Incident Response And Handling

Front 1

Which of the following are used to help reveal multiple layers of defense, help reveal application layer security protocols, and help validate network layer security settings by ensuring demilitarized and other isolated zones function as expected?

Back 1

Penetration tests

Front 2

Penetration testers can help provide __________ to managers in the organization.

Back 2

security awareness

Front 3

Penetration testers:

Back 3

prioritize any findings and recommended policy and control changes.

Front 4

Penetration tests are also called:

Back 4

vulnerability scans.

Front 5

The -O switch in the Nmap commands you ran in this lab (for example, nmap -O -v 10.20.100.50) instructed Nmap to:

Back 5

detect the operating system of the machine

Front 6

The -v switch in the Nmap commands you ran in this lab (for example, nmap -O -v 10.20.100.50) instructed Nmap to:

Back 6

show a great deal of detail.

Front 7

The following command line syntax (nmap --script=smb-check-vulns -p445 10.20.100.50) was used for:

Back 7

running an SMB vulnerability scan against 10.20.100.50.

Front 8

The first full vulnerability scan you conducted (on the 10.20.100.50 machine) indicated that the server was:

Back 8

vulnerable to the MS08_067 exploit since it either doesn't have a service pack installed or is SP2 with no additional hotfixes applied to it.

Front 9

The following command line syntax (nmap --script=smb-check-vulns -p445 192.168.3.25) was used to:

Back 9

run a vulnerability check on port 445.

Front 10

The full vulnerability scan you conducted on the 192.168.3.25 machine indicated that the server is a high-risk system because it is vulnerable to SMBv2 DoS attack which will:

Back 10

allow a denial of service attack with the BSOD (Blue Screen of Death).

Front 11

Vulnerability checks can be run:

Back 11

against specific ports to find additional vulnerabilities that might need to be addressed.

Front 12

The __________ vulnerability scan allows an attacker to grab three encrypted footprint keys without generating a log entry on the Unix system and allows for future exploitation.

Back 12

ssh-hostkey.nse

Front 13

Which of the following is an encrypted footprint key that is faster at validation (but slower at signature generation) and is used for encrypting and signatures?

Back 13

RSA—Rivest, Shamir and Adelman

Front 14

Which of the following is a standalone antivirus scanner for Windows systems?

Back 14

ClamWin

Front 15

In the lab, you performed a virus scan on just the infected folders, but in a real-world situation, you would scan:

Back 15

the entire C drive.

Front 16

There is little point in hardening a system if it is already compromised. Therefore, a __________ is an important first step in locking down any system.

Back 16

virus scan

Front 17

In the lab, one of the scan results determined that the TargetWindows01 server was infected with a live virus (Trojan.Bo) that:

Back 17

allows the BOclient to control the remote system as if logged on locally.

Front 18

In the lab, the Shutdown Event alert indicated that the shutdown was related to:

Back 18

BlueScreen.

Front 19

In the lab, you configured the Windows host-based firewall to:

Back 19

reduce the attack surface on the system.

Front 20

In the lab, you enabled the Windows host-based firewall and then re-ran a previous scan in order to:

Back 20

verify that the vulnerable open ports have been eliminated.

Front 21

A message digest, or hash, algorithm takes a string of text (the contents of your file or message) and:

Back 21

produces a fixed-length set of hexadecimal characters.

Front 22

Hashes are used for ensuring the __________ of the message.

Back 22

integrity

Front 23

As long as the content within a file does not change, the hash value (or checksum) will:

Back 23

calculate the same value every time.

Front 24

Encryption is used for ensuring the __________ of the message.

Back 24

confidentiality

Front 25

Which of the following refers to the free encryption software, based on the OpenPGP standard (RFC4880), that uses both symmetric and asymmetric encryption?

Back 25

Gnu Privacy Guard (GnuPG)

Front 26

DSA (Digital Signature Algorithm) and RSA (Rivest-Shamir-Adleman) are common __________ algorithms that can be used to successfully encrypt data and decrypt data.

Back 26

asymmetric encryption

Front 27

In __________, a key pair is generated, one key is kept private and the other is shared.

Back 27

asymmetric encryption

Front 28

MD5 (Message-Digest algorithm 5) uses a __________ hash sum.

Back 28

128-bit

Front 29

SHA1 (Secure Hash Algorithm 1) uses a __________ hash sum.

Back 29

160-bit

Front 30

The more bits in the hash sum, the:

Back 30

greater the integrity checking of each bit that is transmitted from the source to its destination.

Front 31

In the lab, the system displayed the words __________ to indicate that both the MD5sum and the SHA1sum hash had worked correctly and that the Example.txt file had not been modified.

Back 31

Example.txt: OK

Front 32

In the lab, you used __________ to encrypt messages that you then sent between two fictitious users (Instructor and Student).

Back 32

Gnu Privacy Guard (GnuPG)

Front 33

Which of the following is required before GnuPG can create an encryption key pair?

Back 33

Collecting entropy

Front 34

When creating a GnuPG key, typing on the keyboard, moving the mouse, using disk space, and playing games are all actions that:

Back 34

generate more entropy (random bytes).

Front 35

The number of bytes sufficient to generate a GnuPG key pair is:

Back 35

different each time the key is generated.

Front 36

Which of the following do you need to decrypt encrypted messages and files from a trusted sender?

Back 36

The sender's public key

Front 37

The GnuPG -e switch is used to:

Back 37

encrypt data.

Front 38

GnuPG -d is used to:

Back 38

decrypt data.

Front 39

The first phase of hacking is __________ phase, which is designed to gain as much information about a target organization and its systems as possible?

Back 39

reconnaissance

Front 40

The Internet has always provided the would-be attacker potential access; now it also provides much-welcomed:

Back 40

intelligence.

Front 41

Which of the following can a hacker derive from the IP address of a target server?

Back 41

The physical location of the server's data center

Front 42

Which of the following is a tool that combines many common network information functions into a convenient single interface?

Back 42

Sam Spade

Front 43

Sam Spade is considered a(n):

Back 43

non-intrusive tool.

Front 44

While Sam Spade provides quite a bit of information about a domain, it is merely combining __________ information from a variety of sources.

Back 44

publicly available

Front 45

Which of the following will return information about the domain owner, including contact names, numbers, addresses, and the names of associated servers?

Back 45

WHOIS

Front 46

Which of the following is primarily used to verify whether the domain name is available or whether it has been registered?

Back 46

WHOIS

Front 47

By its nature, WHOIS information must be:

Back 47

publicly available.

Front 48

Companies wishing to disguise their ownership of a domain may choose to register domains:

Back 48

through an agent.

Front 49

Which of the following is designed to perform DNS queries, allowing you to look up the IP addresses associated with particular domain names?

Back 49

nslookup

Front 50

Which of the following is used to identify the network path that must be followed to reach one system from another?

Back 50

traceroute

Front 51

Which of the following provides the names and IP addresses of all intermediate systems and can be used to identify potential intermediate attack points?

Back 51

traceroute

Front 52

Which of the following may be used to estimate the geographic location of a server?

Back 52

traceroute

Front 53

Which of the following are used by data gatherers to find a large amount of information about a company, using not only the officially released information, but also information in publications and other Web sites?

Back 53

Search engines

Front 54

In the lab, you created a report of your research findings as if you were a(n):

Back 54

ethical hacker gathering information for a client.

Front 55

When you were conducting your public domain research in the lab, you selected a target organization with a(n):

Back 55

e-commerce Web site.

Front 56

Which section of your Hacking Research Report described the tools and techniques that you used to conduct both the technical research and public domain research?

Back 56

Methodology

Front 57

Which section of your Hacking Research Report included 2 to 3 paragraphs describing the information you uncovered in the lab and how an attacker might be able to exploit this information?

Back 57

Executive Summary

Front 58

The purpose of __________ within an organization is to proactively locate vulnerabilities in an organization's defenses, and correct them to strengthen overall security.

Back 58

ethical hacking

Front 59

It is the responsibility of the organization's __________ to know their networks and remove any possible point of entry before that happens.

Back 59

security and administration team

Front 60

Which of the following statements is true regarding ethical hacking?

Back 60

Ethical hackers follow the same approach that hackers use to compromise remote systems and networks.

Front 61

What distinguishes ethical hackers from other intruders?

Back 61

Ethical hackers obtain written permission to run security tools within the organization's network.

Front 62

Zenmap is a graphical interface for __________, a port scanning tool that can quickly identify hosts and detect what operating system and services are running on them, and all without privileged access.

Back 62

Nmap

Front 63

Zenmap and similar tools are typically used during which phases of the ethical hacking process?

Back 63

The reconnaissance and scanning phases

Front 64

In the lab, the __________ indicated the number of open ports discovered by Zenmap.

Back 64

Intense Scan report

Front 65

What step in the hacking attack process identifies known vulnerabilities?

Back 65

The enumeration phase

Front 66

Which of the following tools identifies known vulnerabilities of devices, operating systems, applications, databases, and services running on those devices?

Back 66

OpenVAS

Front 67

OpenVAS is a scanning engine that runs:

Back 67

remotely on a server.

Front 68

The first page of the Full OpenVAS Report you downloaded as part of the vulnerability scan was a:

Back 68

summary showing the number of high, medium, and low severity vulnerabilities that were identified.

Front 69

Metasploit is part of the __________ security distribution for Linux.

Back 69

Kali

Front 70

A Linux __________ is a bootable virtual machine (or CD or USB stick) that comes preloaded with popular open source security software packages.

Back 70

security distribution

Front 71

In the lab, which of the following tools did you use to exploit the victim system?

Back 71

Metasploit

Front 72

The Metasploit startup splash screen:

Back 72

will be different each you start Metasploit.

Front 73

In the Intense scan report, what was the name of the vulnerable service you identified on port 21?

Back 73

vsftpd

Front 74

According to the description in the OpenVAS vulnerability report, the type of vulnerability found on port 21 could enable a hacker to:

Back 74

compromise the system through a backdoor.

Front 75

Metasploit ranked the vulnerability found in the lab as __________, indicating that the exploit is almost certain to work.

Back 75

excellent

Front 76

In the lab, Metasploit was able to connect to the victim system with __________ access, and without requiring a password.

Back 76

root-level

Front 77

The OpenVAS vulnerability report included a __________ for the vulnerability that was found in the lab.

Back 77

recommended solution

Front 78

Network and system engineers and information systems security professionals can help ensure Web application security through regular:

Back 78

penetration testing.

Front 79

If e-commerce or privacy data is entered into a Web application, the company is bound by __________ to ensure the confidentiality of customer data.

Back 79

compliance laws and standards

Front 80

The __________ contains abundant information about common software vulnerabilities and exploits.

Back 80

CVE listing database

Front 81

Penetration testing should be performed whenever the Web application or service is:

Back 81

updated or modified.

Front 82

An ethical hacker:

Back 82

recommends specific countermeasures for remediating the vulnerabilities and eliminating the exploits.

Front 83

Which of the following is a tool specifically designed with common vulnerabilities to help Web developers test their own applications prior to release?

Back 83

Damn Vulnerable Web Application (DVWA)

Front 84

Which of the following is a Damn Vulnerable Web Application (DVWA) security level that mimics a vulnerable Web application?

Back 84

Low

Front 85

A reflective cross-site scripting attack (like the one in this lab) is a __________ attack in which all input shows output on the user's/attacker's screen and does not modify data stored on the server.

Back 85

non-persistent

Front 86

The goal of a cross-site scripting (XSS) attack is usually to:

Back 86

gain administrator or some other elevated level of user privileges

Front 87

Which of the following refers to the malicious insertion of scripting code to extract data or modify a Web site's code, application, or content?

Back 87

Cross-site scripting (XSS)

Front 88

What was the expected outcome when you entered a name in the "What's your name?" box on the XSS Web form?

Back 88

Repeated it back to you in a friendly welcome

Front 89

Cross-site scripting (XSS) vulnerabilities are generally found in Web forms that:

Back 89

send and retrieve data to databases via HTML.

Front 90

The most basic method of not allowing any scripts to be run on a Web page is to:

Back 90

prohibit greater-than and less-than arrows from being submitted.

Front 91

Which of the following commands is a scripting function used to generate a pop-up window with the message "Here is proof of a vulnerability"?

Back 91

alert

Front 92

In general, which of the following is accomplished by appending a valid SQL command to the input that is being passed through a Web form into the database behind it?

Back 92

SQL injection

Front 93

Often, programmers forget to __________, which then makes an application vulnerable to SQL injection.

Back 93

include script handling for special characters like apostrophes in their data input forms

Front 94

Which of the following is a default schemata in the MySQL database software that is an easy place for SQL injection hackers to start and can return much information about the structure and content of the tables in the Web site's database?

Back 94

information_schema

Front 95

Hackers often use __________ instead of cleartext to make the scripts harder to detect.

Back 95

hexadecimal character strings

Front 96

Database administrators should monitor their SQL databases for unauthorized or abnormal SQL injections and write scripts for alarming as well as __________ alerts.

Back 96

Simple Network Management Protocol (SNMP)

Front 97

The information you gathered in the lab's tests, along with the ability to write to a file, indicates that you have found a(n):

Back 97

injectable database.

Front 98

Which of the following is true regarding antivirus programs?

Back 98

Antivirus programs are designed to stop the spread and activity of viruses.

Front 99

Which of the following is an approach to identifying viruses in which the program recognizes symptoms of a virus?

Back 99

Suspicious behavior

Front 100

Which of the following is an approach to identifying viruses in which the program uses a signatures database to identify a virus?

Back 100

Dictionary-based detection

Front 101

Which of the following terms refers to anything developed for the purpose of doing harm?

Back 101

Malware

Front 102

A slow response opening applications or browsing the Internet, applications not working as they normally would, and the operating system not booting up correctly are all symptoms of:

Back 102

a malware infection.

Front 103

Antivirus vendors usually update their antivirus signature files:

Back 103

several times per week

Front 104

AVG automatically updates the database on a regular basis, as long as the machine is:

Back 104

able to reach the Internet.

Front 105

In addition to updating the signatures database regularly, it is also important to:

Back 105

research and apply any patches to the antivirus software itself.

Front 106

Which feature of AVG enables you to remove specific files or folder from the scan?

Back 106

The Exceptions feature

Front 107

Which of the following terms is used to describe a correctly formatted document that appears to be malware to an antivirus program?

Back 107

False positive

Front 108

By default, AVG scans:

Back 108

the whole computer.

Front 109

When a virus scan is complete, AVG displays a(n) __________ showing the number of threats that were identified and removed.

Back 109

Report Summary

Front 110

Each threat identified by AVG is given a __________ of high, medium, or low.

Back 110

threat severity rating

Front 111

In the AVG Report Summary, what did the green checkmark indicate?

Back 111

Whether or not each threat was removed from your computer

Front 112

The information regarding the results of an AVG scan is saved in the:

Back 112

AVG History.

Front 113

Which AVG feature scans every single file as it is opened, saved, or copied?

Back 113

Resident Shield

Front 114

The Virus Vault is considered a __________ where all removed files, virus infected or suspicious, are stored until you take action on them.

Back 114

quarantine area

Front 115

All the files in the Virus Vault are:

Back 115

encrypted and cannot do the computer any harm.

Front 116

A false positive stored in the Virus Vault is:

Back 116

easily restored within the interface.

Front 117

Which of the following checkbox options would you use to ensure that a scan will run on startup if the computer were off at the scheduled time?

Back 117

Run when computer starts up if task has been missed

Front 118

Which of the following refers to an event in an organization that can include accidental actions or malicious actions that result in a problem?

Back 118

Security incident

Front 119

An organization's __________ identifies the incident response team roles, responsibilities, and processes for performing an incident response.

Back 119

security policy

Front 120

Which phase of the incident response process is used to determine what went right during the incident response, what went wrong, and how to make the process better?

Back 120

Lesson Learned

Front 121

In which phase of the incident response process is the affected system tested, restored, and returned to service?

Back 121

Recovery

Front 122

Which phase of the incident response process includes collecting evidence without destroying or altering it, as well as removing the threat?

Back 122

Eradication

Front 123

In which phase of the incident response process do you control the event as much as possible in order to stop the threat?

Back 123

Containment

Front 124

In which phase of the incident response process do you establish just what has actually occurred?

Back 124

Identification

Front 125

Which phase of the incident response process ensures that there is a plan in place for handling incidents, a team responsible for investigating, and procedures for consistency?

Back 125

Preparation

Front 126

After a security incident, an infected machine should be:

Back 126

kept in its steady state.

Front 127

After determining that the event in the lab constituted an incident, you instructed the help desk to have the user of the machine cease all activity and contain the infected machine by:

Back 127

disconnecting from the network.

Front 128

In the lab, a(n) __________ was generated that indicated that one of the Windows workstations on the network was likely infected with some type of malware.

Back 128

trouble ticket

Front 129

The __________ feature of AVG enables you to remove specific files or folders from an antivirus scan.

Back 129

Exceptions

Front 130

Which button in the Report Summary will display each threat identified by AVG, including its threat severity rating and whether or not the threat was removed from your computer?

Back 130

Detections

Front 131

Once you have the name and details for a virus, you can search the __________ or the Internet for more information about how the virus entered your network

Back 131

antivirus company's Web site

Front 132

The __________, provided by AVG Threatlabs, is a useful resource for learning about viruses.

Back 132

Virus Encyclopedia

Front 133

Which of the following refers to the quarantine area where all removed files (virus infected or suspicious) are stored until you take action on them?

Back 133

Virus Vault

Front 134

Which button in AVG will delete all viruses, malware, and malicious software detected by the application?

Back 134

Empty Vault

Front 135

Which of the following statements is true regarding information security breaches?

Back 135

Cyber laws act as a broad deterrent but they do not secure networks from malicious activity.

Front 136

Prevention and detection are the two major categories of:

Back 136

internal controls.

Front 137

Which of the following block IP traffic based on the filtering criteria that the information systems security practitioner configures?

Back 137

Intrusion prevention systems (IPS)

Front 138

Which of the following statements is true regarding intrusion detection systems (IDS)?

Back 138

Intrusion detection systems are alert-driven, but they require the information systems security practitioner to configure them properly.

Front 139

Which of the following can perform protocol analysis, content searching/matching, and can be used to detect a variety of attacks and probes?

Back 139

Snort

Front 140

Which of the following is an open source network intrusion prevention and detection system, capable of performing real-time traffic analysis and packet logging on IP networks?

Back 140

Snort

Front 141

When checking the status of the Snort service, a response of __________ indicates that Snort is running and is configured with the default alerts and rules (signatures).

Back 141

OK

Front 142

You need to restart the Snort service if a __________ is received.

Back 142

fail status

Front 143

Which of the following is a Web-based tool that analyzes intrusions detected by Snort?

Back 143

Snorby

Front 144

Performing a network traffic __________ provides information about what protocols and traffic behavior patterns are normal.

Back 144

baseline definition analysis

Front 145

In the lab, you created a new user account in OpenVAS with:

Back 145

administrative privileges.

Front 146

Which of the following is a framework of several services and tools offering vulnerability scanning and management solutions?

Back 146

OpenVAS

Front 147

OpenVAS is used to run tests against client computers using a:

Back 147

database of known exploits and weaknesses

Front 148

Which of the distinct roles that OpenVAS recognizes provides only enough privileges to view resources?

Back 148

Observer

Front 149

Which of the distinct roles that OpenVAS recognizes includes extra privileges, like the ability to add users or synchronize the feed?

Back 149

Administrator

Front 150

Which of the distinct roles that OpenVAS recognizes provides only enough privileges for everyday use?

Back 150

User

Front 151

In the lab, OpenVAS identified:

Back 151

a single security issue of medium risk level.

Front 152

When Snort captures and examines IP packets, it:

Back 152

looks for specific IP packet traffic patterns and abnormal traffic attempting to enter a network.