ISM 4320 Midterm
Which parameter can be added to nmap to run a script scan with the default scripts?
-sC
The ISN is set at which step of the TCP three-way handshake?
1 and 2
The netstat command indicates that POP3 is in use on a remote server. Which port is the remote server most likely using?
110
Which port numbers indicate NetBIOS is in use on a remote target?
135-139
Enumeration of Windows systems can be more difficult if which port is filtered?
139/TCP
What port, other than port 110, is used to retrieve e-mail?
143
A NetBIOS name can contain a maximum of how many characters?
15
Which of the following is not a valid octal number? 7770 5555 4567 3482
3482
What port does DNS use?
53
The base-64 numbering system uses how many bits to represent a character?
6
The U.S. Department of Justice defines a hacker as which of the following?
A person who accesses a computer or network without the owner's permission
A penetration tester is which of the following? A security professional who's hired to break into a network to discover vulnerabilities A person who uses telephone services without payment A person who breaks into a computer or network without permission from the owner A hacker who breaks into a system without permission but doesn't delete or destroy files
A security professional who's hired to break into a network to discover vulnerabilities
What portion of your ISP contract might affect your ability to conduct a penetration test over the Internet?
Acceptable use policy
To reduce the risk of a virus attack on a network, you should do which of the following? Educate users about opening attachments from suspicious e-mail. Use antivirus software. All of the above Keep virus signature files current.
All of the above
Which of the following is a good Web site for gathering information on a domain? www.arin.net http://centralops.net/co/ All selections www.google.com www.namedroppers.com
All selections
Why does the fping -f 193.145.85.201 193.145.85.220 command cause an error?
An incorrect parameter is used.
What's the first method a security tester should attempt to find a password for a computer on the network?
Ask the user
An exploit that attacks computer systems by inserting executable code in areas of memory because of poorly written code is called which of the following?
Buffer overflow
What exploit is used to elevate an attacker's permissions by inserting executable code in the computer's memory?
Buffer overflow
Port scanning provides the state for all but which of the following ports? Open Closed Filtered Buffered
Buffered
As a security tester, what should you do before installing hacking software on your computer?
Check with local law enforcement agencies.
Which federal law prohibits unauthorized access of classified information?
Computer Fraud and Abuse Act, Title 18
How can you find out which computer crime laws are applicable in your state?
Contact your local law enforcement agencies.
Which of the following components is most vulnerable to network attacks? WINS DNS TCP/IP DHCP
DNS
Which of the following contains host records for a domain? UNIX Web clients WINS Linux server DNS
DNS
What type of network attack relies on multiple servers participating in an attack on one host system?
Distributed denial-of-service attack
What organization offers the CEH certification exam?
EC-Council
Which federal law prohibits intercepting any communication, regardless of how it was transmitted?
Electronic Communication Privacy Act
Which of the following testing processes is the most intrusive? Null scanning Numeration Port scanning Enumeration
Enumeration
What's the hexadecimal equivalent of the binary number 1111 1111?
FF
A NULL scan requires setting the FIN, ACK, and URG flags. True or False?
False
A written contract isn't necessary when a friend recommends a client. True or False?
False
Antivirus software should be updated annually. True or False?
False
Fping doesn't allow pinging multiple IP addresses simultaneously. True or False?
False
The Nbtstat command is used to enumerate *nix systems. True or False?
False
The Ping of Death is an exploit that sends multiple ICMP packets to a host faster than the host can handle. True or False?
False
The Windows Net use command is a quick way to discover any shared resources on a computer or server. True or False?
False
If you run a program in New York City that uses network resources to the extent that a user is denied access to them, what type of law have you violated?
Federal
What is the best method of preventing NetBIOS attacks?
Filtering certain ports at the firewall
What is the main purpose of malware?
Financial gain or destruction
What component can be used to reduce the risk of a Trojan program or rootkit sending information from an attacked computer to a remote host?
Firewall
What is the most widely used port-scanning tool?
Nmap
What is an OSCP?
Offensive Security Certified Professional
TCP communication can be likened to which of the following? Phone conversation Driving on a highway Announcement over a loudspeaker Bullhorn at a sporting event
Phone Conversation
Entering a company's restricted area by following closely behind an authorized person is referred to as what?
Piggybacking
Security testers and hackers use which of the following to determine the services running on a host and the vulnerabilities associated with these services? Zone transfers Encryption algorithms Port scanning Zone scanning
Port scanning
A FIN packet sent to a closed port responds with which packet?
RST
A closed port responds to a SYN packet with which packet?
RST
A team composed of people with varied skills who attempt to penetrate a network is called which of the following?
Red Team
To determine whether scanning is illegal in your area, you should do which of the following?
Refer to state laws.
When conducting competitive intelligence, which of the following is a good way to determine the size of a company's IT support staff? Review job postings on Web sites such as www.monster.com or www.dice.com. Perform a zone transfer of the company's DNS server. Use the host -t command. Use the nslookup command.
Review job postings on Web sites such as www.monster.com or www.dice.com.
Which organization issues the Top 25 list of software errors?
SANS Institute
Which of the following is a popular network management service for network administrators? NetBIOS UDP TCP/IP SNMP
SNMP
Which of the following is a commonly used UNIX enumeration tool? Netstat Netcat Nbtstat SNMPWalk
SNMPWalk
To determine a company's primary DNS server, you can look for a DNS server containing which of the following? PTR record Cname record SOA record Host record
SOA record
Which of the following is one method of gathering information about the operating systems a company is using? Connect via Telnet to the company's Web server. Search the Web for e-mail addresses of IT employees. Ping the URL and analyze ICMP messages. Use the ipconfig /os command.
Search the Web for e-mail addresses of IT employees.
A null session is enabled by default in all the following Windows versions except: Windows Server 2008 Windows 95 Windows 2000 Windows 98
Windows Server 2008
Which of the following enables you to view all host computers on a network? ipconfig SOA Zone transfers HTTP HEAD method
Zone transfers
If you're trying to find newsgroup postings by IT employees of a certain company, which of the following Web sites should you visit? http://groups.google.com www.arin.org www.samspade.com www.google.com
http://groups.google.com
To find extensive Nmap information and examples of the correct syntax to use in Linux, which command should you type?
man nmap
To identify the NetBIOS names of systems on the 193.145.85.0 network, which of the following commands do you use? nbtscan 193.145.85.0-255 nbtscan 193.145.85.0/24 nbtstat 193.145.85.0/24 netstat 193.145.85.0/24
nbtscan 193.145.85.0/24
Which of the following commands should you use to determine whether there are any shared resources on a Windows computer with the IP address 193.145.85.202? nbtstat -a \\193.145.85.202 netstat -c 193.145.85.202 nbtscan -a 193.145.85.202 nbtstat -a 193.145.85.202
nbtstat -a 193.145.85.202
On a Windows computer, what command can you enter to show all open ports being used?
netstat
Which command verifies the existence of a node on a network?
ping
What command is used to log on to a remote server, computer, or router? netstat telnet ping traceroute
telnet
Which of the following relies on a host to propagate throughout a network? virus worm sniffer program
virus
Which of the following doesn't attach itself to a host but can replicate itself? Virus Buffer overflow Trojan program Worm
worm
One purpose of adware is to determine users' purchasing habits. True or False?
True
Security testers can use Hping to bypass filtering devices. True or False?
True
The Net view command can be used to see whether there are any shared resources on a server. True or False?
True
"Destination Unreachable" is designated by which ICMP type code?
Type 3
A ping command initially uses which ICMP type code?
Type 8
To see a brief summary of Nmap commands in a Linux shell, which of the following should you do?
Type nmap -h
Which federal law amended Chapter 119 of Title 18, U.S. Code?
U.S. PATRIOT Act, Sec. 217: Interception of Computer Trespasser Communications
What's one way to gather information about a domain? Use the ipconfig command. View the header of an e-mail you send to an e-mail account that doesn't exist. Connect via Telnet to TCP port 53. Use the ifconfig command.
View the header of an e-mail you send to an e-mail account that doesn't exist.
Which of the following is an example of a macro programming language? Cþþ Shell Basic Visual Basic for Applications
Visual Basic for Applications
Before conducting a security test by using social-engineering tactics, what should you do?
Get written permission from the person who hired you to conduct the security test.
Which of the following is a tool for creating a custom TCP/IP packet and sending it to a host computer? Traceroute Tracert Nmapping Hping
Hping
What protocol is used for reporting or informational purposes? IGMP ICMP TCP IP
ICMP
In basic network scanning, ICMP Echo Requests (type 8) are sent to host computers from the attacker, who waits for which type of packet to confirm that the host computer is live?
ICMP Echo Reply (type 0)
What organization designates a person as a CISSP?
ISC2
What is a potential mistake when performing a ping sweep on a network? Including a broadcast address in the ping sweep range Including a subnet IP address in the ping sweep range Including the subnet mask in the ping sweep range Including the intrusion detection system's IP address in the ping sweep range
Including a broadcast address in the ping sweep range
A software or hardware component that records each keystroke a user enters is called which of the following?
Keylogger
Which of the following describes an attack where attackers inject themselves between two parties or systems communicating with one another in order to manipulate messages being passed back and forth? Buffer overflow Man-in-the-middle attack Trojan attack Denial-of-service attack
Man-in-the-middle attack
Which of the following is a good place to begin your search for vulnerabilities in Microsoft products? User manuals Microsoft Security Bulletins Newsgroup references to vulnerabilities Hacking Web sites
Microsoft Security Bulletins
If you dont' have access to Nessus, which of the following can be used by an attacker to gain information about remote *nix hosts? Netcat Nbtscan Netstat NMap
NMap
Most NetBIOS enumeration tools connect to the target system by using which of the following?
NULL
Which type of port scan sends a packet with all flags turned off?
NULL
Which of the following is the vulnerability scanner from which OpenVAS was developed? ISS Scanner Nessus SuperScan OpenVAS Pro
Nessus
Which of the following commands connects to a computer containing shared files and folders? Net view Netstat Net use Nbtstat
Net use
Which of the following is a Windows command-line utility for seeing NetBIOS shares on a network? Net view Net user Net use Nbtuser
Net view
Discovering a user's password by observing the keys he or she presses is called which of the following? Shoulder surfing Password crunching Password hashing Piggybacking
Shoulder surfing
Which protocol offers guaranteed delivery and is connection oriented?
TCP
Which protocol uses UDP? Telnet TFTP Netstat FTP
TFTP
Many social engineers begin gathering the information they need by using which of the following? E-mail A company Intranet The Internet The telephone
The telephone
Which of the following exploits might hide its destructive payload in a legitimate application or game? Trojan program Buffer overflow Worm Macro virus
Trojan program
A UDP packet is usually smaller than a TCP packet. True or False?
True
A cookie can store information about a Web site's visitors. True or False?
True
An exploit discovered for one OS might also be effective on another OS. True or False?
True
FTP offers more security than TFTP. True or False?
True
