FINAL

What would a signal range for a Bluetooth device commonly be?

300 ft for 4.0

What would you use a bluebugging attack for?

A bluebugging attack is used to gain access to a smartphone in order to initiate a call out to the attacker's phone. This allows the attacker to listen to anything happening around the phone owner

XSS attack

A cross-site scripting attack is one that uses the web server to attack the client side

man-in-the-middle attack

A form of eavesdropping where the attacker makes an independent connection between two victims and steals information to use fraudulently.

1st type of ids

A host-based IDS watches activity on a local system, such as changes to critical system files. It may also watch log files or audit other system behaviors.

What tool could you use to enable sniffing on your wireless network to acquire all headers?

Airmon-ng

Smurf Attack

An attack that broadcasts a ping request to all computers on the network yet changes the address from which the request came to that of the target.

What can an intrusion prevention system do that an intrusion detection system can't?

Block or reject network traffic

Why is bluesnarfing potentially more dangerous than bluejacking from the standpoint of the victim?

Bluejacking receives while bluesnarfing sends.

Port 53

DNS (Domain Name System)

TCP vulnerabilities

Denial of Service Attacks

What type of attack is a compromise of availability?

DoS

How would you ensure that confidentiality is implemented in an organization?

Encryption

IP Vulnerabilities

Expose IoT

Restricted

Exposure of restricted data would have undesirable effects.

Port 21

FTP (File Transfer Protocol) Command

Port 20

FTP (File Transfer Protocol) Data

How to find the port address on Wireshark

Find the TCP packets and look at the TCP layer details

What is the purpose of a deauthentication attack?

Forcing stations to reauthenticate

How many stages are used in the WPA handshake?

Four

An intrusion detection system can perform which of the following functions?

Generate alerts on traffic

Port 80

HTTP (HyperText Transfer Protocol) - used for transferring web pages

Port 443

HTTPS (Hyper Text Transfer Protocol Secure) Secure communications

What protocol is used for a Smurf attack?

ICMP

WPA2 (Wi-Fi Protected Access 2)

IEEE 802.11i-2004

What is the purpose of performing a Bluetooth scan?

Identifying endpoint

What is Weak in WEP

Initialization Vector

If you were implementing defense in breadth, what might you do?

Introduce a DevSecOps culture

IPS

Intrusion Prevention System will drop and reject malicious traffic

ARP Poisoning

Occurs con the Communication Layer The attacker use the same LAN. The attacker associates his MAC address with the IP address of the target so that any traffic meant for the target is received by the attacker.

What types of authentication are allowed in a WPA-encrypted network?

Personal and enterprise

What are the phases of the ISO 27001 cycle?

Plan, Do, Check, Act

How would you calculate risk?

Probability * loss value

Port 25

SMTP (Simple Mail Transfer Protocol) Routing mail between mail servers

Port 22

SSH (Secure Shell) Secure login, file transfer and port fowarding

TCP 3-way handshake

Sender sends a SYN, Receiver sends a SYNACK, Sender sends an ACK

Fraggle Attack

Smurf attack variation that uses UDP instead of ICMP.

Which of the following products might be used as an intrusion detection system?

Snort

How does an evil twin attack work?

Spoofing an SSID

UDP vulnerability

Spoofing and DOS attacks

How to find the destination address on Wireshark

Statics, Conversations, Ethernet TAP

DNS Poisoning

Technique used by criminals to alter DNS records and drive users to fake sites, to committing phishing.

Port 23

Telnet Unencrypted text communications

TCP SYN Attack

The connection stays open because the ACK from the sender was never sent. Since the connection is open give space for a lot of other connections to stay half open and confuse the server.

Confidential

The exposure of confidential information would cause damage to national security.

Secret

The exposure of secret information would cause serious damage to national security.

Top secret

The highest level of data classification. Only a very limited number of people will be able to look at data classified as top secret.

If you were to see that someone was using OpenVAS, followed by Nessus, what might you assume?

They were trying to reduce false positives

Official

This is information that relates to government business and may not be an indicator of the potential for harm if the information were lost or exposed.

What would be necessary for a TCP conversation to be considered ESTABLISHED by a stateful firewall?

Three-way handshake complete

Which information would a packet filter use to make decisions about what traffic to allow into the network?

UDP source port

Unclassified

Unclassified information can be viewed by everyone. This may include declassified information that was once considered a higher classification but the threat posed by its exposure has subsided.

To remove malware from the network before it gets to the endpoint, you would use which of the following?

Unified threat management appliance

What important event can be exposed by enabling auditing?

User login

How to find the source address on Wireshark

View and Analyze the frame, look at the address resolution protocol section

Which of these isn't an example of an attack that compromises integrity?

Watering hole

Which of these is an example of an application layer gateway?

Web application firewall

WPA2

WiFi Protected Access 2

WPA

Wifi Protected Access: use the TKIP encryption method. It was designed to replace WEP. use RC4 stream cipher

What tool would allow you to run an evil twin attack?

Wifiphisher

WEP

Wired Equivalence Protocol.

What would be a reason to use the Override feature in OpenVAS?

You want to change a severity rating on a finding.

2nd type of IDS

a network IDS can take some of the same sorts of rules and generate log messages.

Fragmentation Attack

attacks can be used to evade network security mechanisms simply because these devices, when they are inline, would take time to reassemble the messages before the adversarial activity would be seen. This reassembly takes time and so some devices just don't bother because the reassembly and detection can add latency to communications.

Land Attack

sets the source and destination information of a TCP segment to be the same. This sends the segment into a loop in the operating system, as it is processed as an outbound, then an inbound, and so forth. This loop would lock up the system.

Evil Twin Attack

uses a rogue access point to pretend to be a legitimate network