Ethical hacking

Which parameter can be added to nmap to run a script scan with the default scripts?

-sC

The ISN is set at which step of the TCP three-way handshake?

1 and 2

Which port numbers indicate NetBIOS is in use on a remote target?

135 to 139

Enumeration of Windows systems can be more difficult if which port is filtered?

139/TCP

A NetBIOS name can contain a maximum of how many characters?

15

Which of the following is not a valid octal number?

3482

The base-64 numbering system uses how many bits to represent a character?

6

The U.S. Department of Justice defines a hacker as which of the following?

A person who accesses a computer or network without the owner's permission

A penetration tester is which of the following?

A security professional who's hired to break into a network to discover vulnerabilities

What portion of your ISP contract might affect your ability to conduct a penetrationtest over the Internet?

Acceptable use policy

To reduce the risk of a virus attack on a network, you should do which of the following?

All of the above

Which of the following is a good Web site for gathering information on a domain?

All selections

Why does the fping -f 193.145.85.201 193.145.85.220 command cause an error?

An incorrect parameter is used.

An exploit that attacks computer systems by inserting executable code in areas of memory because of poorly written code is called which of the following?

Buffer overflow

What exploit is used to elevate an attacker's permissions by inserting executable code in the computer's memory?

Buffer overflow

Port scanning provides the state for all but which of the following ports?

Buffered

As a security tester, what should you do before installing hacking software on your computer?

Check with local law enforcement agencies.

Which federal law prohibits unauthorized access of classified information?

Computer Fraud and Abuse Act, Title 18

How can you find out which computer crime laws are applicable in your state?

Contact your local law enforcement agencies.

What type of network attack relies on multiple servers participating in an attack on one host system?

DDOS attack

Which of the following components is most vulnerable to network attacks?

DNS

Which of the following contains host records for a domain?

DNS

What organization offers the CEH certification exam?

EC-Council

Which federal law prohibits intercepting any communication, regardless of how it was transmitted?

Electronic Communication Privacy Act

Which of the following testing processes is the most intrusive?

Enumeration

What's the hexadecimal equivalent of the binary number 1111 1111?

FF

A written contract isn't necessary when a friend recommends a client. True or False?

False

The Ping of Death is an exploit that sends multiple ICMP packets to a host faster than the host can handle. True or False?

False

The Windows Net use command is a quick way to discover any shared resources on a computer or server. True or False?

False

If you run a program in New York City that uses network resources to the extent that a user is denied access to them, what type of law have you violated?

Federal

What is the best method of preventing NetBIOS attacks?

Filtering certain ports at the firewall

What is the main purpose of malware?

Financial gain or destruction

What component can be used to reduce the risk of a Trojan program or rootkit sending information from an attacked computer to a remote host?

Firewall

What is a potential mistake when performing a ping sweep on a network?

Including a broadcast address in the ping sweep range

What is the most widely used port-scanning tool?

Nmap

Most NetBIOS enumeration tools connect to the target system by using which of the following?

Null sessions

What is an OSCP?

Offensive Security Certified Professional

TCP communication can be likened to which of the following?

Phone conversation

Entering a company's restricted area by following closely behind an authorized person is referred to as which of the following?

Piggybacking

The netstat command indicates that POP3 is in use on a remote server. Which port is the remote server most likely using?

Port 110

What port does DNS use?

Port 53

Security testers and hackers use which of the following to determine the services running on a host and the vulnerabilities associated with these services?

Port scanning

A FIN packet sent to a closed port responds with which of the following packets?

RST

A closed port responds to a SYN packet with which of the following packets?

RST

A team composed of people with varied skills who attempt to penetrate a network iscalled which of the following?

Red team

To determine whether scanning is illegal in your area, you should do which of the following?

Refer to state laws.

When conducting competitive intelligence, which of the following is a good way to determine the size of a company's IT support staff?

Review job postings on Web sites such as www.monster.com or www.dice.com.

Which organization issues the Top 25 list of software errors?

SANS Institute

Which of the following is a popular network management service for network administrators?

SNMP

Which of the following is a commonly used UNIX enumeration tool?

SNMPWalk

To determine a company's primary DNS server, you can look for a DNS server containing which of the following?

SOA record

Which of the following is one method of gathering information about the operating systems a company is using?

Search the Web for e-mail addresses of IT employees.

A null session is enabled by default in all the following Windows versions except:

Windows Server 2008

Which of the following doesn't attach itself to a host but can replicate itself?

Worm

Which of the following enables you to view all host computers on a network?

Zone transfers

If you're trying to find newsgroup postings by IT employees of a certain company, which of the following Web sites should you visit?

http://groups.google.com

To find extensive Nmap information and examples of the correct syntax to use in Linux, which of the following commands should you type?

man nmap

To identify the NetBIOS names of systems on the 193.145.85.0 network, which of the following commands do you use?

nbtscan 193.145.85.0/24

Which of the following commands should you use to determine whether there are any shared resources on a Windows computer with the IP address 193.145.85.202?

nbtstat -a 193.145.85.202

On a Windows computer, what command can you enter to show all open ports being used?

netstat

Which command verifies the existence of a node on a network?

ping

What port, other than port 110, is used to retrieve e-mail?

port 143

What command is used to log on to a remote server, computer, or router?

telnet

Many social engineers begin gathering the information they need by using which of the following?

the telephone

A UDP packet is usually smaller than a TCP packet. True or False?

true

A cookie can store information about a Web site's visitors. True or False?

true

Security testers can use Hping to bypass filtering devices. True or False?

true

The Net view command can be used to see whether there are any shared resources on a server. True or False?

true

A ping command initially uses which ICMP type code?

type 8

One purpose of adware is to determine users' purchasing habits. True or False?

True

"Destination Unreachable" is designated by which ICMP type code?

Type 3

To see a brief summary of Nmap commands in a Linux shell, which of the following should you do?

Type nmap -h.

Which federal law amended Chapter 119 of Title 18, U.S. Code?

U.S. PATRIOT Act, Sec. 217: Interception of Computer Trespasser Communications

What's one way to gather information about a domain?

View the header of an e-mail you send to an e-mail account that doesn't exist.

Which of the following relies on a host to propagate throughout a network?

Virus

Which of the following is an example of a macro programming language?

Visual Basic for Applications

A NULL scan requires setting the FIN, ACK, and URG flags. True or False?

false

Antivirus software should be updated annually. True or False?

false

Fping doesn't allow pinging multiple IP addresses simultaneously. True or False?

false

The Nbtstat command is used to enumerate *nix systems. True or False?

false

Before conducting a security test by using social-engineering tactics, what should you do?

Get written permission from the person who hired you to conduct the security test.

Which of the following is a tool for creating a custom TCP/IP packet and sending it to a host computer?

Hping

What protocol is used for reporting or informational purposes?

ICMP

In basic network scanning, ICMP Echo Requests (type 8) are sent to host computers from the attacker, who waits for which type of packet to confirm that the host computer is live?

ICMP Echo Reply (type 0)

What organization designates a person as a CISSP?

ISC2

A software or hardware component that records each keystroke a user enters is called which of the following?

Keylogger

Which of the following describes an attack where attackers inject themselves between two parties or systems communicating with one another in order to manipulate messages being passed back and forth?

Man-in-the-middle attack

Which of the following is a good place to begin your search for vulnerabilities in Microsoft products?

Microsoft Security Bulletins

If you dont' have access to Nessus, which of the following can be used by an attacker to gain information about remote *nix hosts?

NMap

Which type of port scan sends a packet with all flags turned off?

NULL

Which of the following is the vulnerability scanner from which OpenVAS was developed?

Nessus

Which of the following commands connects to a computer containing shared files and folders?

Net use

Which of the following is a Windows command-line utility for seeing NetBIOS shares on a network?

Net view

Discovering a user's password by observing the keys he or she presses is called which of the following?

Shoulder surfing

Which protocol offers guaranteed delivery and is connection oriented?

TCP

Which protocol uses UDP?

TFTP

Which of the following exploits might hide its destructive payload in a legitimate application or game?

Trojan program

An exploit discovered for one OS might also be effective on another OS. True or False?

True

FTP offers more security than TFTP. True or False?

True

What's the first method a security tester should attempt to find a password for a computer on the network?

ask the user