Quiz
WCC Pen Test
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (179)
1For the purpose of penetration testing; a backdoor is:
- AA vendor supplied service
- Bhaving access to compromised valid credentials
- Caccess to a target without using normal authentication
- Dsomething put in by the software developers
2Which tool uses ICMP to tunnel data
- Aptunnel
- Bproxychains
- Cncat
- Dsslh
3One technique to maintaining a backdoor is to replace a system binary with a compromised one
- AVerdadeiro
- BFalso
4Strategies for maintaining access include:
- Acracking passwords
- Bcreating reverse tunnels
- Chidden web applications
- Dcompromised operating systems
5Which of the following are used as a web shell:
- Aweevely
- Bsocat
- CWeBaCoo
- Ddns2tcp
6What is sidejacking?
- Apassive cookie stealing
- Bsitting next to a user and seeing what they are typing
- Cstealing a sidecar
- Da make up name by the instructor
7Proxychains can for any TCP connections from a client to go through a proxy.
- AVerdadeiro
- BFalso
8Netcat can be used to maintain access to a compromised target
- AVerdadeiro
- BFalso
9Tunneling cannot evade firewall rules
- AVerdadeiro
- BFalso
10The concept of wrapping a protocol within another is called:
- Aproxy service
- Bmultiplexing
- Cbackdoor
- Dtunneling
11Tunnels run on a specific and well known protocols and ports
- AVerdadeiro
- BFalso
12To tunnel connections using DNS you must
- AControl the default DNS server used by the target
- Bmake sure inbound port 80 is not blocked
- Ccontrol a DNS server that the target will use
- DInstall a DNS server on the target
13When you gain access to a target as a user and have access to another user's (not admin) functions:
- Ayou are just lucky
- Bperformed vertical escalation
- Cperformed horizontal escalation
- Dhave gained root/admin access
14Which password attack is generally quicker and less obvious to the target:
- Aoffline
- Bonline
15An online password attack will never trigger any alters or block the attacker
- AVerdadeiro
- BFalso
16What is needed to do an offline password attack?
- Ajust the attack tool
- Bthe target address
- Cthe password file
- Dthe group file
17Wireshark can read tcpdump or windump packet capture files
- AVerdadeiro
- BFalso
18Tools that use precomputed hashes to crack a password
- AJohn
- BRainbowCrack
- CHashcat
- DOphCrack
19In order to capture packets on a network
- Athe network interface needs to be in promiscuous mode
- Bthere must be two connections to the network
- Ca packet capture framework needs to be installed such as libpcap
- Donly linux systems can capture packets
20Which of the following are networks spoofing tools?
- Anetmap
- Barpspoof
- Clanmap
- Dettercap
21How can network spoofing be used for privilege escalation
- Ato control network traffic
- Bit can't
- Cit only need access to one party
- Dby reflecting the ip address
22Performing offline password cracking requires:
- AThat you have access to the password hashes
- Bhave a fast network connection so you can try usernames and passwords quickly
- Caccess to the target network
- Dknown the password policy
23What tool can be used to sniff switch traffic
- Awireshark
- Btcpdump
- Cdsniff
- Darpspoff
24What tool would be used to do a live attack on a website login
- Ajohn
- Bbrutessh
- Chydra
- Dophcrack
25All explorations will lead to privilege escalation
- AVerdadeiro
- BFalso
26What tool will create a custom world list by spidering the web
- Acrunch
- BJohn
- Crtgen
- DCeWL
27Which of the following are offline password crackers?
- Arainbow crack
- Bxhydra
- CJohn
- Dsshbrute
28Dsniff is a tool that could capture a password as it crosses the network
- AVerdadeiro
- BFalso
29To take advantage of a vulnerability you need
- Aan exploit
- Ba user name
- Ca payload
- Da module
30When you get access to the target, understanding the target operating system:
- Ais not important
- Bis handled by the exploit code
- Cautomatically gets you root or admin access
- Dis very important to understand
31An exploit can be Proof of Concept code that demonstrates the vulnerability
- AVerdadeiro
- BFalso
32A metasploit payload is:
- AWhere the target is set
- BWhat compromises the machine
- CWhat controls the action after the target is compromised
- Dlisted under exploits
33Hacking frameworks allow for one click p0wning a target
- AVerdadeiro
- BFalso
34How is a banner grab different from a port scan?
- Ait is the same thing
- Bport scan assumes the port is running the registered service while a banner grab will query the service and report what is returned
- Cbanner grab is easier to perform and makes less noise
- Dprobing the dns server will do the same thing
35Metasploit auxiliary is where you would find special scanning tools.
- AVerdadeiro
- BFalso
36After "popping a box" what task should you consider doing?
- ALog off to see if you can do it again
- Bset up a backdoor so you can get back in
- CCheck to see who is also logged in
- DLeave a message on the machine and post to claim your cred as a hacker
37A metasploit exploit
- Ais what compromises the target
- Bis where the target is set
- Chas options
- Dis listed under payloads
38Meterpreter is
- AA special payload
- Ban exploit
- Ca regular payload
- Dis an auxiliary
39What is the purpose of fuxxing
- ATo cause a denial of service attack
- Bto make the keyboard softer
- Cto test packet routes
- DTo test against unexpected, invalid or random inputs
40Why is the ability to reverse engineer a good skill to have?
- ATo point out bad coding practices on security blogs
- BTo be able to find what was patched in an update
- Cto verify automated tools are working correctly
- Dto rewrite the codes to avoid copyright violations
41If your payload is a reverse shell the connection is made
- Afrom the target back to listener controlled by you
- Bfrom your machine directly to the target
- Cthrough a proxy server
- Dbrute forcing the firewall
42Metasploit is an exploitation toolkit
- AVerdadeiro
- BFalso
43When you use a decomplier on a binary application you will get all the comments that were initially in the source code
- AVerdadeiro
- BFalso
44Which metasploit payload would allow you to connect to a target behind a firewall
- Ageneric shell
- Btcp shell
- Cudp shell
- Dreverse shell
45Metasploit auxiliaries are
- Aextra payloads
- Bspecial exploits
- Calternative configuration
- Dextra recon and assessment tools
46Shell code is:
- AAn exploit
- Ba payload
- Callows connections to the target
- Dsomething written in bash or sh
47Metasploit is a framework that allows you to
- AChoose an exploit
- BChoose a payload
- CDevelop an exploit
- DDevelop a payload
48Where would you not expect to find vulnerabilities
- AOperating systems
- BApplications
- CWeb Sites
- DData Bases
- EEmbedded systems
- FNone of the above
49Which is not a fuzzing tools?
- Abunny
- BBED
- CjBroFuxx
- Damap
- Eunicornscan
50LBD is tool that
- Acan enumerate a web server
- Bis not legal in Germany
- CCan detect web load-balancing technology
- Dis not part of backtrack
51Web application analysis is done with the following tools
- ASQLMap
- Bdnswalk
- Cburpsuite
- Dgrendel scan
52What organization is dedicated to keep a list of all currently known vulnerabilities
- AMITRE
- BNIST
- COWASP
- DSymantec
53Vulnerability is always exploitable by an attacker
- AVerdadeiro
- BFalso
54What is the purpose of fuzzing?
- ATesting inputs with unexpected, invalid or random data
- Btesting outputs with unexpected, invalid or random data
- Cto cover the target with fuzz to see it will overheat and crash
- Dto enter false information into a target to see if you can get superuser
55What is the purpose of vulnerability mapping
- Ato choose a pen test methodology
- Bto get DNS information A & PTR records
- Cto research exploits
- Dto figure out your billing rate
56Which tool can be used for Man in the Middle attacks
- ANikto2
- BSQLMap
- CJbroFuzz
- DBurp Suite
57Vulnerabilities can be classified as
- Adesign
- Boperational
- Cimplementation
- Dlocal
- Eremote
58Ratproxy is a passive port scanner
- AVerdadeiro
- BFalso
59Which of the following is not a proxy tool?
- Aburp suite
- Bparos
- CSQLNinja
- Dratproxy
60A remote exploit requires
- AA publicly exposed port or service
- Baccess to the local network
- Cinsider help
- Dstolen credentials
61What does CVE stand for?
- ACommon Vector Exploit
- BCommon Vulnerabilities and Exposure number
- CCenter for Veterans Enterprise
- DContinuous Vulnerabilities Enhancement
62Black-box testing can exploit local vulnerabilities
- AVerdadeiro
- BFalso
63The process of identifying and analyzing exposed services on the target is called
- AEnumeration
- BScoping
- CVulnerability mapping
- Dinformation gathering
64What are the three broad classifications of vulnerabilities
- ADevelopmental, insertion, operational
- BDesign, Implementation, Organization
- CDevelopmental, Implementation, Orientation
- DDesign, Implementation, Operational
65A vulnerability is a weakness in the system
- AVerdadeiro
- BFalso
66samrdump is a tool to attack the Security Account Manager (SAM) in windows
- AVerdadeiro
- BFalso
67Which tool is not a general vulnerability scanner?
- ABED
- BNessus
- COpenVAS
- DMBSA
68A local exploit requires
- AA publicly exposed port or service
- BAccess to the local network
- Cinsider help
- Dstolen credentials
69The potential danger of a vulnerability is listed as a number between 1 & 10 using:
- ACVE
- BNVD
- CCVSS
- DCCE
70What tools are used for service enumeration?
- Ahttprint
- Bnmap -PN target.com
- Camap
- Dfierce
71Packet fragmentation can be used to bypass firewalls
- AVerdadeiro
- BFalso
72tcpdump will require the network interface to be in the promiscuous mode
- AVerdadeiro
- BFalso
73What is the difference between banner grabbing and finger printing
- Afinger printing looks at packet responses & banner grab looks at the reply when connecting to a service
- Bthere is no difference
- Cfinger printing looks at the reply when connecting to a service & banner grab looks at packet
- Dfinger printing is illegal banner grabbing is not
74Because port 80 is shown as open, it means that it is running a web server on that port
- AVerdadeiro
- BFalso
75Enumeration tools are generally able to bypass detection tools
- AVerdadeiro
- BFalso
76How do you find SNMP ports?
- Anmap -A target.com
- Bfierce
- Cnmap -p 161 -sU network/24
- Dbunny
77Which of the following tools are single purpose
- Aonesixtyone
- BAmap
- Cunicornscan
- Dike-scan
- Enmap
78Flags are set in which header
- AIP
- BICMP
- CUDP
79When a scan reports that the port is filtered is means
- Athe target has been set to not respond
- Bthe target is not really up and running
- Cthere is a packet-filtering device blocking the probe
- Dit is a false positive - the target is vulnerable
80What does "open|filtered" mean in nmap report?
- Athe port is really open
- Bthere is a definitely firewall in place
- Cnmap is broken
- DOccurs for scan types in which open ports give no response
81Which tools/options actively probe the target
- Anmap -sL target.com
- Bunicornscan
- Cnmap -A target.com
- Damap
82What type of TP scan is stealthy and has the most reliable results?
- ASYN connect
- BSYN half open
- CSYN ACK
- DSYN FIN
83Reflection attacks are usually targeted against
- ATCP Services
- BUDP Services
- CICMP service
- DARP service
84UDP Port scans
- Aare more accurate than TCP port scans
- Bmay take longer when scanning multiple ports that a similar TCP scan
- Cmay yield inclusive results
- Dare always blocked by firewalls
85By default, nmap scans UDP ports
- AVerdadeiro
- BFalso
86By default, nmap scans all 65535 ports
- AVerdadeiro
- BFalso
87Enumeration is the process of
- Afinding live machines outside the target scope
- Bfinding live machines within the target scope
- Cfinding and identifying services running on live machines
- Dfinding machines with default passwords
88What tool is used for VPN (IP-Sec) enumeration
- Agenlist
- Bamap
- Cnmap -PS target.com
- Dike-scan
89Attacking ports below 1023 is more productive than those above 1023 because?
- Aports above 1023 may not have root or admin privileges by default
- Bports below 1023 are not well known
- Cfirewalls block ports above 1024 are blocked by default
- Dephemeral ports have little value
90Which tools are used for web server assessment?
- Anikto2
- Bhttprint
- Cnmap -PN 192.168.67.0/24
- Damap -bq 200.200.200.5 8 3306
91Ping uses
- AICMP echo request and echo reply
- BTCP port 80 SYN-ACK
- CUDP port 53
- DLayer 4 of the OSI model
92The arp command will find machines on the other side of a router
- AVerdadeiro
- BFalso
93nping can generate the following packet types
- ATCP
- BUDP
- CICMP
- DARP
94hping3 allow for custom crafted packets
- AVerdadeiro
- BFalso
95nbtscan will find netbios information across the network
- AVerdadeiro
- BFalso
96hping3 allows for
- Asource address spoofing
- Bdifferent protocols
- Cpacket fragmentation
- Dsetting of various TCP flags
97The DNS name and netbios name of Windows machine will always be the same
- AVerdadeiro
- BFalso
98In Linux the command "ping 127.0.1" will
- Astop after 4 attempts
- Bnot work against the localhost
- Creturn the MAC address
- Dcontinue until a conduct-C is issued
99What is passive OS finger printing
- AA form of finger painting
- BPinging the target and looking at the TTL number
- CDoing an indepth scan of the target
- DCapturing traffic between the target and another host to determine the OS
100nmap -O <target ip> will
- AFinger print the OS
- Breturn only open ports
- Cdo nothing
- Dreturn the service version on open ports
101What tool works only for target discovery when you have access to the internal network?
- Aarping
- Bgenlist
- Chping3
- Dnbtscan
102Which of the following are passive OS finger printing tools?
- Ap0f
- Bettercap
- Cxprobe2
- Dnmap -O target.com
103hping3 cannot be used for
- Atesting weak firewall rules
- Btesting network performance
- Cport scanning
- Ddomain name lookup
104when issuing the command ping www.wccnet.edu from outside the WCC campus, it:
- AWill not return any packet 100% packet loss
- Bwill return the IP number of the site
- Cwill be successful until stopped
- Dwill return the MAC address
105genlist saves port scans in a database to evaluate changes over time
- AVerdadeiro
- BFalso
106The difference between ping and fping is
- Aping will scan and generate a list of live targets
- Bonly ping will set the number of packets to be sent
- Conly fping will set the number of packets to be sent
- Dfping will scan and generate a list of live targets
107What port is SNMP on
- A80
- B137
- C161
- D445
108hping3 will send to port 0 a TCP packet by default
- AVerdadeiro
- BFalso
109The ping command will always find a live host
- AVerdadeiro
- BFalso
110arping can be used to detect if an IP address has ben used
- AVerdadeiro
- BFalso
111The default ping packet (with header) size is
- A32 bytes
- B64 bytes
- C128 bytes
- D256 bytes
112p0f finger prints various operating systems by
- Aport scanning the target
- Bby analyzing the TCP packets sent during network activity
- Cconnecting to the CIFS share
- Dusing ssh or remote desktop
113nping is part of the nmap package
- AVerdadeiro
- BFalso
114Which tool is generally not used for Target Discovery
- AMetasploit
- Bweb search engines
- Cdnswalk
- Dmetafoofil
115The first stage of information gathering is to
- ACollect data that is available to the general public
- Bgo dumpster diving
- Ccall the front desk asking for information
- Dtry to connect to the internal systems
116A goal of passive information gathering is
- Ato find vulnerable systems
- Bto research the target without the target seeing any suspicious traffic
- Cto ask the target for information about their systems
- Dto scan the target looking for information
117Meta data is not useful during penetration testing
- AVerdadeiro
- BFalso
118What might DNS information most likely tell you
- Ahost names and ip number of the machines at the target
- Bcontact information on who runs the network
- Chow their email is handled
- Dwhat machines are currently up and running
119Passive information gathering techniques do not include
- Ausing public resources such as Spokeo, LinkedIn
- Bsearching public DNS servers
- Cbrute forcing the targets web login
- Dreading the targets public facing web site
120What processes are included in target scoping
- Agathering client requirements
- Bpreparing a test plan
- Cscanning systems
- Dscheduling
- Esending phishing email
121When you query a public resource such as Spokeo or LinkedIn, the target has full knowledge that you are looking at them.
- AYes
- BDepends
- CNo
122The purpose of searching the web for metadata is to
- Afind contact information
- Bunderstand what applications are used
- Cfind leaked information such as configuration or password files
- Dto find business connections that may be easier to compromise and thus get into the target
123Why might you use different tools to determine the path/route to a host?
- AFirewalls and routers may respond differently with different protocols
- Bone tool is as good as the other
- Cpen-tester's lack of knowledge on how to use the tool
- Dwhat might show up in logs, intrusion prevention systems, intrusion detection systems, etc.
124By default, tracert/traceroute use the following protocol
- Aboth Windows and linux uses ICMP
- BWindows uses UDP and Linux uses ICMP
- CWindows uses ICMP and Linux uses UDP
- Dboth Win and Linux use UDP
125When discovering DNS information, which is the most likely to set off warning bells at the target
- AQuerying a specific host name
- Bdoing a reverse lookup on a specific host
- Cattempting to do a zone transfer
- Dquerying for the MX record
126What tool might return the owner and administrator of the domain name
- Aping
- Btracert
- Cwhois
- Dfierce
127Which of the following is not a good business objective
- Ato achieve compliance or meet standards
- Bsecure confidential data
- Cto make headlines with notice of disclosure and/or breach
- Dverify security posture
128It is the duty of the penetration tester to verify the identity of the contracting party
- AVerdadeiro
- BFalso
129In the information gathering state you are mostly hitting the target's site for information
- AVerdadeiro
- BFalso
130The purpose of spending time scoping is to
- Agather the client's requirements
- Bdetermine the business objectives
- Cdetermine what tools to use for the pen-test
- Dconfirm qualifications of the pen-tester
131A pen-tester should have good project management skills
- AVerdadeiro
- BFalso
132Scoping is best done at the beginning of the engagement
- AVerdadeiro
- BFalso
133The purpose of profiling boundaries is to
- Adiscover limitations and restrictions
- Bknown where to sit when on site
- Cunderstand the culture as to not offend with improper language or dress
- Dto use as a negotiation tool
134What steps are included in information gathering?
- Acalling the main switchboard asking for an org chart
- Blooking for public resources
- Ccollecting route information
- Drunning dnsenum against 8.8.8.8
- Erunning nmap -A targetname
135What should take place if the pen-tester finds evidence that the target has already been compromised
- AContinue testing and document in the report
- BStop the test immediately and contact the client
- Ccontact the authorities
- Dclean up the incident and secure the system
136Target scoping increases the changes of a successful outcome
- AVerdadeiro
- BFalso
137During the scoping process the pen-tester needs to evaluate their skills and ability to perform the required testing
- AVerdadeiro
- BFalso
138The outcome of the scoping phase is to
- Ahave found all the vulnerabilities
- Bto show how vulnerable the target is
- Cto have a formalized testing plan
- Dhave a documented findings report
139Pen-testing frameworks provide
- Aa road map for engagements
- Ba repeatable methodology
- Ca get out of jail free card
- Dproof that the tester is qualified
140Why is important for a pen-tester to have thought about their ethics
- Ato keep them from going to jail
- Bto help guide them when they run into questionable situations
- Cit is a requirement to perform a pen-test
- Dit is not important
141If you have full knowledge of the target environment
- Ayou are a black hat
- Byou are using a black box approach
- Cyou are a white hat
- Dyou are using a white box approach
142A vulnerability scan is also considered a pen-test
- AVerdadeiro
- BFalso
143Black box testing is also known as internal testing
- AVerdadeiro
- BFalso
144What pen-test methodology has both managerial & technical components
- AOSSTMM
- BISSAF
- CWASC-TC
- DOWASP
145Pen-testing will always verify the SANs Critical Security Controls
- AVerdadeiro
- BFalso
146Measuring the security of a system is really easy
- AVerdadeiro
- BFalso
147When choosing a framework, it is important to match the goals and requirements of the client
- AVerdadeiro
- BFalso
148Which is more costly
- AWhite box testing
- BBlack box testing
149In a blind pen-test
- AThe attacker has inside information and the target knows the attack is coming
- Bthe attacker has no knowledge of target and the target does not known the attack is coming
- Cthe attacker has no knowledge of target and the target knows the attack is coming
- Dthe attacker has knowledge of target and the target does not know the attack is coming
150Ethics is not important in pen-testing
- AVerdadeiro
- BFalso
151A false positive is
- Asomething that looks to be a vulnerability but when tested turns out to be turn
- Bsomething that looks to be a vulnerability but when tested turns out to be false
- Csomething that looks to be ok but when tested turns out to be vulnerability
- Dsomething that looks to be vulnerability but when tested turns out to be a vulnerability
152What is the difference between vulnerability assessment & penetration testing
- AThey are often considered the same thing
- BA pentest just reports weaknesses where a vulnerability assessment actually will test the weakness
- CA vulnerability assessment just reports weaknesses where a pentest actually will test the weakness
- DUsed by fountain pen manufactures to test the nib of a pen
153Are all penetration tests performed as cyber attacks
- AVerdadeiro
- BFalso
154A penetration test can be fully automated
- AVerdadeiro
- BFalso
155What is the difference between a Risk Assessment, Vulnerability Assessment, and a Pen-Test
- Aonly the pen test assesses security
- BA risk assessment is an overall look at the security posture, a vulnerability assessment explores for what looks like a problem, a pen test actually tests to see if security can be broken
- Ca vulnerability assessment is an overall look at the security posture, a risk assessment explores for what looks like a problem, a pen test actually tests to see if security can be broken
- DThey are all the same thing
156Penetration tests may cause major damage to the targets infrastructure
- AVerdadeiro
- BFalso
157Goals of a penetration test are to
- APositively identify who attacked you
- Bidentify current security posture
- Ctest security policies that are being followed
- Didentify what patches are needed
158Depending on your industry, you may be required to conduct specific types of pen tests
- AVerdadeiro
- BFalso
159Pen-testing can verify that technology is configured properly
- AVerdadeiro
- BFalso
160Pen-testing is more than a vulnerability scan
- AVerdadeiro
- BFalso
161What is the purpose of a pen testing methodology
- Ato show the customer what you are about to do
- Bprovides a road map for the pentest
- Ca document that vendors charge a lot of money for
- DA waste of time
162If a system has a vulnerability, does it mean that it is at risk
- Ayes
- Bno
163For critical systems, when should a pen-test be performed?
- Aevery 6 months
- Bevery year
- Cevery 4 years
- Dafter major changes
164because you pass a pen-test, you are safe from attackers
- AVerdadeiro
- BFalso
165Social engineering works because people are usually the weakest link
- AVerdadeiro
- BFalso
166Why is social engineering such an effective attack method?
- Athe target lets you into the organization
- Brequires that firewall be breached
- Cit can only be done remotely
- Dit finds applications that are not patched
167Social engineering is the practice of
- Abeing social-able
- Bexploiting human vulnerabilities
- Cgoing to an engineering school
- Dsomething that is rarely possible
168All social engineering is illegal
- AVerdadeiro
- BFalso
169Phishing is considered a type of SPAM/junk email
- AVerdadeiro
- BFalso
170What method requires more information?
- Aspear-phishing
- Bphishing
171A framework for social engineering is called
- ASET
- BSTE
- CSocial Attack Tool
- DThere is no such thing
172Which is not a method of social engineering
- Aimpersonation
- Bphone calls
- Creciprocation
- Dinfluential authority
- Escarcity
- Fsocial relationship
173Social engineering works against
- Aoperating systems
- Bhardware
- Capplications
- Dpeople
174It is illegal to send your target phishing emails
- AVerdadeiro
- BFalso
175At what phase of a pen-test do you find the most relevant information for social engineering
- AScoping
- BInformation Gathering
- CTarget discovery
- DEnumerating
- EVulnerability mapping
176Social Engineering is always used for malicious purposes
- AVerdadeiro
- BFalso
177The best defense against social engineering is?
- AFirewall
- BIPS/IDS
- CTraining & Awareness
- DNetwork Sniffers
178A social engineer needs to have a good understanding of
- Ascience
- Bpsychology
- Cart
- Dtechnology
179If you are trying to get an unpublished phone number form a receptionist, you would most likely use this method
- Ainfluential authority
- Bscarcity
- Creciprocation
- Dsocial relationship
Informações
- Descrição
- Quiz sobre WCC Pen Test, criado por Jon K em 16-12-2018.
- Autor
- Jon K
- Idioma
- English
- Visualizações
- 0
- Avaliação
- Ainda sem avaliações Avalie este quiz