Q1. You have installed antivirus software and you want to be sure that your AV signatures are working correctly. You don't want to risk the deliberate introduction of a live virus to test the AV software. You would like to write a harmless test virus, which is based on the European Institute for Computer Antivirus Research format that can be detected by the AV software. 

How should you proceed? 

A. Type the following code in notepad and save the file as SAMPLEVIRUS.COM. Your antivirus program springs into action whenever you attempt to open, run or copy it. X5O!P%@AP[4\PZX54(P^)7CC)7}$SAMPLEVIRUS-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* 

B. Type the following code in notepad and save the file as AVFILE.COM. Your antivirus program springs into action whenever you attempt to open, run or copy it. X5O!P%@AP[4\PZX54(P^)7CC)7}$AVFILE-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* 

C. Type the following code in notepad and save the file as TESTAV.COM. Your antivirus program springs into action whenever you attempt to open, run or copy it. X5O!P%@AP[4\PZX54(P^)7CC)7}$TESTAV-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* 

D. Type the following code in notepad and save the file as EICAR.COM. Your antivirus program springs into action whenever you attempt to open, run or copy it. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* 

View Answer

Q2. Which of the following algorithms can be used to guarantee the integrity of messages being sent, in transit, or stored? (Choose the best answer) 

A. symmetric algorithms 

B. asymmetric algorithms 

C. hashing algorithms 

D. integrity algorithms 

View Answer

Q3. What file system vulnerability does the following command take advantage of? 

type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe 

A. HFS 

B. ADS 

C. NTFS 

D. Backdoor access 

View Answer

Q4. What port number is used by LDAP protocol? 

A. 110 

B. 389 

C. 445 

D. 464 

View Answer

Q5. Blane is a security analyst for a law firm. One of the lawyers needs to send out an email to a client but he wants to know if the email is forwarded on to any other recipients. The client is explicitly asked not to re-send the email since that would be a violation of the lawyer's and client's agreement for this particular case. What can Blane use to accomplish this? 

A. He can use a split-DNS service to ensure the email is not forwarded on. 

B. A service such as HTTrack would accomplish this. 

C. Blane could use MetaGoofil tracking tool. 

D. Blane can use a service such as ReadNotify tracking tool. 

View Answer

Q6. To scan a host downstream from a security gateway, Firewalking: 

A. Sends a UDP-based packet that it knows will be blocked by the firewall to determine how specifically the firewall responds to such packets 

B. Uses the TTL function to send packets with a TTL value set to expire one hop past the identified security gateway 

C. Sends an ICMP ''administratively prohibited'' packet to determine if the gateway will drop the packet without comment. 

D. Assesses the security rules that relate to the target system before it sends packets to any hops on the route to the gateway 

View Answer

Q7. Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned. As a security professional, what would you infer from this scan? 

A. It is a network fault and the originating machine is in a network loop 

B. It is a worm that is malfunctioning or hardcoded to scan on port 500 

C. The attacker is trying to detect machines on the network which have SSL enabled 

D. The attacker is trying to determine the type of VPN implementation and checking for IPSec 

View Answer

Q8. You receive an e-mail with the following text message. 

"Microsoft and HP today warned all customers that a new, highly dangerous virus has been discovered which will erase all your files at midnight. If there's a file called hidserv.exe on your computer, you have been infected and your computer is now running a hidden server that allows hackers to access your computer. Delete the file immediately. Please also pass this message to all your friends and colleagues as soon as possible." 

You launch your antivirus software and scan the suspicious looking file hidserv.exe located in c:\windows directory and the AV comes out clean meaning the file is not infected. You view the file signature and confirm that it is a legitimate Windows system file "Human Interface Device Service". 

What category of virus is this? 

A. Virus hoax 

B. Spooky Virus 

C. Stealth Virus 

D. Polymorphic Virus 

View Answer

Q9. John has performed a scan of the web server with NMAP but did not gather enough information to accurately identify which operating system is running on the remote host. How could you use a web server to help in identifying the OS that is being used? 

A. Telnet to an Open port and grab the banner 

B. Connect to the web server with an FTP client 

C. Connect to the web server with a browser and look at the web page 

D. Telnet to port 8080 on the web server and look at the default page code 

View Answer

Q10. Which FTP transfer mode is required for FTP bounce attack? 

A. Active Mode 

B. Passive Mode 

C. User Mode 

D. Anonymous Mode 

View Answer