Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IST-267 Network Vulnerabilitiy Assess > Chapter 5 > Flashcards

Chapter 5 Flashcards

1
Q

Tom is reviewing a vulnerability scan report and finds that one of the servers on his network
suffers from an internal IP address disclosure vulnerability. What protocol is likely in use on
this network that resulted in this vulnerability?
A. TLS
B. NAT
C. SSH
D. VPN

A

B. NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which one of the CVSS metrics would contain information about the type of user account an
attacker must use to execute an attack?
A. AV
B. C
C. PR
D. AC

A

C. PR (Privileges Required)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which one of the following values for the CVSS attack complexity metric would indicate that
the specified attack is simplest to exploit?
A. High
B. Medium
C. Low
D. Severe

A

C. Low

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which one of the following values for the confidentiality, integrity, or availability CVSS
metric would indicate the potential for total compromise of a system?
A. N
B. A
C. H
D. L

A

C. H ,stands for high

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the most recent version of CVSS that is currently available?
A. 1.0
B. 2.0
C. 2.5
D. 3.0

A

D. 3.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which one of the following metrics is not included in the calculation of the CVSS exploitability score?
A. Attack vector
B. Vulnerability age
C. Attack complexity
D. Privileges Required

A

B. Vulnerability age

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  1. Kevin recently identified a new security vulnerability and computed its CVSS base score as
    6.5. Which risk category would this vulnerability fall into?
    A. Low
    B. Medium
    C. High
    D. Critical
A

B. Medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Tara recently analyzed the results of a vulnerability scan report and found that a vulnerability reported by the scanner did not exist because the system was actually patched as specified. What type of error occurred?
A. False positive
B. False negative
C. True positive
D. True negative

A

A. False positive

Scanner reports a vuln when one doesnt exist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which one of the following is not a common source of information that may be correlated
with vulnerability scan results?
A. Logs
B. Database tables
C. SIEM
D. Configuration management system

A

B. Database tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which one of the following operating systems should be avoided on production networks?
A. Windows Server 2003
B. Red Hat Enterprise Linux 8
C. CentOS 8
D. Ubuntu 22.04

A

A. Windows Server 2003

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In what type of attack does the attacker place more information in a memory location than is
allocated for that use?
A. SQL injection
B. LDAP injection
C. Cross-site scripting
D. Buffer overflow

A

D. Buffer overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The Dirty COW attack is an example of what type of vulnerability?
A. Malicious code
B. Privilege escalation
C. Buffer overflow
D. LDAP injection

A

B. Privilege escalation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which one of the following protocols should never be used on a public network?
A. SSH
B. HTTPS
C. SFTP
D. Telnet

A

D. Telnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Betty is selecting a transport encryption protocol for use in a new public website she is creating. Which protocol would be the best choice?
A. SSL 2.0
B. SSL 3.0
C. TLS 1.0
D. TLS 1.3

A

D. TLS 1.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

. Which one of the following conditions would not result in a certificate warning during a vulnerability scan of a web server?
A. Use of an untrusted CA
B. Inclusion of a public encryption key
C. Expiration of the certificate
D. Mismatch in certificate name

A

B. Inclusion of a public encryption key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What software component is responsible for enforcing the separation of guest systems in a
virtualized infrastructure?
A. Guest operating system
B. Host operating system
C. Memory controller
D. Hypervisor

A

D. Hypervisor

17
Q

In what type of attack does the attacker seek to gain access to resources assigned to a different virtual machine?
A. VM escape
B. Management interface brute force
C. LDAP injection
D. DNS amplification

A

A. VM escape

18
Q

Which one of the following terms is not typically used to describe the connection of physical
devices to a network?
A. IoT
B. IDS
C. ICS
D. SCADA

A

B. IDS

19
Q

Monica discovers that an attacker posted a message attacking users who visit a web forum
that she manages. Which one of the following attack types is most likely to have occurred?
A. SQL injection
B. Malware injection
C. LDAP injection
D. Cross-site scripting

A

D. Cross-site scripting

20
Q

Alan is reviewing web server logs after an attack and finds many records that contain semicolons and apostrophes in queries from end users. What type of attack should he suspect?
A. SQL injection
B. LDAP injection
C. Cross-site scripting
D. Buffer overflow

A

A. SQL injection

IST-267 Network Vulnerabilitiy Assess (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions