Security + Flashcards
While waiting in the lobby of your building for a guest, you notice a man in a red shirt standing close to a locked door with a large box in his hands. He waits for someone else to come along and open the locked door and then proceeds to follow her inside. What type of social engineering attack have you just witnessed?
Impersonation
Phishing
Boxing
Tailgating
Tailgating
A colleague asks you for advice on why he can’t log in to his Gmail account. Looking at his browser, you see he typed www.gmal.com in the address bar. The screen looks very similar to the Gmail login screen. Your colleague has just fallen victim to what type of attack?
A. Jamming
B. Rainbow Table
C. Whale phishing
D. Typosquatting
D. Typosquatting
A user in your organization contacts you to see if there’s any update to the “account compromise” that happened last week. When you ask him to explain what he means. and the user tells you he received a phone call earlier in the week from you department and was asked to verify his user ID and password. The user says he gave the caller his user ID and password. This user has fallen victim to what specific type of attack?
Spear Phishing
Vishing
Phishing
Replication
Vishing
Coming into your office, you overhear a conversation between two security guards. One guard is telling the other she caught several people digging through the trash behind the building early this morning. The security guard says the people claimed to be looking for aluminum cans, but only had a bag of papers no cans. What type of attack has this security guard witnessed?
Spear Phishing
Pharming
Dumpster Diving
Rolling Refuse
Dumpster Diving
Which of the following are specifically used to spread influence, alter perceptions, and sway people toward a position favored by those spreading it?
Identity fraud, invoice scams, credential harvesting
Hoaxes, eliciting information, urgency
influence campaigns, social media, hybrid warfare
authority, intimidation, consensus
Influence campaigns, social media, hybrid warfare
Which of the following is a type of social engineering attack in which an attacker attempts to obtain sensitive information from a user by masquerading as a trusted entity in an e-mail?
Phishing
Pharming
Spam
Vishing
Phishing
Which of the following is/are psychological tools used by social engineers to create false trust with a target?
Impersonation
Urgency or scarcity
Authority
All of the above
all of the above
once an organization’s security policies have been established, what is the single most effective method of countering potential social engineering attacks?
An active security awareness program
A separate physical access control mechanism for each department in the organization
Frequent testing of both the organization’s physical security procedures and employee telephone practices
Implementing access control cards and the wearing of security identification badges
An active security awareness program
You notice a new custodian in the office, working much earlier than normal, emptying trash cans, and moving slowly past people working. You ask him where the normal guy is, and in very broken English he says “Out sick,” indicating a cough. What is happening?
Watering hole attack
Impersonation
Prepending
Identity fraud
Impersonation
You boss thanks you for pictures you sent from the recent company picnic. You ask him what he is talking about, and he says he got an e-mail from you with pictures from the picnic. Knowing you have not sent him that e-mail, what type of attack do you suspect is happening?
Phishing
Spear phishing
Reconnaissance
Impersonation
Spear phishing
A disgruntled administrator is fired for negligence at your organization. Thirty days later, your organization’s internal file server and backup server crash at exactly the same time. Examining the servers, you determine that critical operating system files were deleted from both systems. If the disgruntled administrator was responsible for administering those servers during her employment, this is most likely an example of what kind of malware?
Crypto-malware
Trojan
Worm
Logic bomb
Logic bomb
A colleague has been urging you to download a new animated screensaver he has been using for several weeks. While he is showing you the program, the cursor on his screen moves on its own and a command prompt window opens and quickly closes. You can’t tell what if anything was displayed in that command prompt window. Your colleague says, “it’s been doing that for a while, but it’s no big deal.” Based on what you’ve seen, you suspect the animated screensaver is really what type of malware?
A worm
A trojan
Ransomware
Spyware
A Trojan
Several desktops in your organization are displaying a red screen with the message “Your files have been encrypted. Pay 1 bitcoin to recover them.” These desktops have most likely been affected by what type of malware?
Spyware
Spraying
Ransomware
Crypto-malware
Ransomware
While port scanning your network for unauthorized systems, you notice one of your file servers has TCP port 31337 open. When you connect to the port with netcat, you see a prompt that reads “Enter password for access:”. Your server may be infected with what type of malware?
PUP
Fileless virus
Backdoor
Man in the middle
Backdoor
While port-scanning your network for unauthorized systems, you notice one of your file servers has TCP port 61337 open. When you use Wireshark and examine the packets, you see encrypted traffic, in single packets, going back and forth every five minutes. The external connection is a server outside of your organization. What is this connection?
Command and Control
Backdoor
External backup location
Remote Login
Command and Control
A user in your organization is having issues with her laptop. Every time she opens a web browser, she sees different pop-up ads every few minutes. It doesn’t seem to matter which websites are being visited—the pop-ups still appear. What type of attack does this sound like?
PUP
Ransomware
Worm
Virus
PUP (Potentially unwanted program)
Users at your organization are complaining about slow systems. Examining several of them, you see that CPU utilization is extremely high and a process called “btmine” is running on each of the affected systems. You also notice each of the affected systems is communicating with an IP address outside your country on UDP port 43232. If you disconnect the network connections on the affected systems, the CPU utilization drops significantly. Based on what you’ve observed, you suspect these systems are infected with what type of malware?
Rainbow tables
Crypto-malware
dictionary
hybrid attack
Crypto-malware
A piece of malware is infecting the desktops in your organization. Every hour, more systems are infected. The infections are happening in different departments and in cases where the users don’t share any files, programs, or even e-mails. What type of malware can cause this type of infection?
Virus
Trojan
Rat
Worm
Worm
Which of the following are characteristics of remote access trojans?
They can be deployed through malware such as worms
They allow attacks to connect to the system remotely
They give attackers the ability to modify files and change settings
All of the above
All of the above
“To test your systems against weak passwords, you as an admin (with proper permissions) test all the accounts using the top 100 commonly used passwords. What is this test an example of?”
Dictionary
Password spraying
Rainbow tables
Online
Password spraying
When an attacker captures network traffic and retransmits it at a later time, what type of attack are they attempting?
DoS attack
Replay attack
Bluejacking attack
MITM
Replay attack
What type of attack involves an attacker putting a layer of code between an original device driver and the operating system.
Refactoring
Trojan Horse
Shimming
Pass the hash
Shimming
You’re reviewing a custom web application and accidentally type a number in a text field. The application returns an error message containing variable names, filenames, and the full path of the application. This is an example of which of the following?
Resource exhaustion
Improper error handling
Generic error message
Common misconfiguration
Improper error handling
You’re working with a group testing a new application. You’ve noticed that when three or more of you click Submit on a specific form at the same time, the application crashes every time. This is most likely an example of which of the following?
A race condition
A non-deterministic error
Undocumented feature
DLL injection
A race condition
