Ethical Hacking Final 2

Ethical Hacking Final Study online at 1. What cmd is used to listen to open ports with netstat?: netstat -sn 2. What should not be included in rules of engagement?: Intellectual property ownership 3. What describes a vulnerability scan?: A way to automate the discovery of vulnerabilities 4. What network appliance sense irregularities and actively tries to stop it?: IPS 5. A black-box test means the tester has what?: No knowledge 6. What is the process of making an OS secure from attack called?: Hardening 7. What is the focus of a security audit or vulnerability assessment?: Locating vulnerabilities 8. A white-box/crystal-box test means the tester has what?: Full knowledge 9. What category of firewall filters is based on packet header data only?: Packet 10. What category of firewall filters is based on packet header data and session data?: Statefull 11. A team that conducts pen testing is referred to as what?: Red team 12. A team that conducts defense is referred to as what?: Blue team 13. What cmd on Linux will use brute-force effort to locate a file?: find 14. In Linux, what account denotes the administrator?: root 15. How would an admin set a password for a user in linux?: passwd user pass123 16. What cmd displays the network config in Linux?: ifconfig 17. What directory holds basic cmds in Linux?: /bin 18. In Linux, how do you create a new user in the terminal?: adduser savion -oruseradd -d /home/samarea ssamarea 19. How many hosts can be accommodated in a subnet with netmask 255.255.252.0: 1024 20. Where is the event log located in Linux?: /var/log 21. $nmap -n 10.10.10.10-60 performs what Nmap scan?: Connect scan 1 / 24 Ethical Hacking Final Study online at 22. By default, if you don't run nmap as root what scan will be run?: connect - will be in $ mode 23. #nmap -nv -sT 10.10.10.10-60 performs what Nmap scan?: Connect scan 24. How would you use netcat to set up a server on a system? (cmd): nc -l -p 100 25. #nmap -n 10.10.10.10-60 performs what Nmap scan?: Syn stealth scan 26. If you set up a server with netcat are you a listener or client?: listener 27. What does a half-open scan not do?: Not include the final ACK 28. What is not a flag on a TCP flag? (fake, not real value): END 29. Port 23: telnet 30. Port 21: ftp 31. Port 22: ssh 32. Port 25: smtp 33. During a FIN or Xmas Tree scan, what indicates a port is closed?: RST 34. During a FIN or Xmas Tree scan, what indicates a port is open?: No response 35. What is an ICMP echo scan?: ping sweep 36. What port number is used by DNS for zone transfer: TCP 53 37. What port number is used by DNS for queries/response: UDP 53 38. What command would take down a host after running nmap on it?: nmap -n --script=all 10.10.10.10 39. What does a SYN scan do?: Establish a half-open connection 40. What is the TTL for Ubuntu/Linux?: 64 41. What is the TTL for Windows?: 128 42. If you can ping a website's IP, but not access it via domain name, what is the issue?: The DNS server isn't functioning correctly 43. What designator is used to identify a user account in Linux?: UID 44. What designator is used to identify a user account in Windows?: SID 45. UID 0: root user 46. Using nmap, what is the cmd to scan a subnet of 192.168.0.0/24 using ping sweep & identify the OS: nmap -sP -O 192.168.0.0/243 2 / 24 E thical Hacking Final Study online at 47. What is the function of a CNAME record?: Supplements an alias to a domain name 48. What tool is used to illuminate a SID for a username?: SID2User 49. What UDP flag forces a connection to terminate at both ends of the ciruit?: None 50. client -> SEQ 300, ACK 0, SYN -> <- SEQ 243, ACK 301, SYN/ACK <- server client -> SEQ 301, ACK 244, ACK: a 51. A record: IP to hostname 52. AAAA record: IPv6 translation 53. MX record: mail server 54. nmap -p21,80,443 -sV -O 45.33.32.156: Should have PORT, STATE, SERVICE, VERSION columns & operating system info 55. What nmap scan is preformed? # nmap -n 10.10.10.10-60: A syn stealth scan 56. Which of the following types of attacks has no flags set? A.) SYN B.) NULL C.) Xmas Tree D.) FIN: B.) NULL 57. What port is used for NETBIOS traffic? A.) 123 B.) 139 C.) 161 D.) 110: B.) 139 58. What is missing from a half open scan?: An ACK 59. At which layer of the OSI model does a proxy operate?: Application 60. What is the sequence of the three way hand-shake?: SYN,SYN-ACK,ACK 61. You have selected the option in your IDS to notify you via email if it senses any network irregularities. Checking the logs, you notice a few incidents but you didn't receive any alerts. What protocol needs to be configured on the 3 / 24 E thical Hacking Final Study online at IDS? A.) NTP B.) SNMP C.) POP3 D.) SMTP: D.) SMTP 62. Which command would retrieve banner information from a website at port 80? A.) nc 192.168.10.27 80 B.) nc 192.168.19.27 443 C.) nc 192.168.10.27 -p 80 D.) nc 192.168.10.27 -p -l 80: A.) nc 192.168.10.27 80 63. If a device is using node MAC addresses to funnel traffic, what layer of the OSI model is this device working in?: Layer 2 64. What record will reveal information about a mail server for a domain?: MX 65. During a Xmas tree scan what indicates a port is closed?: RST 66. What is the default TTL value for Microsoft Windows?: 128 67. What is the default TTL value for Linux?: 64 68. What port number or numbers is associated with the IP protocol?: No ports 69. The command: SID: S-1-5-21domain-501 suggests what type of account? A.) Administrator B.) Normal Guest C.) Power Users D.) Domain admin: B.) Normal Guest 70. Which of the following provides free information about a website that includes phone numbers, admins email, and even the domain registry authority? A.) Nslookup B.) Dig C.) Whois.net D.) Ping: C.) whois.net 4 / 24 Ethical Hacking Final Study online at 71. Using nmap, what switches allows us to fingerprint an operating system and conduct a port scan? A.) -sS -sO B.) -sSO C.) -O -Ss D.) -O -sS: D.) -O -sS 72. What is the size of each of the fields in a UDP header?: 16 bits 73. When trying to identify all the workstations on a subnet, what method might you choose? A.) Port Scan B.) Anonymizer C.) Ping Sweep D.) Web Crawler: C.) Ping Sweeper 74. What items should not be included in the rules of engagement? A.) Test dates and times B.) Contact information C.) Limitation of liability D.) Daily debriefing and conference call: C.) Limitation of liability 75. What nmap scan is preformed by this command? # nmap -n -sT 10.10.10.10-60: A connect scan 76. To make Tcpdump to sniff on network interface eth0, do not resolve host and service names, for tcp packets to and from host 10.10.10.10 and without ARP packet. Which of the following command should be invoked? A.) tcpdump -nn -i eth0 and tcp and host 10.10.10.10 and not arp B.) tcpdump -nn -i eth0 tcp and host 10.10.10.10 and not arp C.) tcpdump -nn -i eth0 tcp and host 10.10.10.10. and no arp D.) tcpdump -nn -i eth0 tcp and net 10.10.10.10 and no arp: B.) tcpdump -nn -i eth0 tcp and host 10.10.10.10 and not arp 77. What port is used to filter for SMB traffic?: Port 445 78. As a pen tester, only you and a few key selected individuals from the company will know of the targeted network that will be tested. You also 5 / 24 E thical Hacking Final Study online at have zero knowledge of your target other than the name and location of the company/ What type of assessment is this?: Black box testing 79. Which nmap switch utilizes the fastest scan? A.) -T0 B.) -sT C.) -T5 D.) -sS: C.) -T5 80. Which record indicates the mapping of an ip address to a hostname? A.) MX B.) PTR C.) NS D.) CNAME: B.) PTR 81. Which google hack allows the user to search for the file types that are located within a website? A.) filetype: B.) inurl: C.) typefile: D.) file:: A.) filetype 82. When sending a packet with a FIN flag set, what will the target respond with if the port is open? A.) RST is returned B.) No response is returned C.) RST/ACK is returned D.) SYN/ACK is returned: B.) Ne response is returned 83. If you were to ARP poison the default gateway, what would be the expected results? A.) You will receive traffic on that specific virtual local network B.) You will receive all the traffic on the current network associated with the gateway C.) You will not receive any traffic D.) You may cause a DoS on the network: B.) You will receive all the traffic on the current network associated with the gateway 6 / 24 E thical Hacking Final Study online at 84. Which is the initial value of the SID that is used to annotate an administrators account? A.) 500 B.) 100 C.) 5000 D.) 1: A.) 500 85. What port number is used by NetBIOS for name services? A.) UDP 137 B.) TCP 137 C.) UDP 190 D.) None: B.) TCP 137 86. Which utility will display active network connections on a host? A.) netcat B.) netstat C.) nmap D.) ns: B.) netstat 87. Which one of the following command flags may be used to put the netcat into a mode where it listens for connections on a Windows system? A.) -p B.) -s C.) n D.) -l: D.) -l 88. Which one of the following tools is specifically designed to serve as a web application assessment tool? A.) Nmap B.) Nessus C.) Nikto D.) Ripid7 nexpose: C.) Nikto 89. Fran learned from a colleague that an attacker targeting organizations similar to hers is conducting scanning and brute force attacks against Win- dows Remote Desktop services. She would like to check her firewall logs for similar attacks. What TCP port should she use to filter log entries? 7 / 24 E thical Hacking Final Study online at A.) 22 B.) 3389 C.) 443 D.) 1433: B.) 3389 90. The command below does which of the following? Address: 10.10.12.15 >set type=any > ls -d wayne.net > dns.wayne.net A.) Looks at the server name B.) Zone transfer C.) DNS poisoning D.) ARP spoofing: B.) Zone transfer 91. The command: SID: S-1-5-21domian-501, suggests what type of account? A.) Administrator B.) Normal Guest account C.) Power Users D.) Domain admin: B.) Normal guest user 92. Which one of the following commands will show all the connections that are currently opened in a windows host machine? A.) netstat -an B.) nslookup -ao C.) nmap -sP -T4 target ip D.) nbstat -an: A.) netstat -an 93. You are using a sniffer and you see a frame with a destination address of 0xFFFFFFFFFFFFFFFFFF. What type of frame is this? A.) Layer 3 broadcast B.) Layer 3 network ID C.) Layer 2 network ID D.) Layer 2 broadcast from: D.) Layer 2 broadcast frame 94. Which of the following nmap scans will have a greater chance of being detected? A.) Null scan 8 / 24 E thical Hacking Final Study online at B.) XMAS tree scan C.) ACK scan D.) TCP connect scan: D.) TCP connect scan 95. Which of the following indicated top level parent domain? A.) sybex.com B.) .org C.) www.wiley.com D.) www.: B.) .org 96. In a well-designed pen test, which one of the following steps occur first? A.) Determine the scope of the test B.) Conduct network recon C.) Run a vulnerability scan D.) Conduct social engineering: A.) Determine the scope of the test 97. Jason is running the following nmap command to scan a target host. What kind of scan is Jason conducting? # nmap -n --scanflags FPINPSHURG 10.10.10.10 A.) ACK scan B.) FIN scan C.) Xmas tree scan D.) NULL scan: C.) Xmas tree scan 98. Jason is conducting a pen test against a target Windows system. He would like to obtain the GUI from the target machine, what Metasploit payload should Jason consider to use for his pen test? A.) windows/meterpreter/reverse_tcp B.) windows/shell/bind_tcp C.) windows/meterpreter_reverese_cp D.) windows/vcinject/reverse_https: D.) windows/vcinject/reverse_https 99. Which of the following commands can be used to scan an entire subnet with nmap? A.) nmap 192.168.10.1-30 B.) nmap 192.168.10.1/16 E thical Hacking Final Study online at C.) nmap 192.168.10.1/32 D.) nmap 192.168.10.1/1*: B.) nmap 192.168.10.1/16 100. Which command-line switch can be used with nmap to obtain more information from the screening process? A.) -i B.) -v C.) o D.) -x: B.) -v 101. Which type of software is considered framework, a set of preinstalled tools that aid in compromising and exploiting targeted systems? A.) nmap B.) metasploit C.) Nessus D.) Ettercap: B.) Metasploit 102. In Windows, what designator is used to uniquely identify a user account? A.) GID B.) SID C.) UID D.) PID: B.) SID 103. Jason is running his virtual test machine using NAT network setting in his first pen test. He selected the exploit and payload in Metasploit and fire the exploit against the Windows target where a vulnerable service was running. Metasploit reported that the payload failed. Assuming the exploit is correct, which of the following payload was most likely chosen? A.) windows/meterpreter/bind_tcp B.) windows/shell_bind_tcp C.) windows/meterpreter/reverse_tcp D.) windows/shell/bind_nonx_tcp: C.) windows/meterpreter/reverse_tcp 104. Jennifer is using tcpdump to capture traffic on her network. She would like to review a capture log gathered previously.What command can Jennifer use? A.) tcpdump -r capture.log 10 / 24 E thical Hacking Final Study online at B.) tcpdump - l capture.log C.) tcpdump -t capture.log D.) tcpdump -w capture.log: D.) tcpdump -w capture.log 105. Which best describes a vulnerability scan? A.) A way to find open ports B.) A way to diagram a network Xmas tree C.) A proxy attack D.) A way to automate the discovery of vulnerabilities: D.) A way to automate the discovery of vulnerabilties 106. What item should not be included in the rules of engagement? A.) Test dates and times B.) Contact information C.) Daily debriefing and conference call D.) Intellectual property ownership: D.) Intellectual property ownership 107. What network appliance senses irregularities and plays an active role in stopping that irregular activity from continuing? A.) IPS B.) IDP C.) IDS D.) firewall: A.) IPS 108. A black-box test means the tester has which of the following? A.) No knowledge B.) Some knowledge C.) Complete knowledge D.) Permission: A.) No knowledge 109. What is the process of making an operating system secure from attack called? A.) Hardening B.) Tuning C.) Sealing D.) Locking down: A.) Hardening 11 / 24 Ethical Hacking Final Study online at 110. What is the focus of a security audit or vulnerability assessment? A.) Locating vulnerabilities B.) Locating threats C.) Enacting threats D.) Exploiting vulnerabilities: A.) Locating vulnerabilities 111. Which category of firewall filters is based on packet header data only? A.) Stateful B.) Application C.) Packet D.) Proxy: C.) Packet 112. A team that conducts pen testing can be referred to as what? A.) Blue team B.) Red team C.) Black team D.) White team: B.) Red team 113. In linux, what method uses a brute-force effort to locate a file? A.) find B.) grep C.) | D.) search: A.) find 114. In linux, which of the following accounts denotes the administrator? A.) Admin B.) Administrator C.) root D.) su: C.) root 115. How would an admin set a password for a user in linux? A.) # password user pass123 B.) # chmod pass user pass123 C.) # pass user pass123 D.) # passwd user pass123: D.) passwd user pass123 12 / 24 Ethical Hacking Final Study online at 116. What command displays the network configurations in Linux os? A.) ipconfig B.) netstat C.) ls D.) ifconfig: D.) ifconfig 117. What directory holds the basic commands in the linux os? A.) /etc B.) /bin C.) / D.) /config: B.) /bin 118. In Linux, how would you create a new user in a terminal? A.) # useradd /home/samarea samarea B.) >assuser raeleah C.) cuser ray_j /home/ray_j D.) # adduser savion: D.) # adduser savion 119. How many hosts can be accomodated in a subnet with netmask 255.255.255.0? A.) 128 B.) 256 C.) 512 D.) 1024: D.) 1024 120. Where is the event log located in Linux? A.) /home/log B.) /var/log C.) /log/ D.) /home/system32/log: B.) /var/log 121. How would you use netcat to set up a server on a system? A.) nc -l -p 10.10.10.10 B.) nc -l -p 1000 C.) nc -p -u 1000 D.) nc -l -p -t 10.10.10.10: B.) nc -l -p 1000 13 / 24 E thical Hacking Final Study online at 122. A full-open scan means that the three-way handshake has been completed. What is the difference between this and a half-open scan? A.) A half-open uses TCP B.) A halfopen uses UDP C.) A half-open does not include the final ACK D.) A half-open includes the final ACK: C.) A half-open does not include the final ACK 123. Which of the following is not a flag on a TCP packet? A.) URG B.) PSH C.) RST D.) END: D.) END 124. A scan of a network client shows that port 23 is open; what protocol is aligned with? A.) Telnet B.) NetBIOS C.) DNS D.) SMTP: A.) Telnet 125. During a FIN scan, what indicates that a port is closed? A.) No return response B.) RST C.) ACK D.) SYN: B.) RST 126. What is an ICMP echo scan? A.) A ping sweep B.) A SYN scan C.) A Xmas tree scan D.) Part of a UDP scan: A.) A ping sweep 127. Port number ________ is used by DNS for zone transfers. A.) TCP 53 B.) UDP 53 14 / 24 E thical Hacking Final Study online at C.) TCP 25 D.) UDP 25: A.) TCP 53 128. Jason is a novice pen tester. He was running nmap against target host 10.10.10.10. After he entered the command, the target host went down Which of the following nmap command most likely did he enter? A.) # nmap -n -A 10.10.10.10 B.) # nmap -sC 10.10.10.10 C.) # nmap -n --script=all 10.10.10.10 D.) # nmap -n --script=brute 10.10.10.10: C.) # nmap -n --script=all 10.10.10.10 129. What does a SYN scan accomplish? A.) It establishes a full TCP connection B.) It establishes only a "half open" connection. C.) It opens an ACK connection with the target D.) It detects all closed ports on a target system: B.) It establishes only a "half open" connection. 130. Your end clients report that they cannot reach any website on the external network. As the network admin, you decide to conduct some fact finding. Upon your investigation, you determine that you are able to ping outside of the LAN to external websites using their IP address. Pinging websites with their domain name resolution does not work. What is most likely causing the issue? A.) The firewall is blocking DNS resolution B.) The DNS server is not functioning correctly C.) The external websites are not responding D.) HTTP GET request is being dropped at the firewall from going out: B.) The DNS server is not functioning correctly 131. In Linux, what designator is used to uniquely identify a user account? A.) GID B.) SID C.) UID D.) PID: C.) UID 132. Using nmap, what is the correct command to scan a target subnet of 192.168.0.0/24 using ping sweep and identifying the operating system? 15 / 24 E thical Hacking Final Study online at A.) nmap -sP -O 192.168.0.0/24 B.) nmap -sP -V 192.168.0.0/24 C.) nmap sT -P 192.168.0.0/24 D.) nmap -Ps -O 192.168.0.0/24: A.) nmap -sP -O 192.168.0.0/24 133. What is the function of a CNAME record? A.) Provides authentication to a website B.) Encrypts DNS zone transfers C.) Supplements an alias to a domain name D.) Replaces the MX for security transactions: C.) Supplements an alias to a domain name 134. Which tool is used to illuminate a SID for a username? A.) RST B.) FIN C.) None D.) URG and RST: C.) None 135. Which DNS record maps an IP address to a hostname? A.) MX B.) A C.) AAA D.) MR: B.) A 136. Which of the following is a major security problem with telnet? A.) Password files are stored in an unsecure area on disk B.) Memory traces can corrupt file access C.) User IDs and passwords are unencrypted. D.) Telnet sites are unregistered: A.) Password files are stored in an unsecure area on disk 137. In Linux, what file allows you to see user information such as full name, phone number, and office information? A.) shadow file B.) passwd file C.) userinfo file D.) useraccount file: B.) passwd file 16 / 24 E thical Hacking Final Study online at 138. During a annual security training course, you place a call to another employee picked at random who is not part of the training class. In this call you state that you work in the help desk department and request their password in order to reset an account you noticed is locked. What risk are you demonstrating? A.) Social engineering B.) Weak passwords C.) Malware being installed by coworkers D.) Spam emails circulating the office: A.) Social engineering 139. What file within the Linux os contains administrative information about a user? A.) /etc/shadow B.) /etc/passwd C.) /home D.) /home/profile: B.) /etc/passwd 140. Jason managed to grab a password hash from a linux box. Which of the following tools could he not use to crack the password? A.) John the ripper B.) Hashcat C.) Rainbow table: C.) Rainbow table 141. Jason managed to grab a password hash from a window box. According to the organizations password policy, the admin password must be at least 25 characters long and must include numbers, upper and lowercase as well as special characters. Which could be best approach to use the password hash to pivot in the environment? A.) Use John the ripper to crack the password B.) Use hashcat to crack the password C.) Use cain to crack the password D.) Use pass the hash: D.) pass the hash 142. Jason managed to grab a password hash from a linux box. By reviewing the hash, he noticed that the password hash starts with $1$, which encrypt algorithm is used to generate the password hash?: MD5 Ethical Hacking Final Study online at 143. Jason managed to grab a password hash from a linux box. By reviewing the hash, he noticed that the password hash starts with $5$, which encrypt algorithm is used to generate the password hash?: SHA256 144. Jason managed to grab a password hash from a linux box. By reviewing the hash, he noticed that the password hash starts with $6$, which encrypt algorithm is used to generate the password hash?: SHA512 145. What of the following statement on LANMAN hash is not correct? A.) All passwords in LANMAN hash is up to 14 characters long B.) All characters are converted to upper case when calculating LANMAN hash C.) aad3b435b51404ee in LANMAN hash stands for the padding D.) LANMAN hash is no longer available on a Windows box since Windows XP SP3: D.) LANMAN hash is no longer available on a Windows box since Windows XP SP3 146. If a pen tester can not grab any password hash from the orginization environment. Which of the following techniques cannot be used to access a host in the environment? A.) Password guessing B.) Password cracking C. Password spraying D.) Password sniffing: B.) Password cracking 147. What items should not be included in the rules of engagement? A.) test dates and times B.) permission to test C.) contact information D.) Daily debriefing conference call: B.) Permission to test 148. Which technology allows the use of a single public address to support many internal clients while also preventing exposure of internal IP addresses to the outside world? A.) VPN B.) Tunneling C.) NTP D.) NAT: D.) NAT 18 / 24 E thical Hacking Final Study online at 149. A crystal box test means the tester has which of the following? A.) No knowledge B.) Some knowledge C.) Complete knowledge D.) Permission: C.) Complete knowledge 150. What does stateful inspection provide to the network administrator? A.) It tracks all communication streams and the packets are inspected B.) It provides the administrator with a slower network response C.) It ensures that communications are terminated D.) It provides the administrator with reduced admin work.: A.) It tracks all communication streams and the packets are inspected 151. Of the following methods, which one acts as a middleman between an external network and the private network by initiating and establishing connection? A.) Proxy sever B.) Firewall C.) Router D.) Swithc: A.) Proxy server 152. What permission in linux allows you to read? Write? Execute?: 4 2 1 153. On a class C network, how many hosts can network administrators plan for if they are using the subnet mask /27? A.) 16 B.) 32 C.) 64 D.) 128: B.) 32 154. What command can you used to switch to a different user account in linux? A.) swu B.) user C.) sudo D.) su: D.) su 19 / 24 Ethical Hacking Final Study online at 155. Which report would be best given to a client's senior leadership team? A.) Analysis report B.) Project summary report C.) Executive Summary report D.) Chapter summary report: C.) Executive summary report 156. Which of the following denotes the root directory in a linux system? A.) root/ B.) / C.) home\ D.) \home\: B.) / 157. What command would you use to give read, write, and execute privileges for an object to the owner, group and others in linux? A.) chmod 666 B.) chmod 777 C.) chmod 7 D.) chmod 532: B.) chmod 777 158. VRFY is used to do which of the following? A.) Validate an email address B.) Expand a mailing list C.) Validate an email address D.) Test a connection: A.) Validate an email address 159. Where is the password file located on a windows system A.) C:\Windows\temp B.) C:\Win\System\config C.) C:\Windows\accounts\config D.) C:\Windows\system32\config: D.) C:\Windows\system32\config 160. Why would the adversary encode their payload before sending it to the target victim? A.) Encoding the payload will not provide any additional benefit B.) By encoding the payload, the adversary actually encrypts the payload C.) The encoded payload can bypass the firewall because there is no port associated with the payload 20 / 24 E thical Hacking Final Study online at D.) Encoding the payload can bypass IPS/IDS detection because it changes the signature: D.) Encoding the payload can bypass IPS/IDS detection because it changes the signature 161. In the Windows SAM file, what attributes would indicate to the adversary that a given account is an administrator account? A.) 500 B.) 1001 C.) ADM D.) ADMIN_500: B.) 500 162. What sets up a null session using Windows? A.) ftp ://yourdomain.com B.) C$ \\ yourdomain.com C.) net use \\yourdomain\ipc$"" /u : "" D.) netcat yourdomain: C.) net use \\yourdomain\ipc$"" /u : "" 163. To list all inbound SMB connections, which command should be issued? A.) C:\>net view B.) C:\ >net use C.) C:\> net session D.) C:\> net share: C.) C:\> net session 164. To print a blank line, which command should be issued? A.) C:\> echo . B.) C:\> echo. C.) C:\> cls D.) C:\>type line: B.) C:\> echo. 165. To display all local users on a Windows machine, which command should be issued? A.) C:\> net user B.) C:\> net users C.) C:\> net localgroup D.) C:\> net localgroups: A.) C:\> net user 21 / 24 Ethical Hacking Final Study online at 166. Which of the following is a major security problem with FTP? A.) password files are stored in an unsecure area on the disk B.) memory traces can corrupt file access C.) user IDs and passwords are unencrypted D.) FTP sites are unregistered: C.) user IDs and passwords are unencrypted 167. What is the generic syntax of a wireshark filter? A.) protocol.field operator value B.) field.protocol operator value C.) operator.protocol value field D.) protocol.operator field value: A.) protocol.field operator value 168. What network appliance senses irregularities and plays an active role in stopping that irregular activity from continuing? A.) IPS B.) IDP C.) IDS D.) Firewall: A.) IPS 169. Which Wireshark filter displays only traffic from 10.10.10.10? A.) ip.addr =! 10.10.10.10\ B.) ip.addr ne 10.10.10.10 C.) ip.addr == 10.10.10.10 D.) ip.addr - 10.10.10.10: C.) ip.addr == 10.10.10.10 170. Enumeration is useful to system hacking because it provides which of the following? A.) Passwords B.) IP ranges C.) Configurations D.) Usernames: D.) Usernames 171. The Wayback Machine is used to do which of the following? A.) Get job postings B.) View websites C.) View archived versions of websites D.) Back up copies of websites: C.) View archived versions of websites 22 / 24 E thical Hacking Final Study online at 172. At which layer does a packet-filtering firewall work? A.) Layer 1 B.) Layer 2 C.) Layer 3 D.) Layer 4: C.) Layer 3 173. Which tool can trace the route of a packet? A.) ping B.) tracert C.) whois D.) DNS: B.) tracert 174. What is DNS poisoning?: When the adversary replaces the legitimate ip address that is mapped to the domain name with the malicious ip 175. What prevent packets from circling the internet forever? A.) TTL B.) Spanning tree C.) Broadcast domains D.) NAT: A.) TTL 176. Which flag forces both the sender and receiver on the network to terminate their connection with one another? A.) FIN B.) RST C.) URG D.) SYN: A.) FIN 177. Which of the following is part of the overall portion of the SID? A.) UID B.) RID C.) USD D.) L5R: B.) RID 178. Which switch in the nmap allows for a full TCP connect scan? A.) -sS B.) -sU 23 / 24 E thical Hacking Final Study online at C.) -Fc D.) -sT: D.) -sT 179. An attacker was able to install a device at an unattended workstation and was able to recover passwords, usernames and account information. What did the attacker install? A.) Key logger B.) Key scanner C.) Root kit D.) Trojan: A.) Key logger 180. What program can be used to locate firewalls? A.) Metasplot B.) Traceroute C.) Nslookup D.) Dig: B.) Traceroute