ITN 261 final review
The __________ contains abundant information about common software vulnerabilities and exploits
CVE listing database
In which phase of the incident response process do you control the event as much as possible in order to stop the threat
Containment
Which of the following refers to the malicious insertion of scripting code to extract data or modify a Web site's code, application, or content?
Cross-site scripting (XSS)
Which of the following statements is true regarding information security breaches?
Cyber laws act as a broad deterrent but they do not secure networks from malicious activity
Which of the following is an approach to identifying viruses in which the program uses a signatures database to identify a virus?
Dictionary-based detection
Which phase of the incident response process includes collecting evidence without destroying or altering it, as well as removing the threat?
Eradication
Which of the following statements is true regarding ethical hacking?
Ethical hackers follow the same approach that hackers use to compromise remote systems and networks
What distinguishes ethical hackers from other intruders?
Ethical hackers obtain written permission to run security tools within the organization's network
Which of the following terms is used to describe a correctly formatted document that appears to be malware to an antivirus program?
False positive
Which of the following statements is true regarding security countermeasures on your wireless access point (WAP)?
Hashing should be used for data transmissions and e-mails through WLANs.
In which phase of the incident response process do you establish just what has actually occurred
Identification
Which of the following statements is true regarding intrusion detection systems (IDS)?
Intrusion detection systems are alert-driven, but they require the information systems security practitioner to configure them properly
Which of the following block IP traffic based on the filtering criteria that the information systems security practitioner configures?
Intrusion prevention systems (IPS)
Metasploit is part of the __________ security distribution for Linux
Kali
Which phase of the incident response process is used to determine what went right during the incident response, what went wrong, and how to make the process better?
Lesson Learned
Which of the following terms refers to anything developed for the purpose of doing harm?
Malware
Which of the following statements is true regarding building a baseline definition?
Network engineers use baseline analysis to identify anomalies that could indicate problems
Zenmap is a graphical interface for __________, a port scanning tool that can quickly identify hosts and detect what operating system and services are running on them, and all without privileged access.
Nmap
Which of the following statements is true regarding external intrusion detection system (IDS) and intrusion prevention system (IPS) devices?
Normal hacking applications and tools that generate ICMP, IP, UDP, and TCP should be identified and blocked on these devices.
In Wireshark, which statistical feature can identify the packet size distribution of the capture
Packet Lengths
Which of the following are used to help reveal multiple layers of defense, help reveal application layer security protocols, and help validate network layer security settings by ensuring demilitarized and other isolated zones function as expected?
Penetration tests
Which phase of the incident response process ensures that there is a plan in place for handling incidents, a team responsible for investigating, and procedures for consistency?
Preparation
In Wireshark, which statistical feature identifies what protocols were on the LAN segment and which ones were permitted to be on the LAN segment?
Protocol Hierarchy
Which of the following is an encrypted footprint key that is faster at validation (but slower at signature generation) and is used for encrypting and signatures?
RSA—Rivest, Shamir and Adelman
In which phase of the incident response process is the affected system tested, restored, and returned to service?
Recovery
Which of the following checkbox options would you use to ensure that a scan will run on startup if the computer were off at the scheduled time?
Run when computer starts up if task has been missed
In general, which of the following is accomplished by appending a valid SQL command to the input that is being passed through a Web form into the database behind it?
SQL injection
Which of the following are used by data gatherers to find a large amount of information about a company, using not only the officially released information, but also information in publications and other Web sites?
Search engines
Which of the following refers to an event in an organization that can include accidental actions or malicious actions that result in a problem?
Security incident
Database administrators should monitor their SQL databases for unauthorized or abnormal SQL injections and write scripts for alarming as well as __________ alerts
Simple Network Management Protocol (SNMP)
Which of the following can perform protocol analysis, content searching/matching, and can be used to detect a variety of attacks and probes?
Snort
Which of the following is a connection-oriented protocol that is used by applications that require this type of behavior?
TCP
What step in the hacking attack process identifies known vulnerabilities?
The enumeration phase
Which of the following can a hacker derive from the IP address of a target server?
The physical location of the server's data center
Which of the following do you need to decrypt encrypted messages and files from a trusted sender?
The sender's public key
Which of the following is an encryption method that has only 40-bits of encryption?
WEP (Wired Equivalent Privacy)
Which of the following is an encryption method that has 128-bits of encryption and is a subset of IEEE 802.11i?
WPA (WiFi Protected Access)
Which of the following is an encryption method that has 256-bits of encryption and is the full implementation of IEEE 802.11i?
WPA2 (WiFi Protected Access 2)
Which of the following statements is true regarding wireless networks (WLANs)?
Wireless networks open the company to risks not found in a wired network
Which of the following tools does not have a limitation on the size of the capture file, which makes it better suited to protocol capture?
Wireshark
A slow response opening applications or browsing the Internet, applications not working as they normally would, and the operating system not booting up correctly are all symptoms of:
a malware infection
Vulnerability checks can be run
against specific ports to find additional vulnerabilities that might need to be addressed
Which of the following commands is a scripting function used to generate a pop-up window with the message "Here is proof of a vulnerability"?
alert
Creating a baseline definition is done by
analyzing network traffic
During the XSS test, the fact that the Web form was able to correctly process the simple alert script indicated that there was a good chance that
any type of malicious script could be run
It is critical to use encryption techniques on a wireless LAN because the data payload within IP packets, including logons, passwords, and privacy data, would otherwise
appear in cleartext
DSA (Digital Signature Algorithm) and RSA (Rivest-Shamir-Adleman) are common __________ algorithms that can be used to successfully encrypt data and decrypt data
asymmetric encryption
In __________, a key pair is generated, one key is kept private and the other is shared
asymmetric encryption
Knowing and understanding what protocols and what size of Ethernet frames are being used for the transmission on the LAN segment is an important
baseline definition
As long as the content within a file does not change, the hash value (or checksum) will
calculate the same value every time
If e-commerce or privacy data is entered into a Web application, the company is bound by __________ to ensure the confidentiality of customer data
compliance laws and standards
Encryption is used for ensuring the __________ of the message
confidentiality
The -O switch in the Nmap commands you ran in this lab (for example, nmap -O -v 10.20.100.50) instructed Nmap to
detect the operating system of the machine
The purpose of __________ within an organization is to proactively locate vulnerabilities in an organization's defenses, and correct them to strengthen overall security
ethical hacking
Monitoring __________ allows information systems security practitioners to see who and what is attempting to infiltrate the IP network
external network traffic
The goal of a cross-site scripting (XSS) attack is usually to:
gain administrator or some other elevated level of user privileges
The more bits in the hash sum, the
greater the integrity checking of each bit that is transmitted from the source to its destination
For security reasons, it is important to __________ and to conduct regular site surveys and audits
have a wireless access policy
Hackers often use __________ instead of cleartext to make the scripts harder to detect
hexadecimal character strings
Often, programmers forget to __________, which then makes an application vulnerable to SQL injection
include script handling for special characters like apostrophes in their data input forms
The information you gathered in the lab's tests, along with the ability to write to a file, indicates that you have found a(n)
injectable database
Hashes are used for ensuring the __________ of the message
integrity
Prevention and detection are the two major categories of
internal controls
Monitoring __________ allows network analysts to see exactly which hosts may be compromised and what destination IP addresses employees are accessing
internal network traffic
When Snort captures and examines IP packets, it
looks for specific IP packet traffic patterns and abnormal traffic attempting to enter a network
A network baseline definition is a record of
normal network performance
Network and system engineers and information systems security professionals can help ensure Web application security through regular
penetration testing
Penetration testers
prioritize any findings and recommended policy and control changes.
A message digest, or hash, algorithm takes a string of text (the contents of your file or message) and:
produces a fixed-length set of hexadecimal characters
By its nature, WHOIS information must be
publicly available
An ethical hacker
recommends specific countermeasures for remediating the vulnerabilities and eliminating the exploits
The first phase of hacking is __________ phase, which is designed to gain as much information about a target organization and its systems as possible
reconnaissance
In the lab, Metasploit was able to connect to the victim system with __________ access, and without requiring a password
root-level
The following command line syntax (nmap --script=smb-check-vulns -p445 192.168.3.25) was used to
run a vulnerability check on port 445
The following command line syntax (nmap --script=smb-check-vulns -p445 10.20.100.50) was used for
running an SMB vulnerability scan against 10.20.100.50
It is the responsibility of the organization's __________ to know their networks and remove any possible point of entry before that happens
security and administration team
At the end of the lab, you drafted a WLAN __________ to mitigate the risk, threats, and vulnerabilities identified by the lab.
security implementation plan
An organization's __________ identifies the incident response team roles, responsibilities, and processes for performing an incident response
security policy
Cross-site scripting (XSS) vulnerabilities are generally found in Web forms that
send and retrieve data to databases via HTML
Antivirus vendors usually update their antivirus signature files
several times per week
Isolation, firewalls, and even IDS/IPS devices
should be considered as part of a WLAN layered security strategy
The -v switch in the Nmap commands you ran in this lab (for example, nmap -O -v 10.20.100.50) instructed Nmap to
show a great deal of detail
To establish a connection-oriented connection, a(n) __________ (SYN > SYN-ACK > ACK) is performed between the IP source and IP destination
three-way handshake
Which of the following is used to identify the network path that must be followed to reach one system from another?
traceroute
Penetration testing should be performed whenever the Web application or service is:
updated or modified
There is little point in hardening a system if it is already compromised. Therefore, a __________ is an important first step in locking down any system
virus scan
Penetration tests are also called
vulnerability scans