ITEC 472 Entire Final

In what type of attack does the attacker have the ciphertext of several messages that were encrypted with the same encryption algorithm, but has no access to the plaintext so he or she must try to calculate the key used to encrypt the data?

ciphertext-only

When an attacker has access to a password file, they can run a password-cracking program that uses a dictionary of known words or passwords as an input file. What type of attack is this attacker performing?

dictionary

Which of the following is a function that takes a variable-length string or message and produces a fixed-length message digest?

hashing algorithm

Web servers use which of the following elements in an HTML document to allow an individual to submit information to the Web server?

<form>

Which of the following IEEE projects was developed to create LAN and WAN standards?

802

Which IEEE standard can achieve a throughput of 54 Mbps?

802.11g

What standard specifically defines the process of authenticating and authorizing users on a network?

802.1X

What type of encryption is currently used to secure WPA2?

AES

Which of the following encryption standards is part of the NSA's suite B cryptographic algorithms and is validated strong enough to protect classified data?

AES-256

Which of the following is an alternative term used when referring to Application Security?

AppSec

Which of the following refers to verifying the sender or receiver (or both) is who they claim to be?

Authentication

Which specific type of tag do All CFML tags begin with?

CF

Adobe System's ColdFusion uses its proprietary tags, which are written in which of the following languages?

CFML

Which of the following is the interface that determines how a Web server passes data to a Web browser?

CGI

The 802.11 standard applies to the Physical layer of the OSI model, which deals with wireless connectivity issues of fixed, portable, and moving stations in a local area, and the Media Access Control (MAC) sublayer of which OSI model layer?

Data Link layer

Which of the following protocols is an enhancement to PPP, and was designed to allow a company to select its authentication method?

EAP

What encryption algorithm is efficient requiring few resources, and is based on complex algebra and calculations on curves?

ECC

Which of the following is a scripting language for Windows and Linux that performs repetitive tasks, such as password cracking?

EXPECT

What specific type of spread spectrum modulation allows data to hop to other frequencies to avoid interference that might occur over a frequency band?

FHSS

A device that performs more than one function, such as printing and faxing is called which of the following?

MFD

Which of the following is an SELinux OS security mechanism that enforces access rules based on privileges for interactions between processes, files, and users?

Mandatory Access Control

Which frequency band is used by commercial AM radio stations?

Medium frequency (MF)

Visual Basic Script (VBScript) is a scripting language developed by which of the following companies?

Microsoft

Which type of wireless technology uses microwave radio waves to transmit data?

Narrowband

Which function ensures that a sender and receiver cannot deny sending or receiving a specific message?

Nonrepudiation

Which of the following interfaces is a standard database access method, developed by SQL Access Group, that allows an application to access data stored in a database management system (DBMS)?

ODBC

Which of the following interfaces, developed by Microsoft, is a set of interfaces that enable applications to access data stored in a database management system (DBMS)?

OLE DB

Which of the following EAP methods uses TLS to authenticate the server to the client, but not the client to the server?

PEAP

Which of the following programming languages was originally used primarily on UNIX systems, but is used more widely now on many platforms, such as Macintosh and Windows?

PHP

Connecting to an MS SQL Server database with Microsoft's Object Linking and Embedding Database (OLE DB) requires using which of the following providers?

SQLOLEDB

What is the 1 to 32 character configurable name used to identify a WLAN?

SSID

When using the Common Internet File System (CIFS), which security model does not require a password to be set for the file share?

Share-level security

What type of modulation spreads data across a large-frequency bandwidth instead of traveling across just one frequency band?

Spread spectrum

Which of the following application tests analyzes an application's source code for vulnerabilities, and is therefore only possible when the source code of an application is available?

Static Application Security Testing

In 802.11, which of the following is an addressable unit?

Station (STA)

What protocol improves WPA encryption by adding Message Integrity Checks, Extended Initialization Vectors, Per-packet key mixing, and a Re-keying mechanism to improve encryption?

TKIP

When using the Common Internet File System (CIFS), which security model will require network users to have a user name and password to access a specific resource?

User-level security

What is the IEEE 802 standards name for a wireless network that is limited to one person's workspace?

WPAN

Which of the following is a flawed wireless authentication standard created to allow users to easily add devices to a wireless network securely?

WPS

Which of the following if often found within an embedded OS that can cause a potential vulnerability to an attack?

Web server

What wireless hacking tool can perform scans for wireless access points and can set up fake APs to social-engineer users or confuse attackers using airbase-ng?

WiFi Pineapple

Which of the following source code is now available to the public and was considered a trimmed down version of the Windows desktop OS?

Windows CE

A certificate contains a unique serial number and must follow which standard that describes the creating of a certificate?

X.509

When hackers drive around or investigate an area with an antenna, they are usually looking for which component of a wireless network?

access point

Which of the following is a transceiver that connects to a network via an Ethernet cable and bridges a wireless LAN with a wired network?

access point (AP)

SCADA systems controlling critical infrastructure are usually completely separated from the Internet by which of the following?

air gap

Ubuntu and Debian Linux use what command to update and manage their RPM packages?

apt-get

What is the specific act of checking a user's privileges to understand if they should or should not have access to a page, field, resource, or action in an application?

authorization

What type of attack is being attempted when an attacker uses a password-cracking program to guess passwords by attempting every possible combination of letters?

brute force

To check whether a CGI program works, you can test the URL in your Web browser. Which of the following directories should you save the program to on your Web server before you check the URL in your Web browser?

cgi-bin

Which of the following is contained in a wireless frequency band and breaks up the band into smaller frequency ranges?

channels

What type of attack is being performed when the attacker has access to plaintext and ciphertext, and can choose which messages to encrypt?

chosen-plaintext

Cryptography is the process of converting plaintext, which is readable text, into unreadable or encrypted text called which if the following?

ciphertext

If a security expert decides to study the process of breaking encryption algorithms, they are performing which of the following?

cryptanalysis

What type of system converts between plaintext and ciphertext?

cryptosystem

Which of the following is the process of converting ciphertext back into plaintext?

decryption

What type of useful tools can a security tester find available in both Firefox and Chrome Web browsers?

developer tools

Which of the following is a mathematical function or program that works with a key?

encryption algorithm

Which JavaScript function is a "method" or sequence of statements that perform a routine or task?

getElementById()

What is the specific act of filtering, rejecting, or sanitizing a user's untrusted input before the application processes it?

input validation

Which of the following is a range of allowable values that is used to generate an encryption key?

keyspace

Which of the following is considered to be the most critical SQL vulnerability?

null SA password

Which of the following results from poorly configured technologies that a Web application runs on top of?

security misconfigurations

Which of the following cross-site scripting vulnerabilities types is especially harmful because it can be delivered to subsequent users of the application?

stored

Which type of symmetric algorithm operates on plaintext one bit at a time?

stream ciphers

What type of cryptography is demonstrated by reversing the alphabet so A becomes Z, B becomes Y, and so on?

substitution cipher

Which of the following is a programming interface for connecting a Web application to a database and defines technologies that allow applications, such as Word or Excel, to interact with the Web?

ADO

Which type of vulnerabilities can result from a server accepting untrusted, unvalidated input?

Injection

What type of viruses and code has been created by security researchers and attackers that could infect phones running Google's Android, Windows Mobile, and the Apple iPhone OS?

Java-based

Which of the following is a utility that is a wireless network detector, sniffer, and an intrusion detection system?

Kismet

What application is considered the original password-cracking program and is now used by many government agencies to test for password strength?

L0phtcrack

Which of the following is a common Linux rootkit?

Linux Rootkit 5

Which of the following defines how data is placed on a carrier signal?

Modulation

What is the current file system that Windows utilizes that has strong security features?

NTFS

Which of the following terms is the rate at which a sound wave repeat?

frequency

What type of attack is being conducted when the attacker has messages in both encrypted form and decrypted forms?

known plaintext

What is the most serious shortcoming of Microsoft's original File Allocation Table (FAT) file system?

no ACL support

Which of the following cross-site scripting vulnerabilities types relies on social engineering to trick a user into visiting a maliciously crafted link or URL?

reflected

Cryptosystems that have a single key that encrypts and decrypts data are using what type of algorithm?

symmetric

Which one of the following, if compromised might allow attackers the ability to gain complete access to network resources?

Router

Which of the following systems should be used when equipment monitoring and automation is critical?

SCADA

Rootkits that pose the biggest threat to any OS are those that infect what part of the targeted device?

firmware

In 802.1X, what component refers specifically to the wireless user attempting access to a WLAN?

supplicant

What type of malicious code could be installed in a system's flash memory to allow an attacker to access the system at a later date?

BIOS-based rootkit

Which of the following refers to the flow a user is expected to follow in an application to accomplish a goal?

Business logic

What programming languages are vulnerable to buffer overflow attacks?

C and C++

In what type of attack does the attacker need access to the cryptosystem, and the ciphertext to be decrypted to yield the desired plaintext results?

Chosen-ciphertext

Which of the following does Object Linking and Embedding Database (OLE DB) rely on that allows an application to access data stored on an external device?

Connection strings

If an organization does not want to rely on a wireless device to authenticate users, which of the following is a secure alternative?

RADIUS Server

What encryption algorithm can be used for both encryption and digital signing, uses a one-way function, and is still widely used in e-commerce?

RSA

What type of attack is being performed when an attacker intercepts the initial communications between a Web server and a Web browser while forcing a vulnerable server to insecurely renegotiate the encryption being used down to a weaker cipher?

SSL/TLS downgrade attack

Which of the following application tests analyzes a running application for vulnerabilities?

Dynamic Application Security Testing

Which of the following resources is an excellent starting point for security professionals when investigating VBScript vulnerabilities?

Microsoft Security Bulletin