Domain 6 Flashcards
(100 cards)
1
Q
- During a port scan, Susan discovers a system running services on TCP and UDP 137-139 and TCP 445, as well as TCP 1433. What type of system is she likely to find if she connects to the machine?
a. A Linux email server
b. A Windows SQL server
c. A Linux file server
d. A Windows workstation
A
B. TCP and UDP ports 137-139 are used for NetBIOS services, whereas 445 is used for Active Directory. TCP 1433 is the default port for Microsoft SQL, indicating that this is probably a Windows server providing SQL services.
2
Q
- Which of the following is a method used to design new software tests and to ensure the quality of tests?
a. Code auditing
b. Static code analysis
c. Regression testing
d. Mutation testing
A
D. Mutation testing modifies a program in small ways, and then tests that mutant to determine if it behaves as it should or if it fails. This technique is used to design and test software tests through mutation. Static code analysis and regression testing are both means of testing code, whereas code auditing is an analysis of source code rather than a means of designing and testing software tests.
3
Q
- During a port scan, Lauren found TCP port 443 open on a system. Which tool is best suited to scanning the service that is most likely running on that port?
a. zzuf
b. Nikto
c. Metasploit
d. sqlmap
A
B. TCP port 443 normally indicates an HTTPS server. Nikto is useful for vulnerability scanning web servers and applications and is the best choice listed for a web server. Metasploit includes some scanning functionality but is not a purpose-built tool for vulnerability scanning. zzuf is a fuzzing tool and isn’t relevant for vulnerability scans, whereas sqlmap is a SQL injection testing tool.
4
Q
- What message logging standard is commonly used by network devices, Linux and Unix systems, and many other enterprise devices?
a. Syslog
b. Netlog
c. Eventlog
d. Remote Log Protocol (RLP)
A
A. Syslog is a widely used protocol for event and message logging. Eventlog, netlog, and Remote Log Protocol are all made-up terms.
5
Q
- Alex wants to use an automated tool to fill web application forms to test for format string vulnerabilities. What type of tool should he use?
a. A black box
b. A brute-force tool
c. A buzzer
d. A static analysis tool
A
C. Fuzzers are tools that are designed to provide invalid or unexpected input to applications, testing for vulnerabilities like format string vulnerabilities, buffer overflow issues, and other problems. A static analysis relies on examining code without running the application or code, and thus would not fill forms as part of a web application. Brute-force tools attempt to bypass security by trying every possible combination for passwords or other values. A black box is a type of penetration test where the testers do not know anything about the environment.
6
Q
- Susan needs to scan a system for vulnerabilities, and she wants to use an open source tool to test the system remotely. Which of the following tools will meet her requirements and allow vulnerability scanning?
a. Nmap
b. OpenVAS
c. MBSA
d. Nessus
A
B. OpenVAS is an open source vulnerability scanning tool that will provide Susan with a report of the vulnerabilities that it can identify from a remote, network-based scan. Nmap is an open source port scanner. Both the Microsoft Baseline Security Analyzer (MBSA) and Nessus are closed source tools, although Nessus was originally open source.
7
Q
- NIST Special Publication 800-53A describes four major types of assessment objects that can be used to identify items being assessed. If the assessment covers IPS devices, which of the types of assessment objects is being assessed?
a. A specification
b. A mechanism
c. An activity
d. An individual
A
B. An IPS is an example of a mechanism like a hardware-, software-, or firmware-based control or system. Specifications are document-based artifacts like policies or designs, activities are actions that support an information system that involves people, and an individual is one or more people applying specifications, mechanisms, or activities.
8
Q
- Jim has been contracted to perform a penetration test of a bank’s primary branch. In order to make the test as real as possible, he has not been given any information about the bank other than its name and address. What type of penetration test has Jim agreed to perform?
a. A crystal box penetration test
b. A gray box penetration test
c. A black box penetration test
d. A white box penetration test
A
C. Jim has agreed to a black box penetration test, which provides no information about the organization, its systems, or its defenses. A crystal or white box penetration test provides all of the information an attacker needs, whereas a gray box penetration test provides some, but not all, information.
9
Q
- As part of a penetration test, Alex needs to determine if there are web servers that could suffer from the 2014 Heartbleed bug. What type of tool could he use, and what should he check to verify that the tool can identify the problem?
a. A vulnerability scanner, to see whether the scanner has a signature or test for the Heartbleed CVE number
b. A port scanner, to see whether the scanner properly identifies SSL connections
c. A vulnerability scanner, to see whether the vulnerability scanner detects problems with the Apache web server
d. A port scanner, to see whether the port scanner supports TLS connections
A
A. A vulnerability scanner that has a test (sometimes called a signature or plugin) that provides a detection method for CVE-2014-0160, also known as the Heartbleed bug, a vulnerability in OpenSSL will detect and report on the issue on any system it can connect to. Port scanners do not determine whether services are vulnerable, and Heartbleed was not a vulnerability in the Apache web server—but even without knowing this, the CVE number is a better indicator of whether the issue will be found than a generic detect for a service.
10
Q
- In a response to a Request for Proposal, Susan receives a SAS-70 Type 1 report. If she wants a report that includes operating effectiveness detail, what should Susan ask for as followup and why?
a. An SAS-70 Type II, because Type I only covers a single point in time
b. An SOC Type 1, because Type II does not cover operating effectiveness
c. An SOC Type 2, because Type I does not cover operating effectiveness
d. An SAC-70 type 3, because Types 1 and 2 are outdated and no longer accepted
A
C. Service Organization Control (SOC) reports replaced SAS-70 reports in 2010. A Type 1 report only covers a point in time, so Susan needs an SOC Type 2 report to have the information she requires to make a design and operating effectiveness decision based on the report.
11
Q
- During a wireless network penetration test, Susan runs aircrack-ng against the network using a password file. What might cause her to fail in her password-cracking efforts?
a. Use of WPA2 encryption
b. Running WPA2 in Enterprise mode
c. Use of WEP encryption
d. Running WPA2 in PSK mode
A
B. WPA2 enterprise uses RADIUS authentication for users rather than a preshared key. This means a password attack is more likely to fail as password attempts for a given user may result in account lock-out. WPA2 encryption will not stop a password attack, and WPA2’s preshared key mode is specifically targeted by password attacks that attempt to find the key. Not only is WEP encryption outdated, but it can also frequently be cracked quickly by tools like aircrack-ng.
12
Q
- Which type of SOC report is best suited to provide assurance to users about an organization’s security, availability, and the integrity of their service operations?
a. An SOC 1 Type 2 report
b. An SOC 2 report
c. An SOC 3 report
d. An SOC 1 Type 1 report
A
C. SOC 3 reports are intended to be shared with a broad community, often with a website seal, and support the organization’s claims about their ability to provide integrity, availability, and confidentiality. SOC 1 reports report on controls over financial reporting, whereas SOC 2 reports cover security, availability, integrity, and privacy for business partners, regulators, and other similar organizations in detail that would not typically be provided to a broad audience.
13
Q
- What type of testing is used to ensure that separately developed software modules properly exchange data?
a. Fuzzing
b. Dynamic testing
c. Interface testing
d. API checksums
A
C. Interface testing is used to ensure that software modules properly meet interface specifications and thus will properly exchange data. Dynamic testing tests software in a running environment, whereas fuzzing is a type of dynamic testing that feeds invalid input to running software to test error and input handling. API checksums are not a testing technique.
14
Q
- Which of the following is not a potential problem with active wireless scanning?
a. Accidently scanning apparent rogue devices that actually belong to guests
b. Causing alarms on the organization’s wireless IPS
c. Scanning devices that belong to nearby organizations
d. Misidentifying rogue devices
A
B. Not only should active scanning be expected to cause wireless IPS alarms, but they may actually be desired if the test is done to test responses. Accidently scanning guests, neighbors, or misidentifying devices belonging to third parties are all potential problems with active scanning and require the security assessor to carefully verify the systems that she is scanning.
15
Q
- Ben uses a fuzzing tool that develops data models and creates fuzzed data based on information about how the application uses data to test the application. What type of fuzzing is Ben doing?
a. Mutation
b. Parametric
c. Generational
d. Derivative
A
C. Generational fuzzing relies on models for application input and conducts fuzzing attacks based on that information. Mutation based fuzzers are sometimes called “dumb” fuzzers because they simply mutate or modify existing data samples to create new test samples. Neither parametric nor derivative is a term used to describe types of fuzzers.
16
Q
- Saria wants to log and review traffic information between parts of her network. What type of network logging should she enable on her routers to allow her to perform this analysis?
a. Audit logging
b. Flow logging
c. Trace logging
d. Route logging
A
B. Flows, also often called network flows, are captured to provide insight into network traffic for security, troubleshooting, and performance management. Audit logging provides information about events on the routers, route logging is not a common network logging function, and trace logs are used in troubleshooting specific software packages as they perform their functions.
17
Q
- Jim has been contracted to conduct a gray box penetration test, and his clients have provided him with the following information about their networks so that he can scan them.
Data center: 10.10.10.0/24
Sales: 10.10.11.0/24
Billing: 10.10.12.0/24
Wireless: 192.168.0.0/16
What problem will Jim encounter if he is contracted to conduct a scan from offsite?
a. The IP ranges are too large to scan efficiently.
b. The IP addresses provided cannot be scanned.
c. The IP ranges overlap and will cause scanning issues.
d. The IP addresses provided are RFC 1918 addresses.
A
D. The IP addresses that his clients have provided are RFC 1918 non-routable IP addresses, and Jim will not be able to scan them from offsite. To succeed in his penetration test, he will either have to first penetrate their network border or place a machine inside their network to scan from the inside. IP addresses overlapping is not a real concern for scanning, and the ranges can easily be handled by current scanning systems.
18
Q
- Karen’s organization has been performing system backups for years but has not used the backups frequently. During a recent system outage, when administrators tried to restore from backups they found that the backups had errors and could not be restored. Which of the following options should Karen avoid when selecting ways to ensure that her organization’s backups will work next time?
a. Log review
b. MTD verification
c. Hashing
d. Periodic testing
A
B. Karen can’t use MTD verification because MTD is the Maximum Tolerable Downtime. Verifying it will only tell her how long systems can be offline without significant business impact. Reviewing logs, using hashing to verify that the logs are intact, and performing periodic tests are all valid ways to verify that the backups are working properly.
19
Q
Questions 19, 20, and 21 refer to the following scenario.
The company that Jennifer works for has implemented a central logging infrastructure, as shown in the following image. Use this diagram and your knowledge of logging systems to answer the following questions.
Diagram shows a corporate network and a data center. Data center includes firewall, SIEM appliance, Linux web server and Linux database server. Corporate network includes Windows desktop systems and Wi-Fi access points.
Image
- Jennifer needs to ensure that all Windows systems provide identical logging information to the SIEM. How can she best ensure that all Windows desktops have the same log settings?
a. Perform periodic configuration audits.
b. Use Group Policy.
c. Use Local Policy.
d. Deploy a Windows syslog client.
A
B. Group Policy enforced by Active Directory can ensure consistent logging settings and can provide regular enforcement of policy on systems. Periodic configuration audits won’t catch changes made between audits, and local policies can drift due to local changes or differences in deployments. A Windows syslog client will enable the Windows systems to send syslog to the SIEM appliance but won’t ensure consistent logging of events.
20
Q
Questions 19, 20, and 21 refer to the following scenario.
The company that Jennifer works for has implemented a central logging infrastructure, as shown in the following image. Use this diagram and your knowledge of logging systems to answer the following questions.
Diagram shows a corporate network and a data center. Data center includes firewall, SIEM appliance, Linux web server and Linux database server. Corporate network includes Windows desktop systems and Wi-Fi access points.
Image
- During normal operations, Jennifer’s team uses the SIEM appliance to monitor for exceptions received via syslog. What system shown does not natively have support for syslog events?
a. Enterprise wireless access points
b. Windows desktop systems
c. Linux web servers
d. Enterprise firewall devices
A
B. Windows systems generate logs in the Windows native logging format. To send syslog events, Windows systems require a helper application or tool. Enterprise wireless access points, firewalls, and Linux systems all typically support syslog.
21
Q
Questions 19, 20, and 21 refer to the following scenario.
The company that Jennifer works for has implemented a central logging infrastructure, as shown in the following image. Use this diagram and your knowledge of logging systems to answer the following questions.
Diagram shows a corporate network and a data center. Data center includes firewall, SIEM appliance, Linux web server and Linux database server. Corporate network includes Windows desktop systems and Wi-Fi access points.
Image
- What technology should an organization use for each of the devices shown in the diagram to ensure that logs can be time sequenced across the entire infrastructure?
a. Syslog
b. NTP
c. Logsync
d. SNAP
A
B. Network Time Protocol (NTP) can ensure that systems are using the same time, allowing time sequencing for logs throughout a centralized logging infrastructure. Syslog is a way for systems to send logs to a logging server and won’t address time sequencing. Neither logsync nor SNAP is an industry term.
22
Q
- During a penetration test, Danielle needs to identify systems, but she hasn’t gained sufficient access on the system she is using to generate raw packets. What type of scan should she run to verify the most open services?
a. A TCP connect scan
b. A TCP SYN scan
c. A UDP scan
d. An ICMP scan
A
A. When a tester does not have raw packet creation privileges, such as when they have not escalated privileges on a compromised host, a TCP connect scan can be used. TCP SYN scans require elevated privileges on most Linux systems due to the need to write raw packets. A UDP scan will miss most services that are provided via TCP, and an ICMP is merely a ping sweep of systems that respond to pings and won’t identify services at all.
23
Q
23. During a port scan using nmap, Joseph discovers that a system shows two ports open that cause him immediate worry: 21/open 23/open What services are likely running on those ports? a. SSH and FTP b. FTP and Telnet c. SMTP and Telnet d. POP3 and SMTP
A
B. Joseph may be surprised to discover FTP (TCP port 21) and Telnet (TCP port 23) open on his network since both services are unencrypted and have been largely replaced by SSH, and SCP or SFTP. SSH uses port 22, SMTP uses port 25, and POP3 uses port 110.
24
Q
- Saria’s team is working to persuade their management that their network has extensive vulnerabilities that attackers could exploit. If she wants to conduct a realistic attack as part of a penetration test, what type of penetration test should she conduct?
a. Crystal box
b. Gray box
c. White box
d. Black box
A
D. Black box testing is the most realistic type of penetration test because it does not provide the penetration tester with inside information about the configuration or design of systems, software, or networks. A gray box test provides some information, whereas a white or crystal box test provides significant or full detail.
25
25. What method is commonly used to assess how well software testing covered the potential uses of a an application?
a. A test coverage analysis
b. A source code review
c. A fuzz analysis
d. A code review report
A. A test coverage analysis is often used to provide insight into how well testing covered the set of use cases that an application is being tested for. Source code reviews look at the code of a program for bugs, not necessarily at a use case analysis, whereas fuzzing tests invalid inputs. A code review report might be generated as part of a source code review.
26
26. Testing that is focused on functions that a system should not allow are an example of what type of testing?
a. Use case testing
b. Manual testing
c. Misuse case testing
d. Dynamic testing
C. Testing how a system could be misused, or misuse testing, focuses on behaviors that are not what the organization desires or that are counter to the proper function of a system or application. Use case testing is used to verify whether a desired functionality works. Dynamic testing is used to determine how code handles variables that change over time, whereas manual testing is just what it implies: testing code by hand.
27
27. What type of monitoring uses simulated traffic to a website to monitor performance?
a. Log analysis
b. Synthetic monitoring
c. Passive monitoring
d. Simulated transaction analysis
B. Synthetic monitoring uses emulated or recorded transactions to monitor for performance changes in response time, functionality, or other performance monitors. Passive monitoring uses a span port or other method to copy traffic and monitor it in real time. Log analysis is typically performed against actual log data but can be performed on simulated traffic to identify issues. Simulated transaction analysis is not an industry term.
28
28. Which of the following vulnerabilities is unlikely to be found by a web vulnerability scanner?
a. Path disclosure
b. Local file inclusion
c. Race condition
d. Buffer overflow
C. Path disclosures, local file inclusions, and buffer overflows are all vulnerabilities that may be found by a web vulnerability scanner, but race conditions that take advantage of timing issues tend to be found either by code analysis or using automated tools that specifically test for race conditions as part of software testing.
29
29. Jim uses a tool that scans a system for available services, then connects to them to collect banner information to determine what version of the service is running. It then provides a report detailing what it gathers, basing results on service fingerprinting, banner information, and similar details it gathers combined with CVE information. What type of tool is Jim using?
a. A port scanner
b. A service validator
c. A vulnerability scanner
d. A patch management tool
C. Vulnerability scanners that do not have administrative rights to access a machine or that are not using an agent scan remote machines to gather information, including fingerprints from responses to queries and connections, banner information from services, and related data. CVE information is Common Vulnerability and Exposure information, or vulnerability information. A port scanner gathers information about what service ports are open, although some port scanners blur the line between port and vulnerability scanners. Patch management tools typically run as an agent on a system to allow them to both monitor patch levels and update the system as needed. Service validation typically involves testing the functionality of a service, not its banner and response patterns.
30
30. Emily builds a script that sends data to a web application that she is testing. Each time the script runs, it sends a series of transactions with data that fits the expected requirements of the web application to verify that it responds to typical customer behavior. What type of transactions is she using, and what type of test is this?
a. Synthetic, passive monitoring
b. Synthetic, use case testing
c. Actual, dynamic monitoring
d. Actual, fuzzing
B. Emily is using synthetic transactions, which can use recorded or generated transactions, and is conducting use case testing to verify that the application responds properly to actual use cases. Neither actual data nor dynamic monitoring is an industry term. Fuzzing involves sending unexpected inputs to a program to see how it responds. Passive monitoring uses a network tap or other capture technology to allow monitoring of actual traffic to a system or application.
31
31. What passive monitoring technique records all user interaction with an application or website to ensure quality and performance?
a. Client/server testing
b. Real user monitoring
c. Synthetic user monitoring
d. Passive user recording
B. Real user monitoring (RUM) is a passive monitoring technique that records user interaction with an application or system to ensure performance and proper application behavior. RUM is often used as part of a predeployment process using the actual user interface. The other answers are all made up—synthetic monitoring uses simulated behavior, but synthetic user monitoring is not a testing method. Similarly, passive monitoring monitors actual traffic, but passive user recording is not an industry term or technique. Client/server testing merely describes one possible architecture.
32
32. Earlier this year, the information security team at Jim’s employer identified a vulnerability in the web server that Jim is responsible for maintaining. He immediately applied the patch and is sure that it installed properly, but the vulnerability scanner has continued to flag the system as vulnerable even though Jim is sure the patch is installed. Which of the following options is Jim’s best choice to deal with the issue?
a. Uninstall and reinstall the patch.
b. Ask the information security team to flag the system as patched and not vulnerable.
c. Update the version information in the web server’s configuration.
d. Review the vulnerability report and use alternate remediation instructions if they are provided.
B. Jim should ask the information security team to flag the issue as resolved if he is sure the patch was installed. Many vulnerability scanners rely on version information or banner information, and may flag patched versions if the software provider does not update the information they see. Uninstalling and reinstalling the patch will not change this. Changing the version information may not change all of the details that are being flagged by the scanner, and may cause issues at a later date. Reviewing the vulnerability information for a workaround may be a good idea but should not be necessary if the proper patch is installed; it can create maintenance issues later.
33
33. Angela wants to test a web browser’s handling of unexpected data using an automated tool. What tool should she choose?
a. Nmap
b. zzuf
c. Nessus
d. Nikto
B. zzuf is the only fuzzer on the list, and zzuf is specifically designed to work with tools like web browsers, image viewers, and similar software by modifying network and file input to application. Nmap is a port scanner, Nessus is a vulnerability scanner, and Nikto is a web server scanner.
34
34. STRIDE, which stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege, is useful in what part of application threat modeling?
a. Vulnerability assessment
b. Misuse case testing
c. Threat categorization
d. Penetration test planning
C. An important part of application threat modeling is threat categorization. It helps to assess attacker goals that influence the controls that should be put in place. The other answers all involve topics that are not directly part of application threat modeling.
35
35. Why should passive scanning be conducted in addition to implementing wireless security technologies like wireless intrusion detection systems?
a. It can help identify rogue devices.
b. It can test the security of the wireless network via scripted attacks.
c. Their short dwell time on each wireless channel can allow them to capture more packets.
d. They can help test wireless IDS or IPS systems.
A. Passive scanning can help identify rogue devices by capturing MAC address vendor IDs that do not match deployed devices, by verifying that systems match inventories of organizationally owned hardware by hardware address, and by monitoring for rogue SSIDs or connections.
Scripted attacks are part of active scanning rather than passive scanning, and active scanning is useful for testing IDS or IPS systems, whereas passive scanning will not be detected by detection systems. Finally, a shorter dwell time can actually miss troublesome traffic, so balancing dwell time versus coverage is necessary for passive wireless scanning efforts.
36
36. During a penetration test, Lauren is asked to test the organization’s Bluetooth security. Which of the following is not a concern she should explain to her employers?
a. Bluetooth scanning can be time consuming.
b. Many devices that may be scanned are likely to be personal devices.
c. Bluetooth passive scans may require multiple visits at different times to identify all targets.
d. Bluetooth active scans can’t evaluate the security mode of Bluetooth devices.
D. Bluetooth active scans can determine both the strength of the PIN and what security mode the device is operating in. Unfortunately, Bluetooth scans can be challenging due to the limited range of Bluetooth and the prevalence of personally owned Bluetooth enabled devices. Passive Bluetooth scanning only detects active connections and typically requires multiple visits to have a chance of identifying all devices.
37
37. What term describes software testing that is intended to uncover new bugs introduced by patches or configuration changes?
a. Nonregression testing
b. Evolution testing
c. Smoke testing
d. Regression testing
D. Regression testing, which is a type of functional or unit testing, tests to ensure that changes have not introduced new issues. Nonregression testing checks to see if a change has had the effect it was supposed to, smoke testing focuses on simple problems with impact on critical functionality, and evolution testing is not a software testing technique.
38
38. Which of the tools cannot identify a target’s operating system for a penetration tester?
a. Nmap
b. Nessus
c. Nikto
d. sqlmap
D. Nmap, Nessus, and Nikto all have OS fingerprinting or other operating system identification capabilities. sqlmap is designed to perform automated detection and testing of SQL injection flaws, and does not provide OS detection.
39
39. Susan needs to predict high-risk areas for her organization and wants to use metrics to assess risk trends as they occur. What should she do to handle this?
a. Perform yearly risk assessments.
b. Hire a penetration testing company to regularly test organizational security.
c. Identify and track key risk indicators.
d. Monitor logs and events using a SIEM device.
C. Key risk indicators are used to tell those in charge of risk management how risky an activity is and how much impact changes are having on that risk profile. Identifying key risk indicators and monitoring them can help to identify high-risk areas earlier in their life cycle. Yearly risk assessments may be a good idea, but only provide a point in time view, whereas penetration tests may miss out on risks that are not directly security related. Monitoring logs and events using a SIEM device can help detect issues as they occur but won’t necessarily show trends in risk.
40
40. What major difference separates synthetic and passive monitoring?
a. Synthetic monitoring only works after problems have occurred.
b. Passive monitoring cannot detect functionality issues.
c. Passive monitoring only works after problems have occurred.
d. Synthetic monitoring cannot detect functionality issues.
C. Passive monitoring only works after issues have occurred because it requires actual traffic. Synthetic monitoring uses simulated or recorded traffic, and thus can be used to proactively identify problems. Both synthetic and passive monitoring can be used to detect functionality issues.
41
41. Chris uses the standard penetration testing methodology shown here. Use this methodology and your knowledge of penetration testing to answer the following questions about tool usage during a penetration test.
Cycle shows activities such as planning, information gathering and discovery, vulnerability scanning, exploitation and reporting.
Image
What task is the most important during Phase 1, Planning?
a. Building a test lab
b. Getting authorization
c. Gathering appropriate tools
d. Determining if the test is white, black, or gray box
B. Getting authorization is the most critical element in the planning phase. Permission, and the “get out of jail free card” that demonstrates that organizational leadership is aware of the issues that a penetration test could cause, is the first step in any penetration test. Gathering tools and building a lab, as well as determining what type of test will be conducted, are all important, but nothing should happen without permission.
42
42. Which of the following tools is most likely to be used during discovery?
a. Nessus
b. john
c. Nmap
d. Nikto
C. Discovery can include both active and passive discovery. Port scanning is commonly done during discovery to assess what services the target provides, and nmap is one of the most popular tools used for this purpose. Nessus and Nikto might be used during the vulnerability scanning phase, and john, a password cracker, can be used to recover passwords during the exploitation phase.
43
43. Which of these concerns is the most important to address during planning to ensure the reporting phase does not cause problems?
a. Which CVE format to use
b. How the vulnerability data will be stored and sent
c. Which targets are off limits
d. How long the report should be
B. Penetration test reports often include information that could result in additional exposure if they were accidently released or stolen. Therefore, determining how vulnerability data should be stored and sent is critical. Problems with off-limits targets are more likely to result in issues during the vulnerability assessment and exploitation phase, and reports should not be limited in length but should be as long as they need to be to accomplish the goals of the test.
44
44. What four types of coverage criteria are commonly used when validating the work of a code testing suite?
a. Input, statement, branch, and condition coverage
b. Function, statement, branch, and condition coverage
c. API, branch, bounds, and condition coverage
d. Bounds, branch, loop, and condition coverage
B. Code coverage testing most frequently requires that every function has been called, that each statement has been executed, that all branches have been fully explored, and that each condition has been evaluated for all possibilities. API, input, and loop testing are not common types of code coverage testing measures.
45
45. As part of his role as a security manager, Jacob provides the following chart to his organization’s management team. What type of measurement is he providing for them?
Time to remediate in days versus number of vulnerabilities graph from 0 to 60 and 0 to 15 respectively shows a zigzag curve that falls slowly from 50 to 2.
a. A coverage rate measure
b. A key performance indicator
c. A time to live metric
d. A business criticality indicator
B. Time to remediate a vulnerability is a commonly used key performance indicator for security teams. Time to live measures how long a packet can exist in hops, business criticality is a measure used to determine how important a service or system is to an organization, and coverage rates are used to measure how effective code testing is.
46
46. What does using unique user IDs for all users provide when reviewing logs?
a. Confidentiality
b. Integrity
c. Availability
d. Accountability
D. Unique user IDs provide accountability when paired with auditable logs to provide that a specific user took any given action. Confidentiality, availability, and integrity can be provided through other means like encryption, systems design, and digital signatures.
47
47. Which of the following is not an interface that is typically tested during the software testing process?
a. APIs
b. Network interfaces
c. UIs
d. Physical interfaces
B. Application programming interfaces (APIs), user interfaces (UIs), and physical interfaces are all important to test when performing software testing. Network interfaces are not a part of the typical list of interfaces tested in software testing.
48
48. What protocol is used to handle vulnerability management data?
a. VML
b. SVML
c. SCAP
d. VSCAP
C. The Security Content Automation Protocol (SCAP) is a community sourced specification for security flaw and security configuration information and is defined in NIST SP 800-126. SVML, VSCAP, and VML are not information security–related terms.
49
49. Misconfiguration, logical and functional flaws, and poor programming practices are all causes of what type of issue?
a. Fuzzing
b. Security vulnerabilities
c. Buffer overflows
d. Race conditions
B. Security vulnerabilities can be created by misconfiguration, logical or functional design or implementation issues, or poor programming practices. Fuzzing is a method of software testing and is not a type of issue. Buffer overflows and race conditions are both caused by logical or programming flaws, but they are not typically caused by misconfiguration or functional issues.
50
50. Which of the following strategies should not be used to handle a vulnerability identified by a vulnerability scanner?
a. Install a patch.
b. Use a workaround fix.
c. Update the banner or version number.
d. Use an application layer firewall or IPS to prevent attacks against the identified vulnerability.
C. Simply updating the version that an application provides may stop the vulnerability scanner from flagging it, but it won’t fix the underlying issue. Patching, using workarounds, or installing an application layer firewall or IPS can all help to remediate or limit the impact of the vulnerability.
51
51. During a penetration test Saria calls her target’s help desk claiming to be the senior assistance to an officer of the company. She requests that the help desk reset the officer’s password because of an issue with his laptop while traveling and persuades them to do so. What type of attack has she successfully completed?
a. Zero knowledge
b. Help desk spoofing
c. Social engineering
d. Black box
C. Saria’s social-engineering attack succeeded in persuading a staff member at the help desk to change a password for someone who they not only couldn’t see, but who they couldn’t verify actually needed their password reset. Black box and zero knowledge are both terms describing penetration tests without information about the organization or system, and help desk spoofing is not an industry term.
52
52. In this image, what issue may occur due to the log handling settings?
Log properties-application dialog box shows full name, log path, log size, created modified and accessed dates, maximum log size option, radio buttons to overwrite events, archive the log or clear log manually and Clear log button.
Image
a. Log data may be lost when the log is archived.
b. Log data may be overwritten.
c. Log data may not include needed information.
d. Log data may fill the system disk.
D. The menu shown will archive logs when they reach the maximum size allowed (20 MB). These archives will be retained, which could fill the disk. Log data will not be overwritten, and log data should not be lost when the data is archived. The question does not include enough information to determine if needed information may not be logged.
53
53. Which of the following is not a hazard associated with penetration testing?
a. Application crashes
b. Denial of service
c. Exploitation of vulnerabilities
d. Data corruption
C. Penetration tests are intended to help identify vulnerabilities, and exploiting them is part of the process rather than a hazard. Application crashes; denial of service due to system, network, or application failures; and even data corruption can all be hazards of penetration tests.
54
54. Which NIST special publication covers the assessment of security and privacy controls?
a. 800-12
b. 800-53A
c. 800-34
d. 800-86
B. NIST SP 800-53A is titled “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans,” and covers methods for assessing and measuring controls.
NIST 800-12 is an introduction to computer security, 800-34 covers contingency planning, and 800-86 is the “Guide to Integrating Forensic Techniques into Incident Response.”
55
55. What type of port scanning is known as “half open” scanning?
a. TCP Connect
b. TCP ACK
c. TCP SYN
d. Xmas
C. TCP SYN scans only open a connection halfway; they do not complete the TCP connection with an ACK, thus leaving the connection open. TCP Connect scans complete the connection, whereas TCP ACK scans attempt to appear like an open connection. Xmas, or Christmas tree, scans set the FIN, PSH, and URG flags, thereby “lighting up” the TCP packet.
56
56. Lauren is performing a review of a third-party service organization and wants to determine if the organization’s policies and procedures are effectively enforced over a period of time. What type of industry standard assessment report should she request?
a. SSAE 16 SOC 1 Type I
b. SAS 70 Type I
c. SSAE 16 SOC 1 Type II
d. SAS 70 Type II
C. SOC 1 reports are prepared according to the Statement on Standards for Attestation Engagements, or SSAE number 16 (typically shortened to SSAE-16). An SOC 1 Type I report validates policies and procedures at a point in time, whereas SOC 1 Type II reports cover a period of time of at least six months. SOC 1 reports replaced SAS 70 reports in 2011, meaning that a current report should be an SSAE-16 SOC 1 report.
57
57. Jim is working with a penetration testing contractor who proposes using Metasploit as part of her penetration testing effort. What should Jim expect to occur when Metasploit is used?
a. Systems will be scanned for vulnerabilities.
b. Systems will have known vulnerabilities exploited.
c. Services will be probed for buffer overflow and other unknown flaws.
d. Systems will be tested for zero-day exploits.
B. Metasploit is an exploitation package that is designed to assist penetration testers. A tester using Metasploit can exploit known vulnerabilities for which an exploit has been created or can create their own exploits using the tool. While Metasploit provides built-in access to some vulnerability scanning functionality, a tester using Metasploit should primarily be expected to perform actual tests of exploitable vulnerabilities. Similarly, Metasploit supports creating buffer overflow attacks, but it is not a purpose-built buffer overflow testing tool, and of course testing systems for zero-day exploits doesn’t work unless they have been released.
58
58. During a third-party audit, Jim’s company receives a finding that states, “The administrator should review backup success and failure logs on a daily basis, and take action in a timely manner to resolve reported exceptions.” What is the biggest issue that is likely to result if Jim’s IT staff need to restore from a backup?
a. They will not know if the backups succeeded or failed.
b. The backups may not be properly logged.
c. The backups may not be usable.
d. The backup logs may not be properly reviewed.
C. The audit finding indicates that the backup administrator may not be monitoring backup logs and taking appropriate action based on what they report, thus resulting in potentially unusable backups. Issues with review, logging, or being aware of the success or failure of backups are less important than not having usable backups.
59
59. Jim is helping his organization decide on audit standards for use throughout their international organization. Which of the following is not an IT standard that Jim’s organization is likely to use as part of its audits?
a. COBIT
b. SSAE-16
c. ITIL
d. ISO27002
C. ITIL, which originally stood for IT Infrastructure Library, is a set of practices for IT service management, and is not typically used for auditing. COBIT, or the Control Objectives for Information and Related Technology, ISO 27002, and SSAE-16, or the Statement on Standards for Attestation Engagements number 16, are all used for auditing.
60
60. Which of the following best describes a typical process for building and implementing an Information Security Continuous Monitoring program as described by NIST Special Publication 800-137?
a. Define, establish, implement, analyze and report, respond, review, and update
b. Design, build, operate, analyze, respond, review, revise
c. Prepare, detect and analyze, contain, respond, recover, report
d. Define, design, build, monitor, analyze, react, revise
A. NIST SP 800-137 outlines the process for organizations that are establishing, implementing, and maintaining an ICSM as define, establish, implement, analyze and report, respond, review, and update. Prepare, detect and analyze, contain, respond, recover, report is an incident response plan, and the others do not match the NIST process.
61
61. Lauren’s team conducts regression testing on each patch that they release. What key performance measure should they maintain to measure the effectiveness of their testing?
a. Time to remediate vulnerabilities
b. A measure of the rate of defect recurrence
c. A weighted risk trend
d. A measure of the specific coverage of their testing
B. Lauren’s team is using regression testing, which is intended to prevent the recurrence of issues. This means that measuring the rate of defect recurrence is an appropriate measure for their work. Time to remediate vulnerabilities is associated with activities like patching, rather than preparing the patch, whereas a weighted risk trend is used to measure risk over time to an organization. Finally, specific coverage may be useful to determine if they are fully testing their effort, but regression testing is more specifically covered by defect recurrence rates.
62
62. Which of the following types of code review is not typically performed by a human?
a. Software inspections
b. Code review
c. Static program analysis
d. Software walkthroughs
C. Static program reviews are typically performed by an automated tool. Program understanding, program comprehension, code review, software inspections and software walkthroughs are all human-centric methods for reviewing code.
63
63. Susan is the lead of a Quality Assurance team at her company. They have been tasked with the testing for a major release of their company’s core software product. Use your knowledge of code review and testing to answer the following three questions.
Susan’s team of software testers are required to test every code path, including those that will only be used when an error condition occurs. What type of testing environment does her team need to ensure complete code coverage?
a. White box
b. Gray box
c. Black box
d. Dynamic
A. In order to fully test code, a white box test is required. Without full visibility of the code, error conditions or other code could be missed, making a gray box or black box test an inappropriate solution. Using dynamic testing that runs against live code could also result in some conditions being missed due to sections of code not being exposed to typical usage.
64
64. Susan is the lead of a Quality Assurance team at her company. They have been tasked with the testing for a major release of their company’s core software product. Use your knowledge of code review and testing to answer the following three questions.
As part of the continued testing of their new application, Susan’s quality assurance team has designed a set of test cases for a series of black box tests. These functional tests are then run, and a report is prepared explaining what has occurred. What type of report is typically generated during this testing to indicate test metrics?
a. A test coverage report
b. A penetration test report
c. A code coverage report
d. A line coverage report
A. A test coverage report measures how many of the test cases have been completed and is used as a way to provide test metrics when using test cases. A penetration test report is provided when a penetration test is conducted—this is not a penetration test. A code coverage report covers how much of the code has been tested, and a line coverage report is a type of code coverage report.
65
65. Susan is the lead of a Quality Assurance team at her company. They have been tasked with the testing for a major release of their company’s core software product. Use your knowledge of code review and testing to answer the following three questions.
As part of their code coverage testing, Susan’s team runs the analysis in a nonproduction environment using logging and tracing tools. Which of the following types of code issues is most likely to be missed during testing due to this change in the operating environment?
a. Improper bounds checking
b. Input validation
c. A race condition
d. Pointer manipulation
C. The changes from a testing environment with instrumentation inserted into the code and the production environment for the code can mask timing-related issues like race conditions. Bounds checking, input validation, and pointer manipulation are all related to coding issues rather than environmental issues and are more likely to be discoverable in a test environment.
66
66. What step should occur after a vulnerability scan finds a critical vulnerability on a system?
a. Patching
b. Reporting
c. Remediation
d. Validation
D. Once a vulnerability scanner identifies a potential problem, validation is necessary to verify that the issue exists. Reporting, patching, or other remediation actions can be conducted once the vulnerability has been confirmed.
67
67. Kathleen is reviewing the code for an application. She first plans the review, conducts an overview session with the reviewers and assigns roles, and then works with the reviewers to review materials and prepare for their roles. Next, she intends to review the code, rework it, and ensure that all defects found have been corrected.
What type of review is Kathleen conducting?
a. A dynamic test
b. Fagan inspection
c. Fuzzing
d. A Roth-Parker review
B. Fagan testing is a detailed code review that steps through planning, overview, preparation, inspection, rework, and follow-up phases. Dynamic tests test the code in a real runtime environment, whereas fuzzing is a type of dynamic testing that feeds invalid inputs to software to test its exception-handling capabilities. Roth-Parker reviews were made up for this question.
68
68. Danielle wants to compare vulnerabilities she has discovered in her data center based on how exploitable they are, if exploit code exists, as well as how hard they are to remediate. What scoring system should she use to compare vulnerability metrics like these?
a. CSV
b. NVD
c. VSS
d. CVSS
D. The Common Vulnerability Scoring System (CVSS) includes metrics and calculation tools for exploitability, impact, how mature exploit code is, and how vulnerabilities can be remediated, as well as a means to score vulnerabilities against users’ unique requirements. NVD is the National Vulnerability Database, CSV is short for Comma-Separated Values, and VSS is a made-up term.
69
69. During a port scan of his network, Alex finds that a number of hosts respond on TCP ports 80, 443, 515, and 9100 in offices throughout his organization. What type of devices is Alex likely discovering?
a. Web servers
b. File servers
c. Wireless access points
d. Printers
D. Network-enabled printers often provided services via TCP 515 and 9100, and have both nonsecure and secure web-enabled management interfaces on TCP 80 and 443. Web servers, access points, and file servers would not typically provide service on the LPR and LPD ports (515 and 9100).
70
70. Nikto, Burp Suite, and Wapiti are all examples of what type of tool?
a. Web application vulnerability scanners
b. Code review tools
c. Vulnerability scanners
d. Port scanners
A. Nikto, Burp Suite, and Wapiti are all web application vulnerability scanners, tools designed specifically to scan web servers and applications. While they share some functionality with broader vulnerability scanners and port scanning tools, they have a narrower focus and typically have deeper capabilities than vulnerability scanners.
71
71. During an nmap scan, what three potential statuses are provided for a port?
a. Open, unknown, closed
b. Open, closed, and filtered
c. Available, denied, unknown
d. Available, unavailable, filtered
B. Nmap reports one of three statuses: Open, which means that the port is open and that an application responds; Closed, which means that the port is accessible but there is no application response; and Filtered, which means that a firewall is not allowing nmap to determine if the port is open or closed.
72
72. Which of the following is not a method of synthetic transaction monitoring?
a. Database monitoring
b. Traffic capture and analysis
c. User session monitoring
d. Website performance monitoring
C. User session monitoring is not a means of conducting synthetic performance monitoring. Synthetic performance monitoring uses scripted or recorded data, not actual user sessions. Traffic capture, database performance monitoring, and website performance monitoring can all be used during synthetic performance monitoring efforts.
73
73. Susan needs to ensure that the interactions between the components of her e-commerce application are all handled properly. She intends to verify communications, error handling, and session management capabilities throughout her infrastructure. What type of testing is she planning to conduct?
a. Misuse case testing
b. Fuzzing
c. Regression testing
d. Interface testing
D. Susan is conducting interface testing. Interface testing involves testing system or application components to ensure that they work properly together. Misuse case testing focuses on how an attacker might misuse the application and would not test normal cases. Fuzzing attempts to send unexpected input and might be involved in interface testing, but it won’t cover the full set of concerns. Regression testing is conducted when testing changes and is used to ensure that the application or system functions as it did before the update or change.
74
74. Jim is designing his organization’s log management systems and knows that he needs to carefully plan to handle the organization’s log data. Which of the following is not a factor that Jim should be concerned with?
a. The volume of log data
b. A lack of sufficient log sources
c. Data storage security requirements
d. Network bandwidth
B. Not having enough log sources is not a key consideration in log management system design, although it may be a worry for security managers who can’t capture the data they need. Log management system designs must take into account the volume of log data and the network bandwidth it consumes, the security of the data, and the amount of effort required to analyze the data.
75
75. Jim has contracted with a software testing organization that uses automated testing tools to validate software. He is concerned that they may not completely test all statements in his software. What measurement should he ask for in their report to provide information about this?
a. A use case count
b. A test coverage report
c. A code coverage report
d. A code review report
C. Jim should ask for a code coverage report, which provides information on the functions, statements, branches, and conditions or other elements that were covered in the testing. Use cases are used as part of a test coverage calculation that divides the tested use cases by the total use cases, but use cases may not cover all possible functions or branches. A code review report would be generated if the organization was manually reviewing the application’s source code.
76
76. When a Windows system is rebooted, what type of log is generated?
a. Error
b. Warning
c. Information
d. Failure audit
C. Rebooting a Windows machine results in an information log entry. Windows defines five types of events: errors, which indicate a significant problem; warnings, which may indicate future problems; information, which describes successful operation; success audits, which record successful security accesses; and failure audits, which record failed security access attempts.
77
77. During a review of access logs, Alex notices that Danielle logged into her workstation in New York at 8 a.m. daily, but that she was recorded as logging into her department’s main web application shortly after 3 a.m. daily. What common logging issue has Alex likely encountered?
a. Inconsistent log formatting
b. Modified logs
c. Inconsistent timestamps
d. Multiple log sources
C. Inconsistent timestamps are a common problem, often caused by improperly set time zones or due to differences in how system clocks are set. In this case, a consistent time difference often indicates that one system uses local time, and the other is using Greenwich Mean Time (GMT). Logs from multiple sources tend to cause problems with centralization and collection, whereas different log formats can create challenges in parsing log data. Finally, modified logs are often a sign of intrusion or malicious intent.
78
78. What type of vulnerability scan accesses configuration information from the systems it is run against as well as information that can be accessed via services available via the network?
a. Authenticated scans
b. Web application scans
c. Unauthenticated scans
d. Port scans
A. Authenticated scans use a read-only account to access configuration files, allowing more accurate testing of vulnerabilities. Web application, unauthenticated scans, and port scans don’t have access to configuration files unless they are inadvertently exposed.
Microsoft’s STRIDE threat assessment model places threats into one of six categories:
Spoofing—threats that involve user credentials and authentication, or falsifying legitimate communications
Tampering—threats that involve the malicious modification of data
Repudiation—threats that cause actions to occur that cannot be denied by a user
Information disclosure—threats that involve exposure of data to unauthorized individuals
Denial of service—threats that deny service to legitimate users
Elevation of privilege—threats that provide higher privileges to unauthorized users
79
79. Ben’s organization has begun to use STRIDE to assess their software, and has identified threat agents and the business impacts that these threats could have. Now they are working to identify appropriate controls for the issues they have identified. Use the STRIDE model to answer the following three questions.
Ben’s development team needs to address an authorization issue, resulting in an elevation of privilege threat. Which of the following controls is most appropriate to this type of issue?
a. Auditing and logging is enabled.
b. RBAC is used for specific operations.
c. Data type and format checks are enabled.
d. User input is tested against a whitelist.
B. Using role-based access controls (RBACs) for specific operations will help to ensure that users cannot perform actions that they should not be able to. Auditing and logging can help detect abuse but won’t prevent it, and data type, format checks, and whitelisting are all useful for preventing attacks like SQL injection and buffer overflow attacks but are not as directly aimed at authorization issues.
80
80. Ben’s organization has begun to use STRIDE to assess their software, and has identified threat agents and the business impacts that these threats could have. Now they are working to identify appropriate controls for the issues they have identified. Use the STRIDE model to answer the following three questions.
Ben’s team is attempting to categorize a transaction identification issue that is caused by use of a symmetric key shared by multiple servers. What STRIDE category should this fall into?
a. Information disclosure
b. Denial of service
c. Tampering
d. Repudiation
D. Since a shared symmetric key could be used by any of the servers, transaction identification problems caused by a shared key are likely to involve a repudiation issue. If encrypted transactions cannot be uniquely identified by server, they cannot be proved to have come from a specific server.
81
81. Ben’s organization has begun to use STRIDE to assess their software, and has identified threat agents and the business impacts that these threats could have. Now they are working to identify appropriate controls for the issues they have identified. Use the STRIDE model to answer the following three questions.
Ben wants to prevent or detect tampering with data. Which of the following is not an appropriate solution?
a. Hashes
b. Digital signatures
c. Filtering
d. Authorization controls
C. Filtering is useful for preventing denial of service attacks but won’t prevent tampering with data. Hashes and digital signatures can both be used to verify the integrity of data, and authorization controls can help ensure that only those with the proper rights can modify the data.
82
82. Which NIST document covers the creation of an Information Security Continuous Monitoring (ISCM)?
a. NIST SP 800-137
b. NIST SP 800-53a
c. NIST SP 800-145
d. NIST SP 800-50
A. NIST SP 800-137 is titled “Information Security Continuous Monitoring (ISCM) for Federal Systems and Organizations” and describes the process of building and maintaining an ISCM. NIST SP 800-145 defines cloud computing, whereas NIST SP 800-53A covers assessing security and privacy controls for federal systems and organizations. NIST SP 800-50 focuses on information security awareness programs.
83
83. Which of the following is not an issue when using fuzzing to find program faults?
a. They often find only simple faults.
b. Fuzz testing bugs are often severe.
c. Fuzzers may not fully cover the code.
d. Fuzzers can’t reproduce errors.
B. Finding severe bugs is not a fault—in fact, fuzzing often finds important issues that would otherwise have been exploitable. Fuzzers can reproduce errors, but typically don’t fully cover the code—code coverage tools are usually paired with fuzzers to validate how much coverage was possible. Fuzzers are often limited to simple errors because they won’t handle business logic or attacks that require knowledge from the application user.
84
84. What term describes an evaluation of the effectiveness of security controls performed by a third party?
a. A security assessment
b. A penetration test
c. A security audit
d. A security test
Image
During a port scan, Ben uses nmap’s default settings and sees the following results. Use this information to answer the following three questions.
C. Security audits are security assessments performed by third parties and are intended to evaluate the effectiveness of security controls. Security assessments are conducted by internal staff, and security tests are used to verify that a control is functioning effectively. Penetration tests can be conducted by internal or external staff and test systems by using actual exploitation techniques.
85
85. If Ben is conducting a penetration test, what should his next step be after receiving these results?
a. Connect to the web server using a web browser.
b. Connect via Telnet to test for vulnerable accounts.
c. Identify interesting ports for further scanning.
d. Use sqlmap against the open databases.
C. After scanning for open ports using a port scanning tool like nmap, penetration testers will identify interesting ports and then conduct vulnerability scans to determine what services may be vulnerable. This will perform many of the same activities that connecting via a web server will, and will typically be more useful than trying to manually test for vulnerable accounts via Telnet. sqlmap would typically be used after a vulnerability scanner identifies additional information about services, and the vulnerability scanner will normally provide a wider range of useful information.
86
86. Based on the scan results, what OS was the system that was scanned most likely running?
a. Windows Desktop
b. Linux
c. Network device
d. Windows Server
B. The system is likely a Linux system. The system shows X11, as well as login, shell, and nfs ports, all of which are more commonly found on Linux systems than Windows systems or network devices. This system is also very poorly secured; many of the services running on it should not be exposed in a modern secure network.
87
87. Ben’s manager expresses concern about the coverage of his scan. Why might his manager have this concern?
a. Ben did not test UDP services.
b. Ben did not discover ports outside the “well-known ports.”
c. Ben did not perform OS fingerprinting.
d. Ben tested only a limited number of ports.
D. Nmap only scans 1000 TCP and UDP ports by default, including ports outside of the 0–1024 range of “well-known” ports. By using the defaults for nmap, Ben missed 64,535 ports. OS fingerprinting won’t cover more ports but would have provided a best guess of the OS running on the scanned system.
88
88. What technique relies on reviewing code without running it?
a. Fuzzing
b. Black box analysis
c. Static analysis
d. Gray box analysis
C. Static analysis is the process of reviewing code without running it. It relies on techniques like data flow analysis to review what the code does if it was run with a given set of inputs. Black and gray box analyses are not types of code review, although black box and gray box both describe types of penetration testing. Fuzzing provides unexpected or invalid data inputs to test how software responds.
89
89. Saria needs to write a request for proposal for code review and wants to ensure that the reviewers take the business logic behind her organization’s applications into account. What type of code review should she specify in the RFP?
a. Static
b. Fuzzing
c. Manual
d. Dynamic
C. A manual code review, which is performed by humans who review code line by line, is the best option when it is important to understand the context and business logic in the code. Fuzzing, dynamic, and static code review can all find bugs that manual code review might not, but won’t take the intent of the programmers into account.
90
90. What type of diagram used in application threat modeling includes malicious users as well as descriptions like mitigates and threatens?
a. Threat trees
b. STRIDE charts
c. Misuse case diagrams
d. DREAD diagrams
C. Misuse case diagrams use language beyond typical use case diagrams, including threatens and mitigates. Threat trees are used to map threats but don’t use specialized languages like threatens and mitigates. STRIDE is a mnemonic and model used in threat modeling, and DREAD is a risk assessment model.
91
91. What is the first step that should occur before a penetration test is performed?
a. Data gathering
b. Port scanning
c. Getting permission
d. Planning
C. The most important first step for a penetration test is getting permission. Once permission has been received, planning, data gathering, and then elements of the actual test like port scanning can commence.
92
92. What international framework was SSAE-16 based on?
a. ISO27001
b. SAS70
c. SOX
d. ISAE 3402
D. SSAE-16 is based on ISAE 3402, the International Standard on Assurance Engagements. It differs in a number of ways, including how it handles purposeful acts by service organizational personnel as well as anomalies, but the two share many elements. SAS-70 has been replaced by SSAE-16, whereas ISO27001 is a formal specification for an information security management system (ISMS). SOX is the Sarbanes–Oxley Act, a U.S. law that impacts accounting and investor protection.
93
93. During a penetration test of her organization, Kathleen’s IPS detects a port scan that has the URG, FIN, and PSH flags set and produces an alarm. What type of scan is the penetration tester attempting?
a. A SYN scan
b. A TCP flag scan
c. An Xmas scan
d. An ACK scan
C. A TCP scan that sets all or most of the possible TCP flags is called a Christmas tree, or Xmas, scan since it is said to “light up like a Christmas tree” with the flags. A SYN scan would attempt to open TCP connections, whereas an ACK scan sends packets with the ACK flag set. There is no such type of scan known as a TCP flag scan.
94
94. Nmap is an example of what type of tool?
a. Vulnerability scanner
b. Web application buzzer
c. Network design and layout
d. Port scanner
D. Nmap is a very popular open source port scanner. Nmap is not a vulnerability scanner, nor is it a web application fuzzer. While port scanners can be used to partially map a network, and its name stands for Network Mapper, it is not a network design tool.
95
95. What type of vulnerabilities will not be found by a vulnerability scanner?
a. Local vulnerabilities
b. Service vulnerabilities
c. Zero-day vulnerabilities
d. Vulnerabilities that require authentication
C. Vulnerability scanners cannot detect vulnerabilities for which they do not have a test, plug-in, or signature. Signatures often include version numbers, service fingerprints, or configuration data. They can detect local vulnerabilities as well as those that require authentication if they are provided with credentials, and of course, they can detect service vulnerabilities.
96
96. MITRE’s CVE database provides what type of information?
a. Current versions of software
b. Patching information for applications
c. Vulnerability information
d. A list of costs versus effort required for common processes
C. The Common Vulnerabilities and Exposures (CVE) dictionary provides a central repository of security vulnerabilities and issues. Patching information for applications and software versions are sometimes managed using central patch management tools, but a single central database is not available for free or public use. Costs versus effort is also not what CVE stands for.
97
97. A zero-day vulnerability is announced for the popular Apache web server in the middle of a workday. In Jacob’s role as an information security analyst, he needs to quickly scan his network to determine what servers are vulnerable to the issue. What is Jacob’s best route to quickly identify vulnerable systems?
Image
a. Immediately run Nessus against all of the servers to identify which systems are vulnerable.
b. Review the CVE database to find the vulnerability information and patch information.
c. Create a custom IDS or IPS signature.
d. Identify affected versions and check systems for that version number using an automated scanner.
NIST Special Publication 800-115, the Technical Guide to Information Security Testing and Assessment, provides NIST’s process for penetration testing. Using this image as well as your knowledge of penetration testing, answer the following questions.
Cycle shows activities such as planning, information gathering and discovery, vulnerability scanning, exploitation and reporting.
D. In many cases when an exploit is initially reported, there are no prebuilt signatures or detections for vulnerability scanners, and the CVE database may not have information about the attack immediately. Jacob’s best option is to quickly gather information and review potentially vulnerable servers based on their current configuration. As more information becomes available, signatures and CVE information are likely to be published. Unfortunately for Jacob, IDS and IPS signatures will only detect attacks, and won’t detect whether systems are vulnerable unless he sees the systems being exploited.
98
98. Which of the following is not a part of the discovery phase?
a. Hostname and IP address information gathering
b. Service information capture
c. Dumpster diving
d. Privilege escalation
D. Privilege escalation occurs during the attack phase of a penetration test. Host and service information gathering, as well as activities like dumpster diving that can provide information about the organization, its systems, and security, are all part of the discovery phase.
99
99. NIST specifies four attack phase steps: gaining access, escalating privileges, system browsing, and installing additional tools. Once attackers install additional tools, what phase will a penetration tester typically return to?
a. Discovery
b. Gaining access
c. Escalating privileges
d. System browsing
B. Once additional tools have been installed, penetration testers will typically use them to gain additional access. From there they can further escalate privileges, search for new targets or data, and once again, install more tools to allow them to pivot further into infrastructure or systems.
100
100. Which of the following is not a typical part of a penetration test report?
a. A list of identified vulnerabilities
b. All sensitive data that was gathered during the test
c. Risk ratings for each issue discovered
d. Mitigation guidance for issues identified
B. Penetration testing reports often do not include the specific data captured during the assessment, as the readers of the report may not be authorized to access all of the data, and exposure of the report could result in additional problems for the organization. A listing of the issues discovered, risk ratings, and remediation guidance are all common parts of a penetration test report.
