Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IST-267 Network Vulnerabilitiy Assess > Fiankl > Flashcards

Fiankl Flashcards

1
Q

What is the CIA triad?

A

Confidentiality (prevent unauthroized access to information or systems)

Integrity (prevent unauthroized modification of information or systems)

Availability (ensure use of information and systems is possible)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the DAD triad?

A

Disclosure (gain unauthorized access)

Alteration (make unauthorized changes)

Denial (prevent legit use of systems and info)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the four stages of the CompTIA Penetration
Test?

A

Planning and
Scoping

Information
Gathering and
Vulnerability
Scanning

Attacking and
Exploiting

Reporting and
Communicating
Results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the steps in The Cyber Kill Chain?

A

Reconnaissance.
(
Weaponization.
(
Delivery.
(
Exploitation.
(
Installation.
(
Command and control.
(
Actions on Objectives.
(

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Reconnaissance in the cyber kill chain?

A

(Attackers gather open source intelligence and conduct initial scans of target environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Weaponization in the cyber kill chain?

A

Attackers develop a specific
attack tool designed to exploit the vulnerabilities identified during reconnaissance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Delivery in the cyber kill chain?

A

Attackers next must deliver that malware to the target. (Network vuln, social enginnering, infected USB, sending as email attachment,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Exploitation in the cyber kill chain?

A

The malware gains access to the targeted system. Victim opens a malicious file or when the attacker exploits a vulnerability over the network or otherwise gains a foothold on the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Installation in the cyber kill chain?

A

The attacker uses the
initial access provided by the malware to establish permanent, or persistent, access to the
target system. (Making a backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Command and Control in the cyber kill chain?

A

After getting permanent access the attacker may use a remote shell or other means to control the system.

They can control it manually or may connect an automated command-and-control (C2C) network that provides it with instructions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Tom is running a penetration test in a web application and discovers a flaw that allows
him to shut down the web server remotely.

What goal of penetration testing has Tom most
directly achieved?
A. Disclosure
B. Integrity
C. Alteration
D. Denial

A

D. Denial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Actions on Objectives in the cyber kill chain?

A

Attacker uses the system to advance the original objectives of their attack. (theft, use of resources, mine crypto, modification or deletion of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Brian ran a penetration test against a school’s grading system and discovered a flaw that
would allow students to alter their grades by exploiting a SQL injection vulnerability.

What
type of control should he recommend to the school’s cybersecurity team to prevent students
from engaging in this type of activity?

A. Confidentiality
B. Integrity
C. Alteration
D. Availability

A

B. Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Assuming no significant changes in an organization’s cardholder data environment, how
often does PCI DSS require that a merchant accepting credit cards conduct penetration testing?
A. Monthly
B. Semiannually
C. Annually
D. Biannually

A

C. Annually
(or after any significant change in the cardholder data environment)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which one of the following is not a benefit of using an internal penetration testing team?
A. Contextual knowledge
B. Cost
C. Subject matter expertise
D. Independence

A

D. Independence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Edward Snowden gathered a massive quantity of sensitive information from the National
Security Agency and released it to the media without permission.

What type of attack
did he wage?
A. Disclosure
B. Denial
C. Alteration
D. Availability

A

A. Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Beth recently conducted a phishing attack against a penetration testing target in an attempt
to gather credentials that she might use in later attacks. What stage of the penetration testing
process is Beth in?

A

Attacking and Exploiting (she is conducting an
active social engineering attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Rich recently got into trouble with a client for using an attack tool during a penetration
test that caused a system outage. During what stage of the penetration testing process
should Rich and his clients have agreed on the tools and techniques that he would use during the test?
A. Planning and Scoping
B. Information Gathering and Vulnerability Scanning
C. Attacking and Exploiting
D. Reporting and Communication Results

A

A. Planning and Scoping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which one of the following steps of the Cyber Kill Chain does not map to the Attacking and
Exploiting stage of the penetration testing process?
A. Weaponization
B. Reconnaissance
C. Installation
D. Actions on Objective

A

B. Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which one of the following security assessment tools is not commonly used during the
Information Gathering and Vulnerability Scanning phase of a penetration test?
A. Nmap
B. Nessus
C. Metasploit
D. Nslookup

A

C. Metasploit
(exploitation framework , suited for Attacking and Exploiting phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which one of the following is not an open source intelligence gathering tool?
A. WHOIS
B. Nslookup
C. Nessus
D. FOCA

A

C. Nessus (commercial vulnerability scanner)

FOCA (harvests information from files)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

During what phase of the Cyber Kill Chain does an attacker steal information, use computing resources, or alter information without permission?

A

C. Actions on Objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does pwd do in Linux?

A

Shows the current directory you are working in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What vulnerability scanner is specifically designed to test the security
of web applications against a wide variety of attacks?

A

Nikto

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Grace is investigating a security incident where the attackers left USB drives containing
infected files in the parking lot of an office building. What stage in the Cyber Kill Chain
describes this action?

A

C. Delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What do these mean and what do they translate to in numbers

  1. Rwx-rw-r 2. Rw–wx-r–
A
  1. Rwx-rw-r

User can read write and execute
Group can read and write
Others can only read
761

  1. Rw–wx-r–

User can read and write
Group can write and execute
USer can only read
634

r = 4
w =2
x =1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which one of the following tools is an exploitation framework commonly used by penetration testers?
A. Metasploit
B. Wireshark
C. Aircrack-ng
D. SET

A

A. Metasploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How would you run a network scan on the 192.168.68.1 IP?

A

nmap 192.168.68.1 Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does ls and ls -l do in Linux?

A

Lists the contents of the folder you are working in. -l shows all files in those directories. and their permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  1. What is the name of the exploitation framework created by H.D. Moore?
A

Metaspolit

18
Q

What is the command used to change the password to the kali account?

A

passwd kali (enter current, enter new)

18
Q

What is the absolute path for the location of the wordlists collection in Kali Linux?

A

/usr/share/wordlists

19
Q
  1. Where is the Windows version of Netcat stored in Kali Linux?
A

/usr/share/windows-binaries

20
Q

What is an Advanced Persistent Threat APT?

A

A threat actor that is sophisticated, well-resourced, and motivated.

21
Q

Which of the phases of the Cyber Kill Chain is the most difficult to detect by defenders

A

Reconaissance is the most difficult phase to detect by defenders, an adversary doing recon is usually not harmful or obvious to a defender. Identifying employees, emails, and internet servers likely won’t ping any safety alarms for a defending company.

22
Q

What is a “zero day” exploit?

A

A zero day exploit is an exploit or flaw in a system that is unknown to the defenders of that system

23
Q

At what percentage rate is the penetration testing industry growing annually?

A

23.7%

24
Q

What type of an attack would an email address and phone number be used for?

A

Phishing attack

25
Q

Who is the creator of Nmap and what is his hacker handle?

A

Gordon Lyon, Fyodor

26
Q

What is the command switch used to run a “ping sweep” in Nmap? What is a ping sweep?

A

-sP
A ping sweep is a network scanning technique to identify active devices on a network by pinging a range of IP addresses.

27
Q

What is the purpose of the -sL command switch in Nmap?

A

Does a DNS lookup for each IP “scanned” without doing any scanning.

28
Q

How many UDP & TCP ports are on a system running TCP/IP?

A

65,535

29
Q
  1. What is one port you would scan a network for if you were trying to find Linux hosts specifically?
A

443

30
Q

Why would a port show as filtered in Nmap?

A

A firewall blocked the connection

31
Q

If a TCP port shows as closed in Nmap, what packet response did Nmap receive from the scanned target?

A

The service is not running

32
Q

What is the command switch you would use to scan for UDP ports in nmap?

A

-sU

33
Q

What would the Nmap command be if you wanted to scan the 10.10.0.0/16 range for the presence of FTP servers and only show open ports?

A

10.10.0.0/16 –open

34
Q

What is the command switch to run a Nmap service scan? What is a service scan?

A

-sV

It conducts more tests against open ports to determine what kind of service is running along with it.

35
Q

What does the RCE acronym stand for? What does it mean?

A

Remote Code Execution, a hacker can execute whatever commands they want on a victim’s machine.

36
Q

Which notorious malware worm added the exploit for MS08-67 to its collection of methods for spreading to different systems? How else did it spread?

A

Conficker

USB drive infections, scanning file shares, and dictionary attacks

37
Q

What exploit code was stolen by Shadow Brokers from the NSA?

A

EternalBlue

38
Q

What is the name of the significant worm that used the NSA exploit stolen by the Shadow Brokers

A

WannaCry

39
Q

What does the curl command do?

A

It forces a browser to display the page and all of its details.

40
Q

What term describes a document created to define project-specific activities, deliverables, and
timelines based on an existing contract?

A

SOW ( Statement of work)

41
Q

What type of legal agreement typically covers sensitive data and information that a penetration tester may encounter while performing an assessment?

A

An NDA

42
Q

Elaine wants to ensure that the limitations of her red-team penetration test are fully
explained. Which of the following are valid disclaimers for her agreement? (Choose two.)
A. Risk tolerance
B. Point-in-time
C. Comprehensiveness
D. Impact tolerance

A

B. Point-in-time
C. Comprehensiveness

43
Q

Jen wants to conduct a penetration test and includes mobile application testing. Which standard or methodology is most likely to be useful for her efforts?

A

B. OWASP (Open Worldwide Application Security Project)

44
Q

What type of assessment most closely simulates an actual attacker’s efforts?

A. A red-team assessment with a zero knowledge strategy
B. A goals-based assessment with a full knowledge strategy
C. A red-team assessment with a full knowledge strategy
D. A compliance-based assessment with a zero knowledge strategy

A

A. A red-team assessment with a zero knowledge strategy

45
Q

What is nmap scan -sT?

A

TCP connect “full connect”
(Used when an underprivileged account is the tester’s only option)

46
Q

What provides information about a domain’s registrar and
physical location?

A

WHOIS

47
Q

Mike recovers a binary executable file that he
wants to quickly analyze for useful information. What will quickly give him
a view of potentially useful information in the binary?

A

strings
(parses a file for strings of text and outputs them)

48
Q

What does a result of * * * mean during a traceroute?

A

There is no response to the query, perhaps a timeout, but traffic is going through.

49
Q

What is nmap scan -sS?

A

TCP SYN scan, fast scan that tends to work through most firewalls

50
Q

What is nmap scan -p

A

Specifies a port range 1-65535

51
Q

What is nmap scan -sA and what does it do?

A

TCP ACK scan

used to identify ports or hosts that may be filtered and resistant to any other form of scanning

52
Q

What is Mimikatz?

A

A program for extracting passwords, hashes, PINs, from Windows memory.

53
Q

Wireshark?

A

Packet sniffer and analysis tool

54
Q

Nessus?

A

Vulnerability scanner

55
Q

Hydra?

A

Login cracker, used for brute-force password attacks

56
Q

Netcat?

A

Used for reading from and writing to network connections using TCP OR UDP

57
Q

Telnet?

A

An application network protocol that enables user communication with a remote computer via a text-based interface

58
Q

John the Ripper

A

Password cracking tool

59
Q

What tool can white-box penetration testers use to help identify the systems present on a network prior to conducting vulnerability scans?

A

Asset inventory

60
Q

Sarah is conducting a penetration test and discovers a critical vulnerability in an application.
What should she do next?

A

Consult the SOW (Statement of Work)

IST-267 Network Vulnerabilitiy Assess (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions