Hands-On Ethical Hacking and Network Defense C. 4 Review

Which of the following is a good Web site for gathering information on a domain?

All of the above

What's the first method a security tester should attempt to find a password for a computer on the network?

Ask the user.

Which of the following contains host records for a domain?

DNS

______ is one of the components most vulnerable to network attacks.

DNS

Before conducting a security test by using social-engineering tactics, what should you do?

Get written permission from the person who hired you to conduct the security test.

When conducting competitive intelligence, which of the following is a good way to determine the size of a company's IT support staff?

Review job postings on Web sites such as www.monster.com or www.dice.com.

If you're trying to find newsgroup postings by IT employees of a certain company, which of the following Web sites should you visit?

http://groups.google.com

Which of the following tools can assist you in finding general information about an organization and its employees? (Choose all that apply.)

www.google.com http://groups.google.com

Shoulder surfers can use their skills to find which of the following pieces of information?

Passwords ATM PINs Long-distance access codes

Entering a company's restricted area by following closely behind an authorized person is referred to as which of the following?

Piggybacking

To determine a company's primary DNS server, you can look for a DNS server containing which of the following?

SOA record

Which of the following is one method of gathering information about the operating systems a company is using?

Search the Web for e-mail addresses of IT employees.

Discovering a user's password by observing the keys he or she presses is called which of the following?

Shoulder surfing

Many social engineers begin gathering the information they need by using which of the following?

The telephone

A cookie can store information about a Web site's visitors. True or False?

True

What social-engineering technique involves telling an employee that you're calling from the CEO's office and need certain information ASAP? (Choose all that apply.)

Urgency Position of authority

Which of the following is a fast and easy way to gather information about a company? (Choose all that apply.)

View the company's Web site. Look for company ads in phone directories.

What's one way to gather information about a domain?

View the header of an e-mail you send to an e-mail account that doesn't exist.

To find information about the key IT personnel for a company's domain, you might use which of the following tools? (Choose all that apply.)

Whois DomainDossier

Which of the following enables you to view all host computers on a network?

Zone transfers