Penetration Review 1

A NULL scan requires setting the FIN, ACK, and URG flags. True or False?

False

A written contract isn't necessary when a friend recommends a client. True or False?

False

Antivirus software should be updated annually. True or False?

False

Fping doesn't allow pinging multiple IP addresses simultaneously. True or False?

False

The Ping of Death is an exploit that sends multiple ICMP packets to a host faster than the host can handle. True or False?

False

Which of the following is one method of gathering information about the operating systems a company is using?

a. Search the Web for e-mail addresses of IT employees.

If you're trying to find newsgroup postings by IT employees of a certain company, which of the following Web sites should you visit?

a. http://groups.google.com

Which of the following Nmap commands sends a SYN packet to a computer with the IP address 193.145.85.210? (Choose all that apply.)

a. nmap -sS 193.145.85.210 b. nmap -v 193.145.85.210

Which Nmap command verifies whether the SSH port is open on any computers in the 192.168.1.0 network? (Choose all that apply.)

a. nmap -v 192.168.1.0-254 -p 22 d. nmap -v 192.168.1.0/24 -p 22

Entering a company's restricted area by following closely behind an authorized person is referred to as which of the following?

b. Piggybacking

The netstat command indicates that POP3 is in use on a remote server. Which port is the remote server most likely using?

b. Port 110

What port, other than port 110, is used to retrieve e-mail?

b. Port 143

To bypass some ICMP-filtering devices on a network, an attacker might send which type of packets to scan the network for vulnerable services? (Choose all that apply.)

b. SYN packets c. ACK packets

Many social engineers begin gathering the information they need by using which of the following?

b. The telephone

A ping command initially uses which ICMP type code?

b. Type 8

A computer ____________ relies on a host to propagate throughout a network

b. Virus

Which of the following is not a valid octal number?

c. 3482

A penetration tester is which of the following?

c. A security professional who's hired to hack into a network to discover vulnerabilities

What portion of your ISP contract might affect your ability to conduct a penetration test over the Internet?

c. Acceptable use policy

What's the first method a security tester should attempt to find a password for a computer on the network?

c. Ask the user.

Before conducting a security test by using social-engineering tactics, what should you do?

c. Get written permission from the person who hired you to conduct the security test.

Which of the following enables you to view all host computers on a network?

c. Zone transfers

TCP communication can be likened to which of the following?

d. Phone conversation

What port does DNS use?

d. Port 53

A closed port responds to a SYN packet with which of the following packets?

d. RST

A team composed of people with varied skills who attempt to penetrate a network is called which of the following?

d. Red team

List three types of malware.

viruses, worms, Trojan programs, adware, and spyware

What three models do penetration or security testers use to conduct tests?

white box, black box, gray box

Which parameter can be added to nmap to run a script scan with the default scripts?

-sC

List the six flags of a TCP packet.

SYN, ACK, PSH, URG, RST, FIN

List the three components of the TCP/IP three-way handshake.

SYN, SYN-ACK, and ACK

. One purpose of adware is to determine users' purchasing habits. True or False?

True

. Security testers can use Hping to bypass filtering devices. True or False?

True

A UDP packet is usually smaller than a TCP packet. True or False?

True

A cookie can store information about a Web site's visitors. True or False?

True

An exploit discovered for one OS might also be effective on another OS. True or False?

True

FTP offers more security than TFTP. True or False?

True

An exploit that leaves an attacker with another way to compromise a network later is called which of the following? (Choose all that apply.)

a. Rootkit d. Backdoor

List three worms or viruses that use e-mail as a form of attack.

Waledec, Nimda, Melissa, and W32/Sobig.F

The U.S. Department of Justice defines a hacker as which of the following?

a. A person who accesses a computer or network without the owner's permission

Why does the fping -f 193.145.85.201 193.145.85.220 command cause an error?

a. An incorrect parameter is used.

An exploit that attacks computer systems by inserting executable code in areas of memory because of poorly written code is called which of the following?

a. Buffer overflow

As a security tester, what should you do before installing hacking software on your computer?

a. Check with local law enforcement agencies.

Which federal law prohibits unauthorized access of classified information?

a. Computer Fraud and Abuse Act, Title 18

How can you find out which computer crime laws are applicable in your state?

a. Contact your local law enforcement agencies.

Which of the following contains host records for a domain?

a. DNS

What is the main purpose of malware?

a. Doing harm to a computer system

What's the hexadecimal equivalent of the binary number 1111 1111?

a. FF

Which flags are set on a packet sent with the nmap -sX 193.145.85.202 command? (Choose all that apply.)

a. FIN b. PSH d. URG

Security testers and hackers use which of the following to determine the services running on a host and the vulnerabilities associated with these services?

a. Gaining access to shares and network resources b. Obtaining user logon names and group memberships

Which organization issues the Top 25 list of software errors?

a. SANS Institute

A security tester should have which of the following attributes? (Choose all that apply.)

a. Good listening skills b. Knowledge of networking and computer technology c. Good verbal and written communication skills d. An interest in securing networks and computer systems

What is a potential mistake when performing a ping sweep on a network?

a. Including a broadcast address in the ping sweep range

What organization designates a person as a CISSP?

a. International Information Systems Security Certification Consortium (ISC2)

A(n) _______________ scan sends a packet with all flags set to NULL.

a. NULL

On a Windows computer, what command can you enter to show all open ports being used?

a. Netstat

What is the most widely used port-scanning tool?

a. OpenVAS b. DumpSec d. Hyena

Shoulder surfers can use their skills to find which of the following pieces of information? (Choose all that apply.)

a. Passwords b. ATM PINs c. Long-distance access codes

Which command verifies the existence of a node on a network?

a. Ping

When conducting competitive intelligence, which of the following is a good way to determine the size of a company's IT support staff?

a. Review job postings on Web sites such as www.monster.com or www.dice.com.

Which of the following exploits might hide its destructive payload in a legitimate application or game?

a. Trojan program

To see a brief summary of Nmap commands in a Linux shell, which of the following should you do?

a. Type nmap -h.

Which of the following protocols is connectionless? (Choose all that apply.)

a. UDP b. IP

What social-engineering technique involves telling an employee that you're calling from the CEO's office and need certain information ASAP? (Choose all that apply.)

a. Urgency c. Position of authority

What's one way to gather information about a domain?

a. View the header of an e-mail you send to an e-mail account that doesn't exist.

To find information about the key IT personnel responsible for a company's domain, you might use which of the following tools? (Choose all that apply.)

a. Whois c. SamSpade

Which of the following doesn't attach itself to a host but can replicate itself?

a. Worm

Before using hacking software over the Internet, you should contact which of the following? (Choose all that apply.)

a. Your ISP c. Local law enforcement authorities to check for compliance

Which of the following tools can assist you in finding general information about an organization and its employees? (Choose all that apply.)

a. www.google.com b. http://groups.google.com

The base-64 numbering system uses ____________ bits to represent a character.

b. 6

What exploit is used to elevate an attacker's permissions by inserting executable code in the computer's memory?

b. Buffer overflow

What organization offers the CEH certification exam?

b. EC-Council

Which federal law prohibits intercepting any communication, regardless of how it was transmitted?

b. Electronic Communication Privacy Act

A software or hardware component that records each keystroke a user enters is called which of the following?

b. Keylogger

Which of the following is a good place to begin your search for vulnerabilities in Microsoft products?

b. Microsoft Security Bulletins

Which of the following is a tool for creating a custom TCP/IP packet and sending it to a host computer?

c. Hping

What protocol is used for reporting or informational purposes?

c. ICMP

Some experienced hackers refer to inexperienced hackers who copy or use prewritten scripts or programs as which of the following? (Choose all that apply.)

c. Packet monkeys d. Script kiddies

A FIN packet sent to a closed port responds with which of the following packets?

c. RST

To determine whether scanning is illegal in your area, you should do which of the following?

c. Refer to state laws.

Which protocol offers guaranteed delivery and is connection oriented?

c. TCP

What command is used to log on to a remote server, computer, or router?

c. Telnet

"Destination Unreachable" is designated by which ICMP type code?

c. Type 3

Which of the following is a fast and easy way to gather information about a company? (Choose all that apply.)

c. View the company's Web site. d. Look for company ads in phone directories.

The ISN is set at which step of the TCP three-way handshake?

d. 1 and 2

To reduce the risk of a virus attack on a network, you should do which of the following?

d. All of the above

Port scanning provides the state for all but which of the following ports?

d. Buffered

______________ is one of the components most vulnerable to network attacks.

d. DNS

What type of network attack relies on multiple servers participating in an attack on one host system?

d. Distributed denial-of-service attack

If you run a program in New York City that uses network resources to the extent that a user is denied access to them, what type of law have you violated?

d. Federal

What component can be used to reduce the risk of a Trojan program or rootkit sending information from an attacked computer to a remote host?

d. Firewall

In basic network scanning, ICMP Echo Requests (type 8) are sent to host computers from the attacker, who waits for which type of packet to confirm that the host computer is live?

d. ICMP Echo Reply (type 0)

What is an OSCP?

d. ISECOM

To determine a company's primary DNS server, you can look for a DNS server containing which of the following?

d. SOA record

Discovering a user's password by observing the keys he or she presses is called which of the following?

d. Shoulder surfing

Which protocol uses UDP?

d. TFTP

Which federal law amended Chapter 119 of Title 18, U.S. Code?

d. U.S. Patriot Act, Sec. 217: Interception of Computer Trespasser Communications

. Which of the following is an example of a macro programming language?

d. Visual Basic for Applications

To find extensive Nmap information and examples of the correct syntax to use in Linux, which of the following commands should you type?

d. man nmap

Which of the following is a good Web site for gathering information on a domain?

e. All of the above