Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

TSM353 > Chapter 8-10 > Flashcards

Chapter 8-10 Flashcards

1
Q 
This document protects the pen-tester from legal liability should issues arise from an agreed-upon pen test.
A. Rules of Engagement
B. Title IX
C. Memorandum of Understanding
D. Acceptable Use Policy
A

A. Rules of Engagement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of these is not an example of a server-side exploitation:
A. Insert SQL code into a form on a webpage to gain unauthorized access to database records
B. Gaining unauthorized access to a server via a backdoor
C. Inserting malicious code into a website through cross site scripting
D. Exploiting a vulnerability in the management interface of a server

A

B. Gaining unauthorized access to a server via a backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q 
This multipurpose tool that is installed on most Linux distros provides a discreet, but unencrypted channel to remotely send text and files to a target machine.
  A. Empire 
  B. Meterpreter 
  C. NetCat 
  D. Nmap
A

C. NetCat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q 
In order to determine whether SSH were running on a host, this scanning type would be used:
  A. Port scanning 
  B. Network Tracing 
  C. Version Scanning 
  D. OS Fingerprinting
A

C. Version Scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q 
This phase involves gaining access to a target through means of some type of unintended access.
  A. Post-Exploitation 
  B. Exploitation 
  C. Scanning 
  D. Reconnaissance 
  E. Planning
A

B. Exploitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q 
A user who is infected with malware from a web server due to a vulnerability in their browser has experienced a:
  A. Server-side exploit 
  B. Humiliation 
  C. Client-side exploit 
  D. Local Privilege Escalation
A

C. Client-side exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q 
Determining which hosts are active on a network is part of which phase of a pen-test:
  A. Exploitation 
  B. Post-Exploitation 
  C. Planning 
  D. Scanning 
  E. Reconnaissance
A

D. Scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q 
Examining publicly available information to gather information about the target is part of this phase:
A.	Planning 
B.	Scanning 
C.	Post-Exploitation 
D.	Reconnaissance 
E.	Exploitation
A

D. Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of these is not a passive scanning technique?
A. Scanning the organization’s public IP range
B. Pulling site registration records
C. Scanning for files on a public website
D. Examining metadata in publicly available files

A

A. Scanning the organization’s public IP range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q 
What port is used for file shares (SMB)?
 A. 445 
  B. 143 
  C. 110 
  D. 443
A

A. 445

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q 
What port is used for DNS services?
  A. 22 
  B. 53 
  C. 445 
  D. 25
A

B. 53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q 
Data collected from publicly available sources and used in an intelligent context is known as:
  A. Open Source Intelligence 
  B. Open Source Collective 
  C. Collective Intelligence 
  D. Open Source Software
A

A. Open Source Intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q 
When an Nmap scan has determined a port has no service listening on it, the status is reported as:
  A. Unfiltered 
  B. Open 
  C. Closed 
  D. Filtered
A

C. Closed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q 
Sending scan packets gradually so as to not trigger alerts is which type of firewall evasion technique:
  A. Sending bad checksums 
  B. Specify MTU 
  C. Decoys 
  D. Timing attacks 
  E. Fragmented packets
A

D. Timing attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q 
Sending spoofed packets to hide the attacker's IP address is which type of firewall evasion technique:
  A. Sending bad checksums 
  B. Specify MTU 
  C. Decoys 
  D. Timing attacks 
  E. Fragmented packets
A

C. Decoys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q 
Forcing packets to be sent in smaller packet sizes to force payloads to be broken up into multiple packets in an effort to obfuscate the payload is which type of firewall evasion technique:
  A. Timing attacks 
  B. Sending bad checksums 
  C. Specify MTU 
  D. Decoys 
  E. Fragmented packets
A

C. Specify MTU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q 
Sending an echo request to a host to determine its status is which type of scan:
  A. TCP Connect 
  B. UDP 
  C. TCP SYN 
  D. ICMP
A

D. ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q 
When an Nmap scan cannot access a port, the status is reported as:
  A. Unfiltered 
  B. Filtered 
  C. Closed 
  D. Open
A

B. Filtered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q 
Taking advantage of web input forms in order to perform unauthorized operations on a database is which type of web attack:
  A. Application Override 
  B. SQL Script Injection 
  C. Cross-Site Scripting 
  D. LDAP Injection
A

B. SQL Script Injection

20
Q 
A web error code in the 400 range is considered to be which type of code:
  A. Redirection 
  B. Successful 
  C. Informational 
  D. Server Error 
  E. Client Error
A

E. Client Error

21
Q 
A web error code in the 500 range is considered to be which type of code:
  A. Client Error 
  B. Redirection 
  C. Informational 
  D. Server Error 
  E. Successful
A

D. Server Error

22
Q 
A web error code in the 200 range is considered to be which type of code:
  A. Informational 
  B. Client Error 
  C. Server Error 
  D. Redirection 
  E. Successful
A

E. Successful

23
Q 
Which of these is considered to be the strongest wireless security:
  A. WEP 
  B. WPA 
  C. TKIP 
  D. WPA2
A

D. WPA2

24
Q 
The overall management of industrial technology systems is known as:
  A. PLC 
  B. OSINT 
  C. ICS 
  D. SCADA
A

D. SCADA

25
Q 
Which of these is considered to be the weakest wireless security:
  A. WPA2 
  B. WEP 
  C. AES 
  D. WPA
A

B. WEP

26
Q 
The NIST Publication that provides standardized guidelines for Industrial Control Systems is known as:
  A. 800-125 
  B. 800-39 
  C. 800-53 
  D. 800-82R2
A

D. 800-82R2

27
Q 
The MAC address of a wireless access point is known as:
  A. GUID 
  B. BSSD 
  C. OUID 
  D. SSID
A

B. BSSD

28
Q 
The KRACK vulnerability affects which wireless protocol:
  A. TKIP 
  B. WPA2 
  C. WPA 
  D. WEP
A

B. WPA2

29
Q

Pentesting phases of attack?

A
  1. Planning
  2. Reconnaissance
  3. Scanning
  4. Expoitation
  5. Post-Exploitation
30
Q

Scanning types

A 
Network Tracing
Network Sweeping
Port Scanning
OS fingerprinting
Version scanning
Vulnerability scanning
31
Q

No internals known?

A

Black box

32
Q

Full target details known?

A

Crystal box

33
Q

Full target details known?

A

Crystal box

34
Q

Active scanning

A

interacting directly with the target network to gather info

35
Q

Scan types

A 
ICMP
TCP SYN
TCP Connect
NULL
FIN
XMAS
36
Q

The process of discovering potential attack vectors in the system for further exploitation of the system.

A

Enumeration

37
Q

Scan types

A 
ICMP
TCP SYN
TCP Connect
NULL
FIN
XMAS
38
Q

Telnet port

A

23

39
Q

FTP port

A

20,21

40
Q

Email port

A

25, 110

41
Q

SNMP port

A

161, 162

42
Q

Web Browsing

A

80

43
Q

Secure Web Browsing

A

443

44
Q

DNS port

A

53

45
Q

SSH port

A

22

46
Q

SMB port

A

445

47
Q

Firewall evasion techniques

A 
Timing attacks
Fragmented packets
SPecify MTU
Sending bad checksums
Decoys

TSM353 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions