that directory entries point to the virus code instead of the actual program
- DOverwrites the original MBR and only executes the new virus code
63In order to have an anonymous Internet surf, which of the following is best choice?
- AUse SSL sites when entering personal information
- BUse Tor network with multi-node
- CUse shared WiFi
- DUse public VPN
64A security analyst in an insurance company is assigned to test a new web application that
will be used by clients to help them choose and apply for an insurance plan. The analyst discovers
that the application is developed in ASP scripting language and it uses MSSQL as a database backend.
The analyst locates the application's search form and introduces the following code in the search
input field:
When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable".
Which web applications vulnerability did the analyst discover?
- ACross-site request forgery
- BCommand injection
- CCross-site scripting
- DSQL injection
65You have several plain-text firewall logs that you must review to evaluate network traffic.
You know that in order to do fast, efficient searches of the logs you must use regular expressions.
Which command-line utility are you most likely to use?- AGrep
- BNotepad
- CMS Excel
- DRelational Database
66A computer technician is using a new version of a word processing software package when
it is discovered that a special sequence of characters causes the entire computer to crash. The
technician researches the bug and discovers that no one else experienced the problem. What is the
appropriate next step?- AIgnore the problem completely and let someone else deal with it.
- BCreate a document that will crash the computer when opened and send it to friends.
- CFind an underground bulletin board and attempt to sell the bug to the highest bidder.
- DNotify the vendor of the bug and do not disclose it until the vendor gets a chance to issue a fix.
67Which of the following is an application that requires a host application for replication?
- AMicro
- BWorm
- CTrojan
- DVirus
68An organization hires a tester to do a wireless penetration test. Previous reports indicate
that the last test did not contain management or control packets in the submitted traces. Which of
the following is the most likely reason for lack of management or control packets?- AThe wireless card was not turned on.
- BThe wrong network card drivers were in use by Wireshark.
- COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
- DCertain operating systems and adapters do not collect the management or control packets.
69An attacker scans a host with the below command. Which three flags are set? (Choose
three.)
#nmap -sX host.domain.com- AThis is ACK scan. ACK flag is set
- BThis is Xmas scan. SYN and ACK flags are set
- CThis is Xmas scan. URG, PUSH and FIN are set
- DThis is SYN scan. SYN flag is set
70You work for Acme Corporation as Sales Manager. The company has tight network security
restrictions. You are trying to steal data from the company's Sales database (Sales.xls) and transfer
them to your home computer. Your company filters and monitors traffic that leaves from the internal
network to the Internet. How will you achieve this without raising suspicion?- AEncrypt the Sales.xls using PGP and e-mail it to your personal gmail account
- BPackage the Sales.xls using Trojan wrappers and telnet them back your home computer
- CYou can conceal the Sales.xls database in another file like photo.jpg or other files and send it out in an innocent looking email or file transfer using Steganography techniques
- DChange the extension of Sales.xls to sales.txt and upload them as attachment to your hotmail account
71A penetration tester is attempting to scan an internal corporate network from the internet
without alerting the border sensor. Which is the most efficient technique should the tester consider
using?- ASpoofing an IP address
- BTunneling scan over SSH
- CTunneling over high port numbers
- DScanning using fragmented IP packets
72A hacker searches in Google for filetype:pcf to find Cisco VPN config files. Those files may
contain connectivity passwords that can be decoded with which of the following?- ACupp
- BNessus
- CCain and Abel
- DJohn The Ripper Pro
73Which of the following is an example of IP spoofing?
- ASQL injections
- BMan-in-the-middle
- CCross-site scripting
- DARP poisoning
74A technician is resolving an issue where a computer is unable to connect to the Internet
using a wireless access point. The computer is able to transfer files locally to other machines, but
cannot successfully reach the Internet. When the technician examines the IP address and default
gateway they are both on the
192.168.1.0/24. Which of the following has occurred?- AThe gateway is not routing to a public IP address.
- BThe computer is using an invalid IP address.
- CThe gateway and the computer are not on the same network.
- DThe computer is not using a private IP address.
75A certified ethical hacker (CEH) is approached by a friend who believes her husband is
cheating. She offers to pay to break into her husband's email account in order to find proof so she
can take him to court. What is the ethical response?- ASay no; the friend is not the owner of the account.
- BSay yes; the friend needs help to gather evidence.
- CSay yes; do the job for free.
- DSay no; make sure that the friend knows the risk she's asking the CEH to take.
76env x=`(){ :;};echo exploit` bash -c 'cat /etc/passwd'
What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?- ADisplay passwd content to prompt
- BRemoves the passwd file
- CChanges all passwords in passwd
- DAdd new user to the passwd file
77As a securing consultant, what are some of the things you would recommend to a company
to ensure DNS security?- AUse the same machines for DNS and other applications
- BHarden DNS servers
- CRestrict Zone transfers
- DUse split-horizon operation for DNS servers
- EHave subnet diversity between DNS servers
78Some passwords are stored using specialized encryption algorithms known as hashes. Why
is this an appropriate method?- AIt is impossible to crack hashed user passwords unless the key used to encrypt them is obtained.
- BIf a user forgets the password, it can be easily retrieved using the hash key stored by
administrators. - CHashing is faster compared to more traditional encryption algorithms.
- DPasswords stored using hashes are non-reversible, making finding the password much more difficult.
79A company has publicly hosted web applications and an internal Intranet protected by a
firewall. Which technique will help protect against enumeration?- AReject all invalid email received via SMTP.
- BAllow full DNS zone transfers.
- CRemove A records for internal hosts.
- DEnable null session pipes.
80Which of the following incident handling process phases is responsible for defining rules,
collaborating human workforce, creating a back-up plan, and testing the plans for an organization?- APreparation phase
- BContainment phase
- CIdentification phase
- DRecovery phase
81In both pharming and phishing attacks an attacker can create websites that look similar to
legitimate sites with the intent of collecting personal identifiable information from its victims. What is
the difference between pharming and phishing attacks?- AIn a pharming attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a phishing attack an attacker provides the victim with a URL that is either misspelled or looks similar to the actual websites domain name.
- BBoth pharming and phishing attacks are purely technical and are not considered forms of social engineering.
- CBoth pharming and phishing attacks are identical.
- DIn a phishing attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a pharming attack an attacker provides the victim with a URL that is either misspelled or looks very similar to the actual websites domain name.
82While you were gathering information as part of security assessments for one of your
clients, you were able to gather data that show your client is involved with fraudulent activities. What
should you do?- AImmediately stop work and contact the proper legal authorities
- BIgnore the data and continue the assessment until completed as agreed
- CConfront the client in a respectful manner and ask her about the data
- DCopy the data to removable media and keep it in case you need it
83A tester has been hired to do a web application security test. The tester notices that the site
is dynamic and must make use of a back end database.
In order for the tester to see if SQL injection is possible, what is the first character that the tester
should use to attempt breaking a valid SQL request?- ASemicolon
- BSingle quote
- CExclamation mark
- DDouble quote
84While
using your bank's online servicing you notice the following string in the URL bar:
"http://www.MyPersonalBank.com/account?id=368940911028389
& Damount=10980&Camount=21"
You observe that if you modify the Damount & Camount values and submit the request, that data on
the web page reflect the changes.
Which type of vulnerability is present on this site?- AWeb Parameter Tampering
- BCookie Tampering
- CXSS Reflection
- DSQL injection
85When does the Payment Card Industry Data Security Standard (PCI-DSS) require
organizations to perform external and internal penetration testing?- AAt least once a year and after any significant upgrade or modification
- BAt least once every three years or after any significant upgrade or modification
- CAt least twice a year or after any significant upgrade or modification
- DAt least once every two years and after any significant upgrade or modification
86A covert channel is a channel that
- Atransfers information over, within a computer system, or network that is outside of the security policy.
- Btransfers information over, within a computer system, or network that is within the security policy
- Ctransfers information via a communication path within a computer system, or network for transfer of data.
- Dtransfers information over, within a computer system, or network that is encrypted.
87Which of the following scanning method splits the TCP header into several packets and
makes it difficult for packet filters to detect the purpose of the packet?- AICMP Echo scanning
- BSYN/FIN scanning using IP fragments
- CACK flag probe scanning
- DIPID scanning
88Which of the following parameters describe LM Hash (see exhibit):
Exhibit:
- AI, II, and III
- BI
- CII
- DI and II
89A hacker was able to sniff packets on a company's wireless network. The following
information was discovered:
Using the Exlcusive OR, what was the original message?
- A00101000 11101110
- B11010111 00010001
- C00001101 10100100
- D11110010 01011011
90Which of the following is a form of penetration testing that relies heavily on human
interaction and often involves tricking people into breaking normal security procedures?- ASocial Engineering
- BPiggybacking
- CTailgating
- DEavesdropping
91This asymmetry cipher is based on factoring the product of two large prime numbers.
What cipher is described above?- ARSA
- BSHA
- CRC5
- DMD5
92Which property ensures that a hash function will not produce the same hashed value for
two different messages?- ACollision resistance
- BBit length
- CKey strength
- DEntropy
93Assume a business-crucial web-site of some company that is used to sell handsets to the
customers worldwide.
All the developed components are reviewed by the security team on a monthly basis. In order to
drive business further, the web-site developers decided to add some 3rd party marketing tools on it.
The tools are written in JavaScript and can track the customer's activity on the site. These tools are
located on the servers of the marketing company.
What is the main security risk associated with this scenario?- AExternal script contents could be maliciously modified without the security team knowledge
- BExternal scripts have direct access to the company servers and can steal the data from there
- CThere is no risk at all as the marketing services are trustworthy
- DExternal scripts increase the outbound company data traffic which leads greater financial losses
94What attack is used to crack passwords by using a precomputed table of hashed passwords?
- ABrute Force Attack
- BHybrid Attack
- CRainbow Table Attack
- DDictionary Attack
95A Security Engineer at a medium-sized accounting firm has been tasked with discovering
how much information can be obtained from the firm's public facing web servers. The engineer
decides to start by using netcat to port 80.
The engineer receives this output:
Which of the following is an example of what the engineer performed?
- ACross-site scripting
- BBanner grabbing
- CSQL injection
- DWhois database query
96Which of the following is an adaptive SQL Injection testing technique used to discover
coding errors by inputting massive amounts of random data and observing the changes in the
output?- AFunction Testing
- BDynamic Testing
- CStatic Testing
- DFuzzing Testing
97What two conditions must a digital signature meet?
- AHas to be unforgeable, and has to be authentic.
- BHas to be legible and neat.
- CMust be unique and have special characters.
- DHas to be the same number of characters as a physical signature and must be unique.
98Jimmy is standing outside a secure entrance to a facility. He is pretending to have a tense
conversation on his cell phone as an authorized employee badges in. Jimmy, while still on the phone,
grabs the door as it begins to close.
What just happened?- APiggybacking
- BMasqurading
- CPhishing
- DWhaling
99You have the SOA presented below in your Zone.
Your secondary servers have not been able to contact your primary server to synchronize
information. How long will the secondary servers attempt to contact the primary server before it
considers that zone is dead and stops responding to queries?
collegae.edu.SOA, cikkye.edu ipad.college.edu. (200302028 3600 3600 604800 3600)- AOne day
- BOne hour
- COne week
- DOne month
100Study the log below and identify the scan type.
- Anmap -sR 192.168.1.10
- Bnmap -sS 192.168.1.10
- Cnmap -sV 192.168.1.10
- Dnmap -sO -T 192.168.1.10
101Which technical characteristic do Ethereal/Wireshark, TCPDump, and Snort have in
common?- AThey are written in Java.
- BThey send alerts to security monitors.
- CThey use the same packet analysis engine.
- DThey use the same packet capture utility.
102Which of the following is a component of a risk assessment?
- AAdministrative safeguards
- BPhysical security
- CDMZ
- DLogical interface
103What is the outcome of the comm"nc -l -p 2222 | nc 10.1.0.43 1234"?
- ANetcat will listen on the 10.1.0.43 interface for 1234 seconds on port 2222.
- BNetcat will listen on port 2222 and output anything received to a remote connection on 10.1.0.43 port 1234.
- CNetcat will listen for a connection from 10.1.0.43 on port 1234 and output anything received to port2222.
- DNetcat will listen on port 2222 and then output anything received to local interface 10.1.0.43.
104Which type of cryptography does SSL, IKE and PGP belongs to?
- ASecret Key
- BHash Algorithm
- CDigest
- DPublic Key
105A regional bank hires your company to perform a security assessment on their network after
a recent data breach. The attacker was able to steal financial data from the bank by compromising
only a single server.
Based on this information, what should be one of your key recommendations to the bank?- APlace a front-end web server in a demilitarized zone that only handles external web traffic
- BRequire all employees to change their passwords immediately
- CMove the financial data to another server on the same IP subnet
- DIssue new certificates to the web servers from the root certificate authority
106What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming
through the firewall if your network is comprised of Windows NT, 2000, and XP?- A110
- B135
- C139
- D161
- E445
- F1024
107In Trojan terminology, what is a covert channel?
- AA channel that transfers information within a computer system or network in a way that violates the security policy
- BA legitimate communication path within a computer system or network for transfer of data
- CIt is a kernel operation that hides boot processes and services to mask detection
- DIt is Reverse tunneling technique that uses HTTPS protocol instead of HTTP protocol to establish connections
108To reduce the attack surface of a system, administrators should perform which of the
following processes to remove unnecessary software, services, and insecure configuration settings?- AHarvesting
- BWindowing
- CHardening
- DStealthing
109What tool should you use when you need to analyze extracted metadata from files you
collected when you were in the initial stage of penetration test (information gathering)?- AArmitage
- BDimitry
- CMetagoofil
- Dcdpsnarf
110While checking the settings on the internet browser, a technician finds that the proxy server
settings have been checked and a computer is trying to use itself as a proxy server. What specific
octet within the subnet does the technician see?- A10.10.10.10
- B127.0.0.1
- C192.168.1.1
- D192.168.168.168
111Which of the following is NOT an ideal choice for biometric controls?
- AIris patterns
- BFingerprints
- CHeight and weight
- DVoice
112In an internal security audit, the white hat hacker gains control over a user account and
attempts to acquire access to another account's confidential files and information. How can he
achieve this?- APort Scanning
- BHacking Active Directory
- CPrivilege Escalation
- DShoulder-Surfing
113Which of the following is designed to verify and authenticate individuals taking part in a
data exchange within an enterprise?- ASOA
- BSingle-Sign On
- CPKI
- DBiometrics
114One of your team members has asked you to analyze the following SOA record.
What is the TTL? Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800
2400.)- A200303028
- B3600
- C604800
- D2400
- E60
- F4800
115Which one of the following Google advanced search operators allows an attacker to restrict
the results to those websites in the given domain?- A[cache:]
- B[site:]
- C[inurl:]
- D[link:]
116Which of the following is a primary service of the U.S. Computer Security Incident Response
Team (CSIRT)?- ACSIRT provides an incident response service to enable a reliable and trusted single point of contact for reporting computer security incidents worldwide.
- BCSIRT provides a computer security surveillance service to supply a government with important intelligence information on individuals travelling abroad.
- CCSIRT provides a penetration testing service to support exception reporting on incidents
worldwide by individuals and multi-national corporations. - DCSIRT provides a vulnerability assessment service to assist law enforcement agencies with profiling an individual's property or company's asset.
117Which specific element of security testing is being assured by using hash?
- AAuthentication
- BIntegrity
- CConfidentiality
- DAvailability
118Which of the following Bluetooth hacking techniques does an attacker use to send messages
to users without the recipient's consent, similar to email spamming?- ABluesmacking
- BBluesniffing
- CBluesnarfing
- DBluejacking
119While performing online banking using a Web browser, Kyle receives an email that contains
an image of a well-crafted art. Upon clicking the image, a new tab on the web browser opens and
shows an animated GIF of bills and coins being swallowed by a crocodile. After several days, Kyle
noticed that all his funds on the bank was gone. What Web browser-based security vulnerability got
exploited by the hacker?- AClickjacking
- BWeb Form Input Validation
- CCross-Site Request Forgery
- DCross-Site Scripting
120Which of the following is the most important phase of ethical hacking wherein you need to
spend considerable amount of time?- AGaining access
- BEscalating privileges
- CNetwork mapping
- DFootprinting
121Vlady works in a fishing company where the majority of the employees have very little
understanding of IT let alone IT Security. Several information security issues that Vlady often found
includes, employees sharing password, writing his/her password on a post it note and stick it to
his/her desk, leaving the computer unlocked, didn't log out from emails or other social media
accounts, and etc.
After discussing with his boss, Vlady decided to make some changes to improve the security
environment in his company. The first thing that Vlady wanted to do is to make the employees
understand the importance of keeping confidential information, such as password, a secret and they
should not share it with other persons.
Which of the following steps should be the first thing that Vlady should do to make the employees in
his company understand to importance of keeping confidential information a secret?- AWarning to those who write password on a post it note and put it on his/her desk
- BDeveloping a strict information security policy
- CInformation security awareness training
- DConducting a one to one discussion with the other employees about the importance of
information security
122A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites.
77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets
had an ICMP ID:0 and Seq:0. What can you infer from this information?- AThe packets were sent by a worm spoofing the IP addresses of 47 infected sites
- BICMP ID and Seq numbers were most likely set by a tool and not by the operating system
- CAll 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
- D13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and Seq 0
123XOR is a common cryptographic tool. 10110001 XOR 00111010 is?
- A10111100
- B11011000
- C10011101
- D10001011
124During a penetration test, a tester finds that the web application being analyzed is
vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this
vulnerability?- AThe web application does not have the secure flag set.
- BThe session cookies do not have the HttpOnly flag set.
- CThe victim user should not have an endpoint security solution.
- DThe victim's browser must have ActiveX technology enabled.
125Cryptography is the practice and study of techniques for secure communication in the
presence of third parties (called adversaries.) More generally, it is about constructing and analyzing
protocols that overcome the influence of adversaries and that are related to various aspects in
information security such as data confidentiality, data integrity, authentication, and non-repudiation.
Modern cryptography intersects the disciplines of mathematics, computer science, and electrical
engineering. Applications of cryptography include ATM cards, computer passwords, and electronic
commerce.
Basic example to understand how cryptography works is given below:
Which of the following choices is true about cryptography?
- AAlgorithm is not the secret, key is the secret.
- BSymmetric-key algorithms are a class of algorithms for cryptography that use the different
cryptographic keys for both encryption of plaintext and decryption of ciphertext. - CSecure Sockets Layer (SSL) use the asymmetric encryption both (public/private key pair) to deliver the shared session key and to achieve a communication way.
- DPublic-key cryptography, also known as asymmetric cryptography, public key is for decrypt, private key is for encrypt.
126Which of the following cryptography attack is an understatement for the extraction of
cryptographic secrets (e.g. the password to an encrypted file) from a person by a coercion or torture?- AChosen-Cipher text Attack
- BCiphertext-only Attack
- CTiming Attack
- DRubber Hose Attack
127Which of the following is a detective control?
- ASmart card authentication
- BSecurity policy
- CAudit trail
- DContinuity of operations plan
128Which of the following is a common Service Oriented Architecture (SOA) vulnerability?
- ACross-site scripting
- BSQL injection
- CVPath injection
- DXML denial of service issues
129Which of the following is considered as one of the most reliable forms of TCP scanning?
- ATCP Connect/Full Open Scan
- BHalf-open Scan
- CNULL Scan
- DXmas Scan
130Why would you consider sending an email to an address that you know does not exist
within the company you are performing a Penetration Test for?- ATo determine who is the holder of the root account
- BTo perform a DoS
- CTo create needless SPAM
- DTo illicit a response back that will reveal information about email servers and how they treat undeliverable mail
- ETo test for virus protection
131........is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one
offered on the premises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or
mobile phone to a tainted hotspot by posing as a legitimate provider. This type of attack may be used
to steal the passwords of unsuspecting users by either snooping the communication link or by
phishing, which involves setting up a fraudulent web site and luring people there.
Fill in the blank with appropriate choice.- ACollision Attack
- BEvil Twin Attack
- CSinkhole Attack
- DSignal Jamming Attack
132Which NMAP feature can a tester implement or adjust while scanning for open ports to
avoid detection by the network's IDS?- ATiming options to slow the speed that the port scan is conducted
- BFingerprinting to identify which operating systems are running on the network
- CICMP ping sweep to determine which hosts on the network are not available
- DTraceroute to control the path of the packets sent during the scan
133Susan has attached to her company's network. She has managed to synchronize her boss's
sessions with that of the file server. She then intercepted his traffic destined for the server, changed
it the way she wanted to and then placed it on the server in his home directory.
What kind of attack is Susan carrying on?- AA sniffing attack
- BA spoofing attack
- CA man in the middle attack
- DA denial of service attack
134Matthew received an email with an attachment named "YouWon$10Grand.zip." The zip file
contains a file named "HowToClaimYourPrize.docx.exe." Out of excitement and curiosity, Matthew
opened the said file.
Without his knowledge, the file copies itself to Matthew's APPDATA\IocaI directory and begins to
beacon to a Command-and-control server to download additional malicious binaries. What type of
malware has Matthew encountered?- AKey-logger
- BTrojan
- CWorm
- DMacro Virus
135Nation-state threat actors often discover vulnerabilities and hold on to them until they want
to launch a sophisticated attack. The Stuxnet attack was an unprecedented style of attack because it
used four types of vulnerability.
What is this style of attack called?- Azero-day
- Bzero-hour
- Czero-sum
- Dno-day
136A network security administrator is worried about potential man-in-the-middle attacks
when users access a corporate web site from their workstations. Which of the following is the best
remediation against this type of attack?- AImplementing server-side PKI certificates for all connections
- BMandating only client-side PKI certificates for all connections
- CRequiring client and server PKI certificates for all connections
- DRequiring strong authentication for all DNS queries
137What is not a PCI compliance recommendation?
- ALimit access to card holder data to as few individuals as possible.
- BUse encryption to protect all transmission of card holder data over any public network.
- CRotate employees handling credit card transactions on a yearly basis to different departments.
- DUse a firewall between the public network and the payment card data.
138When you are testing a web application, it is very useful to employ a proxy tool to save
every request and response. You can manually test every request and analyze the response to find
vulnerabilities. You can test parameter and headers manually to get more precise results than if using
web vulnerability scanners.
What proxy tool will help you find web vulnerabilities?- ABurpsuite
- BMaskgen
- CDimitry
- DProxychains
139Which of the following algorithms provides better protection against brute force attacks by
using a 160-bit message digest?- AMD5
- BSHA-1
- CRC4
- DMD4
140During a penetration test, the tester conducts an ACK scan using NMAP against the external
interface of the DMZ firewall. NMAP reports that port 80 is unfiltered. Based on this response, which
type of packet inspection is the firewall conducting?- AHost
- BStateful
- CStateless
- DApplication
141Which tool allows analysts and pen testers to examine links between data using graphs and
link analysis?- AMaltego
- BCain & Abel
- CMetasploit
- DWireshark
142This configuration allows NIC to pass all traffic it receives to the Central Processing Unit
(CPU), instead of passing only the frames that the controller is intended to receive. Select the option
that BEST describes the above statement.- AMulti-cast mode
- BWEM
- CPromiscuous mode
- DPort forwarding
143Yancey is a network security administrator for a large electric company. This company
provides power for over 100, 000 people in Las Vegas. Yancey has worked for his company for over
15 years and has become very successful. One day, Yancey comes in to work and finds out that the
company will be downsizing and he will be out of a job in two weeks. Yancey is very angry and decides to place logic bombs, viruses, Trojans, and backdoors all over the network to take down the
company once he has left. Yancey does not care if his actions land him in jail for 30 or more years, he
just wants the company to pay for what they are doing to him.
What would Yancey be considered?- AYancey would be considered a Suicide Hacker
- BSince he does not care about going to jail, he would be considered a Black Hat
- CBecause Yancey works for the company currently; he would be a White Hat
- DYancey is a Hacktivist Hacker since he is standing up to a company that is downsizing
144An enterprise recently moved to a new office and the new neighborhood is a little risky. The
CEO wants to monitor the physical perimeter and the entrance doors 24 hours. What is the best
option to do this job?- AUse fences in the entrance doors.
- BInstall a CCTV with cameras pointing to the entrance doors and the street.
- CUse an IDS in the entrance doors and install some of them near the corners.
- DUse lights in all the entrance doors and along the company's perimeter.
145What technique is used to perform a Connection Stream Parameter Pollution (CSPP) attack?
- AInjecting parameters into a connection string using semicolons as a separator
- BInserting malicious Javascript code into input parameters
- CSetting a user's session identifier (SID) to an explicit known value
- DAdding multiple parameters with the same name in HTTP requests
146You have successfully comprised a server having an IP address of 10.10.0.5. You would like
to enumerate all machines in the same network quickly.
What is the best nmap command you will use?- Anmap -T4 -F 10.10.0.0/24
- Bnmap -T4 -r 10.10.1.0/24
- Cnmap -T4 -O 10.10.0.0/24
- Dnmap -T4 -q 10.10.0.0/24
147Suppose you've gained access to your client's hybrid network. On which port should you
listen to in order to know which Microsoft Windows workstations has its file sharing enabled?- A1433
- B161
- C445
- D3389
148The company ABC recently discovered that their new product was released by the
opposition before their premiere. They contract an investigator who discovered that the maid threw
away papers with confidential information about the new product and the opposition found it in the
garbage. What is the name of the technique used by the opposition?- AHack attack
- BSniffing
- CDumpster diving
- DSpying
149When you return to your desk after a lunch break, you notice a strange email in your inbox.
The sender is someone you did business with recently, but the subject line has strange characters in
it.
What should you do?- AForward the message to your company's security response team and permanently delete the message from your computer.
- BReply to the sender and ask them for more information about the message contents.
- CDelete the email and pretend nothing happened
- DForward the message to your supervisor and ask for her opinion on how to handle the situation
150Which of the following is a symmetric cryptographic standard?
- ADSA
- BPKI
- CRSA
- D3DES
151In this attack, a victim receives an e-mail claiming from PayPal stating that their account has
been disabled and confirmation is required before activation. The attackers then scam to collect not
one but two credit card numbers, ATM PIN number and other personal details. Ignorant users usually
fall prey to this scam.
Which of the following statement is incorrect related to this attack?- ADo not reply to email messages or popup ads asking for personal or financial information
- BDo not trust telephone numbers in e-mails or popup ads
- CReview credit card and bank account statements regularly
- DAntivirus, anti-spyware, and firewall software can very easily detect these type of attacks
- EDo not send credit card numbers, and personal or financial information via e-mail
152ICMP ping and ping sweeps are used to check for active systems and to check
- Aif ICMP ping traverses a firewall.
- Bthe route that the ICMP ping took.
- Cthe location of the switchport in relation to the ICMP ping.
- Dthe number of hops an ICMP ping takes to reach a destination.
153While conducting a penetration test, the tester determines that there is a firewall between
the tester's machine and the target machine. The firewall is only monitoring TCP handshaking of
packets at the session layer of the OSI model. Which type of firewall is the tester trying to traverse?- APacket filtering firewall
- BApplication-level firewall
- CCircuit-level gateway firewall
- DStateful multilayer inspection firewall
154A penetration tester is conducting a port scan on a specific host. The tester found several
ports opened that were confusing in concluding the Operating System (OS) version installed.
Considering the NMAP result below, which of the following is likely to be installed on the target
machine by the OS?
- AThe host is likely a printer.
- BThe host is likely a Windows machine.
- CThe host is likely a Linux machine.
- DThe host is likely a router.
155DHCP snooping is a great solution to prevent rogue DHCP servers on your network. Which
security feature on switches leverages the DHCP snooping database to help prevent man-in-themiddle
attacks?- APort security
- BA Layer 2 Attack Prevention Protocol (LAPP)
- CDynamic ARP inspection (DAI)
- DSpanning tree
156What would you enter, if you wanted to perform a stealth scan using Nmap?
- Anmap -sU
- Bnmap -sS
- Cnmap -sM
- Dnmap -sT
157Which of the following conditions must be given to allow a tester to exploit a Cross-Site
Request Forgery (CSRF) vulnerable web application?- AThe victim user must open the malicious link with an Internet Explorer prior to version 8.
- BThe session cookies generated by the application do not have the HttpOnly flag set.
- CThe victim user must open the malicious link with a Firefox prior to version 3.
- DThe web application should not use random tokens.
158What is the best Nmap command to use when you want to list all devices in the same
network quickly after you successfully identified a server whose IP address is 10.10.0.5?- Anmap -T4 -F 10.10.0.0/24
- Bnmap -T4 -q 10.10.0.0/24
- Cnmap -T4 -O 10.10.0.0/24
- Dnmap -T4 -r 10.10.1.0/24
159In Wireshark, the packet bytes panes show the data of the current packet in which format?
- ADecimal
- BASCII only
- CBinary
- DHexadecimal
160While doing a Black box pen test via the TCP port (80), you noticed that the traffic gets
blocked when you tried to pass IRC traffic from a web enabled host. However, you also noticed that outbound HTTP traffic is being allowed. What type of firewall is being utilized for the outbound
traffic?- AStateful
- BApplication
- CCircuit
- DPacket Filtering
161What is the correct process for the TCP three-way handshake connection establishment and
connection termination?- AConnection Establishment: FIN, ACK-FIN, ACKConnection Termination: SYN, SYN-ACK, ACK
- BConnection Establishment: SYN, SYN-ACK, ACKConnection Termination: ACK, ACK-SYN, SYN
- CConnection Establishment: ACK, ACK-SYN, SYNConnection Termination: FIN, ACK-FIN, ACK
- DConnection Establishment: SYN, SYN-ACK, ACKConnection Termination: FIN, ACK-FIN, ACK
162As an Ethical Hacker you are capturing traffic from your customer network with Wireshark
and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find
this kind of traffic?- Arequest smtp 25
- Btcp.port eq 25
- Csmtp port
- Dtcp.contains port 25
163Which of the following is a design pattern based on distinct pieces of software providing
application functionality as services to other applications?- AService Oriented Architecture
- BObject Oriented Architecture
- CLean Coding
- DAgile Process
164What is the way to decide how a packet will move from an untrusted outside host to a
protected inside that is behind a firewall, which permits the hacker to determine which ports are
open and if the packets can pass through the packet-filtering of the firewall?- AFirewalking
- BSession hijacking
- CNetwork sniffing
- DMan-in-the-middle attack
165The collection of potentially actionable, overt, and publicly available information is known
as- AOpen-source intelligence
- BHuman intelligence
- CSocial intelligence
- DReal intelligence
166Which of the following parameters enables NMAP's operating system detection feature?
- ANMAP -sV
- BNMAP -oS
- CNMAP -sR
- DNMAP -O
167Which of the following is the structure designed to verify and authenticate the identity of
individuals within the enterprise taking part in a data exchange?- APKI
- Bsingle sign on
- Cbiometrics
- DSOA
168What network security concept requires multiple layers of security controls to be placed
throughout an IT infrastructure, which improves the security posture of an organization to defend
against malicious attacks or potential vulnerabilities?- ASecurity through obscurity
- BHost-Based Intrusion Detection System
- CDefense in depth
- DNetwork-Based Intrusion Detection System
169An attacker attaches a rogue router in a network. He wants to redirect traffic to a LAN
attached to his router as part of a man-in-the-middle attack. What measure on behalf of the
legitimate admin can mitigate this attack?- AOnly using OSPFv3 will mitigate this risk.
- BMake sure that legitimate network routers are configured to run routing protocols with
authentication. - CRedirection of the traffic cannot happen unless the admin allows it explicitly.
- DDisable all routing protocols and only use static routes.
170Which of the following is an advantage of utilizing security testing methodologies to conduct
a security audit?- AThey provide a repeatable framework.
- BAnyone can run the command line scripts.
- CThey are available at low cost.
- DThey are subject to government regulation.
171Darius is analysing logs from IDS. He want to understand what have triggered one alert and
verify if it's true positive or false positive. Looking at the logs he copy and paste basic details like
below:
source IP: 192.168.21.100
source port: 80
destination IP: 192.168.10.23
destination port: 63221
What is the most proper answer.- AThis is most probably true negative.
- BThis is most probably true positive which triggered on secure communication between client and server.
- CThis is most probably false-positive, because an alert triggered on reversed traffic.
- DThis is most probably false-positive because IDS is monitoring one direction traffic.
172You are tasked to perform a penetration test. While you are performing information
gathering, you find an employee list in Google. You find the receptionist's email, and you send her an
email changing the source email to her boss's email( boss@company ). In this email, you ask for a pdf
with information. She reads your email and sends back a pdf with links. You exchange the pdf links
with your malicious links (these links contain malware) and send back the modified pdf, saying that
the links don't work. She reads your email, opens the links, and her machine gets infected. You now
have access to the company network.
What testing method did you use?- ASocial engineering
- BTailgating
- CPiggybacking
- DEavesdropping
173SNMP is a protocol used to query hosts, servers, and devices about performance or health
status data. This protocol has long been used by hackers to gather great amount of information
about remote hosts. Which of the following features makes this possible? (Choose two.)- AIt used TCP as the underlying protocol.
- BIt uses community string that is transmitted in clear text.
- CIt is susceptible to sniffing.
- DIt is used by all network devices on the market.
174Firewalk has just completed the second phase (the scanning phase) and a technician
receives the output shown below. What conclusions can be drawn based on these scan results?
- AThe firewall itself is blocking ports 21 through 23 and a service is listening on port 23 of the target host.
- BThe lack of response from ports 21 and 22 indicate that those services are not running on the destination server.
- CThe scan on port 23 passed through the filtering device. This indicates that port 23 was not blocked at the firewall.
- DThe scan on port 23 was able to make a connection to the destination host prompting the firewall to respond with a TTL error.
175Which of the following is a component of a risk assessment?
- APhysical security
- BAdministrative safeguards
- CDMZ
- DLogical interface
Información
- Descripción
- CEH CEH Test sobre Preparacion 3, creado por David Martinez Lora el 30/10/2020.
- Autor
- David Martinez Lora
- Idioma
- Español
- Visitas
- 2
- Historial
- Creado el 30 oct 2020 · actualizado el 1 nov 2020
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test