Information Security Careers and Certifications - Module 5

Module 5 Question: What word is the currently accepted term that is used today to refer to network-connected hardware devices? a. host b. endpoint c. device d. client Answers: b Question: Which of the following is NOT a feature of blocking ransomware? a. A message on the user's screen appears pretending to be from a reputable third party. b. It prevents a user from using their computer in a normal fashion. c. It can be defeated by a double power cycle. d. It is the earliest form of ransomware. Answers: c Question: Cillian is explaining to an intern why ransomware is considered to be the most serious malware threat. Which of the follow reasons would Cillian NOT give? a. Once a device is infected with ransomware, it will never function normally. b. Launching a ransomware attack is relatively inexpensive and does not require a high degree of skill. c. Ransomware attacks occur with a very high frequency. d. Attacks from ransomware have a high impact on organizations. Answers: a Question: Finn's team leader has just texted him that an employee, who violated company policy by bringing in a file on a USB flash drive, has just reported that their computer is infected with locking ransomware. Why would Finn consider this a serious situation? a. It sets a precedent by encouraging other employees to violate company policy. b. It can encrypt all files on any network that is connected to the employee's computer. c. The organization may be forced to pay up to $500 for the ransom. d. The employee would have to wait at least an hour before their computer could be restored. Answers: b Question: What is the difference between a keylogger and spyware? a. A keylogger operates much faster than spyware. b. Spyware is illegal while a keylogger is not. c. Spyware typically secretly monitors users but unlike a keylogger makes no attempts to gather sensitive user keyboard input. d. Spyware can be installed using a hardware device while a keylogger cannot. Answers: c Question: Which of the following is NOT a technology used by spyware? a. tracking software b. system-modifying software c. active tracking technologies d. automatic download of software Answers: c Question: Which of the following is NOT true about RATs? a. A RAT gives the threat agent unauthorized remote access to the victim's computer by using specially configured communication protocols. b. A RAT and a worm have the same basic function. c. A RAT allows the attacker to not only monitor what the user is doing but also can change computer settings, browse and copy files, and even use the computer to access other computers connected on the network. d. A RAT creates an opening into the victim's computer, allowing the threat actor unrestricted access. Answers: b Question: Which of the following types of computer viruses is malicious computer code that becomes part of a file? a. file-based virus b. jump virus c. fileless virus d. RAM-Check virus Answers: a Question: Which of the following is NOT a Microsoft Windows common LOLBin? a. DLR b. .NET Framework c. Macro d. PowerShell Answers: a Question: Which of the following is sometimes called a "network virus" because it enters a computer to move through the network? a. fileless virus b. worm c. trojan d. file-based virus Answers: b Question: Which of these would NOT be considered the result of a logic bomb? a. Send an email to Rowan's inbox each Monday morning with the agenda of that week's department meeting. b. If the company's stock price drops below $50, then credit Oscar's retirement account with one additional year of retirement credit. c. Erase the hard drives of all the servers 90 days after Alfredo's name is removed from the list of current employees. d. Delete all human resource records regarding Augustine one month after he leaves the company. Answers: a Question: Which of the following attacks is based on a website accepting user input without sanitizing it? a. RSS b. XSS c. iSQL d. SSXRS Answers: b Question: Which of the following attacks is based on the principle that when a user is currently authenticated on a website and then loads another webpage, the new page inherits the identity and privileges of the first website? a. SSFR b. DLLS c. CSRF d. DRCR Answers: c (cross-site request forgery (CSRF)) Question: Which of the following manipulates the trusting relationship between web servers? a. SSRF b. CSRF c. EXMAL d. SCSI Answers: a server-side request forgery (SSRF) Question: Which type of memory vulnerability attack manipulates the "return address" of the memory location of a software program? a. pointer attack b. stuffing attack c. integer overwrite d. buffer overflow attack Answers: d Question: What race condition can result in a NULL pointer/object dereference? a. Conflict race condition b. Value-based race condition c. Thread race condition d. Time of check (TOC) to time of use (TOU) Answers: d Question: Which of the following would NOT be considered an IoA? a. resource manipulation b. out-of-cycle logging c. account lockout d. blocked content Answers: a Question: Nollaig is reviewing the steps that an attacker took when they compromised a web server and accessed confidential files. What type of attack was this? a. directory traversal b. account overflow c. race condition d. TOE Answers: a Question: Which of the following is NOT correct about a secure cookie? a. It is a means of protection of a web browser. b. A secure cookie is only sent to the server with an encrypted request. c. It uses the HTTPS protocol. d. It prevents an unauthorized person from intercepting a cookie that is being transmitted. Answers: a Question: Which statement regarding a keylogger is NOT true? a. Software keyloggers can be designed to send captured information automatically back to the attacker through the Internet. b. Hardware keyloggers are installed between the keyboard connector and computer keyboard USB port. c. Software keyloggers are generally easy to detect. d. Keyloggers can be used to capture passwords, credit card numbers, or personal information. Answers: c