Quiz
WCC Pen Test
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (179)
1For the purpose of penetration testing; a backdoor is:
- AA vendor supplied service
- Bhaving access to compromised valid credentials
- Caccess to a target without using normal authentication
- Dsomething put in by the software developers
2Which tool uses ICMP to tunnel data
- Aptunnel
- Bproxychains
- Cncat
- Dsslh
3One technique to maintaining a backdoor is to replace a system binary with a compromised one
- ATrue
- BFalse
4Strategies for maintaining access include:
- Acracking passwords
- Bcreating reverse tunnels
- Chidden web applications
- Dcompromised operating systems
5Which of the following are used as a web shell:
- Aweevely
- Bsocat
- CWeBaCoo
- Ddns2tcp
6What is sidejacking?
- Apassive cookie stealing
- Bsitting next to a user and seeing what they are typing
- Cstealing a sidecar
- Da make up name by the instructor
7Proxychains can for any TCP connections from a client to go through a proxy.
- ATrue
- BFalse
8Netcat can be used to maintain access to a compromised target
- ATrue
- BFalse
9Tunneling cannot evade firewall rules
- ATrue
- BFalse
10The concept of wrapping a protocol within another is called:
- Aproxy service
- Bmultiplexing
- Cbackdoor
- Dtunneling
11Tunnels run on a specific and well known protocols and ports
- ATrue
- BFalse
12To tunnel connections using DNS you must
- AControl the default DNS server used by the target
- Bmake sure inbound port 80 is not blocked
- Ccontrol a DNS server that the target will use
- DInstall a DNS server on the target
13When you gain access to a target as a user and have access to another user's (not admin) functions:
- Ayou are just lucky
- Bperformed vertical escalation
- Cperformed horizontal escalation
- Dhave gained root/admin access
14Which password attack is generally quicker and less obvious to the target:
- Aoffline
- Bonline
15An online password attack will never trigger any alters or block the attacker
- ATrue
- BFalse
16What is needed to do an offline password attack?
- Ajust the attack tool
- Bthe target address
- Cthe password file
- Dthe group file
17Wireshark can read tcpdump or windump packet capture files
- ATrue
- BFalse
18Tools that use precomputed hashes to crack a password
- AJohn
- BRainbowCrack
- CHashcat
- DOphCrack
19In order to capture packets on a network
- Athe network interface needs to be in promiscuous mode
- Bthere must be two connections to the network
- Ca packet capture framework needs to be installed such as libpcap
- Donly linux systems can capture packets
20Which of the following are networks spoofing tools?
- Anetmap
- Barpspoof
- Clanmap
- Dettercap
21How can network spoofing be used for privilege escalation
- Ato control network traffic
- Bit can't
- Cit only need access to one party
- Dby reflecting the ip address
22Performing offline password cracking requires:
- AThat you have access to the password hashes
- Bhave a fast network connection so you can try usernames and passwords quickly
- Caccess to the target network
- Dknown the password policy
23What tool can be used to sniff switch traffic
- Awireshark
- Btcpdump
- Cdsniff
- Darpspoff
24What tool would be used to do a live attack on a website login
- Ajohn
- Bbrutessh
- Chydra
- Dophcrack
25All explorations will lead to privilege escalation
- ATrue
- BFalse
26What tool will create a custom world list by spidering the web
- Acrunch
- BJohn
- Crtgen
- DCeWL
27Which of the following are offline password crackers?
- Arainbow crack
- Bxhydra
- CJohn
- Dsshbrute
28Dsniff is a tool that could capture a password as it crosses the network
- ATrue
- BFalse
29To take advantage of a vulnerability you need
- Aan exploit
- Ba user name
- Ca payload
- Da module
30When you get access to the target, understanding the target operating system:
- Ais not important
- Bis handled by the exploit code
- Cautomatically gets you root or admin access
- Dis very important to understand
31An exploit can be Proof of Concept code that demonstrates the vulnerability
- ATrue
- BFalse
32A metasploit payload is:
- AWhere the target is set
- BWhat compromises the machine
- CWhat controls the action after the target is compromised
- Dlisted under exploits
33Hacking frameworks allow for one click p0wning a target
- ATrue
- BFalse
34How is a banner grab different from a port scan?
- Ait is the same thing
- Bport scan assumes the port is running the registered service while a banner grab will query the service and report what is returned
- Cbanner grab is easier to perform and makes less noise
- Dprobing the dns server will do the same thing
35Metasploit auxiliary is where you would find special scanning tools.
- ATrue
- BFalse
36After "popping a box" what task should you consider doing?
- ALog off to see if you can do it again
- Bset up a backdoor so you can get back in
- CCheck to see who is also logged in
- DLeave a message on the machine and post to claim your cred as a hacker
37A metasploit exploit
- Ais what compromises the target
- Bis where the target is set
- Chas options
- Dis listed under payloads
38Meterpreter is
- AA special payload
- Ban exploit
- Ca regular payload
- Dis an auxiliary
39What is the purpose of fuxxing
- ATo cause a denial of service attack
- Bto make the keyboard softer
- Cto test packet routes
- DTo test against unexpected, invalid or random inputs
40Why is the ability to reverse engineer a good skill to have?
- ATo point out bad coding practices on security blogs
- BTo be able to find what was patched in an update
- Cto verify automated tools are working correctly
- Dto rewrite the codes to avoid copyright violations
41If your payload is a reverse shell the connection is made
- Afrom the target back to listener controlled by you
- Bfrom your machine directly to the target
- Cthrough a proxy server
- Dbrute forcing the firewall
42Metasploit is an exploitation toolkit
- ATrue
- BFalse
43When you use a decomplier on a binary application you will get all the comments that were initially in the source code
- ATrue
- BFalse
44Which metasploit payload would allow you to connect to a target behind a firewall
- Ageneric shell
- Btcp shell
- Cudp shell
- Dreverse shell
45Metasploit auxiliaries are
- Aextra payloads
- Bspecial exploits
- Calternative configuration
- Dextra recon and assessment tools
46Shell code is:
- AAn exploit
- Ba payload
- Callows connections to the target
- Dsomething written in bash or sh
47Metasploit is a framework that allows you to
- AChoose an exploit
- BChoose a payload
- CDevelop an exploit
- DDevelop a payload
48Where would you not expect to find vulnerabilities
- AOperating systems
- BApplications
- CWeb Sites
- DData Bases
- EEmbedded systems
- FNone of the above
49Which is not a fuzzing tools?
- Abunny
- BBED
- CjBroFuxx
- Damap
- Eunicornscan
50LBD is tool that
- Acan enumerate a web server
- Bis not legal in Germany
- CCan detect web load-balancing technology
- Dis not part of backtrack
51Web application analysis is done with the following tools
- ASQLMap
- Bdnswalk
- Cburpsuite
- Dgrendel scan
52What organization is dedicated to keep a list of all currently known vulnerabilities
- AMITRE
- BNIST
- COWASP
- DSymantec
53Vulnerability is always exploitable by an attacker
- ATrue
- BFalse
54What is the purpose of fuzzing?
- ATesting inputs with unexpected, invalid or random data
- Btesting outputs with unexpected, invalid or random data
- Cto cover the target with fuzz to see it will overheat and crash
- Dto enter false information into a target to see if you can get superuser
55What is the purpose of vulnerability mapping
- Ato choose a pen test methodology
- Bto get DNS information A & PTR records
- Cto research exploits
- Dto figure out your billing rate
56Which tool can be used for Man in the Middle attacks
- ANikto2
- BSQLMap
- CJbroFuzz
- DBurp Suite
57Vulnerabilities can be classified as
- Adesign
- Boperational
- Cimplementation
- Dlocal
- Eremote
58Ratproxy is a passive port scanner
- ATrue
- BFalse
59Which of the following is not a proxy tool?
- Aburp suite
- Bparos
- CSQLNinja
- Dratproxy
60A remote exploit requires
- AA publicly exposed port or service
- Baccess to the local network
- Cinsider help
- Dstolen credentials
61What does CVE stand for?
- ACommon Vector Exploit
- BCommon Vulnerabilities and Exposure number
- CCenter for Veterans Enterprise
- DContinuous Vulnerabilities Enhancement
62Black-box testing can exploit local vulnerabilities
- ATrue
- BFalse
63The process of identifying and analyzing exposed services on the target is called
- AEnumeration
- BScoping
- CVulnerability mapping
- Dinformation gathering
64What are the three broad classifications of vulnerabilities
- ADevelopmental, insertion, operational
- BDesign, Implementation, Organization
- CDevelopmental, Implementation, Orientation
- DDesign, Implementation, Operational
65A vulnerability is a weakness in the system
- ATrue
- BFalse
66samrdump is a tool to attack the Security Account Manager (SAM) in windows
- ATrue
- BFalse
67Which tool is not a general vulnerability scanner?
- ABED
- BNessus
- COpenVAS
- DMBSA
68A local exploit requires
- AA publicly exposed port or service
- BAccess to the local network
- Cinsider help
- Dstolen credentials
69The potential danger of a vulnerability is listed as a number between 1 & 10 using:
- ACVE
- BNVD
- CCVSS
- DCCE
70What tools are used for service enumeration?
- Ahttprint
- Bnmap -PN target.com
- Camap
- Dfierce
71Packet fragmentation can be used to bypass firewalls
- ATrue
- BFalse
72tcpdump will require the network interface to be in the promiscuous mode
- ATrue
- BFalse
73What is the difference between banner grabbing and finger printing
- Afinger printing looks at packet responses & banner grab looks at the reply when connecting to a service
- Bthere is no difference
- Cfinger printing looks at the reply when connecting to a service & banner grab looks at packet
- Dfinger printing is illegal banner grabbing is not
74Because port 80 is shown as open, it means that it is running a web server on that port
- ATrue
- BFalse
75Enumeration tools are generally able to bypass detection tools
- ATrue
- BFalse
76How do you find SNMP ports?
- Anmap -A target.com
- Bfierce
- Cnmap -p 161 -sU network/24
- Dbunny
77Which of the following tools are single purpose
- Aonesixtyone
- BAmap
- Cunicornscan
- Dike-scan
- Enmap
78Flags are set in which header
- AIP
- BICMP
- CUDP
79When a scan reports that the port is filtered is means
- Athe target has been set to not respond
- Bthe target is not really up and running
- Cthere is a packet-filtering device blocking the probe
- Dit is a false positive - the target is vulnerable
80What does "open|filtered" mean in nmap report?
- Athe port is really open
- Bthere is a definitely firewall in place
- Cnmap is broken
- DOccurs for scan types in which open ports give no response
81Which tools/options actively probe the target
- Anmap -sL target.com
- Bunicornscan
- Cnmap -A target.com
- Damap
82What type of TP scan is stealthy and has the most reliable results?
- ASYN connect
- BSYN half open
- CSYN ACK
- DSYN FIN
83Reflection attacks are usually targeted against
- ATCP Services
- BUDP Services
- CICMP service
- DARP service
84UDP Port scans
- Aare more accurate than TCP port scans
- Bmay take longer when scanning multiple ports that a similar TCP scan
- Cmay yield inclusive results
- Dare always blocked by firewalls
85By default, nmap scans UDP ports
- ATrue
- BFalse
86By default, nmap scans all 65535 ports
- ATrue
- BFalse
87Enumeration is the process of
- Afinding live machines outside the target scope
- Bfinding live machines within the target scope
- Cfinding and identifying services running on live machines
- Dfinding machines with default passwords
88What tool is used for VPN (IP-Sec) enumeration
- Agenlist
- Bamap
- Cnmap -PS target.com
- Dike-scan
89Attacking ports below 1023 is more productive than those above 1023 because?
- Aports above 1023 may not have root or admin privileges by default
- Bports below 1023 are not well known
- Cfirewalls block ports above 1024 are blocked by default
- Dephemeral ports have little value
90Which tools are used for web server assessment?
- Anikto2
- Bhttprint
- Cnmap -PN 192.168.67.0/24
- Damap -bq 200.200.200.5 8 3306
91Ping uses
- AICMP echo request and echo reply
- BTCP port 80 SYN-ACK
- CUDP port 53
- DLayer 4 of the OSI model
92The arp command will find machines on the other side of a router
- ATrue
- BFalse
93nping can generate the following packet types
- ATCP
- BUDP
- CICMP
- DARP
94hping3 allow for custom crafted packets
- ATrue
- BFalse
95nbtscan will find netbios information across the network
- ATrue
- BFalse
96hping3 allows for
- Asource address spoofing
- Bdifferent protocols
- Cpacket fragmentation
- Dsetting of various TCP flags
97The DNS name and netbios name of Windows machine will always be the same
- ATrue
- BFalse
98In Linux the command "ping 127.0.1" will
- Astop after 4 attempts
- Bnot work against the localhost
- Creturn the MAC address
- Dcontinue until a conduct-C is issued
99What is passive OS finger printing
- AA form of finger painting
- BPinging the target and looking at the TTL number
- CDoing an indepth scan of the target
- DCapturing traffic between the target and another host to determine the OS
100nmap -O <target ip> will
- AFinger print the OS
- Breturn only open ports
- Cdo nothing
- Dreturn the service version on open ports
101What tool works only for target discovery when you have access to the internal network?
- Aarping
- Bgenlist
- Chping3
- Dnbtscan
102Which of the following are passive OS finger printing tools?
- Ap0f
- Bettercap
- Cxprobe2
- Dnmap -O target.com
103hping3 cannot be used for
- Atesting weak firewall rules
- Btesting network performance
- Cport scanning
- Ddomain name lookup
104when issuing the command ping www.wccnet.edu from outside the WCC campus, it:
- AWill not return any packet 100% packet loss
- Bwill return the IP number of the site
- Cwill be successful until stopped
- Dwill return the MAC address
105genlist saves port scans in a database to evaluate changes over time
- ATrue
- BFalse
106The difference between ping and fping is
- Aping will scan and generate a list of live targets
- Bonly ping will set the number of packets to be sent
- Conly fping will set the number of packets to be sent
- Dfping will scan and generate a list of live targets
107What port is SNMP on
- A80
- B137
- C161
- D445
108hping3 will send to port 0 a TCP packet by default
- ATrue
- BFalse
109The ping command will always find a live host
- ATrue
- BFalse
110arping can be used to detect if an IP address has ben used
- ATrue
- BFalse
111The default ping packet (with header) size is
- A32 bytes
- B64 bytes
- C128 bytes
- D256 bytes
112p0f finger prints various operating systems by
- Aport scanning the target
- Bby analyzing the TCP packets sent during network activity
- Cconnecting to the CIFS share
- Dusing ssh or remote desktop
113nping is part of the nmap package
- ATrue
- BFalse
114Which tool is generally not used for Target Discovery
- AMetasploit
- Bweb search engines
- Cdnswalk
- Dmetafoofil
115The first stage of information gathering is to
- ACollect data that is available to the general public
- Bgo dumpster diving
- Ccall the front desk asking for information
- Dtry to connect to the internal systems
116A goal of passive information gathering is
- Ato find vulnerable systems
- Bto research the target without the target seeing any suspicious traffic
- Cto ask the target for information about their systems
- Dto scan the target looking for information
117Meta data is not useful during penetration testing
- ATrue
- BFalse
118What might DNS information most likely tell you
- Ahost names and ip number of the machines at the target
- Bcontact information on who runs the network
- Chow their email is handled
- Dwhat machines are currently up and running
119Passive information gathering techniques do not include
- Ausing public resources such as Spokeo, LinkedIn
- Bsearching public DNS servers
- Cbrute forcing the targets web login
- Dreading the targets public facing web site
120What processes are included in target scoping
- Agathering client requirements
- Bpreparing a test plan
- Cscanning systems
- Dscheduling
- Esending phishing email
121When you query a public resource such as Spokeo or LinkedIn, the target has full knowledge that you are looking at them.
- AYes
- BDepends
- CNo
122The purpose of searching the web for metadata is to
- Afind contact information
- Bunderstand what applications are used
- Cfind leaked information such as configuration or password files
- Dto find business connections that may be easier to compromise and thus get into the target
123Why might you use different tools to determine the path/route to a host?
- AFirewalls and routers may respond differently with different protocols
- Bone tool is as good as the other
- Cpen-tester's lack of knowledge on how to use the tool
- Dwhat might show up in logs, intrusion prevention systems, intrusion detection systems, etc.
124By default, tracert/traceroute use the following protocol
- Aboth Windows and linux uses ICMP
- BWindows uses UDP and Linux uses ICMP
- CWindows uses ICMP and Linux uses UDP
- Dboth Win and Linux use UDP
125When discovering DNS information, which is the most likely to set off warning bells at the target
- AQuerying a specific host name
- Bdoing a reverse lookup on a specific host
- Cattempting to do a zone transfer
- Dquerying for the MX record
126What tool might return the owner and administrator of the domain name
- Aping
- Btracert
- Cwhois
- Dfierce
127Which of the following is not a good business objective
- Ato achieve compliance or meet standards
- Bsecure confidential data
- Cto make headlines with notice of disclosure and/or breach
- Dverify security posture
128It is the duty of the penetration tester to verify the identity of the contracting party
- ATrue
- BFalse
129In the information gathering state you are mostly hitting the target's site for information
- ATrue
- BFalse
130The purpose of spending time scoping is to
- Agather the client's requirements
- Bdetermine the business objectives
- Cdetermine what tools to use for the pen-test
- Dconfirm qualifications of the pen-tester
131A pen-tester should have good project management skills
- ATrue
- BFalse
132Scoping is best done at the beginning of the engagement
- ATrue
- BFalse
133The purpose of profiling boundaries is to
- Adiscover limitations and restrictions
- Bknown where to sit when on site
- Cunderstand the culture as to not offend with improper language or dress
- Dto use as a negotiation tool
134What steps are included in information gathering?
- Acalling the main switchboard asking for an org chart
- Blooking for public resources
- Ccollecting route information
- Drunning dnsenum against 8.8.8.8
- Erunning nmap -A targetname
135What should take place if the pen-tester finds evidence that the target has already been compromised
- AContinue testing and document in the report
- BStop the test immediately and contact the client
- Ccontact the authorities
- Dclean up the incident and secure the system
136Target scoping increases the changes of a successful outcome
- ATrue
- BFalse
137During the scoping process the pen-tester needs to evaluate their skills and ability to perform the required testing
- ATrue
- BFalse
138The outcome of the scoping phase is to
- Ahave found all the vulnerabilities
- Bto show how vulnerable the target is
- Cto have a formalized testing plan
- Dhave a documented findings report
139Pen-testing frameworks provide
- Aa road map for engagements
- Ba repeatable methodology
- Ca get out of jail free card
- Dproof that the tester is qualified
140Why is important for a pen-tester to have thought about their ethics
- Ato keep them from going to jail
- Bto help guide them when they run into questionable situations
- Cit is a requirement to perform a pen-test
- Dit is not important
141If you have full knowledge of the target environment
- Ayou are a black hat
- Byou are using a black box approach
- Cyou are a white hat
- Dyou are using a white box approach
142A vulnerability scan is also considered a pen-test
- ATrue
- BFalse
143Black box testing is also known as internal testing
- ATrue
- BFalse
144What pen-test methodology has both managerial & technical components
- AOSSTMM
- BISSAF
- CWASC-TC
- DOWASP
145Pen-testing will always verify the SANs Critical Security Controls
- ATrue
- BFalse
146Measuring the security of a system is really easy
- ATrue
- BFalse
147When choosing a framework, it is important to match the goals and requirements of the client
- ATrue
- BFalse
148Which is more costly
- AWhite box testing
- BBlack box testing
149In a blind pen-test
- AThe attacker has inside information and the target knows the attack is coming
- Bthe attacker has no knowledge of target and the target does not known the attack is coming
- Cthe attacker has no knowledge of target and the target knows the attack is coming
- Dthe attacker has knowledge of target and the target does not know the attack is coming
150Ethics is not important in pen-testing
- ATrue
- BFalse
151A false positive is
- Asomething that looks to be a vulnerability but when tested turns out to be turn
- Bsomething that looks to be a vulnerability but when tested turns out to be false
- Csomething that looks to be ok but when tested turns out to be vulnerability
- Dsomething that looks to be vulnerability but when tested turns out to be a vulnerability
152What is the difference between vulnerability assessment & penetration testing
- AThey are often considered the same thing
- BA pentest just reports weaknesses where a vulnerability assessment actually will test the weakness
- CA vulnerability assessment just reports weaknesses where a pentest actually will test the weakness
- DUsed by fountain pen manufactures to test the nib of a pen
153Are all penetration tests performed as cyber attacks
- ATrue
- BFalse
154A penetration test can be fully automated
- ATrue
- BFalse
155What is the difference between a Risk Assessment, Vulnerability Assessment, and a Pen-Test
- Aonly the pen test assesses security
- BA risk assessment is an overall look at the security posture, a vulnerability assessment explores for what looks like a problem, a pen test actually tests to see if security can be broken
- Ca vulnerability assessment is an overall look at the security posture, a risk assessment explores for what looks like a problem, a pen test actually tests to see if security can be broken
- DThey are all the same thing
156Penetration tests may cause major damage to the targets infrastructure
- ATrue
- BFalse
157Goals of a penetration test are to
- APositively identify who attacked you
- Bidentify current security posture
- Ctest security policies that are being followed
- Didentify what patches are needed
158Depending on your industry, you may be required to conduct specific types of pen tests
- ATrue
- BFalse
159Pen-testing can verify that technology is configured properly
- ATrue
- BFalse
160Pen-testing is more than a vulnerability scan
- ATrue
- BFalse
161What is the purpose of a pen testing methodology
- Ato show the customer what you are about to do
- Bprovides a road map for the pentest
- Ca document that vendors charge a lot of money for
- DA waste of time
162If a system has a vulnerability, does it mean that it is at risk
- Ayes
- Bno
163For critical systems, when should a pen-test be performed?
- Aevery 6 months
- Bevery year
- Cevery 4 years
- Dafter major changes
164because you pass a pen-test, you are safe from attackers
- ATrue
- BFalse
165Social engineering works because people are usually the weakest link
- ATrue
- BFalse
166Why is social engineering such an effective attack method?
- Athe target lets you into the organization
- Brequires that firewall be breached
- Cit can only be done remotely
- Dit finds applications that are not patched
167Social engineering is the practice of
- Abeing social-able
- Bexploiting human vulnerabilities
- Cgoing to an engineering school
- Dsomething that is rarely possible
168All social engineering is illegal
- ATrue
- BFalse
169Phishing is considered a type of SPAM/junk email
- ATrue
- BFalse
170What method requires more information?
- Aspear-phishing
- Bphishing
171A framework for social engineering is called
- ASET
- BSTE
- CSocial Attack Tool
- DThere is no such thing
172Which is not a method of social engineering
- Aimpersonation
- Bphone calls
- Creciprocation
- Dinfluential authority
- Escarcity
- Fsocial relationship
173Social engineering works against
- Aoperating systems
- Bhardware
- Capplications
- Dpeople
174It is illegal to send your target phishing emails
- ATrue
- BFalse
175At what phase of a pen-test do you find the most relevant information for social engineering
- AScoping
- BInformation Gathering
- CTarget discovery
- DEnumerating
- EVulnerability mapping
176Social Engineering is always used for malicious purposes
- ATrue
- BFalse
177The best defense against social engineering is?
- AFirewall
- BIPS/IDS
- CTraining & Awareness
- DNetwork Sniffers
178A social engineer needs to have a good understanding of
- Ascience
- Bpsychology
- Cart
- Dtechnology
179If you are trying to get an unpublished phone number form a receptionist, you would most likely use this method
- Ainfluential authority
- Bscarcity
- Creciprocation
- Dsocial relationship
Information
- Description
- Quiz on WCC Pen Test, created by Jon K on 16/12/2018.
- Author
- Jon K
- Language
- English
- Views
- 0
- Rating
- No ratings yet Rate this quiz