Pen Test Chp. 4-7 Review Questions
List three logical operators used in C programming.
AND, OR, and NOT
To bypass some ICMP-filtering devices on a network, an attacker might send which type of packets to scan the network for vulnerable services? (Choose all that apply.) PING packets SYN packets ACK packets Echo Request packets
SYN packets ACK packets
Port scanning provides the state for all but which of the following ports? Closed Open Filtered Buffered
Buffered
Which of the following is the Win32 API function for verifying the file system on a Windows computer? Filesystem() FsType() System() IsNT()
FsType()
Which flags are set on a packet sent with the nmap -sX 193.145.85.202 command? (Choose all that apply.) FIN PSH SYN URG
FIN PSH URG
A FIN packet sent to a closed port responds with which of the following packets? FIN SYN-ACK RST SYN
RST
To find information about the key IT personnel responsible for a company's domain, you might use which of the following tools? (Choose all that apply.) Whois Whatis Domain Dossier Nbtstat
Whois
What's the first method a security tester should attempt to find a password for a computer on the network? Use a scanning tool. Install a sniffer on the network. Ask the user. Install a password-cracking program.
Ask the user.
Most programming languages enable programmers to perform which of the following actions? (Choose all that apply.) Branching Testing Faulting Looping
Branching Testing Looping
Which of the following contains host records for a domain? DNS WINS Linux server UNIX Web clients
DNS
is one of the components most vulnerable to network attacks. TCP/IP WINS DHCP DNS
DNS
Which of the following testing processes is the most intrusive? Port scanning Enumeration Null scanning Numeration
Enumeration
Fping doesn't allow pinging multiple IP addresses simultaneously. True or False?
False
HTML files must be compiled before users can see the resulting Web pages. True or False?
False
The Nbtstat command is used to enumerate *nix systems. True or False?
False
The Windows Net use command is a quick way to discover any shared resources on a computer or server. True or False?
False
If you're trying to find newsgroup postings by IT employees of a certain company, which of the following Web sites should you visit? http://groups.google.com www.google.com www.samspade.com www.arin.org
http://groups.google.com
Which of the following Nmap commands sends a SYN packet to a computer with the IP address 193.145.85.210? (Choose all that apply.) nmap -sS 193.145.85.210 nmap -v 193.145.85.210 nmap -sA 193.145.85.210 nmap -sF 193.145.85.210
nmap -sS 193.145.85.210 nmap -v 193.145.85.210
Security testers can use Hping to bypass filtering devices. True or False?
True
Using the following Perl code, how many times will "This is easy..." be displayed onscreen? for ($count=1; $count <= 5; $count++) { print "This is easy..."; } 6 4 None (syntax error) 5
5
What is the result of running the following C program? main() { int a = 2; if (a = 1) printf("I made a mistake!"); else printf("I did it correctly!"); } "Syntax error: illegal use of ;" is displayed. "I made a mistake!" is displayed. "Syntax error: variable not declared" is displayed. "I did it correctly!" is displayed.
"I made a mistake!" is displayed.
To add comments to a Perl script, you use which of the following symbols? // /* # <!--
#
Which port numbers indicate NetBIOS is in use on a remote target? 135 to 137 389 to 1023 135 to 139 110 and 115
135 to 139
Enumeration of Windows systems can be more difficult if port is filtered. 110/UDP 443/UDP 80/TCP 139/TCP
139/TCP
A NetBIOS name can contain a maximum of characters. 10 11 15 16
16
Which of the following HTML tags is used to create a hyperlink to a remote Web site? <A HREF=http://URL> <A HREF="http://URL"> <A HREF="file:///c:/filename> <A HREF/>
<A HREF="http://URL">
A C program must contain which of the following? Name of the computer programmer A main() function The #include <std.h> header file A description of the algorithm used
A main() function
An algorithm is defined as which of the following? A list of possible solutions for solving a problem A method for automating a manual process A program written in a high-level language A set of instructions for solving a specific problem
A set of instruction for solving a specific problem
Which of the following is a good Web site for gathering information on a domain? www.google.com www.namedroppers.com http://centralops.net/co/ www.arin.net All of the above
All of the above
Why does the fping -f 193.145.85.201 193.145.85.220 command cause an error? An incorrect parameter is used. The IP range should be indicated as 193.145.85.201-220. There's no such command. IP ranges aren't allowed with this command.
An incorrect parameter is ued.
Documentation of a program should include which of the following? (Choose all that apply.) Author Date written Explanation of complex algorithms Modifications to the code
Author Date written Explanation of complex algorithms Modifications to the code
A NULL scan requires setting the FIN, ACK, and URG flags. True or False?
False
What is the best method of preventing NetBIOS attacks? Filtering certain ports at the firewall Telling users to create difficult-to-guess passwords Pausing the Workstation service Stopping the Workstation service
Filtering certain ports at the firewall
Security testers conduct enumeration for which of the following reasons? (Choose all that apply.) Gaining access to shares and network resources Obtaining user logon names and group memberships Discovering services running on computers and servers Discovering open ports on computers and servers
Gaining access to shares and network resources Obtaining user logon names and group memberships
Before conducting a security test by using social-engineering tactics, what should you do? Set up an appointment. Document all findings. Get written permission from the person who hired you to conduct the security test. Get written permission from the department head.
Get written permission from the person who hired you to conduct the security test.
Which of the following tags enables an HTML programmer to create a loop? <LOOP> <NEST> <WHILE> HTML doesn't have a looping function or tag.
HTML doesn't have a looping function or tag.
Which of the following is a tool for creating a custom TCP/IP packet and sending it to a host computer? Tracert Traceroute Hping Nmapping
Hping
In basic network scanning, ICMP Echo Requests (type 8) are sent to host computers from the attacker, who waits for which type of packet to confirm that the host computer is live? ICMP SYN-ACK packet ICMP SYN packet ICMP Echo Reply (type 8) ICMP Echo Reply (type 0)
ICMP Echo Reply (type 0)
What is a potential mistake when performing a ping sweep on a network? Including a broadcast address in the ping sweep range Including a subnet IP address in the ping sweep range Including the subnet mask in the ping sweep range Including the intrusion detection system's IP address in the ping sweep range
Including a broadcast address in the ping sweep range
A(n) scan sends a packet with all flags set to NULL. NULL VOID SYN XMAS
NULL
Which of the following is the vulnerability scanner from which OpenVAS was developed? OpenVAS Pro Nessus ISS Scanner SuperScan
Nessus
Which of the following commands connects to a computer containing shared files and folders? Net view Net use Netstat Nbtstat
Net use
Which of the following is a Windows command-line utility for seeing NetBIOS shares on a network? Net use Net user Net view Nbtuser
Net view
Most NetBIOS enumeration tools connect to the target system by using which of the following? ICMP packets Default logons and blank passwords Null sessions Admin accounts
Null Sessions
Which of the following tools can be used to enumerate Windows systems? (Choose all that apply.) OpenVAS or Nessus Reddit DumpIt Hyena
OpenVAS or Nessus Dumpit Hyena
Shoulder surfers can use their skills to find which of the following pieces of information? (Choose all that apply.) Passwords ATM PINs Long-distance access codes Open port numbers
Passwords ATM PINs Long-distance access codes
Entering a company's restricted area by following closely behind an authorized person is referred to as which of the following? Shoulder surfing Piggybacking False entering Social engineering
Piggybacking
A closed port responds to a SYN packet with which of the following packets? FIN SYN-ACK SYN RST
RST
When conducting competitive intelligence, which of the following is a good way to determine the size of a company's IT support staff? Review job postings on Web sites such as www.monster.com or www.dice.com. Use the nslookup command. Perform a zone transfer of the company's DNS server. Use the host -t command.
Review job postings on Web sites such as www.monster.com or www.dice.com.
Which of the following is a commonly used UNIX enumeration tool? Netcat Nbtstat Netstat SNMPWalk
SNMPWalk
To determine a company's primary DNS server, you can look for a DNS server containing which of the following? Cname record Host record PTR record SOA record
SOA record
Which of the following is one method of gathering information about the operating systems a company is using? Search the Web for e-mail addresses of IT employees. Connect via Telnet to the company's Web server. Ping the URL and analyze ICMP messages. Use the ipconfig /os command.
Search the Web for e-mail addresses of IT employees.
Discovering a user's password by observing the keys he or she presses is called which of the following? Password hashing Password crunching Piggybacking Shoulder surfing
Shoulder surfing
Many social engineers begin gathering the information they need by using which of the following? The Internet The telephone A company Intranet E-mail
The telephone
A cookie can store information about a Web site's visitors. True or False?
True
In object-oriented programming, classes are defined as the structures that hold data and functions. True or False?
True
Perl and C are the most widely used programming languages among security professionals. True or False?
True
The Net view command can be used to see whether there are any shared resources on a server. True or False?
True
What social-engineering technique involves telling an employee that you're calling from the CEO's office and need certain information ASAP? (Choose all that apply.) Urgency Status quo Position of authority Quid pro quo
Urgency Position of authority
Which of the following is a fast and easy way to gather information about a company? (Choose all that apply.) Conduct port scanning. Perform a zone transfer of the company's DNS server. View the company's Web site. Look for company ads in phone directories.
View the company's Web site.
What's one way to gather information about a domain? View the header of an e-mail you send to an e-mail account that doesn't exist. Use the ipconfig command. Use the ifconfig command. Connect via Telnet to TCP port 53.
View the header an e-mail you send to an e-mail account that doesn't exist.
A null session is enabled by default in all the following Windows versions except: Windows 95 Windows Server 2008 Windows 98 Windows 2000
Windows Server 2008
Which of the following enables you to view all host computers on a network? SOA ipconfig Zone transfers HTTP HEAD method
Zone transfers
In C, which looping function performs an action first and then tests to see whether the action should continue to occur? for loop while loop do loop unless loop
do loop
Which of the following C statements has the highest risk of creating an infinite loop? while (a > 10) while (a < 10) for (a = 1; a < 100; ++a) for (;;)
for (;;)
What are the three looping mechanisms in C? (Choose all that apply.) for loop while loop if-then-else loop do loop
for loop while loop do while loop
Name two looping mechanisms used in Perl.
for loop, while loop
To find extensive Nmap information and examples of the correct syntax to use in Linux, which of the following commands should you type? nmap -h nmap -help nmap? man nmap
man nmap
To identify the NetBIOS names of systems on the 193.145.85.0 network, which of the following commands do you use? nbtscan 193.145.85.0/24 nbtscan 193.145.85.0-255 nbtstat 193.145.85.0/24 netstat 193.145.85.0/24
nbtscan 193.145.85.0/24
Which of the following commands should you use to determine whether there are any shared resources on a Windows computer with the IP address 193.145.85.202? netstat -c 193.145.85.202 nbtscan -a 193.145.85.202 nbtstat -a 193.145.85.202 nbtstat -a \\193.145.85.202
nbtstat -a \\193.145.85.202
What is the most widely used port-scanning tool? Netcat Netstat Nmap Nslookup
nmap
Which Nmap command verifies whether the SSH port is open on any computers in the 192.168.1.0 network? (Choose all that apply.) nmap -v 192.168.1.0-254 -p 22 nmap -v 192.168.1.0-254 -p 23 nmap -v 192.168.1.0-254 -s 22 nmap -v 192.168.1.0/24 -p 22
nmap -v 192.168.1.0-254 -p 22 nmap -v 192.168.1.0/24 -p 22
Security testers and hackers use which of the following to determine the services running on a host and the vulnerabilities associated with these services? Zone transfers Zone scanning Encryption algorithms Port scanning
port scanning
Before writing a program, many programmers outline it first by using which of the following? Pseudocode Machine code Assembly code Assembler code
pseudocode
A missing parenthesis or brace might cause a C compiler to return which of the following? System fault Interpreter error Syntax error Machine-language fault
syntax error
To see a brief summary of Nmap commands in a Linux shell, which of the following should you do? Type nmap -h. Type nmap -summary. Type help nmap. Press the F1 key.
type nmap -h
Which of the following tools can assist you in finding general information about an organization and its employees? (Choose all that apply.) www.google.com http://groups.google.com netcat nmap
www.google.com http://groups.google.com
