Q1. In the following example, which of these is the "exploit"? 

Today, Microsoft Corporation released a security notice. It detailed how a person could bring down the Windows 2003 Server operating system, by sending malformed packets to it. They detailed how this malicious process had been automated using basic scripting. Even worse, the new automated method for bringing down the server has already been used to perform denial of service attacks on many large commercial websites. 

Select the best answer. 

A. Microsoft Corporation is the exploit. 

B. The security "hole" in the product is the exploit. 

C. Windows 2003 Server 

D. The exploit is the hacker that would use this vulnerability. 

E. The documented method of how to use the vulnerability to gain unprivileged access. 

View Answer

Q2. Theresa is the chief information security officer for her company, a large shipping company based out of New York City. In the past, Theresa and her IT employees manually checked the status of client computers on the network to see if they had the most recent Microsoft updates. Now that the company has added over 100 more clients to accommodate new departments, Theresa must find some kind of tool to see whether the clients are up-to-date or not. Theresa decides to use Qfecheck to monitor all client computers. When Theresa runs the tool, she is repeatedly told that the software does not have the proper permissions to scan. Theresa is worried that the operating system hardening that she performs on all clients is keeping the software from scanning the necessary registry keys on the client computers. 

What registry key permission should Theresa check to ensure that Qfecheck runs properly? 

A. In order for Qfecheck to run properly, it must have enough permission to read 

B. She needs to check the permissions of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates registry key 

C. Theresa needs to look over the permissions of the registry key 

D. The registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Microsoft must be checked 

View Answer

Q3. Why would an attacker want to perform a scan on port 137? 

A. To discover proxy servers on a network 

B. To disrupt the NetBIOS SMB service on the target host 

C. To check for file and print sharing on Windows systems 

D. To discover information about a target host using NBTSTAT 

View Answer

Q4. How would you describe a simple yet very effective mechanism for sending and receiving unauthorized information or data between machines without alerting any firewalls and IDS's on a network? 

A. Covert Channel 

B. Crafted Channel 

C. Bounce Channel 

D. Deceptive Channel 

View Answer

Q5. In what stage of Virus life does a stealth virus gets activated with the user performing certain actions such as running an infected program? 

A. Design 

B. Elimination 

C. Incorporation 

D. Replication 

E. Launch 

F. Detection 

View Answer

Q6. Matthew re-injects a captured wireless packet back onto the network. He does this hundreds of times within a second. The packet is correctly encrypted and Matthew assumes it is an ARP request packet. The wireless host responds with a stream of responses, all individually encrypted with different IVs. What is this attack most appropriately called? 

A. Spoof attack 

B. Replay attack 

C. Injection attack 

D. Rebound attack 

View Answer

Q7. When Jason moves a file via NFS over the company's network, you want to grab a copy of it by sniffing. Which of the following tool accomplishes this? 

A. macof 

B. webspy 

C. filesnarf 

D. nfscopy 

View Answer

Q8. Nathalie would like to perform a reliable scan against a remote target. She is not concerned about being stealth at this point. Which of the following type of scans would be the most accurate and reliable? 

A. A FIN Scan 

B. A Half Scan 

C. A UDP Scan 

D. The TCP Connect Scan 

View Answer

Q9. What is "Hacktivism"? 

A. Hacking for a cause 

B. Hacking ruthlessly 

C. An association which groups activists 

D. None of the above 

View Answer

Q10. John runs a Web Server, IDS and firewall on his network. Recently his Web Server has been under constant hacking attacks. He looks up the IDS log files and sees no Intrusion attempts but the web server constantly locks up and needs rebooting due to various brute force and buffer overflow attacks but still the IDS alerts no intrusion whatsoever. 

John become suspicious and views he firewall logs and he notices huge SSL connections constantly hitting web server. 

Hackers have been using the encrypted HTTPS protocol to send exploits to the web server and that was the reason the IDS did not detect the intrusions. 

How would Jon protect his network form these types of attacks? 

A. Install a proxy server and terminate SSL at the proxy 

B. Install a hardware SSL “accelerator” and terminate SSL at this layer 

C. Enable the IDS to filter encrypted HTTPS traffic 

D. Enable the firewall to filter encrypted HTTPS traffic 

View Answer