Ethical Hacking 102 T/F

A brute-force attack tries passwords that are pulled from a predefined list of words.

False

A denial of service (DoS) attack is considered a critical problem because it is very difficult to defeat.

False

A distributed denial of service (DDoS) attack is mostly an annoyance however a denial of service (DoS) attack is much more of a problem.

False

A drawback to public key infrastructure (PKI) is that the two parties must have prior knowledge of one another in order to establish a relationship.

False

A poison null byte attack uploads masses of files to a server with the goal of filling up the hard drive on the server in an attempt to cause the application to crash.

False

A session, the connection that a client has with the server application, should use the same identifier, encryption, and other parameters every time a new connection between client and server is created, rather than create new information for each connection and then discard it each time.

False

A site administrator can block the Internet Archive from making snapshots of the site.

False

Accumulating as many connections as possible on social media (seeking quantity over quality) makes it less likely that you will link or "friend" a scam artist or an identity thief.

False

Active fingerprinting takes longer than passive fingerprinting.

False

Adware is a type of malware designed to trick victims into purchasing and downloading useless and potentially dangerous software.

False

An advantage to brute-force password attacks is that they typically do not take much time to perform.

False

An effective method for uncovering database problems is to consider the security problem simply from an insider's perspective, rather than an outsider's perspective.

False

Antivirus software cannot detect suspicious behavior of applications on a system.

False

Because wardialing involves the use of modems, it is out of date and should no longer be used.

False

Covert channels are not capable of transferring information using a mechanism that was not designed for the purpose. Select one:

False

Databases are rarely a target for attackers because many of them are "unhackable."

False

Delivering malicious software via instant messaging (IM) is relatively difficult because IM software has had strong security controls from the beginning.

False

Fail-open state results in closed and completely restricted access or communication.

False

Firewalls provide very little protection to a database server.

False

Future generations of cryptography technology will most likely represent an evolution of past technologies and techniques.

False

In symmetric encryption, one key is used for encryption and a separate key is used for decryption.

False

It is much harder to detect active OS fingerprinting than passive OS fingerprinting.

False

Logic bombs are relatively easy to detect.

False

Many attackers gain access to their target system through something known as a window.

False

Modern antivirus software is not equipped to deal with the problems polymorphic viruses pose.

False

Most encryption cannot be broken.

False

Most users of social networking sites are diligent about protecting their personal information through privacy settings and similar configuration options available on these sites.

False

Obtaining financial information on companies operating in the United States is difficult because financial records on publicly traded companies are not available to the public.

False

Over the past several years, social networking sites have become less and less of a target for cybercriminals.

False

Over time, corporations have been moving fewer and fewer services to the cloud.

False

Placing a backdoor on a system prevents an attacker from coming back later in an attempt to take control of the system. Select one:

False

Private information on Facebook is truly private.

False

Safe browsing practices have little to do with whether individuals become victims online.

False

Sanitizing a Web posting refers to a company deleting information that others may find insensitive or offensive.

False

Scareware is software specifically designed to display advertisements on a system in the form of pop-ups or nag screens.

False

Social networking means tricking or coercing people into revealing information or violating normal security practices.

False

Structured Query Language (SQL) injections require very little skill or knowledge to execute.

False

Symmetric encryption is also called public key cryptography

False

The Security Account Manager (SAM) is a file that resides on the network, not on the hard drive, and is not actively accessed while Windows is running.

False

The ever-increasing amount of personal information that people put online themselves has made gathering information on human beings more difficult.

False

The first viruses debuted in the "wild" in the 1990s as ways to destroy exam records at universities.

False

The goals of confidentiality and integrity are basically the same.

False

The manual method of obtaining network range information is quick, but it is largely ineffective. Select one:

False

The mere existence of an open port means vulnerability exists.

False

The popularity of services such as Facebook, LinkedIn, and Twitter has made the loss of information or loss of control of that information through social media less of a concern.

False

User Datagram Protocol (UDP) acknowledges each connection attempt; Transmission Control Protocol (TCP) does not, so it tends to produce less reliable results.

False

Whenever possible, security practitioners work to encourage people to use their social network for both their professional activities and their personal activities.

False

Worms require user intervention for their infection to take place; viruses do not.

False

A buffer overflow can result in data being corrupted or overwritten.

True

A code is a mechanism that relies on the usage of complete words or phrases, whereas ciphers utilize single letters to perform encryption.

True

A countermeasure for protecting domain information is to employ commonly available proxy services to block the access of sensitive domain data.

True

A good way to prevent Structured Query Language (SQL) injection attacks is to use input validation, which ensures that only approved characters are accepted.

True

A one-way hash function is also known as a fingerprint.

True

A persuasion/coercion attack is considered psychological.

True

A ping is actually an Internet Control Message Protocol (ICMP) message.

True

A rootkit can provide a way to hide spyware such as a keystroke logger so that it is undetectable even to those looking for it. Select one:

True

An attacker can use enumeration methods to determine whether or how a target can respond to system hacking activities.

True

An organization's Web server is often the public face of the organization that customers and clients see first

True

Brutus is a password cracker that is designed to decode different password types present in Web applications.

True

Databases can be easily missed because they may be installed as part of another application or just not reported by the application owner.

True

Defacing a Web site is one of the most common acts of vandalism against Web sites.

True

Digital signatures are a combination of public key cryptography and hashing. Select one:

True

Education is the first line of defense for stopping both worms and viruses.

True

Enumeration represents the point at which the attack crosses the legal line to being an illegal activity in some areas.

True

Error messages should be considered a potential Web server vulnerability because they can provide vital information to an attacker.

True

For both symmetric and asymmetric cryptography, data is encrypted by applying the key to an encryption algorithm.

True

For many businesses, a social media presence is a key part of the corporate communications strategy.

True

Hardware-based keystroke loggers can be plugged into a universal serial bus (USB) or PS2 port on a system and monitor the passing signals for keystrokes.

True

Hoax viruses are those designed to make the user take action even though no infection or threat exists.

True

If any part of a multipartite virus is not eradicated from the infected system, it can re-infect the system.

True

In some cases, spyware creators have stated their intentions outright by presenting End-User License Agreements (EULAs) to the victim.

True

In symmetric encryption, the length of the key and the quality of the algorithm will determine how secure the encryption system is.

True

In the Windows OS, the NetBIOS service is commonly targeted by attackers because diverse information can be obtained, including usernames, share names, and service information.

True

Input validation refers to restricting the type of input or data the Web site will accept so that mistakes will not be entered into the system.

True

It is worthwhile to conduct an Internet search on yourself in order to see what personal information is available about you online.

True

Malware can be used to turn a system into a server hosting any type of content, such as illegal music or movies, pirated software, pornography, and financial data.

True

Malware in the current day has been adopted by criminals for a wide array of purposes to capture information about the victim or commit other acts.

True

Nmap is valuable in OS fingerprinting as well as port scanning.

True

Of the tools for detecting Trojans, one of the easiest to access would be the command line tool known as netstat.

True

Offline attacks are a form of password attack that relies on weaknesses in how passwords are stored on a system.

True

Once escalated privileges have been obtained, the PsTools suite makes it possible for an attacker to run an application on a remote system rather easily.

True

One of the common problems that make password attacks effective is that many people use ordinary words as their password.

True

One of the main characteristics of worms is that they do not need a host program to function.

True

Process isolation provides extra protection against catastrophic failure of a system by ensuring that one process crashing will not take others with it.

True

Public key infrastructure (PKI) addresses storing, managing, distributing, and maintaining keys and digital certificates securely.

True

Rainbow tables compute every possible combination of characters prior to capturing a password so that the attacker can then capture the password hash from the network and compare it with the hashes that have already been generated

True

SolarWinds has the ability to generate network maps that can be viewed in products such as Microsoft's diagramming product Visio.

True

Substitution, transposition, stream, and block are common forms of ciphers.

True

Symmetric encryption is inherently faster than asymmetric encryption due to the nature of the computations performed.

True

The Whois tool has been used by law enforcement to gain information useful in prosecuting criminal activity.

True

The purpose of OS fingerprinting is to determine the operating system that is in use on a specific target.

True

The strength of asymmetric encryption is that it addresses the key distribution problem inherent with symmetric encryption.

True

The terms algorithm and cipher describe the formula or process used to perform encryption.

True

There are currently five primary Regional Internet Registries (RIRs) across the globe

True

U.S. laws regulate the exportation of cryptographic systems.

True

When working on securing Web applications, the safety of information must be considered both when it is being stored and when it is being transmitted, because both stages are potential areas for attack.

True

With passive fingerprinting, the victim has less chance of detecting and reacting to the impending attack.

True

Wrappers can be used to merge an attacker's intended payload with a harmless executable to create a single executable from the two.

True

ohnny Long's Google Hacking Database (GHDB) is a database of queries that can be used to conduct a Google Web search to identify sensitive data and content.

True

A number of different methods can be used to deface a Web site.

True