fc_three Flashcards
Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is
the best protection that will work for her?
A. Password protected files
B. Hidden folders
C. BIOS password
D. Full disk encryption.
Answer: D
A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should
he do?
A. Ignore it.
B. Try to sell the information to a well-paying party on the dark web.
C. Notify the web site owner so that corrective action be taken as soon as possible to patch the
vulnerability.
D. Exploit the vulnerability without harming the web site owner so that attention be drawn to the problem.
Answer: C
What two conditions must a digital signature meet?
A. Has to be unforgeable, and has to be authentic.
B. Has to be legible and neat.
C. Must be unique and have special characters.
D. Has to be the same number of characters as a physical signature and must be unique.
Answer: A
A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd. How
can he use it?
A. The password file does not contain the passwords themselves.
B. He can open it and read the user ids and corresponding passwords.
C. The file reveals the passwords to the root user only.
D. He cannot read it because it is encrypted.
Answer: A
Which Intrusion Detection System is best applicable for large environments where critical assets on the
network need extra security and is ideal for observing sensitive network segments?
A. Network-based intrusion detection system (NIDS)
B. Host-based intrusion detection system (HIDS)
C. Firewalls
D. Honeypots
Answer: A
A company’s Web development team has become aware of a certain type of security vulnerability in their
Web software. To mitigate the possibility of this vulnerability being exploited, the team wants to modify the
software requirements to disallow users from entering HTML as input into their Web application.
What kind of Web application vulnerability likely exists in their software?
A. Cross-site scripting vulnerability
B. Cross-site Request Forgery vulnerability
C. SQL injection vulnerability
D. Web site defacement vulnerability
Answer: A
Bob learned that his username and password for a popular game has been compromised. He contacts the
company and resets all the information. The company suggests he use two-factor authentication, which
option below offers that?
A. A new username and password
B. A fingerprint scanner and his username and password.
C. Disable his username and use just a fingerprint scanner.
D. His username and a stronger password.
Answer: B
A network administrator discovers several unknown files in the root directory of his Linux FTP server. One
of the files is a tarball, two are shell script files, and the third is a binary file is named “nc.” The FTP server’s
access logs show that the anonymous user account logged in to the server, uploaded the files, and
extracted the contents of the tarball and ran the script using a function provided by the FTP server’s
software. The ps command shows that the nc file is running as process, and the netstat command shows
the nc process is listening on a network port.
What kind of vulnerability must be present to make this remote attack possible?
A. File system permissions
B. Privilege escalation
C. Directory traversal
D. Brute force login
Answer: A
Which of the following incident handling process phases is responsible for defining rules, collaborating
human workforce, creating a back-up plan, and testing the plans for an organization?
A. Preparation phase
B. Containment phase
C. Identification phase
D. Recovery phase
Answer: A
An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and
Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible
breach of security. When the investigator attempts to correlate the information in all of the logs, the
sequence of many of the logged events do not match up.
What is the most likely cause?
A. The network devices are not all synchronized.
B. Proper chain of custody was not observed while collecting the logs.
C. The attacker altered or erased events from the logs.
D. The security breach was a false positive.
Answer: A
What is correct about digital signatures?
A. A digital signature cannot be moved from one signed document to another because it is the hash of the
original document encrypted with the private key of the signing party.
B. Digital signatures may be used in different documents of the same type.
C. A digital signature cannot be moved from one signed document to another because it is a plain hash of
the document content.
D. Digital signatures are issued once for each user and can be used everywhere until they expire.
Answer: A
Look at the following output. What did the hacker accomplish?
A. The hacker used whois to gather publicly available records for the domain.
B. The hacker used the “fierce” tool to brute force the list of available domains.
C. The hacker listed DNS records on his own domain.
D. The hacker successfully transferred the zone and enumerated the hosts.
Answer: D
If executives are found liable for not properly protecting their company’s assets and information systems,
what type of law would apply in this situation?
A. Civil
B. International
C. Criminal
D. Common
Answer: A
Which of the following is considered an exploit framework and has the ability to perform automated attacks
on services, ports, applications and unpatched security flaws in a computer system?
A. Wireshark
B. Maltego
C. Metasploit
D. Nessus
Answer: C
What network security concept requires multiple layers of security controls to be placed throughout an IT
infrastructure, which improves the security posture of an organization to defend against malicious attacks or
potential vulnerabilities?
A. Security through obscurity
B. Host-Based Intrusion Detection System
C. Defense in depth
D. Network-Based Intrusion Detection System
Answer: C
Which of the following tools can be used for passive OS fingerprinting? A. tcpdump B. nmap C. ping D. tracert
Answer: A
Jimmy is standing outside a secure entrance to a facility. He is pretending to have a tense conversation on his cell phone as an authorized employee badges in. Jimmy, while still on the phone, grabs the door as it begins to close. What just happened? A. Phishing B. Whaling C. Tailgating D. Masquerading
Answer: C
What is the correct process for the TCP three-way handshake connection establishment and connection
termination?
A. Connection Establishment: FIN, ACK-FIN, ACKConnection Termination: SYN, SYN-ACK, ACK
B. Connection Establishment: SYN, SYN-ACK, ACKConnection Termination: ACK, ACK-SYN, SYN
C. Connection Establishment: ACK, ACK-SYN, SYNConnection Termination: FIN, ACK-FIN, ACK
D. Connection Establishment: SYN, SYN-ACK, ACKConnection Termination: FIN, ACK-FIN, ACK
Answer: D
What is not a PCI compliance recommendation?
A. Limit access to card holder data to as few individuals as possible.
B. Use encryption to protect all transmission of card holder data over any public network.
C. Rotate employees handling credit card transactions on a yearly basis to different departments.
D. Use a firewall between the public network and the payment card data.
Answer: C
Websites and web portals that provide web services commonly use the Simple Object Access Protocol
SOAP. Which of the following is an incorrect definition or characteristics in the protocol?
A. Based on XML
B. Provides a structured model for messaging
C. Exchanges data between web services
D. Only compatible with the application protocol HTTP
Answer: D
Which of the following statements regarding ethical hacking is incorrect?
A. Ethical hackers should never use tools or methods that have the potential of exploiting vulnerabilities in
an organization’s systems.
B. Testing should be remotely performed offsite.
C. An organization should use ethical hackers who do not sell vendor hardware/software or other consulting
services.
D. Ethical hacking should not involve writing to or modifying the target systems.
Answer: A
An IT employee got a call from one of our best customers. The caller wanted to know about the company’s
network infrastructure, systems, and team. New opportunities of integration are in sight for both company
and customer. What should this employee do?
A. Since the company’s policy is all about Customer Service, he/she will provide information.
B. Disregarding the call, the employee should hang up.
C. The employee should not provide any information without previous management authorization.
D. The employees can not provide any information; but, anyway, he/she will provide the name of the person
in charge.
Answer: C
When purchasing a biometric system, one of the considerations that should be reviewed is the processing
speed. Which of the following best describes what it is meant by processing?
A. The amount of time it takes to convert biometric data into a template on a smart card.
B. The amount of time and resources that are necessary to maintain a biometric system.
C. The amount of time it takes to be either accepted or rejected form when an individual provides
Identification and authentication information.
D. How long it takes to setup individual user accounts.
Answer: C
What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed? A. Residual risk B. Inherent risk C. Deferred risk D. Impact risk
Answer: A
Cryptography is the practice and study of techniques for secure communication in the presence of third
parties (called adversaries.) More generally, it is about constructing and analyzing protocols that overcome
the influence of adversaries and that are related to various aspects in information security such as data
confidentiality, data integrity, authentication, and non-repudiation. Modern cryptography intersects the
disciplines of mathematics, computer science, and electrical engineering. Applications of cryptography
include ATM cards, computer passwords, and electronic commerce.
Basic example to understand how cryptography works is given below:
Which of the following choices is true about cryptography?
A. Algorithm is not the secret, key is the secret.
B. Symmetric-key algorithms are a class of algorithms for cryptography that use the different cryptographic
keys for both encryption of plaintext and decryption of ciphertext.
C. Secure Sockets Layer (SSL) use the asymmetric encryption both (public/private key pair) to deliver the
shared session key and to achieve a communication way.
D. Public-key cryptography, also known as asymmetric cryptography, public key is for decrypt, private key is for encrypt.
Answer: C
You're doing an internal security audit and you want to find out what ports are open on all the servers. What is the best way to find out? A. Scan servers with Nmap B. Physically go to each server C. Scan servers with MBSA D. Telent to every port on each server
Answer: A
You want to do an ICMP scan on a remote computer using hping2. What is the proper syntax? A. hping2 host.domain.com B. hping2 --set-ICMP host.domain.com C. hping2 -i host.domain.com D. hping2 -1 host.domain.com
Answer: D
Rebecca commonly sees an error on her Windows system that states that a Data Execution Prevention
(DEP) error has taken place. Which of the following is most likely taking place?
A. A race condition is being exploited, and the operating system is containing the malicious process.
B. A page fault is occurring, which forces the operating system to write data from the hard drive.
C. Malware is executing in either ROM or a cache memory area.
D. Malicious code is attempting to execute instruction in a non-executable memory region.
Answer: D
What is the difference between the AES and RSA algorithms?
A. Both are asymmetric algorithms, but RSA uses 1024-bit keys.
B. RSA is asymmetric, which is used to create a public/private key pair; AES is symmetric, which is used to
encrypt data.
C. Both are symmetric algorithms, but AES uses 256-bit keys.
D. AES is asymmetric, which is used to create a public/private key pair; RSA is symmetric, which is used to
encrypt data.
Answer: B
Seth is starting a penetration test from inside the network. He hasn’t been given any information about the
network. What type of test is he conducting?
A. Internal Whitebox
B. External, Whitebox
C. Internal, Blackbox
D. External, Blackbox
Answer: C
Which of the following is a protocol specifically designed for transporting event messages? A. SYSLOG B. SMS C. SNMP D. ICMP
Answer: A
Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack
of a built-in-bounds checking mechanism?
Output: Segmentation fault A. C# B. Python C. Java D. C++
Answer: D
You are the Systems Administrator for a large corporate organization. You need to monitor all network
traffic on your local network for suspicious activities and receive notifications when an attack is occurring.
Which tool would allow you to accomplish this goal?
A. Network-based IDS
B. Firewall
C. Proxy
D. Host-based IDS
Answer: A
In order to have an anonymous Internet surf, which of the following is best choice?
A. Use SSL sites when entering personal information
B. Use Tor network with multi-node
C. Use shared WiFi
D. Use public VPN
Answer: B
Emil uses nmap to scan two hosts using this command. nmap -sS -T4 -O 192.168.99.1 192.168.99.7
He receives this output:
What is his conclusion?
A. Host 192.168.99.7 is an iPad.
B. He performed a SYN scan and OS scan on hosts 192.168.99.1 and 192.168.99.7.
C. Host 192.168.99.1 is the host that he launched the scan from.
D. Host 192.168.99.7 is down.
Answer: B
An attacker gains access to a Web server’s database and displays the contents of the table that holds all of
the names, passwords, and other user information. The attacker did this by entering information into the
Web site’s user login page that the software’s designers did not expect to be entered. This is an example of
what kind of software design problem?
A. Insufficient input validation
B. Insufficient exception handling
C. Insufficient database hardening
D. Insufficient security management
Answer: A
Internet Protocol Security IPSec is actually a suite of protocols. Each protocol within the suite provides
different functionality. Collective IPSec does everything except.
A. Protect the payload and the headers
B. Authenticate
C. Encrypt
D. Work at the Data Link Layer
Answer: D
Which of the following is a passive wireless packet analyzer that works on Linux-based systems? A. Burp Suite B. OpenVAS C. tshark D. Kismet
Answer: D
While performing online banking using a Web browser, Kyle receives an email that contains an image of a
well-crafted art. Upon clicking the image, a new tab on the web browser opens and shows an animated GIF
of bills and coins being swallowed by a crocodile. After several days, Kyle noticed that all his funds on the
bank was gone. What Web browser-based security vulnerability got exploited by the hacker?
A. Clickjacking
B. Web Form Input Validation
C. Cross-Site Request Forgery
D. Cross-Site Scripting
Answer: C
A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites.
77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets
had an ICMP ID:0 and Seq:0. What can you infer from this information?
A. The packets were sent by a worm spoofing the IP addresses of 47 infected sites
B. ICMP ID and Seq numbers were most likely set by a tool and not by the operating system
C. All 77 packets came from the same LAN segment and hence had the same ICMP ID and Seq number
D. 13 packets were from an external network and probably behind a NAT, as they had an ICMP ID 0 and
Seq 0
Answer: B
One of the Forbes 500 companies has been subjected to a large scale attack. You are one of the shortlisted
pen testers that they may hire. During the interview with the CIO, he emphasized that he wants to totally
eliminate all risks. What is one of the first things you should do when hired?
A. Interview all employees in the company to rule out possible insider threats.
B. Establish attribution to suspected attackers.
C. Explain to the CIO that you cannot eliminate all risk, but you will be able to reduce risk to acceptable
levels.
D. Start the Wireshark application to start sniffing network traffic.
Answer: C
You’ve just discovered a server that is currently active within the same network with the machine you
recently compromised. You ping it but it did not respond. What could be the case?
A. TCP/IP doesn’t support ICMP
B. ARP is disabled on the target server
C. ICMP could be disabled on the target server
D. You need to run the ping command with root privileges
Answer: C
In an internal security audit, the white hat hacker gains control over a user account and attempts to acquire
access to another account’s confidential files and information. How can he achieve this?
A. Port Scanning
B. Hacking Active Directory
C. Privilege Escalation
D. Shoulder-Surfing
Answer: C
You have initiated an active operating system fingerprinting attempt with nmap against a target system:
What operating system is the target host running based on the open ports shown above?
A. Windows XP
B. Windows 98 SE
C. Windows NT4 Server
D. Windows 2000 Server
Answer: D
If you are to determine the attack surface of an organization, which of the following is the BEST thing to do?
A. Running a network scan to detect network services in the corporate DMZ
B. Reviewing the need for a security clearance for each employee
C. Using configuration management to determine when and where to apply security patches
D. Training employees on the security policy regarding social engineering
Answer: A
A software tester is randomly generating invalid inputs in an attempt to crash the program. Which of the
following is a software testing technique used to determine if a software program properly handles a wide range of invalid input?
A. Mutating
B. Randomizing
C. Fuzzing
D. Bounding
Answer: C
The practical realities facing organizations today make risk response strategies essential. Which of the
following is NOT one of the five basic responses to risk?
A. Accept
B. Mitigate
C. Delegate
D. Avoid
Answer: C
Which among the following is a Windows command that a hacker can use to list all the shares to which the current user context has access? A. NET FILE B. NET USE C. NET CONFIG D. NET VIEW
Answer: B
As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to
find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?
A. request smtp 25
B. tcp.port eq 25
C. smtp port
D. tcp.contains port 25
Answer: B
What tool and process are you going to use in order to remain undetected by an IDS while pivoting and
passing traffic over a server you’ve compromised and gained root access to?
A. Install Cryptcat and encrypt outgoing packets from this server.
B. Use HTTP so that all traffic can be routed via a browser, thus evading the internal Intrusion Detection
Systems.
C. Use Alternate Data Streams to hide the outgoing packets from this server.
Answer: B
There are several ways to gain insight on how a cryptosystem works with the goal of reverse engineering
the process. A term describes when two pieces of data result in the same value is?
A. Collision
B. Collusion
C. Polymorphism
D. Escrow
Answer: A
A server has been infected by a certain type of Trojan. The hacker intended to utilize it to send and host
junk mails. What type of Trojan did the hacker use?
A. Turtle Trojans
B. Ransomware Trojans
C. Botnet Trojan
D. Banking Trojans
Answer: C
The security administrator of ABC needs to permit Internet traffic in the host 10.0.0.2 and UDP traffic in the
host 10.0.0.3. Also he needs to permit all FTP traffic to the rest of the network and deny all other traffic.
After he applied his ACL configuration in the router nobody can access to the ftp and the permitted hosts
cannot access to the Internet. According to the next configuration what is happening in the network?
A. The ACL 110 needs to be changed to port 80
B. The ACL for FTP must be before the ACL 110
C. The first ACL is denying all TCP traffic and the other ACLs are being ignored by the router
D. The ACL 104 needs to be first because is UDP
Answer: C
Security and privacy of/on information systems are two entities that requires lawful regulations. Which of
the following regulations defines security and privacy controls for Federal information systems and
organizations?
A. NIST SP 800-53
B. PCI-DSS
C. EU Safe Harbor
D. HIPAA
Answer: A
First thing you do every office day is to check your email inbox. One morning, you received an email from
your best friend and the subject line is quite strange. What should you do?
A. Delete the email and pretend nothing happened.
B. Forward the message to your supervisor and ask for her opinion on how to handle the situation.
C. Forward the message to your company’s security response team and permanently delete the messagefrom your computer.
D. Reply to the sender and ask them for more information about the message contents.
Answer: C
……..is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on the
premises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version
of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted
hotspot by posing as a legitimate provider. This type of attack may be used to steal the passwords of
unsuspecting users by either snooping the communication link or by phishing, which involves setting up a
fraudulent web site and luring people there.
Fill in the blank with appropriate choice.
A. Collision Attack
B. Evil Twin Attack
C. Sinkhole Attack
D. Signal Jamming Attack
Answer: B
What is the term coined for logging, recording and resolving events in a company? A. Internal Procedure B. Security Policy C. Incident Management Process D. Metrics
Answer: C
Which of the following is a wireless network detector that is commonly found on Linux? A. Kismet B. Abel C. Netstumbler D. Nessus
Answer: A
You want to analyze packets on your wireless network. Which program would you use? A. Wireshark with Airpcap B. Airsnort with Airpcap C. Wireshark with Winpcap D. Ethereal with Winpcap
Answer: A
Study the log below and identify the scan type.
A. nmap -sR 192.168.1.10
B. nmap -sS 192.168.1.10
C. nmap -sV 192.168.1.10
D. nmap -sO -T 192.168.1.10
Answer: D
In which phase of the ethical hacking process can Google hacking be employed? This is a technique that
involves manipulating a search string with specific operators to search for vulnerabilities.
Example:
allintitle: root passwd A. Maintaining Access B. Gaining Access C. Reconnaissance D. Scanning and Enumeration
Answer: C
Which specific element of security testing is being assured by using hash? A. Authentication B. Integrity C. Confidentiality D. Availability
Answer: B
While performing ping scans into a target network you get a frantic call from the organization’s security
team. They report that they are under a denial of service attack. When you stop your scan, the smurf attack
event stops showing up on the organization’s IDS monitor.
How can you modify your scan to prevent triggering this event in the IDS?
A. Scan more slowly.
B. Do not scan the broadcast IP.
C. Spoof the source IP address.
D. Only scan the Windows systems.
Answer: B
You are manually conducting Idle Scanning using Hping2. During your scanning you notice that almost
every query increments the IPID regardless of the port being queried. One or two of the queries cause the
IPID to increment by more than one value. Why do you think this occurs?
A. The zombie you are using is not truly idle.
B. A stateful inspection firewall is resetting your queries.
C. Hping2 cannot be used for idle scanning.
D. These ports are actually open on the target system.
Answer: A
Which of the following is designed to verify and authenticate individuals taking part in a data exchange within an enterprise? A. SOA B. Single-Sign On C. PKI D. Biometrics
Answer: C
Sandra is the security administrator of XYZ.com. One day she notices that the XYZ.com Oracle database
server has been compromised and customer information along with financial data has been stolen. The
financial loss will be estimated in millions of dollars if the database gets into the hands of competitors.
Sandra wants to report this crime to the law enforcement agencies immediately. Which organization
coordinates computer crime investigations throughout the United States?
A. NDCA
B. NICP
C. CIRP
D. NPC
E. CIA
Answer: D
While doing a technical assessment to determine network vulnerabilities, you used the TCP XMAS scan.
What would be the response of all open ports?
A. The port will send an ACK
B. The port will send a SYN
C. The port will ignore the packets
D. The port will send an RST
Answer: C
A distributed port scan operates by:
A. Blocking access to the scanning clients by the targeted host
B. Using denial-of-service software against a range of TCP ports
C. Blocking access to the targeted host by each of the distributed scanning clients
D. Having multiple computers each scan a small number of ports, then correlating the results
Answer: D
Why would an attacker want to perform a scan on port 137?
A. To discover proxy servers on a network
B. To disrupt the NetBIOS SMB service on the target host
C. To check for file and print sharing on Windows systems
D. To discover information about a target host using NBTSTAT
Answer: D
While doing a Black box pen test via the TCP port (80), you noticed that the traffic gets blocked when you
tried to pass IRC traffic from a web enabled host. However, you also noticed that outbound HTTP traffic is
being allowed. What type of firewall is being utilized for the outbound traffic?
A. Stateful
B. Application
C. Circuit
D. Packet Filtering
Answer: B
Which of the following is NOT an ideal choice for biometric controls? A. Iris patterns B. Fingerprints C. Height and weight D. Voice
Answer: C
Your next door neighbor, that you do not get along with, is having issues with their network, so he yells to
his spouse the network’s SSID and password and you hear them both clearly. What do you do with this
information?
A. Nothing, but suggest to him to change the network’s SSID and password.
B. Sell his SSID and password to friends that come to your house, so it doesn’t slow down your network.
C. Log onto to his network, after all it’s his fault that you can get in.
D. Only use his network when you have large downloads so you don’t tax your own network.
Answer: A
Which of the following BEST describes the mechanism of a Boot Sector Virus?
A. Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR
B. Moves the MBR to another location on the RAM and copies itself to the original location of the MBR
C. Overwrites the original MBR and only executes the new virus code
D. Modifies directory table entries so that directory entries point to the virus code instead of the actual
program
Answer: A
Matthew received an email with an attachment named “YouWon$10Grand.zip.” The zip file contains a file
named “HowToClaimYourPrize.docx.exe.” Out of excitement and curiosity, Matthew opened the said file.
Without his knowledge, the file copies itself to Matthew’s APPDATA\IocaI directory and begins to beacon to
a Command-and-control server to download additional malicious binaries. What type of malware has
Matthew encountered?
A. Key-logger
B. Trojan
C. Worm
D. Macro Virus
Answer: B
LM hash is a compromised password hashing function. Which of the following parameters describe LM
Hash:?
I – The maximum password length is 14 characters.
II – There are no distinctions between uppercase and lowercase.
III – It’s a simple algorithm, so 10,000,000 hashes can be generated per second.
A. I
B. I, II, and III
C. II
D. I and II
Answer: B
What is the approximate cost of replacement and recovery operation per year of a hard drive that has a
value of $300 given that the technician who charges $10/hr would need 10 hours to restore OS and
Software and needs further 4 hours to restore the database from the last backup to the new hard disk?
Calculate the SLE, ARO, and ALE. Assume the EF = 1 (100%).
A. $440
B. $100
C. $1320
D. $146
Answer: D
Backing up data is a security must. However, it also has certain level of risks when mishandled. Which of
the following is the greatest threat posed by backups?
A. A backup is the source of Malware or illicit information
B. A backup is incomplete because no verification was performed
C. A backup is unavailable during disaster recovery
D. An unencrypted backup can be misplaced or stolen
Answer: D
Which of the following is an NMAP script that could help detect HTTP Methods such as GET, POST, HEAD, PUT, DELETE, TRACE? A. http-git B. http-headers C. http enum D. http-methods
Answer: D
A big company, who wanted to test their security infrastructure, wants to hire elite pen testers like you.
During the interview, they asked you to show sample reports from previous penetration tests. What should
you do?
A. Share reports, after NDA is signed
B. Share full reports, not redacted
C. Decline but, provide references
D. Share full reports with redactions
Answer: C
Knowing the nature of backup tapes, which of the following is the MOST RECOMMENDED way of storing
backup tapes?
A. In a cool dry environment
B. Inside the data center for faster retrieval in a fireproof safe
C. In a climate controlled facility offsite
D. On a different floor in the same building
Answer: C
Which of the following is a vulnerability in GNU’s bash shell (discovered in September of 2014) that gives
attackers access to run remote commands on a vulnerable system?
A. Shellshock
B. Rootshell
C. Rootshock
D. Shellbash
Answer: A
Which of the following is the BEST way to protect Personally Identifiable Information (PII) from being
exploited due to vulnerabilities of varying web applications?
A. Use cryptographic storage to store all PII
B. Use full disk encryption on all hard drives to protect PII
C. Use encrypted communications protocols to transmit PII
D. Use a security token to log into all Web applications that use PII
Answer: C
Which of the following is a restriction being enforced in “white box testing?”
A. Only the internal operation of a system is known to the tester
B. The internal operation of a system is completely known to the tester
C. The internal operation of a system is only partly accessible to the tester
D. Only the external operation of a system is accessible to the tester
Answer: B
When security and confidentiality of data within the same LAN is of utmost priority, which IPSec mode should you implement? A. AH Tunnel mode B. AH promiscuous C. ESP transport mode D. ESP confidential
Answer: C
What is the code written for?
A. Buffer Overflow
B. Encryption
C. Bruteforce
D. Denial-of-service (Dos)
Answer: A
What tool should you use when you need to analyze extracted metadata from files you collected when you
were in the initial stage of penetration test (information gathering)?
A. Armitage
B. Dimitry
C. Metagoofil
D. cdpsnarf
Answer: C
Which type of security feature stops vehicles from crashing through the doors of a building? A. Turnstile B. Bollards C. Mantrap D. Receptionist
Answer: B
Name two software tools used for OS guessing? (Choose two.) A. Nmap B. Snadboy C. Queso D. UserInfo E. NetBus
Answer: A C
An nmap command that includes the host specification of 202.176.56-57.* will scan number of hosts. A. 2 B. 256 C. 512 D. Over 10, 000
Answer: C
In IPv6 what is the major difference concerning application layer vulnerabilities compared to IPv4?
A. Implementing IPv4 security in a dual-stack network offers protection from IPv6 attacks too.
B. Vulnerabilities in the application layer are independent of the network layer. Attacks and mitigation
techniques are almost identical.
C. Due to the extensive security measures built in IPv6, application layer vulnerabilities need not be
addresses.
D. Vulnerabilities in the application layer are greatly different from IPv4.
Answer: B
Which of the following is the BEST approach to prevent Cross-site Scripting (XSS) flaws?
A. Use digital certificates to authenticate a server prior to sending data.
B. Verify access right before allowing access to protected information and UI controls.
C. Verify access right before allowing access to protected information and UI controls.
D. Validate and escape all information sent to a server.
Answer: D
TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during
standard layer 4 network communications. Which of the following tools can be used for passive OS fingerprinting?
A. nmap
B. ping
C. tracert
D. tcpdump
Answer: D
A company recently hired your team of Ethical Hackers to test the security of their network systems. The
company wants to have the attack be as realistic as possible. They did not provide any information besides
the name of their company. What phase of security testing would your team jump in right away?
A. Scanning
B. Reconnaissance
C. Escalation
D. Enumeration
Answer: B
It is a widely used standard for message logging. It permits separation of the software that generates
messages, the system that stores them, and the software that reports and analyzes them. This protocol is
specifically designed for transporting event messages. Which of the following is being described?
A. SNMP
B. ICMP
C. SYSLOG
D. SMS
Answer: C
Defining rules, collaborating human workforce, creating a backup plan, and testing the plans are within
what phase of the Incident Handling Process?
A. Preparation phase
B. Containment phase
C. Recovery phase
D. Identification phase
Answer: A
Which service in a PKI will vouch for the identity of an individual or company? A. KDC B. CA C. CR D. CBC
Answer: B
Sandra has been actively scanning the client network on which she is doing a vulnerability assessment test.
While conducting a port scan she notices open ports in the range of 135 to 139.
What protocol is most likely to be listening on those ports?
A. Finger
B. FTP
C. Samba
D. SMB
Answer: D
What attack is used to crack passwords by using a precomputed table of hashed passwords? A. Brute Force Attack B. Hybrid Attack C. Rainbow Table Attack D. Dictionary Attack
Answer: C
Which of the following is a serious vulnerability in the popular OpenSSL cryptographic software library?
This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS
encryption used to secure the Internet.
A. Heartbleed Bug
B. POODLE
C. SSL/TLS Renegotiation Vulnerability
D. Shellshock
Answer: A
Bob received this text message on his mobile phone: ““Hello, this is Scott Smelby from the Yahoo Bank.
Kindly contact me for a vital transaction on: scottsmelby@yahoo.com””. Which statement below is true?
A. This is probably a legitimate message as it comes from a respectable organization.
B. Bob should write to scottsmelby@yahoo.com to verify the identity of Scott.
C. This is a scam as everybody can get a @yahoo address, not the Yahoo customer service employees.
D. This is a scam because Bob does not know Scott.
Answer: C
Which of the following security policies defines the use of VPN for gaining access to an internal corporate network? A. Network security policy B. Remote access policy C. Information protection policy D. Access control policy
Answer: B
In order to prevent particular ports and applications from getting packets into an organization, what does a
firewall check?
A. Network layer headers and the session layer port numbers
B. Presentation layer headers and the session layer port numbers
C. Application layer port numbers and the transport layer headers
D. Transport layer port numbers and application layer headers
Answer: D
Which of the following is a form of penetration testing that relies heavily on human interaction and often
involves tricking people into breaking normal security procedures?
A. Social Engineering
B. Piggybacking
C. Tailgating
D. Eavesdropping
Answer: A
Which of the following Nmap commands would be used to perform a stack fingerprinting? A. Nmap -O -p80 B. Nmap -hU -Q C. Nmap -sT -p D. Nmap -u -o -w2 E. Nmap -sS -0p targe
Answer: B
