Final Test (Module Quizzes Practice)

Teena, a security professional, has recently joined the company, and she has been trained in various security practices to be followed to protect passwords from being compromised. While implementing the security practices, she notices that a system is susceptible to password cracking attacks. Identify the practice noticed by Teena that can lead to password cracking attacks.

1.) Do not use passwords that can be found in a dictionary. 2.) Do not use cleartext protocols or protocols with weak encryption. 3.) Set the password change policy to 30 days. 4.) Avoid storing passwords in an unsecured location.

Which of the following techniques involves gaining information by listening to someone's conversation or reading private messages being shared between them?

Eavesdropping: Purposely overhearing confidential conversations between employees) to gather sensitive information that might help launch an attack on the organization.

George, a professional hacker, targeted an organization's server to cause reputational damage to the organization. For this purpose, he employed an ARP poisoning tool that forges ARP replies from the target server resulting in customers navigating to the attacker-owned host, which contains irrelevant information for the customers. Which of the following tool helped George in the above scenario to perform an ARP poisoning attack?

Ettercap

Messy, an ex-employee of an organization, was fired because of misuse of resources and security violations. He sought revenge against the company and targeted its network, as he is already aware of its network topology. Which of the following categories of insiders does Messy belong to?

Malicious Insider: Malicious insider threats come from disgruntled or terminated employees who steal data or destroy company networks intentionally by injecting malware into the corporate network.

In which of the following attacks does an attacker send an email or message to the target offering free gifts such as money and software, on the condition that the user forwards the email to a predetermined number of recipients?

Chain Letters: A chain letter is a message offering free gifts, such as money and software, on the condition that the user forwards the email to a predetermined number of recipients.

In which of the following phases of hacking does an attacker employ steganography and tunneling techniques to retain access to the victim's system, remain unnoticed, and remove evidence that might lead to prosecution?

Clearing Tracks: Clearing tracks refers to the activities carried out by an attacker to hide malicious acts.

Which of the following elements of information security ensures that a recipient receives the original message from the sender without any modifications during transit?

Integrity

The assurance that the systems responsible for delivering, storing, and processing information are accessible when required by authorized users is referred to by which of the following elements of information security?

Availability: Assurance that the systems responsible for delivering, storing, and processing information are accessible when required by the authorized users.

Which of the following technique is a brute-force attack on encryption where all possible keys are tested in an attempt to recover the plaintext used to produce a particular ciphertext?

Cryptanalysis: Cryptanalysis is a brute-force attack on encryption that employs a search of the keyspace. In other words, testing all possible keys is one of the attempts to recover the plaintext used to produce a particular ciphertext.

Identify the default authentication method in Microsoft operating systems that uses secret-key cryptography for validating identities.

Kerberos is a network authentication protocol that provides strong authentication for client/server applications through secret-key cryptography. This protocol provides mutual authentication, in that both the server and the user verify each other's identity. Messages sent through the Kerberos protocol are protected against replay attacks and eavesdropping.

Identify the element of information security that refers to the quality of being genuine or uncorrupted as a characteristic of any communication, documents, or any data.

Authenticity

Identify the type of software vulnerability that occurs due to coding errors and allows the attackers to gain access to the target system.

Buffer overflow

Mark, a professional hacker, scanned the target system to check for running services or open ports. After successful scanning, he discovered an open FTP port, exploited it to install malware, and performed malicious activities on the victim system. In which of the following ways did Mark install the malware in the victim system?

File sharing services

Don, a professional hacker, telephoned Bob and claimed to be a network administrator in the target organization. Don informed Bob about a security incident in the network and asked him to provide his account credentials to secure his data. After obtaining these credentials, Don retrieved sensitive information from Bob's account. Which of the following vulnerable behaviors was showcased by Don in the above scenario?

Authority: Authority implies the right to exercise power in an organization. Attackers take advantage of this by presenting themselves as a person of authority, such as a technician or an executive, in a target organization to steal important data.

Which of the following civilian acts enforces "Electronic Transactions and Code Set Standards"?

HIPAA

John, a threat actor, called up Johana, the IT help desk member of the targeted organization, and informed her that Mr. Tibiyani was about to give a presentation to customers but he could not open his files as they were corrupted and that Mr. Tibiyani requested him to call and ask her to send the files to him as soon as possible to start the presentation. Identify the social engineering context created by the attacker in the above scenario.

Intimidation: Intimidation refers to an attempt to intimidate a victim into taking several actions by using bullying tactics. It is usually performed by impersonating some other person and manipulating users into disclosing sensitive information.

Which of the following protocols was upgraded as a default authentication protocol on Windows OS to provide stronger authentication for client/server applications?

Kerberos: Microsoft has upgraded its default authentication protocol to Kerberos which provides a stronger authentication for client/server applications than NTLM.

Which of the following tools includes scanners such as comprehensive security scanners and port scanners and provides information such as NetBIOS names, configuration info, open TCP and UDP ports, transports, and shares?

MegaPing: MegaPing includes scanners such as Comprehensive Security Scanner, Port scanner (TCP and UDP ports), IP scanner, NetBIOS scanner, and Share Scanner. It provides the following information: NetBIOS names, Configuration info, open TCP and UDP ports, Transports, Shares, Users, Groups, Services, Drivers, Local Drives, Sessions, and Remote Time of Date, Printers.

Which of the following is a default authentication scheme that performs authentication using a challenge/response strategy as it does not rely on any official protocol specification and has no guarantee to work effectively in every situation?

NTLM: NT LAN Manager (NTLM) is a default authentication scheme that performs authentication using a challenge/response strategy. Because it does not rely on any official protocol specification, there is no guarantee that it works effectively in every situation.

Identify the type of insiders who are uneducated on the latest potential security threats or simply bypass general security procedures to achieve workplace efficiency.

Negligent Insider: Insiders, who are uneducated on potential security threats or simply bypass general security procedures to meet workplace efficiency, are more vulnerable to social engineering attacks. Many insider attacks result from employee's laxity towards security measures, policies, and practices.

Identify the password cracking tool that helps attackers to gain unauthorized access to the system or network.

THC-Hydra: THC Hydra is a parallelized login cracker that can attack numerous protocols. This tool is a proof-of-concept code that provides researchers and security consultants the possibility to demonstrate how easy it would be to gain unauthorized remote access to a system.

Malcolm, a professional hacker, is attempting to access an organization's systems remotely. For this purpose, he used a tool to recover the passwords of the target system and gain unauthorized access to critical files and other system software. Identify the tool used by Malcolm to crack the passwords of the target system.

hashcat: Hashcat is a cracker compatible with multiple OSs and platforms and can perform multi-hash (MD4, 5; SHA - 224, 256, 384, 512; RIPEMD-160; etc.), multi-device password cracking

Don, a professional hacker, targeted Bob to steal the credentials of his bank account. Don lured Bob to install malicious software embedded with a keylogger. The keylogger installed on Bob's machine recorded all of Bob's keystrokes and transmitted them to Don. Using the keylogger, Don obtained the credentials of Bob's bank account and performed illegal transactions on his account. Identify the type of attack Don has performed in the above scenario.

Active Online Attacks: Here, the attacker communicates with the target machine to gain password access. Techniques used to perform active online attacks include password guessing, dictionary and brute-forcing attacks, hash injection, LLMNR/NBT-NS poisoning, use of Trojans/spyware/keyloggers, internal monologue attacks, Markov-chain attacks, Kerberos password cracking, etc.

Meghan, a professional hacker, was trying to gain unauthorized access to the admin-level system of the target organization. To hack the passwords used by admins, she employed various password cracking techniques such as internal monologue attack, Markov-chain attack, Kerberos password cracking, and LLMNR/NBT-NS poisoning.

Active Online Attacks: This is one of the easiest ways to gain unauthorized administrator-level system access. Here, the attacker communicates with the target machine to gain password access. Techniques used to perform active online attacks include password guessing, dictionary and brute-forcing attacks, hash injection, LLMNR/NBT-NS poisoning, use of Trojans/spyware/keyloggers, internal monologue attacks, Markov-chain attacks, Kerberos password cracking, etc.

Which of the following protocols employs a key distribution center (KDC) that consists of two logically distinct parts, an authentication server (AS) and a ticket-granting server (TGS), and uses "tickets" to prove a user's identity?

Kerberos authentication: Microsoft has upgraded its default authentication protocol to Kerberos, which provides a stronger authentication for client/server applications than NTLM.

Which of the following Google advanced search operators displays websites that are similar to the URL specified?

Related

Joe, a professional hacker, initiated an attack against Bob by tricking him into downloading a free software program embedded with a keylogger labeled as trusted. As the program was labeled trusted, the antivirus software installed on Bob's system failed to identify it as malicious software. As a result, the malicious software recorded all the keystrokes entered by Bob and transmitted them to Joe. Identify the application Joe employed in the above scenario to lure Bob into installing malicious software.

Rogue applications

Which of the following Trojans can an attacker use for the auto-deletion of files, folders, and registry entries as well as local network drives to cause the operating system to fail?

Destructive Trojan -The sole purpose of a destructive Trojan is to delete files on a target system. Antivirus software may not detect destructive Trojans. Once a destructive Trojan infects a computer system, it randomly deletes files, folders, and registry entries as well as local and network drives, often resulting in OS failure

Which of the following countermeasures helps security teams defend against sniffing attacks?

1.) Restrict physical access to the network media to ensure that a packet sniffer cannot be installed 2.) Use end-to-end encryption to protect confidential information 3.) Permanently add the MAC address of the gateway to the ARP cache 4.) Use static IP addresses and ARP tables to prevent attackers from adding the spoofed ARP entries for machines in the network 5.) Turn off network identification broadcasts and, if possible, restrict the network to authorized users to protect the network from being discovered with sniffing tools 6.) Use IPv6 instead of IPv4 7.) Use a switch instead of the hub, as a switch delivers data only to the intended recipient 8.) Retrieve MAC addresses directly from NICs instead of the OS; this prevents MAC address spoofing 9.) Use tools to determine if any NICs are running in promiscuous mode 10.) Use the concept of Access Control List (ACL) to allow access only to a fixed range of trusted IP addresses in a network 11.) Change default passwords to complex passwords Avoid broadcasting SSIDs (Session Set Identifiers)

Which of the following attack vectors involves the use of a huge network of compromised systems by attackers to perform denial-of-service attacks on the target network or systems?

Botnet: A botnet is a huge network of compromised systems used by hackers to perform a distributed task.

David, a professional hacker, has initiated a DDoS attack against a target organization. He developed a malicious code and distributed it through emails to compromise the systems. Then, all the infected systems were grouped together to launch a DDoS attack against the organization. Identify the type of attack launched by David on the target organization.

Botnet: A huge network of compromised systems used by an intruder to perform various network attacks.

Ruby, a hacker, visited her target company disguised as an aspiring candidate seeking a job. She noticed that certain sensitive documents were thrown in the trash near an employee's desk. She collected these documents, which included critical information that helped her to perform further attacks. Identify the type of attack performed by Ruby in the above scenario.

Close-in Attacks: Close-in attacks are performed when the attacker is in close physical proximity to the target system or network. The main goal of performing this type of attack is to gather or modify the information or disrupt its access. For example, an attacker might shoulder surf user credentials. Attackers gain close proximity through the surreptitious entry, open access, or both.

Dennis, an employee experiencing conflict with the management of an organization, uses steganography programs to hide company secrets. He sends this information to competitors, for certain financial benefits, as an innocuous-looking message embedding company secrets in a picture via his official email account. Identify the type of insider attack performed by Dennis in the above scenario.

Disgruntled Employees: Attacks may come from unhappy employees or contract workers. Disgruntled employees, who intend to take revenge on the company, first acquire information and then wait for the right time to compromise the organization's resources.

James, a malware programmer, intruded into a manufacturing plant that produces computer peripheral devices. James tampered with the software inside devices ready to be delivered to clients. The tampered program creates a backdoor that allows unauthorized access to the systems. Identify the type of attack performed by James in the above scenario to gain unauthorized access to the delivered systems.

Distribution attacks: Distribution attacks occur when attackers tamper with hardware or software prior to installation.

Identify the type of hackers recruited by organizations to enhance their cybersecurity by reporting all vulnerabilities to the system and network for remediation

Ethical hacking is the practice of employing computer and network skills in order to assist organizations in testing their network security for possible loopholes and vulnerabilities

Jack, a professional hacker, was recruited by an agency to steal sensitive data from a rival company. From a remote location, he discovered vulnerabilities in the target company's network using a vulnerability scanner. He exploited them to intrude into the network and steal confidential data. Identify the threat source exploited by Jack in the above scenario

External Threats: External attacks are performed by exploiting vulnerabilities that already exist in a network, without the assistance of insider employees. Therefore, the potential to perform an external attack depends on the severity of the identified network weaknesses. Attackers may perform such attacks for financial gain, to damage the reputation of the target organization, or simply for the sake of curiosity.

Given below are the various phases of hacking. Reconnaissance Gaining access Maintaining access Clearing tracks Scanning What is the correct sequence of phases involved in hacking?

In general, there are five phases of hacking: Reconnaissance Scanning Gaining Access Maintaining Access Clearing Tracks.

Williams, an employee, was using his personal laptop within the organization's premises. He connected his laptop to the organization's internal network and began eavesdropping on the communication between other devices connected to the internal network. He sniffed critical information such as login credentials and other confidential data passing through the network. Identify the type of attack performed by Williams in the above scenario.

Insider attacks: Insider attacks are performed by trusted persons who have physical access to the critical assets of the target. An insider attack involves using privileged access to violate rules or intentionally cause a threat to the organization's information or information systems.

Elon, a disgruntled employee with access to sensitive data, intends to damage the organization's reputation. He shares all the critical information and blueprints with the competitor and benefits financially. Identify the threat source in the above scenario.

Internal Threats: Most computer and Internet-related crimes are insiders or internal attacks. These threats are performed by insiders within the organization such as disgruntled or negligent employees and harm the organization intentionally or unintentionally. Most of these attacks are performed by privileged users of the network.

Sam recently joined as a network admin in an organization. He failed to comprehend all the security practices during his training but pretended to have acquired adequate skills. With mediocre knowledge, he left a few loopholes in the firewall implementation that eventually led to unwanted network intrusions. Identify the threat source that led the way to this perimeter breach.

Internal Threats: Most computer and Internet-related crimes are insiders or internal attacks. These threats are performed by insiders within the organization such as disgruntled or negligent employees and harm the organization intentionally or unintentionally. Most of these attacks are performed by privileged users of the network.

Which of the following protocols distributes, inquiries into, retrieves, and posts news articles using a reliable stream-based transmission of news among the ARPA-Internet community?

NNTP: Network News Transfer Protocol (NNTP) distributes, inquires into, retrieves, and posts news articles using a reliable stream-based transmission of news among the ARPA-Internet community. However, this protocol fails to encrypt the data, which allows attackers to sniff sensitive information.

Jack is working as a malware analyst in an organization. He was assigned to inspect an attack performed against the organization. Jack determined that the attacker had restricted access to the main computer's files and folders and was demanding an online payment to remove these restrictions. Which of the following types of attack has Jack identified in the above scenario?

Ransomware: Restricts access to the computer system's files and folders and demands an online ransom payment to the malware creator(s) in order to remove the restrictions.

Identify the reason why organizations recruit ethical hackers.

Reasons why organizations recruit ethical hackers: 1.) To prevent hackers from gaining access to the organization's information systems 2.) To uncover vulnerabilities in systems and explore their potential as a risk 3.) To analyze and strengthen an organization's security posture, including policies, network protection infrastructure, and end-user practices 4.) To provide adequate preventive measures in order to avoid security breaches 5.) To help safeguard the customer data 6.) To enhance security awareness at all levels in a business

Which one of the following vulnerabilities is NOT an example of misconfiguration vulnerability?

Running only necessary services on a machine because The following are some examples of misconfiguration: 1.) An application running with debug enabled 2.) Unnecessary administrative ports that are open for an application 3.) Running outdated software on the system 4.) Running unnecessary services on a machine 5.) Outbound connections to various Internet services 6.) Using misconfigured SSL certificates or default certificates 7.) Improperly authenticated external systems 8.) Incorrect folder permissions 9.) Default accounts or passwords 10.) Set up or configuration pages enabled 11.) Disabling security settings and features

In which of the following social engineering attacks do attackers install small cameras to record the victim's system's actions to obtain login details and other sensitive information?

Shoulder Surfing: Attackers use shoulder surfing to find out passwords, personal identification numbers, account numbers, and other information. They sometimes even use binoculars and other optical devices or install small cameras to record the actions performed on the victim's system to obtain login details and other sensitive information.

John, a professional hacker, was hired by a government agency to penetrate, gain top-secret information from, and damage other government agencies' information systems or networks. Based on the above scenario, which of the following classes of hackers does John fall in?

State-Sponsored Hackers: State-sponsored hackers are skilled individuals having expertise in hacking and are employed by the government to penetrate, gain top-secret information from, and damage the information systems of other government or military organizations.

In which of the following phases of the cyber kill chain methodology does the adversary create a tailored malicious payload based on the vulnerabilities identified?

Weaponization: The adversary analyzes the data collected to identify the vulnerabilities and techniques that can exploit and gain unauthorized access to the target organization.

John, a security specialist, was requested by a client organization to check whether the security testing process was performed according to standard. He implemented a security audit on the organization's network to ensure that the performed test was well-organized, efficient, and ethical. John has conducted the audit following the steps given below. Talk to the client and discuss the needs to be addressed during testing 1.) Analyze the results of the testing and prepare a report 2.) Organize an ethical hacking team and prepare a schedule for testing 3.) Conduct the test 4.) Prepare and sign NDA documents with the client 5.) Present the findings to the client 6.) Identify the correct sequence of the steps John has followed while performing the security audit.

The following steps provide a framework for performing a security audit of an organization, which will help in ensuring that the test is organized, efficient, and ethical: 1.) Talk to the client and discuss the needs to be addressed during the testing 2.) Prepare and sign NDA documents with the client 3.) Organize an ethical hacking team and prepare the schedule for testing 4.) Conduct the test 5.) Analyze the results of the testing and prepare a report 6.) Present the report findings to the client

Which of the following terms refers to the patterns of activities and methods associated with specific threat actors or groups of threat actors that are used to analyze and profile them to enhance an organization's security?

The terms "tactics, techniques, and procedures" refer to the patterns of activities and methods associated with specific threat actors or groups of threat actors. TTPs are helpful in analyzing threats and profiling threat actors and can further be used to strengthen the security infrastructure of an organization.

Which of the following malware components hides the malware presence and protects the malware from reverse engineering, thus making it difficult to be detected by security solutions?

Crypter -Software that protects malware from undergoing reverse engineering or analysis

Which of the following password policies can help administrators increase password security?

Block user accounts if a user exceeds a certain number of failed attempts to guess a password.

Which of the following countermeasures should be followed to protect against password cracking?

The best practices to protect against password cracking are listed as follows: 1.) Enable information security audit to monitor and track password attacks. 2.) Do not use the same password during the password change. 3.) Do not share passwords. 4.) Do not use passwords that can be found in a dictionary. 5.) Do not use cleartext protocols or protocols with weak encryption. 6.) Set the password change policy to 30 days. 7.) Avoid storing passwords in an unsecured location. 8.) Do not use any system's default passwords. 9.) Make passwords hard to guess by using 8-12 alphanumeric characters, with a combination of upper- and lower-case letters, numbers, and symbols. 10.) Ensure that applications neither store passwords to memory nor write them to disk in cleartext.