Chapter 1 Review Questions Flashcards
What is enumeration in hacking?
The phase where a hacker attempts to extract information such as usernames, computer names, network resources, shares, and services.
Which “threat actor” may cross ethical lines, but usually has good intentions?
Gray Hat
What is an Advanced Persistent Threat (APT)>
An attack where the hacker has inconspicuously implanted a means to continuously gain undetected daccess to a network.
What is Threat Modeling?
The process of analyzing the security of the organization and determining security holes.
Once a threat model is put together, the
organization can begin securing its systems and
data
What is the Permission to Test document?
The proof an ethical hacker has that they have permission to perform otherwise-illegal previously-approved-of activities to test the security of an organization’s network.
What is Penetration Testing?
the practice of finding vulnerabilities and risks with the purpose of securing a computer or network system.
Which “threat actor” uses their skills for defensive purposes?
White Hat
What is the Rules of Engagement document?
The form detailing the agreement on how to handle sensitive data and who to contact if something goes wrong.
What is the Open Source Security Testing Methodology Manual (OSSTMM)?
A framework that attempts to create a single accepted method for a thorough security test.
What are the five phases of the ethical hacking methodology?
Performing reconnaissance
Scanning and enumeration
Establishing access
Maintaining access
Clearing tracks
Which penetration testing type simulates an outside attack and is also the most expensive?
Black Box
Which of the following is NOT one of the four common methods for dealing with risk?
Acceptance
Avoidance
Transference
Ignorance
Ignorance
What does ISO/IEC 27001 regulate?
Defines the processes and requirements for an organization’s
information security management systems.
What does the Payment Card Industry Data Security Standards
(PCI-DSS) regulate?
Defines the security standards for any organization that
handles cardholder information for debit cards, credit cards,
prepaid cards, and other types of payment cards.
What does Health Insurance Portability and Accountability
Act (HIPAA) regulate?
A set of standards that ensures a person’s health information
is kept safe and only shared with the patient and medical
professionals that need it.
What is the Sarbanes Oxley Act (SOX)?
A law enacted in 2002 with the goal of implementing
accounting and disclosure requirements that would increase
transparency in corporate governance and financial
reporting and formalizing a system of internal checks and
balances.
What is the Digital Millennium Copyright Act (DMCA)?
A law is designed to protect copyrighted
works.
What is the Federal Information Security Management Act (FISMA)?
A law that defines how federal government data, operations, and
assets are handled.
What is an Objective-Based Penetration Test?
It is an objective-based test that focuses on the overall security of the organization and its data security.
What is the Performing Reconnaissance stage of the Ethical Hacking Methodology?
the hacker begins gathering information about the
target. This can include gathering publicly available information,
using social engineering techniques, or even dumpster diving
What is the Scanning and Enumeration stage of the Ethical Hacking Methodology?
Scanning is a natural extension of reconnaissance. The hacker uses
various tools to gather in-depth information about the network,
computer systems, live systems, open ports, and other features.
Extracting information such as usernames, computer names,
network resources, shares, and services is known as enumeration.
Enumeration is a part of the scanning step
What is the Establishing Access stage of the Ethical Hacking Methodology?
In this phase, the hacker uses all the information gathered through
reconnaissance and scanning to exploit any vulnerabilities found
and gain access.
What is the Maintaining Access stage of the Ethical Hacking Methodology?
Once the hacker has gained access, he can use backdoors, rootkits,
or Trojans to establish permanent access to the system.
What is the Clearing Tracks stage of the Ethical Hacking Methodology?
The final step in the hacking process is clearing tracks. The hacker
overwrites log files to hide the fact they were ever there.
