Ethical Hacking Final 1

Ethical Hacking Final Study online at 1. What can an intrusion prevention system do that an intrusion detection system can't? Log packets Block or reject network traffic Complete the three-way handshake to bogus messages Generate alerts: Block or reject network traffic 2. If you were to see the subnet mask 255.255.252.0, what CIDR notation (prefix) would you use to indicate the same thing? /22/21/20 /23: /22 3. What type of attack is a compromise of availability? Buffer overflow Watering hole DoS Phishing: DoS 4. To remove malware from the network before it gets to the endpoint, you would use which of the following? Application layer gateway Packet filter Stateful firewall Unified threat management appliance: Unified threat management appliance 5. Taylor, a database administrator, wants to determine a publicly available set of databases that contain domain name registration contact information. Which of the following will she use? netstat dig nmap whois: whois 6. If you were on a client engagement and discovered that you left an external hard drive with essential data on it at home, which security principle would you be violating? Nonrepudiation Integrity Confidentiality Availability: Availability 9 1/ E thical Hacking Final Study online at 7. What TCP/IP protocol is fast, unreliable, and operates at the Transport layer? TCP POP3 UDP FTP: UDP 8. What technique would you ideally use to get all of the hostnames associated with a domain? Zone copy Recursive request Zone transfer DNS query: Zone transfer 9. Shawn works as a penetration tester at XYZ. He was asked to get the network route to a destination.Which network diagnostics utility will he use? ifconfig dig traceroute Wireshark: traceroute 10. How many layers in the OSI model map to the top layer in the TCP/IP architecture?: 3 - Application, Presentation, Session 11. What is the purpose of a security policy?: To provide high-level guidance on the role of security 12. Joe, a penetration tester, wants to identify the availability of a remote system by sending ping requests out from the company's network. Which of the following protocols will he use to accomplish the task?: ICMP 13. A breach was caused in which a customer's personal information was compromised. Jordan, a security analyst, is asked to determine which vulnerabilities the attacker used to access company resources.Which of the fol- lowing should he use to remediate the vulnerabilities?: Data leak prevention 14. What layer, in the TCP/IP stack, do applications and protocols, such as HTTP and Telnet, operate?: Application 15. What are the messages sent as part of a TCP three-way handshake?: SYN, SYN-ACK, ACK 16. Which of the following manages its data transfer when files are being copied from one system to another?: NFS Ethical Hacking Final Study online at 17. What is an advantage of a phone call over a phishing email?: You can go into more detailing with pretexting 18. Which social engineering principle may allow a phony call from the help desk to be effective?: Authority 19. If you were to notice operating system commands inside a DNS request while looking at a packet capture, what might you be looking at?: Tunneling attack 20. Which of the following implements the SMS protocol on Unix-like operating systems?: Samba 21. Which of the following is a service that allows remote systems to consume procedures external to the application calling them?: RPC 22. Juan works as a security administrator at XYZ. He configured the most secure policies and tightened every device on his network. He is confident that hackers will never be able to gain access to his network. His peer says even the best network security technologies cannot prevent hackers from gaining access to the network because of the presence of the "'weakest link" in the security chain. What does this "'weakest link" refer to?: Untrained staff 23. What is are RPCs primarily used for?: Interprocess communications 24. You are hired to perform a technical assessment on the network for discovering vulnerabilities on a Windows-based computer. Which of the following tools will you use?: Nessus 25. Which of these may be considered worst practice when it comes to vulnerability scans?: Not taking actions on the results 26. What version of SNMP introduced encryption and user-based authentication?: 3 27. Sam, a penetration tester, has been actively scanning the client network on which he is doing a vulnerability assessment test. While conducting a port scan, he notices open ports in the range of 135 and 139. Which of the following is listening on those ports?: SMB (server message block) 28. An attacker, masquerading as a trusted entity, dupes a victim by sending an instant message. The user is then tricked to install malware and reveal sensitive information. Which of the following attacks is explained in the scenario?: Phishing 3/ 9 Ethical Hacking Final Study online at 29. Ron, a black hat hacker, is looking for a target's corporate credentials. For this, he has used a fictitious scenario to persuade the target to engage with him. Which type of attack is this?: Pretexting 30. What layer, in the TCP/IP stack, is responsible for routing a packet to a destination address?: Networking 31. Internet protocol stack: application transport network data link physical 32. application layer: protocols like http 33. transport layer: ports and tcp/udp 34. network layer: routing of datagrams from source to destination IP address 35. data link layer: Ethernet, WiFi 36. Which of these would be an example of a loss of integrity? Memory failures causing disk drivers to run incorrectly User making changes to a file and saving it Bad blocks flagged on disk Credit cards passed in cleartext: Memory failures causing disk drivers to run incorrectly 37. What tool can an attacker use to find servers, webcams, printers, routers, and other devices connected to the Internet?: Shodan 38. Your organization has asked you to provide the number of bits in a network prefix. Which notation will you use?: Classless inter domain routing (CIDR) 39. The PDU for TCP is called a _____.: Segment 40. What is the number one defense against reconnaissance attacks?: Security policies 41. You have observed that the bit pattern is 11111111 11111111 10000000 00000000. Which of the following subnet masks will you use?: 255.255.128.0 42. You are informed that the additional allocation of an IP address is required in North America. Which of the following RIR (Regional Internet registry) would you be looking in for allocation?: ARIN (American Registry for Internet Numbers) 9 4/ E thical Hacking Final Study online at 43. What is the HTTP method that retrieves data by URI?: GET 44. What type of port scan has the FIN, PSH, and URG flags set?: XMAS 45. Your organization is using the EDGAR website for which of the following purposes?: To recon against public companies 46. What is the logical component of a TCP connection that can be assigned to a process that requires network connectivity?: port 47. An intrusion detection system can perform which of the following functions?: generate alerts on traffic 48. How many host computers can be assigned a valid IPv4 address when using a CIDR /24 prefix?: 2^(32-24) = 256 256 - 2 (for the network and broadcast addresses) 254 49. Which utility is used to gather IP and domain information?: whois 50. Which of the following layers manages the communication between the endpoints when it comes to maintaining the communication of the applications (the client or server)?: session 51. Which network topology are you most likely to run across in a large enterprise network?: star-bus hybrid 52. To find the IP address of a domain, use...: dig 53. To find the ip address range of a single IP: whois 54. What nmap scan would you do to see what application is running: version scan 55. A hacker is conducting the following on the target workstation: nmap -sT 192.33.10.5 The attacker is in which phase?: Scanning and enumeration 56. Which protocol is necessary to enable the functionality of traceroute?: ICMP 57. Which of the below commands NOT used to view the contents of a file? Less command More command Disp command Cat command: Disp E thical Hacking Final Study online at 58. Which is the second phase in the ethical hacking methodology?: Scanning and enumeration 59. What is the SMB protocol used for?: Data transfers on Windows systems 60. Which of these is a reason to use an exploit against a local vulnerability?: Privilege escalation 61. Which of these tools allows you to create your own enumeration function based on ports being identified as open?: Nmap 62. If you were looking for reliable exploits you could use against known vulnerabilities, what would you use?: Exploit-DB 63. Which of these would be a way to exploit a client-side vulnerability?: Sending a crafted URL 64. Which social engineering technique can allow you to gain physical access to a system?: Impersonation 65. You've installed multiple files and processes on the compromised system. What should you also look at installing?: Rootkit 66. What are data descriptions in SNMP called?: Management information base 67. Olivia, a black hat hacker, captures the information transmitted by the remote host to expose the application type, application version, and even operating system type and version. Which of the following techniques will she use to obtain information about the target system?: Banner grabbing 68. What status code will you get if your attempt to use the VRFY command fails?: 550 69. Your company gives you a free simulator for LINUX. Later, you feel like you should buy the simulator in response. What social engineering principle gets you to buy the simulator because you feel obligated to respond to the company's favor?: Reciprocity 70. You are working with a colleague and you see them interacting with an email server using the VRFY command. What is it your colleague is doing?: verifying email addresses 71. Which Google hack allows the user to search for file types located within a website?: filetype: 72. Your organization has asked you to connect all the computers to a single backbone. Which of the following topologies will you use?: Bus 6/ Ethical Hacking Final Study online at 73. Alicia, a network administrator, wants to prevent any system inside the DMZ from communicating with systems inside the organization.Which of the following will she use?: Firewall 74. What is a MAC address used for?: Addressing systems on the local network 75. Ping sweep in nmap: -sP 76. In a normal TCP session, the sender sends a packet to another computer with which of the following flags set?: SYN 77. What is a viable approach to protecting against tailgaiting?: Man traps 78. What SMTP command would you use to get the list of users in a mailing list?: EXPN 79. Camilla, a software engineer, wants to gather NetBIOS statistics by acquiring information about a remote system. Which of the following utilities will he use?: nbstat 80. Which of these may be considered an evasive technique?: Encoding data 81. Countermeasures for port scanning: Ensure that anti-scanning and anti-spoofing rules are configured. Filter all ICMP messages at the firewalls and router. Configure firewall and IDS rules to detect and block probes. 82. Which protocol is used for network management and can gather statistics and derive a current status from the node that it is operating on?: SNMP 83. What is the process Java programs identify themselves to if they are sharing procedures over the network?: RMI registry 84. How do you authenticate with SNMPv1?: community string 85. Closed ports respond to a NULL scan with what type of packet?: RST 86. In an ACK scan, if the attacked port returns an RST packet the attacked port is considered to be operating in what state?: unfiltered 87. Pretexting: a form of social engineering in which one individual lies to obtain confidential data about another individual 88. Jacob works as a security analyst at XYZ. He wants to find a Metasploit exploit that works with a software package he is targeting. Which of the following will help him to locate this?: Searchsploit 7/ 9 Ethical Hacking Final Study online at 89. What is the difference between a SYN scan and a full connect scan?: The SYN scan doesn't complete the three-way handshake. 90. What application would be a common target for client-side exploits?: web browser 91. What type of enumeration would you use the utility dirb for?: directory enumeration 92. dirb: web content scanner 93. Why do you get open|filtered from nmap on some scans?: The port is open but cannot be accessed from the location you are scanning from because it is being filtered by a firewall. 94. What is a common potential downside to running a vulnerability scan?: One downside it does not detect previously unknown vulnerabilities. It can produce false positives or false negatives. 95. What protocol could you use to gather essential system information, providing only very rudimentary authentication information?: SNMP 96. What programming technique underlies Windows and Unix file sharing: RPC 97. When a TCP three-way handshake ends, both parties send what type of packet to end the connection?: FIN 98. What Windows utility is used to perform port scans, traceroutes, DNS resolutions, and ping sweeps?: Megaping 99. What is one reason a UDP scan may take longer than a TCP scan of the same host?: UDP will retransmit more 100. What does nmap look at for fingerprinting an operating system?: The IP ID field and the initial sequence number 101. What is nmap looking at when it conducts a version scan?: Application banners 102. What is an advantage of using masscan over nmap?: faster 103. Joseph, a network administrator, wants to create dynamic connections on an ethernet network by using a switch. Which of the following topologies will he use?: star 104. What is the difference between routing and forwarding?: Routing is the process of determining which path the packets should take fromthe source to the 8/ 9 Ethical Hacking Final Study online at destination. Forwarding involves transferring the packets from therouter's input link to its output link. 9/ 9