Q1. Which of the following is true of the wireless Service Set ID (SSID)? (Select all that apply.) 

A. Identifies the wireless network 

B. Acts as a password for network access 

C. Should be left at the factory default setting 

D. Not broadcasting the SSID defeats NetStumbler and other wireless discovery tools 

View Answer

Q2. Jimmy, an attacker, knows that he can take advantage of poorly designed input validation routines to create or alter SQL commands to gain access to private data or execute commands in the database. What technique does Jimmy use to compromise a database? 

A. Jimmy can submit user input that executes an operating system command to compromise a target system 

B. Jimmy can utilize this particular database threat that is an SQL injection technique to penetrate a target system 

C. Jimmy can utilize an incorrect configuration that leads to access with higher-than-expected privilege of the database 

D. Jimmy can gain control of system to flood the target system with requests, preventing legitimate users from gaining access 

View Answer

Q3. Which are true statements concerning the BugBear and Pretty Park worms? 

Select the best answers. 

A. Both programs use email to do their work. 

B. Pretty Park propagates via network shares and email 

C. BugBear propagates via network shares and email 

D. Pretty Park tries to connect to an IRC server to send your personal passwords. 

E. Pretty Park can terminate anti-virus applications that might be running to bypass them. 

View Answer

Q4. Joe the Hacker breaks into company’s Linux system and plants a wiretap program in order to sniff passwords and user accounts off the wire. The wiretap program is embedded as a Trojan horse in one of the network utilities. Joe is worried that network administrator might detect the wiretap program by querying the interfaces to see if they are running in promiscuous mode. 

Running “ifconfig –a” will produce the following: 

# ifconfig –a 

1o0: flags=848<UP,LOOPBACK,RUNNING,MULTICAST> mtu 8232 

inet 127.0.0.1 netmask ff000000hme0: 

flags=863<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,MULTICAST> mtu inet 192.0.2.99 netmask ffffff00 broadcast 134.5.2.255 ether 

8:0:20:9c:a2:35 

What can Joe do to hide the wiretap program from being detected by ifconfig command? 

A. Block output to the console whenever the user runs ifconfig command by running screen capture utiliyu 

B. Run the wiretap program in stealth mode from being detected by the ifconfig command. 

C. Replace original ifconfig utility with the rootkit version of ifconfig hiding Promiscuous information being displayed on the console. 

D. You cannot disable Promiscuous mode detection on Linux systems. 

View Answer

Q5. What is GINA? 

A. Gateway Interface Network Application 

B. GUI Installed Network Application CLASS 

C. Global Internet National Authority (G-USA) 

D. Graphical Identification and Authentication DLL 

View Answer

Q6. What is Form Scalpel used for? 

A. Dissecting HTML Forms 

B. Dissecting SQL Forms 

C. Analysis of Access Database Forms 

D. Troubleshooting Netscape Navigator 

E. Quatro Pro Analysis Tool 

View Answer

Q7. Theresa is the chief information security officer for her company, a large shipping company based out of New York City. In the past, Theresa and her IT employees manually checked the status of client computers on the network to see if they had the most recent Microsoft updates. Now that the company has added over 100 more clients to accommodate new departments, Theresa must find some kind of tool to see whether the clients are up-to-date or not. Theresa decides to use Qfecheck to monitor all client computers. When Theresa runs the tool, she is repeatedly told that the software does not have the proper permissions to scan. Theresa is worried that the operating system hardening that she performs on all clients is keeping the software from scanning the necessary registry keys on the client computers. 

What registry key permission should Theresa check to ensure that Qfecheck runs properly? 

A. In order for Qfecheck to run properly, it must have enough permission to read 

B. She needs to check the permissions of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates registry key 

C. Theresa needs to look over the permissions of the registry key 

D. The registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Microsoft must be checked 

View Answer

Q8. A denial of Service (DoS) attack works on the following principle: 

A. MS-DOS and PC-DOS operating system utilize a weaknesses that can be compromised and permit them to launch an attack easily. 

B. All CLIENT systems have TCP/IP stack implementation weakness that can be compromised and permit them to lunch an attack easily. 

C. Overloaded buffer systems can easily address error conditions and respond appropriately. 

D. Host systems cannot respond to real traffic, if they have an overwhelming number of incomplete connections (SYN/RCVD State). 

E. A server stops accepting connections from certain networks one those network become flooded. 

View Answer

Q9. What is a sheepdip? 

A. It is another name for Honeynet 

B. It is a machine used to coordinate honeynets 

C. It is the process of checking physical media for virus before they are used in a computer 

D. None of the above 

View Answer

Q10. You are the security administrator for a large online auction company based out of Los Angeles. After getting your ENSA CERTIFICATION last year, you have steadily been fortifying your network’s security including training OS hardening and network security. One of the last things you just changed for security reasons was to modify all the built-in administrator accounts on the local computers of PCs and in Active Directory. After through testing you found and no services or programs were affected by the name changes. 

Your company undergoes an outside security audit by a consulting company and they said that even through all the administrator account names were changed, the accounts could still be used by a clever hacker to gain unauthorized access. You argue with the auditors and say that is not possible, so they use a tool and show you how easy it is to utilize the administrator account even though its name was changed. 

What tool did the auditors use? 

A. sid2user 

B. User2sid 

C. GetAcct 

D. Fingerprint 

View Answer