Ethical Hacking
In one of the following method an attacker attempts to replicate error free navigation by inputting simple input - Determining the database engine type - Type mismatch - Parameter tampering - Determining a SELECT query structure
- Determining a SELECT query structure
Which of the following attacks can take place due to flaws such as insecure cryptographic storage and information leakage? - SQL injection - Shell injection - Sensitive data exposure - Command injection
- Sensitive data exposure
Which of the following is a communication standard that is also known as WiMAX and is designed to provide multiple physical layer (PHY) and MAC options? - 802.11g - 802.16 - 802.11n - 802.15.1
802.16
Which of the following techniques is NOT a best practice for securing webhooks? - Use rate limiting on webhook calls in the web server - Use threaded requests to send multiple requests simultaneously - Avoid validating the X-OP-Timestamp within the threshold of the current time - Ensure that event processing is idempotent
Avoid validating the X-OP-Timestamp within the threshold of the current time
Which of the following tools is employed by a pen tester to find vulnerabilities in an organization's web server and evaluate its security posture by using the same techniques as those currently employed by cybercriminals? - Netcraft - NetVizor - CORE Impact - Pupy
CORE Impact
Which of the following involves injection of malicious html code through a web application? - LDAP injection - Shell injection - SQL injection - Command injection
Command injection
Identify the reason why Web Applications are vulnerable to SQL injection attacks. - Tests the content of string variables and accepts only expected values. - Error messages reveal important information - Avoid constructing dynamic SQL with concatenated input values - Reject entries that contain binary data, escape sequences, and comment characters.
Error messages reveal important information
Which of the following is considered as a quality checking and assurance technique used to identify coding errors and security loopholes in web applications? - Hash stealing - Fuzz testing - Session hijacking - Sandboxing
Fuzz testing
Which of the following methods carries the requested data to the webserver as a part of the message body? - Cold fusion - IBM DB2 - HTTP POST - HTTP GET
HTTP POST
If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TCP? - Broadcast ping - Traceroute - Hping - TCP ping
Hping
In which of the following attacks does an attacker use the same communication channel to perform the attack and retrieve the results? - Inferential SQL injection - Out-of-band SQL injection - In-band SQL injection - Blind SQL injection
In-band SQL injection
Which of the following is a built-in tool of Burp Suite that is used for inspecting and modifying traffic between a browser and target application? - Sequencer tool - Application-aware - Intruder tool - Intercepting proxy
Intercepting proxy
Which of the following protocols uses the port number 88/TCP and can verify the identity of a user or host connected to a network? - Kerberos - Finger - NTP - TFTP
Kerberos
Which of the following tools helps attackers identify networks by passively collecting packets and detecting standard named networks, hidden networks, and the presence of non-beaconing networks via data traffic? - Kismet - L0phtCrack - Netcraft - Robber
Kismet
Which of the following operating systems can be identified when scan results show a TTL value of 64 and TCP window size of 5840? - Linux (Kernel 2.4 and 2.6) - Solaris 7 - iOS 12.4 - Windows XP
Linux (Kernel 2.4 and 2.6)
Which of the following tools does an attacker use to perform SQL injection exploitation through techniques such as union and blind SQL exploitation and bypass certain IPS/IDS rules with generic filters? - Mole - Astra - Weevely - China Chopper
Mole
hich of the following web services is a repository that contains a collection of user-submitted notes or messages on various subjects and topics? - Online reputation services - People search services - NNTP Usenet newsgroups - Business profile sites
NNTP Usenet newsgroups
Which of the following protocol encapsulates the EAP within an encrypted and authenticated Transport Layer Security (TLS) tunnel? - RADIUS - PEAP - LEAP - CCMP
PEAP
Which of the following technologies belongs to the application layer and is used to generate dynamic web content? - Apache - Linux - MySQL - PHP
PHP
Which of the following features in FOCA allows an attacker to find more servers in the same segment of a determined address? - DNS search - IP resolution - Web search - PTR scanning
PTR scanning
Which of the following attacks is possible when an attacker executes .bat or .cmd files and changes the values by superimposing one or more operating-system commands through the request? - WS-address spoofing - XML injection attack - Parsing attack - SOAPAction spoofing
Parsing attack
A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news articles online about the bank, watching the bank employees time in and out, searching the bank's job postings (paying special attention to IT-related jobs), and visiting the local dumpster for the bank's corporate office. What phase of the penetration test is the tester currently in? - Passive information gathering - Information reporting - Vulnerability assessment - Active information gatherin
Passive information gathering
In which of the following attacks does an attacker inject an additional malicious query into an original query to make the DBMS execute multiple SQL queries? - System stored procedure - Illegal/logically incorrect query - Tautology - Piggybacked query
Piggybacked query
In which of the following attacks does an attacker inject an additional malicious query to the original query? - Tautology - In-line comment - Piggybacked query - UNION SQL injection
Piggybacked query
In which type of fuzz testing does the protocol fuzzer send forged packets to the target application that is to be tested? - None of the above - Generation-based - Protocol-based - Mutation-based
Protocol-based
Which of the following is the result obtained after the SQL query "SELECT * From User_Data Where Email_ID
Return data mode
Which of the following DNS record types indicates the authority for a domain of the target DNS server? - SRV - PTR - SOA - CNAME
SOA
Which of the following built-in tools of Burp Suite is used for testing the randomness of session tokens? - Application-aware spider - Sequencer tool -Intruder tool - Intercepting proxy
Sequencer tool
Which of the following does not provide cryptographic integrity protection? - WPA2 - WPA - WEP - TKIP
WEP
Which of the following techniques is NOT a countermeasure for securing files and directories on a web server? - Eliminate sensitive configuration information within the byte code - Disable the serving of directory listings - Eliminate unnecessary files within.jar files - Map virtual directories between two different servers or over a network
Map virtual directories between two different servers or over a network
Which of the following techniques is NOT a countermeasure for securing files and directories on a web server? - Map virtual directories between two different servers or over a network - Disable the serving of directory listings - Eliminate unnecessary files within.jar files - Eliminate sensitive configuration information within the byte code
Map virtual directories between two different servers or over a network
Which of the following is a DNS interrogation tool that allows an attacker to retrieve information about the location and type of servers related to the target web infrastructure? - Halberd - Vega - WAFW00F - Professional Toolset
Professional Tool-set
In which of the following database technologies is the SQL query [ Select * from sycat.coloumns where tabname='table name'] used for column enumeration. - MySQL - MSSQL - DB2 - Oracle
DB2
Which of the following is used to detect bugs and irregularities in web applications? - Mutation-based fuzz testing - Protocol-based fuzz testing - Generation-based fuzz testing - Source code review
Source code review
Which of the following types of DNS records points to a host's IP address? - TXT - A - HINFO - NS
A
Which of the following tools is used to build rules that aim to detect SQL injection attacks? - Super Scan - Snort - Nmap - Masscan
Snort
An attacker is using the scanning tool Hping to scan and identify live hosts, open ports, and services running on a target network. He/she wants to collect all the TCP sequence numbers generated by the target host. Which of the following Hping commands he/she needs to use to gather the required information? - hping3 -S <Target IP> -p 80 --tcp-timestamp - hping3 -F -P -U 10.0.0.25 -p 80 - hping3 <Target IP> -Q -p 139 -s - hping3 -A <Target IP> -p 80
hping3 <Target IP> -Q -p 139 -s
Which of the following is the Google dork that helps an attacker find the configuration pages for online VoIP devices? - intitle:"Sipura.SPA.Configuration" -.pdf - intitle:"SPA504G Configuration" - inurl:/voice/advanced/ - intitle:Linksys SPA configurationintitle:"Login Page" intext:"Phone Adapter Configuration Utility"
intitle:"Sipura.SPA.Configuration" -.pdf
Which one of the following is a Google search query used for VoIP footprinting to extract Cisco phone details? - intitle:"D-Link VoIP Router" "Welcome" - inurl:"NetworkConfiguration" cisco - inurl:/voice/advanced/ - intitle:Linksys SPA configuration - inurl:"ccmuser/logon.asp"
inurl:"NetworkConfiguration" cisco
In blind SQLi, attackers can steal data by asking a series of true or false questions through SQL statements. Select all the correct types of blind SQL injections. - Boolean exploitation - Tautology - Time delay - System-stored procedure
- Boolean exploitation - Time delay
WPA2 uses AES for wireless data encryption at which of the following encryption levels? - 128 bit and TKIP - 128 bit and CCMP - 128 bit and CRC - 64 bit and CCMP
28 bit and CCMP
Which of the following is a standard for Wireless Local Area Networks (WLANs) that provides improved encryption for networks that use 802.11a, 802.11b, and 802.11g standards? - 802.11i - 802.11e - 802.11d - 802.11n
802.11i
Which of the following tools provides automated web application security testing with innovative technologies including DeepScan and AcuSensor technology? - IBM Security AppScan - Hping2 / Hping3 - SoftPerfect network scanner - Acunetix web vulnerability scanner
Acunetix web vulnerability scanner
In which of the following is the original data signal multiplied with a pseudo random noise spreading code? - Direct-sequence Spread Spectrum (DSSS) - Orthogonal Frequency-division Multiplexing (OFDM) - Frequency-hopping Spread Spectrum (FHSS) - Multiple input, multiple output-orthogonal frequency-division multiplexing (MIMO-OFDM)
Direct-sequence Spread Spectrum (DSSS)
Which of the following is NOT an objectives of network scanning? - Discover the services running - Discover usernames and passwords - Discover the network's live hosts - Discover the services running
Discover usernames and passwords
Which of the following should NOT be followed when securing an organization from footprinting attacks? - Educating employees to use pseudonyms on blogs, groups, and forums - Enabling the geo-tagging functionality on cameras - Ensuring that critical information is not revealed in press releases, annual reports, product catalogs, and so on. - Opting for privacy services on the Whois lookup database
Enabling the geo-tagging functionality on cameras
There is a WEP encrypted wireless AP with no clients connected. In order to crack the WEP key, a fake authentication needs to be performed. Which of the following steps need to be performed by the attacker for generating fake authentication? - Set the wireless interface to monitor mode - Ensure association of source MAC address with the AP - Capture the IVs - Use cracking tools
Ensure association of source MAC address with the AP
You are doing research on SQL injection attacks. Which of the following combination of Google operators will you use to find all Wikipedia pages that contain information about SQL, injection attacks, or SQL injection techniques? - site:Wikipedia.org intitle:"SQL Injection" - allinurl: Wikipedia.org intitle:"SQL Injection" - SQL injection site:Wikipedia.org - site:Wikipedia.org related:"SQL Injection"
SQL injection site:Wikipedia.org
Which of the following is considered as a token to identify a 802.11 (Wi-Fi) network (by default it is the part of the frame header sent over a wireless local area network (WLAN))? - Association - Access point - Hotspot - SSID
SSID
Which of the following is to be used to keep certain default wireless messages from broadcasting the ID to everyone? - Bluejacking - Bluesmacking - MAC Spoofing - SSID Cloaking
SSID Cloaking
During a wireless penetration test, a tester detects an AP using the WPA2 encryption. Which of the following attacks should be used to obtain the key? - The tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard. - The tester must capture the WPA2 authentication handshake and then crack it. - The tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key. - The tester must use the tool inSSIDer to crack it using the ESSID of the network.
The tester must capture the WPA2 authentication handshake and then crack it.
Which of the following btlejack commands allows an attacker to sniff new Bluetooth low-energy connections? - btlejack -c any - btlejack -f 0x129f3244 -j - btlejack -s - btlejack -d /dev/ttyACM0 -d /dev/ttyACM2 -s
btlejack -c any
Which of the following TCP communication flags confirms the receipt of a transmission and identifies the next expected sequence number? - SYN flag - RST flag - ACK flag - FIN flag
ACK flag
Which of the following cryptographic algorithms is used by CCMP? - DES - TKIP - AES - RC4
AES
In which of the following attacks does an attacker saturate an API with a massive volume of traffic from multiple infected computers or botnets to delay the API services to legitimate users? - Invalid input attack - Credential stuffing attack - Fuzzing - API DDoS attack
API DDoS attack
Which of the following is used to connect wireless devices to a wireless/wired network? - Association - Bandwidth - Access point (AP) - Hotspot
Access point (AP)
What type of OS fingerprinting technique sends specially crafted packets to the remote OS and analyzes the received response? - Active - Reflective - Passive - Distributive
Active
Which of the following stores critical HTML files related to the webpages of a domain name that will be served in response to requests? - Document root - Virtual document tree - Server root - Web proxy
Document root
If you are responsible for securing a network from any type of attack and if you have found that one of your employees is able to access any website that may lead to clickjacking attacks, what would you do to avoid the attacks? - Delete Cookies - Enable Remote Management - Harden browser permission rules - Configure Application certification rules
Harden browser permission rules
In which of the following scanning techniques does an attacker send a spoofed source address to a computer to determine the available services? - Inverse TCP flag scan - ACK flag probe scan - IDLE/IPID header scan - TCP Maimon scan
IDLE/IPID header scan
An attacker wants to exploit a webpage. From which of the following points does he start his attack process? - Identify server-side functionality - Map the attack surface - Identify entry points for user input - Identify server-side technologies
Identify entry points for user input
Which of the following countermeasures should be followed to defend against DNS hijacking? - Do not safeguard the registrant account information - Use the default router password included in the factory settings - Download audio and video codecs and other downloaders from untrusted websites - Include DNS hijacking into incident response and business continuity planning
Include DNS hijacking into incident response and business continuity planning
In which type of fuzz testing do the current data samples create new test data and the new test data again mutates to generate further random data? - Mutation-based - None of the above - Generation-based - Protocol-based
Mutation-based
Which of the following web-service APIs is programmed to generate, recover, modify, and erase different logs such as profiles, credentials, and business leads? - RESTful API - XML RPC - JSON RPC - SOAP API
SOAP API
Which of the following web-service APIs is programmed to generate, recover, modify, and erase different logs such as profiles, credentials, and business leads? - XML-RPC - SOAP API - RESTful API - JSON-RPC
SOAP API
Which of the following attacks allows an attacker to inject malicious content, modify the user´s online experience, and obtain unauthorized information? - Cross-site request forgery - Session prediction - Session poisoning - Session brute-forcing
Session poisoning
In which of the following footprinting threats does an attacker collect information directly and indirectly through persuasion without using any intrusion methods? - Business loss - Corporate espionage - System and network attack - Social engineering
Social engineering
Which of the following API hacking techniques does not target the API or machine code and instead tricks users into divulging their credentials to perform further attacks? - Session replay attack - Social engineering - User spoofing - Reverse engineering
Social engineering
hich of the following countermeasures prevents buffer overruns? - Keep untrusted data separate from commands and queries. - Use the most restrictive SQL account types for applications. - Test the size and data type of the input and enforce appropriate limits. - Apply the least privilege rule to run the applications that access the DBMS.
Test the size and data type of the input and enforce appropriate limits
Which of the following conditions must be given to allow a tester to exploit a cross-site request forgery (CSRF) vulnerable web application? - The victim user must open a malicious link with an Internet Explorer prior to version 8. - The session cookies generated by the application do not have the HttpOnly flag set. - The victim user must open a malicious link with Firefox prior to version 3. - The web application should not use random tokens.
The web application should not use random tokens.
In which of the following attacks does an attacker use an ORDER BY clause to find the right number of columns in a database table? - In-line comments - UNION SQL injection - Tautology - Piggybacked query
UNION SQL injection
Which of the following includes mandatory support for Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)? - WPA2 - WEP - TKIP - WPA
WPA2
In one of the following defensive techniques, only the list of entities such as data type, range, size, and value that have been approved for secured access are accepted. Which is this technique? - Whitelist validation - Output encoding - Enforcing least privileges - Blacklist validation
Whitelist validation
Which of the following networks is used for very long-distance communication? - Wi-Fi - Bluetooth - ZigBee - WiMax
WiMax
Which of the following Google search queries allows an attacker to identify the FTP servers of the target organization and identify sensitive directories on FTP? - intext:pure-ftpd.confintitle:index of - type:mil inurl:ftp ext:pdf | ps - inurl:"ftp://www." "Index of /" - inurl:github.com intext:.ftpconfig -issues
type:mil inurl:ftp ext:pdf | ps
Which of the following utilities is used by Recon-Dog to detect technologies existing in the target system? - shodan.io - Whois lookup - findsubdomains.com - wappalyzer.com
wappalyzer.com
In which of the following attacks does an attacker load the target website inside a low-opacity iframe? - DNS rebinding attack - RC4 NOMORE attack - Clickjacking attack - JavaScript hijacking
- Clickjacking attack
If a threat detection software installed in any organization network either does not record the malicious event or ignores the important details about the event, then what kind of vulnerability is it? - Security misconfiguration - Broken access control - Insufficient logging and monitoring - Sensitive data exposure
- Insufficient logging and monitoring
Which of the following countermeasures should be followed for the secure update and patch management of web servers? - Apply all updates, regardless of their type, on an "as-needed" basis - Use the default configurations that web servers are dispatched with - Never use virtual patches in the organization Enable all unused script extension mappings
Apply all updates, regardless of their type, on an "as-needed" basis
Which of the following is a timing attack performed by measuring the approximate time taken by a server to process a POST request so that the existence of a username can be deduced? - Cache storage timing attack - Cross-site timing attack - Browser-based timing attack - Direct timing attack
Direct timing attack
Which of the following HTTP service port numbers is used for connecting to a remote network server system? - Port 384 - Port 81 - Port 80 - Port 88
Port 384
Which of the following Google dorks is used by an attacker to find Cisco VPN client passwords? - "Config" intitle:"Index of" intext:vpn - filetype:pcf vpn OR Group - "[main]" "enc_GroupPwd=" ext:txt - filetype:pcf "cisco" "GroupPwd"
"[main]" "enc_GroupPwd=" ext:txt
William has been hired by the ITSec, Inc. to perform web application security testing. He was asked to perform black box penetration testing to test the security of the company's web applications. No information is provided to William about the company's network and infrastructure. William notices that the company website is dynamic and must make use of a backend database. He wants to see if an SQL injection would be possible. As part of the testing, he tries to catch instances where the user input is used as part of an SQL identifier without any input sanitization. Which of the following characters should William use as the input data to catch the above instances? - Right square bracket - Semicolon - Double quote - Single quote
- Double quote - Single quote
To defend against SQL injection, a developer needs to take proper actions in configuring and developing an application. Select all correct statements that help in defending against SQL injection attacks. - Keep untrusted data separate from commands and queries. - Apply input validation only on the client-side. - Ensure that the Web configuration files for each application do not contain sensitive information. - Avoid constructing dynamic SQL with concatenated Input values.
- Keep untrusted data separate from commands and queries. - Ensure that the Web configuration files for each application do not contain sensitive information. - Avoid constructing dynamic SQL with concatenated Input values.
A tester has been hired to perform source code review of a web application to detect SQL injection vulnerabilities. As part of the testing process, he needs to get all the information about the project from the development team. During the discussion with the development team, he comes to know that the project is in the initial stage of the development cycle. As per the above scenario, which of the following processes does the tester need to follow in order to save the company's time and money? - The tester needs to perform dynamic code analysis as it uncovers bugs in the software system. - The tester needs to perform static code analysis as it covers the executable file of the code. - The tester needs to perform dynamic code analysis as it finds and fixes the defects. - The tester needs to perform static code analysis as it covers the structural and statement coverage testing.
- The tester needs to perform static code analysis as it covers the structural and statement coverage testing.
Which of the following wireless standards uses modulation schemes such as GFSK, π/4-DPSK, and 8DPSK and a frequency of 2.4 GHz with data transfer rates in the range of 25-50 Mbps? - 802.11g - 802.15.1 (Bluetooth) - 802.11a - 802.16 (WiMAX)
802.15.1 (Bluetooth)
Which of the following is a type of access-control attack in which an attacker uses any USB adapter or wireless card and connects a host to an unsecured client to attack a specific client or to avoid AP security? - Ad hoc association - Promiscuous client - Client mis-association - Unauthorized association
Ad hoc association
Which of the following countermeasures should be followed to protect web applications against broken authentication and session management attacks? - Apply pass phrasing with at least five random words - Never use SSL for all authenticated parts of the application - Submit session data as part of GET and POST - Do not check weak passwords against a list of the top bad passwords
Apply pass phrasing with at least five random words
Which of the following activities of an organization on social networking sites helps an attacker footprint or collect information regarding the type of business handled by the organization? - Promotion of products - User surveys - Background checks to hire employees - User support
Background checks to hire employees
Which of the following terms describes the amount of information that may be broadcast over a connection? - BSSID - Bandwidth - ISM band - Hotspot
Bandwidth
Which of the following techniques helps the attacker in identifying the OS used on the target host in order to detect vulnerabilities on a target system? - Banner grabbing - Port scanning - Source routing - IP address decoy
Banner grabbing
In which of the following attacks does an attacker pose a true or false question to an database to determine whether an application is vulnerable to SQL injection? - Error-based SQL injection - Union SQL injection - In-Band SQL injection - Blind SQL injection
Blind SQL injection
In which of the following techniques does an attacker use logical requests such as AND/OR to bypass a firewall? - Normalization method - CRLF technique - HPF technique - Blind SQL injection
Blind SQL injection
Which of the following attacks is time-intensive because the database should generate a new statement for each newly recovered bit? - In-band SQL injection - Error-based SQL injection - UNION SQL injection - Blind SQL injection
Blind SQL injection
An attacker collects the make and model of target Bluetooth-enabled devices analyzes them in an attempt to find out whether the devices are in the range of vulnerability to exploit. Identify which type of attack is performed on Bluetooth devices. - Blue Printing - BlueSniff - MAC Spoofing Attack - Bluebugging
Blue Printing
_________ is the art of collecting information about Bluetooth enabled devices such as manufacturer, device model and firmware version. - Bluejacking - BluePrinting - Bluebugging - BlueSniff
BluePrinting
Which of the following terms is used to describe an attack in which an attacker gains remote access to a target Bluetooth-enabled device without the victim being aware of it? - Bluejacking - Bluesnarfing - Bluebugging - Bluesmacking
Bluebugging
Thomas is a cyber thief trying to hack Bluetooth-enabled devices at public places. He decided to hack Bluetooth-enabled devices by using a DoS attack. He started sending an oversized ping packet to a victim's device, causing a buffer overflow and finally succeeded. What type of Bluetooth device attack is Thomas most likely performing? - Bluebugging - Bluesnarfing - Bluesmacking - Bluejacking
Bluesmacking
An attacker wants to perform a session hijacking attack. What tool should he use to achieve his objective? - Netcraft - Nessus - Burp suite - Hydra
Burp suite
Which of the following is not a patch management tool? - GFI LanGuard - Software vulnerability manager - Burp suite - Symantec client management suite
Burp suite
Steve, an attacker, wants to track the most shared content that belongs to the target organization. For this purpose, he used an advanced social search engine that displayed shared activity across all major social networks including Twitter, Facebook, LinkedIn, Google Plus, and Pinterest. What is the tool employed by Steve in the above scenario? - Robber - Vindicate - BuzzSumo - Wireshark
BuzzSumo
Which of the following techniques is used by an attacker to connect a fake account on the provider with a victim's account on the client side? - Attack on "Connect" request - CSRF on authorization response - Attack on "redirect_uri" - Access token reusage
CSRF on authorization response
Which of the following is the most effective technique in identifying vulnerabilities or flaws in the web page code? - Packet analysis - Code analysis - Traffic analysis - Data analysis
Code analysis
Which of the following types of API vulnerabilities occurs when an input is not sanitized and can be exploited by adding malicious SQL statements to input fields to steal session cookies and user credentials? - Code injections - Business logic flaws - Improper use of CORS - Sharing resources via unsigned URLs
Code injections
Which of the following types of API vulnerabilities occurs when an input is not sanitized and can be exploited by adding malicious SQL statements to input fields to steal session cookies and user credentials? - Improper use of CORS - Code injections - Business logic flaws - Sharing resources via unsigned URLs
Code injections
Mark is working as a penetration tester in InfoSEC, Inc. One day, he notices that the traffic on the internal wireless router suddenly increases by more than 50%. He knows that the company is using a wireless 802.11 a/b/g/n/ac network. He decided to capture live packets and browse the traffic to investigate the issue to find out the actual cause. Which of the following tools should Mark use to monitor the wireless network? - WiFish Finder - BlueScan - WiFiFoFum - CommView for WiFi
CommView for WiFi
In which of the following SQL injection attacks does an attacker deface a web page, insert malicious content into web pages, or alter the contents of a database? - Compromised data integrity - Authorization bypass - Remote code execution - Compromised availability of data
Compromised data integrity
You are performing a port scan with Nmap. You are in a hurry and conducting the scans at the fastest possible speed. What type of scan should you run to get very reliable results? - XMAS scan - Connect scan - Stealth scan - Fragmented packet scan
Connect scan
Which of the following is a wireless security layer where per frame/packet authentication provides protection against MITM attacks and prevents an attacker from sniffing data when two genuine users communicate with each other? - Wireless signal security - Device security - Connection security - End-user protection
Connection security
What type of information is gathered by an attacker through Whois database analysis and tracerouting? - Usernames, passwords, and so on - Background of the organization - DNS records and related information - Publicly available email addresses
DNS records and related information
Which of the following practices makes web applications vulnerable to SQL injection attacks? - Database server running OS commands - Firewalling the SQL server - Implementing consistent coding standards - Minimizing privileges
Database server running OS commands
Which of the following countermeasure helps organizations to prevent information disclosure through banner grabbing? - Disable open relay feature - Display false banners - Disable the DNS zone transfers to the untrusted hosts - Restrict anonymous access through RestrictNullSessAccess parameter from the Windows registry
Display false banners
Steven, a wireless network administrator, has just finished setting up his company's wireless network. He has enabled various security features such as changing the default SSID and enabling strong encryption on the company's wireless router. Steven decides to test the wireless network for confidentiality attacks to check whether an attacker can intercept information sent over wireless associations, whether sent in clear text or encrypted by Wi-Fi protocols. As a part of testing, he tries to capture and decode unprotected application traffic to obtain potentially sensitive information using hardware or software tools such as Ettercap, Kismet, Wireshark, etc. What type of wireless confidentiality attack is Steven trying to do? - WEP Key Cracking - Eavesdropping - Masquerading - Evil twin AP
Eavesdropping
Which of the following types of techniques is used to prevent IP spoofing by blocking outgoing packets with a source address that is not inside? - Access-control lists - Random initial sequence numbers - Ingress filtering - Egress filtering
Egress filtering
Which of the following tools allows an attacker to extract information such as sender identity, mail server, sender's IP address, location, and so on? - Web updates monitoring tools - Email tracking tools - Metadata extraction tools - Website mirroring tools
Email tracking tools
Which of the following is the best practice to follow to secure a system or network against port scanning? - Do not configure firewall and IDS rules to detect and block probes - Ensure that firewall and routers do not block source routing techniques - Ensure that the versions of services running on the ports are non-vulnerable - Allow unwanted services running on the ports and update the service versions
Ensure that the versions of services running on the ports are non-vulnerable
Which of the following best practices should be followed to prevent web-shell installation? - Activate directory browsing in the web server - Establish a reverse proxy service for retrieving resources - Do not use escapeshellarg() or escapeshellcmd() - Enable all PHP functions such as exec(), shell_exec(), show_source(), proc_open(), passthru(), and pcntl_exec()
Establish a reverse proxy service for retrieving resources
Fill in the blank. Posing as an authorized AP by beaconing the WLAN's service set identifier (SSID) to lure users is known as __________. - Masquerading - Man-in-the-Middle Attack - Honeypot AP - Evil Twin AP
Evil Twin AP
John is a pen tester working with an information security consultant based in Paris. As part of a penetration testing assignment, he was asked to perform wireless penetration testing for a large MNC. John knows that the company provides free Wi-Fi access to its employees on the company premises. He sets up a rogue wireless access point with the same SSID as that of the company's Wi-Fi network just outside the company premises. He sets up this rogue access point using the tools that he has and hopes that the employees might connect to it. What type of wireless confidentiality attack is John trying to do? - WEP Cracking - Evil Twin AP - War Driving - KRACK Attack
Evil Twin AP
Which of the following deep and dark web searching tools helps an attacker obtain information about official government or federal databases and navigate anonymously without being traced? - ExoneraTor - Whitepages - Been Verified - Spokeo
ExoneraTor
Which of the following footprinting techniques allows an attacker to gather information passively about the target without direct interaction? - Performing social engineering - Extracting information using Internet archives - Extracting DNS information - Performing traceroute analysis
Extracting information using Internet archives
Which of the following TCP communication flags is set to "1" to announce that no more transmissions will be sent to the remote system and the connection established by the SYN flag is terminated? - RST flag - FIN flag - SYN flag - ACK flag
FIN flag
A pen tester was hired to perform penetration testing on an organization. The tester was asked to perform passive footprinting on the target organization. Which of the following techniques comes under passive footprinting? - Performing traceroute analysis - Finding the top-level domains (TLDs) and sub-domains of a target through web services - Querying published name servers of the target - Performing social engineering
Finding the top-level domains (TLDs) and sub-domains of a target through web services
Which of the following scanning tools is a mobile app for Android and iOS that provides complete network information, such as the IP address, MAC address, device vendor, and ISP location? - Netcraft - Maltego - Fing - Nmap
Fing
In which of the following attacks does an attacker repeatedly send some random input to a target API to generate error messages that reveal critical information? - Login/credential stuffing attack - Malicious input attack - Invalid input attack - Fuzzing
Fuzzing
Robert, a penetration tester, is trying to perform SQL penetration testing on the SQL database of the company to discover coding errors and security loopholes. Robert sends massive amounts of random data to the SQL database through the web application in order to crash the web application of the company. After observing the changes in the output, he comes to know that the web application is vulnerable to SQL injection attacks. Which of the following testing techniques is Robert using to find out the loopholes? - Stored Procedure Injection - Alternate Encodings - Fuzzing Testing - Out of Band Exploitation
Fuzzing Testing
Which of the following footprinting techniques allows an attacker to gather information about a target with direct interaction? - Gathering infrastructure details of the target organization through job sites - Gathering website information using web spidering and mirroring tools - Gathering financial information about the target through financial services - Gathering information using groups, forums, blogs, and NNTP Usenet newsgroups
Gathering website information using web spidering and mirroring tools
Which of the following ping methods is effective in identifying active hosts similar to the ICMP timestamp ping, specifically when the administrator blocks the conventional ICMP ECHO ping? - ICMP address mask ping scan - ICMP ECHO ping sweep - ICMP ECHO ping scan - UDP ping scan
ICMP address mask ping scan
An Attacker injects the folllowing SQL inquiry: blah' AND=1( Select Count(*) FROM MY TABLE;-- what is the intention of the attacker? - Identifying the table name - Updating table - Deleting a table - Adding new records
Identifying the table name
Which of the following countermeasures should be followed to protect web applications against broken access control? - Implement a session timeout mechanism - Never limit file permissions to authorized users - Never remove session tokens on the server side on user logout - Implement client-side caching mechanisms
Implement a session timeout mechanism
Which of the following tools is used for gathering email account information from different public sources and checking whether an email was leaked using the haveibeenpwned.com API? - Octoparse - Infoga - Professional Toolset - Metagoofil
Infoga
Shea is a licensed penetration tester. She is working with a client to test their new e-commerce website for SQL injection. After signing the NDA and agreeing on the rules of engagement (RoE), she starts by examining and listing all the input fields on the website. She tries to insert a string value in the CVV2 textbox, where a three-digit number is expected, and she ends up with the below error message. Identify in which stage of the SQL injection methodology is Shea right now. - Information gathering and SQL injection vulnerability detection - Exploit second-order SQL injection - Perform blind SQL injection - Launch SQL injection attacks
Information gathering and SQL injection vulnerability detection.
Which of the following API security risks can be prevented by performing input validation, implementing a parameterized interface for processing inbound API requests, and limiting the number of records returned? - Excessive data exposure - Injection - Mass assignment - Security misconfiguration
Injection
Which of the following attack techniques is used by an attacker to send forged control, management, or data frames over a wireless network to misdirect wireless devices and perform other types of attacks such as DoS? - Confidentiality attack - Integrity attack - Authentication attack - Availability attack
Integrity attack
Which of the following countermeasure should be used to prevent a ping sweep? - Limiting ICMP traffic with access-control lists (ACLs) to the ISP's specific IP addresses - Disabling the firewall - Avoiding the use of DMZ and disallowing commands such as ICMP ECHO_REPLY, HOST UNREACHABLE, and TIME EXCEEDED in DMZ - Allowing connection with any host performing more than 10 ICMP ECHO requests
Limiting ICMP traffic with access-control lists (ACLs) to the ISP's specific IP addresses
Which of the following tools is used by an attacker to create rogue APs and perform sniffing and MITM attacks? - Skyhook - MANA Toolkit - Gobuster - Halberd
MANA Toolkit
Which of the following technologies is an air interface for 4G and 5G broadband wireless communications? - DSSS - MIMO-OFDM - OFDM - FHSS
MIMO-OFDM
hich of the following database management systems contains the system table called "MsysObjects"? - MySQL - Oracle - MSSQL - MS Access
MS Access
Which of the following DNS record type helps in DNS footprinting to determine a domain's mail server? - CNAME - NS - A - MX
MX
In which type of fuzz testing do the current data samples create new test data and the new test data again mutates to generate further random data? - Mutation-based - None of the above - Protocol-based -Generation-based
Mutation-based
Which of the following tools is a web-application security scanner that searches for vulnerabilities to attacks such as clickjacking, SQL injection, and XSS? - Vindicate - Immunity Debugger - Mimikatz - N-Stalker X
N-Stalker X
Which of the following open-source tools would be the best choice to scan a network for potential targets? - Cain & Abel - hashcat - John the Ripper - NMAP
NMAP
Which of the following parameters enable NMAP's operating system detection feature? - NMAP -sC - NMAP -oS - NMAP -O - NMAP -sV
NMAP -O
Which NMAP command combination would let a tester scan every TCP port from a class C network that is blocking ICMP with fingerprinting and service detection? - NMAP -PN -O -sS -p 1-1024 192.168.0/8 - NMAP -P0 -A -sT -p0-65535 192.168.0/16 - NMAP -PN -A -O -sS 192.168.2.0/24 - NMAP -P0 -A -O -p1-65535 192.168.0/24
NMAP -PN -A -O -sS 192.168.2.0/24
Which tool would be used to collect wireless packet data? - Nessus - John the Ripper - Netcat - NetStumbler
NetStumbler
Which statement is TRUE regarding network firewalls in preventing web application attacks? - Network firewalls can prevent attacks because they can detect malicious HTTP traffic - Network firewalls cannot prevent attacks because they are too complex to configure - Network firewalls cannot prevent attacks because ports 80 and 443 must be kept opened - Network firewalls cannot prevent attacks if they are properly configured.
Network firewalls cannot prevent attacks because ports 80 and 443 must be kept opened
Smith, a professional hacker, has targeted an organization. He employed some footprinting tools to scan through all the domains, subdomains, reachable IP addresses, DNS records, and Whois records to perform further attacks. What is the type of information Smith has extracted through the footprinting attempt? - Company's product information - Physical security information - Policy information - Network information
Network information
Which of the following API vulnerabilities allows attackers to gain unauthorized access to API objects or perform actions such as viewing, updating, or deleting? - RBAC privilege escalation - Enumerated resources - No ABAC validation - Business logic flaws
No ABAC validation
Which of the following protocols is used by BlueJacking to send anonymous messages to other Bluetooth-equipped devices? - SDP - LMP - OBEX - L2CAP
OBEX
Which of the following functions can be used by an attacker to link a target SQL server's database to the attacker's own machine and retrieve data from the target SQL server database? - LOAD_FILE() - CONVERT() - INTO OUTFILE() - OPENROWSET()
OPENROWSET()
Which of the following attacks allows an attacker to encode portions of the attack with Unicode, UTF-8, Base64, or URL encoding to hide their attacks and avoid detection? - Network access attack - Cookie snooping - Obfuscation application - Authentication hijacking
Obfuscation application
Which type of antenna is used in wireless communication? - Omnidirectional - Bidirectional - Parabolic - Unidirectional
Omnidirectional
A- Sleep() B- Benchmark() C- mysqlquery() D- Addclashes() - Option B - Option C - Option D - Option A
Option A
Which of the following operators is used for String concentration in an oracle database? A- ''I I' B- ""&"" C- ''+'' D- contact(,) - Option D - Option B - Option C - Option A
Option A
Which of the following DB2 queries allows an attacker to perform column enumeration on a target database? - Option D - Option C - Option B - Option A
Option B
Which of the following SQL injection queries is used by an attacker to extract table column names? - Option A - Option D - Option B - Option C
Option B
Which of the following commands has to be disabled to prevent exploitation at the OS level? - Option C - Option B - Option A - Option D
Option B
Snort is an open-source, free and lightweight network intrusion detection system (NIDS) software for Linux and Windows to detect emerging threats. Snort can be used to detect SQL injection attacks. Identify the correct Snort rule to detect SQL injection attacks. - Option D - Option A - Option C - Option B
Option D
Which of the following MSSQL queries allows an attacker to perform column enumeration on a target database? - Option A - Option D - Option B - Option C
Option D
Which of the following SQL queries is an example of a heavy query used in SQL injection? - Option A - Option C - Option D - Option B
Option D
Which of the following is a Snort rule that is used to detect and block an SQL injection attack? - Option B - Option D - Option C - Option A
Option D
Which of the following queries is used to create a database account in Microsoft SQL Server? - Option D - Option C - Option B - Option A
Option D
In one of the following attacks, an attacker uses different communication channels to perform the attack and obtain results. It is difficult to perform as the attacker needs to communicate with a database server and determine the server features used by a web application. Which is this attack? - In-band SQL injection - Union SQL injection - Out-of-band SQL injection - End-of-line comment
Out-of-band SQL injection
Which of the following is considered as a repair job to a programming problem? - Assessment - Penetration test - Patch - Vulnerability
Patch
Which of the following types of scanning involves the process of checking the services running on a target computer by sending a sequence of messages to break in? - Network scanning - Vulnerability scanning - Port scanning - Banner grabbing
Port scanning
Which of the following IDS/firewall evasion techniques helps an attacker increase their Internet anonymity? - Proxy chaining - Source routing - Source port manipulation - IP address decoy
Proxy chaining
Passive reconnaissance involves collecting information through which of the following? - Social engineering - Email tracking - Traceroute analysis - Publicly accessible sources
Publicly accessible sources
What information is gathered about the victim using email tracking tools? - Recipient's IP address, geolocation, proxy detection, operating system, and browser information - Username of the clients, operating systems, email addresses, and list of software - Information on an organization's web pages since their creation - Targeted contact data, extracts the URL and meta tag for website promotion
Recipient's IP address, geolocation, proxy detection, operating system, and browser information
Which results will be returned with the following Google search query? site:target.com -site:Marketing.target.com accounting - Results matching "accounting" in domain target.com but not on the site Marketing.target.com - Results matching all words in the query - Results from matches on the site marketing.target.com that are in the domain target.com but do not include the word accounting - Results for matches on target.com and Marketing.target.com that include the word "accounting"
Results matching "accounting" in domain target.com but not on the site Marketing.target.com
A security administrator notices that the log file of the company's webserver contains suspicious entries: Based on source code analysis, the analyst concludes that the login.php script is vulnerable to - SQL injection - LDAP injection - command injection - directory traversal
SQL injection
Which of the following scanning techniques is used by an attacker to check whether a machine is vulnerable to UPnP exploits? - SCTP INIT scanning - UDP scanning - SSDP scanning - List scanning
SSDP scanning
Andrew, a professional penetration tester, was hired by ABC Security, Inc., a small IT-based firm in the United States to conduct a test of the company's wireless network. During the information-gathering process, Andrew discovers that the company is using the 802.11 g wireless standard. Using the NetSurveyor Wi-Fi network discovery tool, Andrew starts gathering information about wireless APs. After trying several times, he is not able to detect a single AP. What do you think is the reason behind this? - SSID broadcast feature must be disabled, so APs cannot be detected. - MAC address filtering feature must be disabled on APs or router. - Andrew must be doing something wrong, as there is no reason for him to not detect access points. - NetSurveyor does not work against 802.11g.
SSID broadcast feature must be disabled, so APs cannot be detected
Which of the following protocols provides transport-level security for API messages to ensure confidentiality through encryption and integrity through signature? - SSL - FTP - NTP - IMAP
SSL
Which of the following tools is a network scanner for iPhone and iPad that is used to scan LAN, Wi-Fi networks, websites, open ports, and network devices and can support several networking protocols? - Scany - Whonix - Psiphon - Tails
Scany
Which of the following parameters defines the level of access to an application to redirect a user agent to the authorization server? - State - Scope - Response_type - Redirect_uri
Scope
Sean works as a professional ethical hacker and penetration tester. He is assigned a project for information gathering on a client's network. He started penetration testing and was trying to find out the company's internal URLs, looking for any information about the different departments and business units. Sean was unable find any information. What should Sean do to get the information he needs? - Sean should use email tracking tools - Sean should use WayBackMachine in Archive.org - Sean should use website mirroring tools - Sean should use Sublist3r tool
Sean should use Sublist3r tool
What is the output returned by search engines when extracting critical details about a target from the Internet? - Advanced search operators - Operating systems, location of web servers, users, and passwords - Search engine results pages ("SERPs") - Open ports and services
Search engine results pages ("SERPs")
Which of the following countermeasures should be followed to defend against watering-hole attacks? - Enable third-party content such as advertising services, which track user activities - Never run the web browser in a virtual environment - Secure the DNS server to prevent attackers from redirecting the user to a new location - Use browser plug-ins that allow HTTP redirects
Secure the DNS server to prevent attackers from redirecting the user to a new location
In which of the following processes do the station and access point use the same WEP key to provide authentication, which means that this key should be enabled and configured manually on both the access point and the client? - WPA encryption - Shared key authentication process - WEP encryption - Open-system authentication process
Shared key authentication process
Which of the following activities of a user on social networking sites helps an attacker footprint or collect the identity of the user's family members, the user's interests, and related information? - Creating events - Maintaining the profile - Sharing photos and videos - Playing games and joining groups
Sharing photos and videos
Robert, an attacker, targeted a high-level executive of an organization and wanted to obtain information about the executive on the Internet. He employed a tool through which he discovered the target user on various social networking sites, along with the complete URL. What is the tool used by Robert in the above scenario? - Sublist3r - Sherlock - OpUtils - BeRoot
Sherlock
Sean works as a penetration tester in ABC firm. He was asked to gather information about the target company. Sean begins with social engineering by following the steps: Secretly observes the target to gain critical information Looks at employee's password or PIN code with the help of binoculars or a low-power telescope Based on the above description, identify the social engineering technique. - Phishing - Shoulder surfing - Dumpster diving - Tailgating
Shoulder surfing
Smith works as a professional Ethical Hacker with a large MNC. He is a CEH certified professional and was following the CEH methodology to perform the penetration testing. He is assigned a project for information gathering on a client's network. He started penetration testing and was trying to find out the company's internal URLs, (mostly by trial and error), looking for any information about the different departments and business units. Smith was unable to find any information. What should Smith do to get the information he needs? - Smith should use online services such as netcraft.com to find the company's internal URLs - Smith should use WayBackMachine in Archive.org to find the company's internal URLs - Smith should use email tracking tools such as eMailTrackerPro to find the company's internal URLs- - Smith should use website mirroring tools such as HTTrack Website Copier to find the company's internal URLs
Smith should use online services such as netcraft.com to find the company's internal URLs
Which of the following is the direct approach technique that serves as the primary source for attackers to gather competitive intelligence? - Search engines, Internet, and online databases - Social media postings - Social engineering - Support threads and reviews
Social engineering
In website footprinting, which of the following information is acquired by the attacker when they examine the cookies set by the server? - Software in use and its behavior - Comments present in the source code - Contact details of the web developer or admin - File-system structure and script type
Software in use and its behavior
Which of the following is used to detect bugs and irregularities in web applications? - Source code review - Generation-based fuzz testing - Protocol-based fuzz testing - Mutation-based fuzz testing
Source code review
In one of the following features of the RESTful API, the client end stores the state of the session, and the server is restricted to save data during request processing. Which is this feature? - Code on demand - Cacheable - Stateless - Uniform interface
Stateless
A security engineer is attempting to perform scanning on acompany's internal network to verify security policies of their networks. The engineer uses the following NMAP command: nmap -n -sS -P0 -p 80 ***.***.**.**. What type of scan is this? - Stealth scan - Intense scan - Comprehensive scan - Quick scan
Stealth scan
Which of the following scans detects when a port is open after completing the three-way handshake, establishes a full connection, and closes the connection by sending an RST packet? - ACK flag probe scan - IDLE/IPID header scan - Stealth scan - TCP connect scan
TCP connect scan
Which of the following is the active banner grabbing technique used by an attacker to determine the OS running on a remote target system? - TCP sequence ability test - Sniffing of network traffic - Banner grabbing from page extensions - Banner grabbing from error messages
TCP sequence ability test
Which of the following Encryption technique is used in WPA? - DES - RSA - TKIP - AES
TKIP
In which of the following attacks does an attacker use a conditional OR clause in such a way that the condition of the WHERE clause will always be true? - Tautology - End-of-line comment - Illegal/logically incorrect query - UNION SQL injection
Tautology
Which of the following practices helps developers defend against SQL injection attacks? - Always construct dynamic SQL with concatenated input values - Build Transact-SQL statements directly from user input - Test the content of string variables and accept only expected values - Allow entries that contain binary data, escape sequences, and comment characters
Test the content of string variables and accept only expected values
Which of the following countermeasures prevents buffer overruns? - Test the size and data type of the input and enforce appropriate limits. - Apply the least privilege rule to run the applications that access the DBMS. - Keep untrusted data separate from commands and queries. - Use the most restrictive SQL account types for applications.
Test the size and data type of the input and enforce appropriate limits.
If your web application sets any cookie with a secure attribute, what does this mean? - The cookie cannot be accessed by JavaScript - Cookies will be sent cross-domain - The client will send the cookie only over an HTTPS connection - The cookie will not be sent cross-domain
The client will send the cookie only over an HTTPS connection
Bank of Timbuktu is a medium-sized, regional financial institution in Timbuktu. The bank has deployed a new Internet-accessible Web application recently. Customers can access their account balances, transfer money between accounts, pay bills and conduct online financial business using a Web browser.John Stevens is in charge of information security at Bank of Timbuktu. After one month in production, several customers have complained about the Internet enabled banking application. Strangely, the account balances of many of the bank's customers had been changed! However, money hasn't been removed from the bank; instead, money was transferred between accounts. Given this attack profile, John Stevens reviewed the Web application's logs and found the following entries:Attempted login of unknown user: johnmAttempted login of unknown user: susaRAttempted login of unknown user: sencatAttempted login of unknown user: pete";Attempted login of unknown user: ' or 1=1-Attempted login of unknown user: '; drop table logins-Login of user jason, sessionID= 0x75627578626F6F6BLogin of user daniel, sessionID= 0x98627579539E13BELogin of user rebecca, sessionID= 0x9062757944CCB811Login of user mike, sessionID= 0x9062757935FB5C64Transfer Funds user jasonPay Bill user mikeLogout of user mikeWhat kind of attack did the Hacker attempt to carry out at the bank? - The hacker first attempted logins with suspected user names, and then used SQL injection to gain access to valid bank login IDs. - The hacker attempted session hijacking, in which the hacker opened an account with the bank, then logged in to receive a session ID, guessed the next ID, and took over Jason's session. - The hacker used a generator module to pass results to the webserver and exploited web application CGI vulnerability. - Brute force attack in which the hacker attempted guessing login IDs and passwords from password-cracking tools.
The hacker first attempted logins with suspected user names, and then used SQL injection to gain access to valid bank login IDs.
A penetration tester is conducting a port scan on a specific host. The tester found several open ports that were confusing in concluding the operating system (OS) version installed. Considering the NMAP result below, which of the following is likely to be installed on the target machine by the OS? Starting NMAP 7.70 at 2018-03-15 11:06 NMAP scan report for 172.16.40.65 Host is up (1.00s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 80/tcp open http 139/tcp open netbios-ssn 515/tcp open 631/tcp open ipp 9100/tcp open MAC Address: 00:00:48:0D:EE:89 - The host is likely a Linux machine. - The host is likely a Windows machine. - The host is likely a router. - The host is likely a printer.
The host is likely a printer.
What is the main difference between a "Normal" SQL injection and a "Blind" SQL injection vulnerability? - The attack is called "Blind" because, although the application properly filters user input, it is still vulnerable to code injection. - The vulnerable application does not display errors with information about the injection results to the attacker. - A successful attack does not show an error message to the administrator of the affected application. - The request to the webserver is not visible to the administrator of the vulnerable application.
The vulnerable application does not display errors with information about the injection results to the attacker.
Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by the network's IDS? - Fingerprinting to identify which operating systems are running on the network - Timing options to slow the speed that the port scan is conducted - ICMP ping sweep to determine which hosts on the network are not available - Traceroute to control the path of the packets sent during the scan
Timing options to slow the speed that the port scan is conducted
Which of the following search engine tools helps an attacker use an image as a search query and track the original source and details of images, such as photographs, profile pictures, and memes? - Mention - TinEye - Intelius - Sublist3r
TinEye
Which of the following tools are useful in extracting information about the geographical location of routers, servers, and IP devices in a network? - Traceroute tools - Email tracking tools - Website mirroring tools - Web spidering tools
Traceroute tools
In LAN-to-LAN Wireless Network, the APs provide wireless connectivity to local computers, and computers on different networks that can be interconnected? - True - False
True
SQL injection attacks do not exploit a specific software vulnerability; instead they target websites that do not follow secure coding practices for accessing and manipulating data stored in a relational database. - False - True
True
Which of the following issues can be detected when testers send long strings of junk data, similar to strings for detecting buffer overruns that throw SQL errors on a page? - SQL injection - Truncation - SQL modification - Input sanitization
Truncation
InfoTech Security hired a penetration tester Sean to do physical penetration testing. On the first day of his assessment, Sean goes to the company posing as a repairman and starts checking trash bins to collect the sensitive information. What is Sean trying to do? - Trying to attempt social engineering by eavesdropping - Trying to attempt social engineering using phishing - Trying to attempt social engineering by shoulder surfing - Trying to attempt social engineering by dumpster diving
Trying to attempt social engineering by dumpster diving
Which of the following practices is NOT a preventive measure against KRACK attacks? - Avoid using public Wi-Fi networks - Always enable the HTTPS Everywhere extension - Enable two-factor authentication - Turn off auto-updates for all wireless devices
Turn off auto-updates for all wireless devices
While performing a UDP scan of a subnet, you receive an ICMP reply of Code 3/Type 3 for all the pings you have sent out. What is the most likely cause of this? - The firewall is dropping the packets. - UDP port is open. - The host does not respond to ICMP packets. - UDP port is closed.
UDP port is closed.
Which of the following countermeasures is used to avoid banner grabbing attacks? - Enable the details of the vendor and version in the banners - Never display false banners to mislead or deceive attackers - Turn on unnecessary services on the network host to limit information disclosure - Use ServerMask tools to disable or change banner information
Use ServerMask tools to disable or change banner information
Which of the following countermeasures should be followed to protect web applications from command injection attacks? - Use modular shell disassociation from the kernel - Never use parameterized SQL queries - Never use language-specific libraries
Use modular shell disassociation from the kernel
An attacker tries to enumerate the username and password of an account named "rini Mathew" on wordpress.com. On the first attempt, the attacker tried to login as "rini.mathews," which resulted in the login failure message "invalid email or username." On the second attempt, the attacker tried to login as "rinimathews," which resulted in a message stating that the password entered for the username was incorrect, thus confirming that the username "rinimathews" exists. What is the attack that is performed by the attacker? - Brute-forcing - Man-in-the-middle - Username enumeration - Phishing
Username enumeration
While performing data validation of web content, a security technician is required to restrict malicious input. Which of the following processes is an efficient way of restricting malicious input? - Validate web content input with scanning tools - Validate web content input for extraneous queries - Validate web content input for query strings - Validate web content input for type, length, and range
Validate web content input for type, length, and range
Q 175 - Variations - Declare variables - Case variation - Null byte
Variations
Which of the following consists of 40/104 bit Encryption Key Length? - WEP - RSA - WPA - WPA2
WEP
Which of the following tools consists of a publicly available set of databases that contain personal information of domain owners? - Traceroute tools - Metadata extraction tools - WHOIS lookup tools - Web spidering tools
WHOIS lookup tools
Donald works as a network administrator with ABCSecurity, Inc., a small IT based firm in San Francisco. He was asked to set up a wireless network in the company premises which provides strong encryption to protect the wireless network against attacks. After doing some research, Donald decided to use a wireless security protocol which has the following features: Provides stronger data protection and network access control Uses AES encryption algorithm for strong wireless encryption Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP) Which of the following wireless security protocol did Donald decide to use? - TKIP - WEP - WPA - WPA2
WPA2
Which of the following encryption methods has KRACK vulnerabilities that make it susceptible to packet sniffing, connection hijacking, malware injection, and decryption attacks? - WEP - WPA2 - EAP - WPA
WPA2
Which of the following Wi-Fi security protocols uses GCMP-256 for encryption and HMAC-SHA-384 for authentication? - CCMP - PEAP - WPA3 - WEP
WPA3
Which of the following Wi-Fi security protocols uses GCMP-256 for encryption and HMAC-SHA-384 for authentication? - WPA3 - WEP - CCMP - PEAP
WPA3
Which of the following security standards contains the Dragonblood vulnerabilities that help attackers recover keys, downgrade security mechanisms, and launch various information-theft attacks? - WPA3 - WPA2 - WEP - WPA
WPA3
Which of the following metadata formats does the SOAP API use to reveal a large amount of technical information such as paths, parameters, and message formats? - Swagger - WSDL/XML-Schema - I/O Docs - API-Blueprint
WSDL/XML-Schema
In which of the following technique, an attacker draws symbols in public places to advertise open Wi-Fi networks? - WarWalking - WarFlying - WarDriving - WarChalking
WarChalking
In which of the following techniques does an attacker draw symbols in public places to advertise open Wi-Fi networks? - Warflying - Wardriving - Warwalking - Warchalking
Warchalking
Which of the following automatically discover hidden content and functionality by parsing HTML form and client-side JavaScript requests and responses? - Proxies - Web spiders - Firewalls - Banners
Web spiders
Which of the following APIs is a user-defined HTTP callback or push API that is raised based on events triggered, such as receiving a comment on a post or pushing code to the registry? - Webhook - SOAP API - RESTful API - REST API
Webhook
Which of the following is a query and response protocol used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system? - Whois lookup - TCP/IP - Traceroute - DNS lookup
Whois lookup
Which of the following techniques is used by network management software to detect rogue APs? - AP scanning - Wired side inputs - RF scanning - Virtual-private network
Wired side inputs
Which of the following components of Cisco's WIPS deployment forwards attack information from wireless IPS monitor-mode APs to the MSE and distributes configuration parameters to APs? - Wireless control system - Mobility services engine - Local mode AP - Wireless LAN controller
Wireless LAN controller
In which of the following attacks does an attacker exploit dynamic routing protocols, such as DSR and AODV, and place themselves strategically in a target network to sniff and record ongoing wireless transmissions? - Sinkhole attack - Wormhole attack - RADIUS replay - Honeypot AP attack
Wormhole attack
Kenneth, a professional penetration tester, was hired by the XYZ Company to conduct wireless network penetration testing. Kenneth proceeds with the standard steps of wireless penetration testing. He tries to collect lots of initialization vectors (IVs) using the injection method to crack the WEP key. He uses the aircrack-ng tool to capture the IVs from a specific AP. Which of the following aircrack-ng commands will help Kenneth to do this? - aireplay-ng -1 0 -e teddy -a 00:14:6C:7E:40:80 -h 00:0F:B5:88:AC:82 ath0 - airmon-ng start wifi0 9aireplay-ng -9 -e teddy -a 00:14:6C:7E:40:80 ath0 - airodump-ng -c 9 -- bssid 00:14:6C:7E:40:80 -w output ath0
airodump-ng -c 9 -- bssid 00:14:6C:7E:40:80 -w output ath0
Which of the following options of Sublist3r allows the user to specify a comma-separated list of search engines? - d - p - e - o
e
Which of the following Hping3 command is used to perform ACK scan? - hping3 -1 <IP Address> -p 80 - hping3 -8 50-60 -S <IP Address> -V - hping3 -A <IP Address> -p 80 - hping3 -2 <IP Address> -p 80
hping3 -A <IP Address> -p 80
Which of the following hping commands is used by an attacker to collect the initial sequence number? - hping3 192.168.1.103 -Q -p 139 -s - hping3 -A 10.0.0.25 -p 80 - hping3 -S 72.14.207.99 -p 80 --tcp-timestamp - hping3 -2 10.0.0.25 -p 80
hping3 192.168.1.103 -Q -p 139 -s
Robin, a professional hacker, targeted an organization for financial benefit. He initiated footprinting attacks on the target organization. In this process, he used an advanced Google search query that returns a list of FTP servers by IP address, which are mostly Windows NT servers with guest login capabilities. What is the advanced Google search query employed by Robin in the above scenario? - inurl:~/ftp://193 filetype:(php | txt | html | asp | xml | cnf | sh) ~'/html' - intitle:"Index Of" - intext:sftp-config.jsonintext:pure-ftpd.conf intitle:index of - type:mil inurl:ftp ext:pdf | ps
inurl:~/ftp://193 filetype:(php | txt | html | asp | xml | cnf | sh) ~'/html'
Which of the following web services provides useful information about a target company, such as the market value of the company's shares, company profile, and competitor details? - investing.com - linkup.com - dice.com - indeed.com
investing.com
Which of the following commands displays various options that a user can utilize to obtain a list of words from a target website? - dnsrecon -r 162.241.216.0-162.241.216.255 - cewl --email www.certifiedhacker.com - ruby cewl.rb --help - cewl www.certifiedhacker.com
ruby cewl.rb --help
Which of the following Nmap options is used by an attacker to perform an SCTP COOKIE ECHO scan? - sZ - sU - sL - sY
sZ
Which of the following tools does an attacker use to perform a query on the platforms included in OSRFramework? - domainfy.py - searchfy.py - mailfy.py - usufy.py
searchfy.py
Which Google search query will search for any files a target certifiedhacker.com may have? - site: certifiedhacker.com filetype:xml | filetype:conf | filetype:cnf | filetype:reg | filetype:inf | filetype:rdp | filetype:cfg | filetype:txt | filetype:ora | filetype:ini - allinurl: certifiedhacker.com ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini - site: certifiedhacker.com ext:xml || ext:conf || ext:cnf || ext:reg || ext:inf || ext:rdp || ext:cfg || ext:txt || ext:ora || ext:ini - site: certifiedhacker.com intext:xml | intext:conf | intext:cnf | intext:reg | intext:inf | intext:rdp | intext:cfg | intext:txt | intext:ora | intext:ini
site: certifiedhacker.com filetype:xml | filetype:conf | filetype:cnf | filetype:reg | filetype:inf | filetype:rdp | filetype:cfg | filetype:txt | filetype:ora | filetype:ini
Which Google search query can you use to find mail lists dumped on pastebin.com? - site:pastebin.com intext:*@*.com:* - allinurl: pastebin.com intitle:*@*.com:* - allinurl: pastebin.com intitle:"mail lists" - cache: pastebin.com intitle:*@*.com:*
site:pastebin.com intext:*@*.com:*
A hacker is attempting to check for all the systems alive in the network by performing a ping sweep. Which NMAP switch would the hacker use? - sU - sS - sn - sT
sn
Which of the following system table does MS SQL Server database use to store metadata? Hackers can use this system table to acquire database schema information to further compromise the database. - syscell - ssysobject - ssysrow - ssysdbs
ssysobject
Which of the following is a security risk due to the incorrect implementation of applications, allowing attackers to compromise passwords, keys, session tokens, and exploit user identity? - Security misconfiguration - Sensitive data exposure - Broken authentication - Injection
Broken authentication
In which of the following attack types does an attacker flood an application with an excess amount of data so that the application may crash or exhibit vulnerable behavior? - Directory traversal - Denial-of-service attack - Buffer overflow attack - Parameter/form tampering
Buffer overflow attack
Which of the following techniques is NOT a countermeasure for securing accounts? - Enable unused default user accounts - Use secure web permissions, NTFS permissions, and .NET Framework access control mechanisms - Eliminate unnecessary database users and stored procedures - Remove all unused modules and application extensions
Enable unused default user accounts
Which of the following techniques is NOT a countermeasure for securing accounts? - Remove all unused modules and application extensions - Use secure web permissions, NTFS permissions, and .NET Framework access control mechanisms - Enable unused default user accounts - Eliminate unnecessary database users and stored procedures
Enable unused default user accounts
Which of the following is not a defensive measure for web server attacks while implementing Machine.config? - Limit inbound traffic to port 80 for HTTP and port 443 for HTTPS (SSL) - Ensure that tracing is enabled <trace enable="true"/> and debug compiles are turned on - Encrypt or restrict intranet traffic - Restrict code access security policy settings
Ensure that tracing is enabled <trace enable="true"/> and debug compiles are turned on
Which of the following tools is not used to perform webserver information gathering? - Nmap - Netcraft - Wireshark - Whois
Wireshark
Which of the following is an operation in the web service architecture that involves obtaining the service interface description at the time of development as well as the binding and location description calls at run time? - Find - Bind - Publish - Service
Find
Which of the following techniques makes a web server vulnerable to attacks? - Blocking unrestricted internal and outbound traffic - Running unhardened applications and servers - Regularly updating the web server with the latest patches - Using different system administrator credentials everywhere
Running unhardened applications and servers
Which of the following stores a server's configuration, error, executable, and log files? - Document root - Virtual document tree - Server root - Web proxy
Server root
Which of the following terms refers to a set of hotfixes packed together? - Service pack - Repair pack - Hotfix pack - Patch
Service pack
Which of the following command does an attacker use to enumerate common web applications? - nmap -p80 --script http-userdir -enum localhost - nmap --script http-trace -p80 localhost - nmap --script http-enum -p80 <host> - nmap -p80 --script http-trace <host>
nmap --script http-enum -p80 <host>
An attacker identifies the kind of websites a target company/individual is frequently surfing and tests those particular websites to identify any possible vulnerabilities. When the attacker identifies the vulnerabilities in the website, the attacker injects malicious script/code into the web application that can redirect the webpage and download the malware onto the victim's machine. After infecting the vulnerable web application, the attacker waits for the victim to access the infected web application. What kind of an attack is this? - Phishing attack - Jamming attack - Water hole attack - Denial-of-service attack
- Water hole attack
The Open Web Application Security Project (OWASP) testing methodology addresses the need to secure web applications by providing which one of the following services? - A security certification for hardened web applications - Web application patches - A list of flaws and how to fix them - An extensible security framework named COBIT
A list of flaws and how to fix them
In which of the following attack techniques does an attacker lure victims via email or a link that is constructed such that the loopholes of remote execution code become accessible, allowing the attacker to obtain access privileges equal to those of authorized users? - ActiveX attack - Session fixation - Frame injection - Request forgery attack
ActiveX attack
Which of the following is NOT a best approach to protect your firm against web server attacks? - Apply restricted ACLs - Allow remote registry administration - Remove unnecessary ISAPI filters from the web server - Secure the SAM (Stand-alone Servers Only)
Allow remote registry administration
Which of the following is NOT a best approach to protect your firm against web server attacks? - Remove unnecessary ISAPI filters from the web server - Allow remote registry administration - Apply restricted ACLs - Secure the SAM (Stand-alone Servers Only)
Allow remote registry administration
Which of the following is a web security testing tool that can be used by an attacker to predict and use the next possible session ID token to take over a valid session? - Burp Suite - Nikto2 - NCollector Studio - Netcraft
Burp Suite
An attacker has been successfully modifying the purchase price of items purchased on the company's website. The security administrators verify the webserver and Oracle database have not been compromised directly. They have also verified the intrusion detection system (IDS) logs and found no attacks that could have caused this. What is the most likely way the attacker has been able to modify the purchase price? - By changing hidden form values - By using SQL injection - By using cross site scripting - By utilizing a buffer overflow attack
By changing hidden form values
Which of the following tools is employed by a pen tester to find vulnerabilities in an organization's web server and evaluate its security posture by using the same techniques as those currently employed by cybercriminals? - Pupy - Netcraft - CORE Impact - NetVizor
CORE Impact
In which of the following cookie exploitation attacks does an attacker modify the cookie contents to obtain unauthorized information about a user and thereby perform identity theft? - Cookie sniffing - Cookie replay - Session brute-forcing - Cookie poisoning
Cookie poisoning
Which of the following is a clickjacking technique that overlays only the selected controls from a transparent page and involves masking buttons with hyperlinks and text labels containing false information? - Complete transparent overlay - Rapid content replacement - Cropping - Click event dropping
Cropping
In which of the following attack types does an attacker exploit the trust of an authenticated user to pass malicious code or commands to a web server? - SQL injection attack - Unvalidated input and file injection - Cross-site scripting - Cross-site request forgery
Cross-site request forgery
Which of the following is a web application attack that is also known as a one-click attack and occurs when a hacker instructs a user's web browser to send a request to a vulnerable website through a malicious web page? - Cross-site request forgery - Web service attack - Hidden field manipulation - Cookie snooping
Cross-site request forgery
A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend. The analyst locates the applications search form and introduces the following code in the search input field:"IMG SRC = vbscript:msgbox (Vulnerable" When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable". Which web applications vulnerability did the analyst discover? - Cross-site request forgery - Command injection - Cross-site scripting - SQL injection
Cross-site scripting
Which of the following attacks exploits vulnerabilities in dynamically generated webpages, which enables malicious attackers to inject client-side scripts into webpages viewed by other users? - Cross-site scripting - Broken access control - Security misconfiguration - Sensitive data exposure
Cross-site scripting
Which of the following is an application security threat that occurs when an application includes untrusted data in a new web page without proper validation or escaping or when an application updates an existing web page with user-supplied data? - Security misconfiguration - Components with known vulnerabilities - Cross-site scripting (XSS) - XML external entity (XXE)
Cross-site scripting (XSS)
Which of the following is not a session hijacking technique? - Cross-site scripting - DNS hijacking - Session fixation - Session sidejacking
DNS hijacking
Choose an ICANN accredited registrar and encourage them to set registrar-lock on the domain name in order to avoid which attack? - Man-in-the-middle attack - Denial-of-service attack - Session hijacking attack - DNS hijacking attack
DNS hijacking attack
If an attacker compromises a DNS server and changes the DNS settings so that all the requests coming to the target webserver are redirected to his/her own malicious server, then which attack did he perform? - DNS amplification attack - HTTP response splitting attack - DoS attack - DNS server hijacking
DNS server hijacking
Which of the following is a type of attack in which the attacker alters or deletes the data of a web server and replaces the data with malware? - Data theft - Compromise of user accounts - Data tampering - Website defacement
Data tampering
Which of the following types of damage is caused when attackers access sensitive data such as financial records, future plans, and the source code of a program? - Website defacement - Data theft - Damage of the reputation of the company - Data tampering
Data theft
The security analyst for Danels Company arrives this morning to his office and verifies the primary home page of the company. He notes that the page has the logo of the competition and writings that do not correspond to the true page. What kind of attack do the observed signals correspond to? - DDoS - Defacement - Phishing - HTTP attack
Defacement
An attacker sends numerous fake requests to the webserver from various random systems that results in the webserver crashing or becoming unavailable to the legitimate users. Which attack did the attacker perform? - HTTP response splitting attack - DNS server hijacking - DoS attack - DNS amplification attack
DoS attack
Which of the following is the root file directory of a web server that stores critical HTML files related to web pages of a domain name that will be sent in response to requests? - Virtual hosting - Document root - Web proxy - Server root
Document Root
Which of the following is NOT a best approach to protect your firm against web server files and directories? - Enable serving of directory listings - Avoid mapping virtual directories between two different servers, or over a network - Eliminate unnecessary files within the .jar files - Disable serving certain file types by creating a resource mapping
Enable serving of directory listings
Which of the following techniques allows an attacker to inject unusual characters into HTML code to bypass client-side controls? - Source-code review - Attack hidden form fields - Evade XSS filters - Attack browser extensions
Evade XSS filters
A security administrator is looking for a patch management tool which scans organizational network and manages security and non-security patches. Which of the following patch management tool, he/she can use in order to perform the required task? - Netscan Pro - Nikto - Burp suite - GFI LanGuard
GFI LanGuard
In which of the following types of injection attacks does an attacker exploit vulnerable form inputs, inject HTML code into a webpage, and change the website appearance? - Shell injection - File injection - HTML injection - HTML embedding
HTML injection
Which of the following tools is used by an attacker to perform website mirroring? - HTTrack - Hydra - Netcraft - Nessus
HTTrack
Which of the following techniques does an attacker use to replace the value of the data source parameter with that of a rogue Microsoft SQL server? - Hash stealing - Connection pool DoS - Port scanning - Hijacking web credentials
Hash stealing
One of the following is a clickjacking technique in which an attacker creates an iframe of 1 × 1 pixels containing malicious content placed secretly under the mouse cursor. When the user clicks on this cursor, it will be registered on a malicious page. Which is this clickjacking technique? - Click event dropping - Hidden overlay - Complete transparent overlay - Rapid content replacement
Hidden overlay
An attacker wants to crack passwords using attack techniques like brute-forcing, dictionary attack, and password guessing attack. What tool should he use to achieve his objective? - Netcraft - Nessus - Burp suite - Hydra
Hydra
Which of the following tools is a simple Internet server identification utility that is capable of performing reverse DNS lookup and HTTP server identification? - OllyDbg - ID Serve - Dylib Hijack Scanner - NCollector Studio
ID Serve
Which of the following countermeasures should be followed to defend against DNS hijacking? - Include DNS hijacking into incident response and business continuity planning - Do not safeguard the registrant account information - Use the default router password included in the factory settings - Download audio and video codecs and other downloaders from untrusted websites
Include DNS hijacking into incident response and business continuity planning
What technique is used to perform a connection stream parameter pollution (CSPP) attack? - Injecting parameters into a connection string using semicolons as a separator - Adding multiple parameters with the same name in HTTP requests - Setting a user's session identifier (SID) to an explicit known value - Inserting malicious Javascript code into input parameters
Injecting parameters into a connection string using semicolons as a separator
Which of the following techniques is NOT a countermeasure to defend against web server attacks? - Use a dedicated machine as a web server - Secure the SAM - Install IIS server on a domain controller - Relocate sites and virtual directories to non-system partitions
Install IIS server on a domain controller
Which of the following security misconfigurations supports weak algorithms and uses expired or invalid certificates, resulting in data exposure and account theft? - Improper error handling - Parameter/form tampering - Unvalidated inputs - Insufficient transport layer protection
Insufficient transport layer protection
In which layer of the web-application vulnerability stack does an attacker scan an operating system to find open ports and vulnerabilities and develop viruses/backdoors to exploit them? - Layer 3 - Layer 2 - Layer 5 - Layer 7
Layer 3
In which layer of the web application vulnerability stack does an attacker exploit business-logic flaws and technical vulnerabilities to perform input validation attacks such as XSS? - Layer 4 - Layer 5 - Layer 7 - Layer 6
Layer 7
Which of the following vulnerabilities occurs when an application adds files without the proper validation of inputs, thereby enabling an attacker to modify the input and embed path traversal characters? - Security misconfiguration - File fingerprinting - Local file inclusion - Fileless malware
Local file inclusion
In which of the following attacks does an attacker attempt to access sensitive information by intercepting and altering communications between an end user and a web server? - Man-in-the-middle attack - HTTP response splitting attack - Phishing attack - Website defacement attack
Man-in-the-middle attack
Which of the following attacks allows an attacker to access sensitive information by intercepting and altering communications between an end user and webservers? - Man-in-the-middle attack - HTTP response splitting attack - Directory traversal attack - DoS attack
Man-in-the-middle attack
Which of the following is not a webserver security tool? - Fortify Web - InspectNetIQ secure configuration manager - Netcraft - Retina CS
Netcraft
Which of the following is an attack that can majorly affect web applications, including the basic level of service, and allows a level of privilege that standard HTTP application methods cannot grant? - Platform exploits - CAPTCHA attacks - Buffer overflow - Network access attacks
Network access attacks
Which of the following is a lookup database for default passwords, credentials, and ports? - NetcraftN - Collector Studio - Open Sez Me - ID Serve
Open Sez Me
Which of the following guidelines should be followed by application developers to defend against HTTP response-splitting attacks? - Use the same TCP connection with the proxy for different virtual hosts - Allow CR (%0d or \r) and LF (%0a or \n) characters - Parse all user inputs or other forms of encoding before using them in HTTP headers - Share incoming TCP connections among different clients
Parse all user inputs or other forms of encoding before using them in HTTP headers
Andrew, a software developer in CyberTech organization has released a security update that acts as defensive technique against the vulnerabilities in the software product the company has released earlier. Identify the technique used by Andrew to resolve the software vulnerabilities? - Patch Management - Product Management - Risk Management - Vulnerability Management
Patch Management
Which of the following teams has the responsibility to check for updates and patches regularly? - Vulnerability assessment team - Red team - Patch management team - Security software development team
Patch management team
Attackers use GET and CONNECT requests to use vulnerable web servers as which of the following? - Application servers - DNS servers - None of the above - Proxies
Proxies
An attacker exploits a web application by tampering with the form and parameter of the web application and he is successful in exploiting the web application and gaining access. Which type of vulnerability did the attacker exploit? - Security misconfiguration - SQL injection - Sensitive data exposure - Broken access control
Security misconfiguration
Which of the following attacks allows an attacker to inject malicious content, modify the user´s online experience, and obtain unauthorized information? - Session prediction - Session poisoning - Cross-site request forgery - Session brute-forcing
Session poisoning
Which of the following types of payload modules in the Metasploit framework is self-contained and completely stand-alone? - Stages - Exploit - Singles - Stagers
Singles
During a penetration test, a tester finds that the web application being analyzed is vulnerable to XSS. Which of the following conditions must be met to exploit this vulnerability? - The web application does not have the secure flag set. - The victim's browser must have ActiveX technology enabled. - The victim user should not have an endpoint security solution. - The session cookies do not have the HttpOnly flag set.
The session cookies do not have the HttpOnly flag set.
Which of the following technique defends servers against blind response forgery? - UDP source port randomization - Disallow carriage return (%0d or \r) and line feed (%0a or \n) characters - Removal of carriage returns (CRs) and linefeeds (LFs) - Restriction of web application access to unique IPs
UDP source port randomization
Which of the following technique defends servers against blind response forgery? - UDP source port randomization - Removal of carriage returns (CRs) and linefeeds (LFs) - Disallow carriage return (%0d or \r) and line feed (%0a or \n) characters - Restriction of web application access to unique IPs
UDP source port randomization
A network administrator has observed that the computers in his network have Windows 7 operating system. The administrator has learned that the WannaCry ransomeware is affecting Windows 7 Systems across the globe. Which of the following is the best option that the network administrator has to provide efficient security and defend his network? - Remove all Windows 7 machines from the network - Update security patches and fixes provided by Microsoft - Conduct vulnerability assessment of all the machines in the network - Perform penetration testing on all the machines in the network
Update security patches and fixes provided by Microsoft
Which of the following techniques is used by an attacker to enumerate usernames from a target web application? - Verbose failure message - Dictionary attack - Cookie poisoning - Bypass SAML-based SSO
Verbose failure message
Identify the component of the web server that provides storage on a different machine or a disk after the original disk is filled-up? - Virtual document tree - Server root - Virtual hosting - Document root
Virtual document tree
Which of the following is a web-server component that provides storage on a different machine or disk after the original disk is filled up? - Document root - Server root - Virtual hosting - Virtual document tree
Virtual document tree
Which of the following provides storage on a different machine or disk after the original disk is filled up? - Virtual Hosting - Document root - Virtual document tree - Server root
Virtual document tree
Which of the following components of the web service architecture is an extension of SOAP and can be used to maintain the integrity and confidentiality of SOAP messages? - WS-Security - WS-Policy - WSDL - UDDI
WS-Security
Which of the following provides an interface between end-users and webservers? - Firewall - Database - Demilitarized zone - Web applications
Web applications
Which of the following layers in the web application architecture contains various components such as a firewall, an HTTP request parser, a proxy caching server, an authentication and login handler, a resource handler, and a hardware component? - Web-server logic layer - Business logic layer - Client or presentation layer - Database layer
Web-server logic layer
In which of the following attack types does an attacker alter the visual appearance of a web page by injecting code to add image popups or text? - Web cache poisoning - Server-side request forgery - Website defacement - Web-server misconfiguration
Website defacement
Which of the following attacks occurs when an intruder maliciously alters the visual appearance of a webpage by inserting or substituting provocative, and frequently, offending data? - Directory traversal attack - Website defacement - Man-in-the-middle attack - HTTP response splitting attack
Website defacement
Which technology do SOAP services use to format information? - XML - SATA - PCI - ISDN
XML
Which of the following commands does an attacker use to detect HTTP Trace? - nmap -p80 --script http-userdir -enum localhost - nmap --script http-enum -p80 <host> - nmap --script hostmap <host> - nmap -p80 --script http-trace <host>
nmap -p80 --script http-trace <host>