3200 Chapter 11 - Security Assessments
Rules of engagement
A document that defines exactly how the penetration test will be carried out.
Common Vulnerabilities and Exposures (CVE)
A list of standardized identifiers for known software vulnerabilities and exposures.
Threat feed
A service that tracks cyber threats across the world and provides real-time updates with IP addresses, URLs, and other relevant information regarding the threats.
Security Orchestration, Automation and Response
A solution stack of compatible software programs that collect data about security threats from multiple sources and respond to low-level security events without human assistance.
Common Vulnerability Scoring System
A system that ranks vulnerabilities based on severity.
Scope of work
A very detailed document that defines exactly what is going to be included in the penetration test. This document is also referred to as the statement of work.
Advisories and bulletins
Advisories and bulletins provide detailed updates on cyber threats. They are usually updated weekly.
Reconnaissance
Also known as footprinting. This is the process of gathering information about a target before beginning any penetration test or security audit.
Heuristic-based detection
Also referred to as behavior, anomaly, or statistical-based detection. This detection method first defines a baseline of normal network traffic and then monitors traffic looking for anything that falls outside that baseline.
Signature-based detection
Also referred to as pattern matching, dictionary recognition, or misuse-detection (MD-IDS). This detection method looks for patterns in network traffic and compares them to known attack patterns called signatures.
You are concerned about protecting your network from network-based attacks on the internet. Specifically, you are concerned about attacks that have not yet been identified or that do not have prescribed protections. Which type of device should you use?
Anomaly-based IDS
What is the most common form of host-based IDS that employs signature or pattern-matching detection methods?
Antivirus software
Open-Source Intelligence (OSINT)
Any data that is collected from publicly available sources such as social media, search engines, company websites, media sources, or public government sources.
Which of the following activities are typically associated with a penetration test?
Attempt social engineering.
You have been hired as part of the team that manages an organization's network defense. Which security team are you working on?
Blue
____ team members are the defense of the system. This team is responsible for stopping the red team's advances.
Blue
As part of a special program, you have discovered a vulnerability in an organization's website and reported it to the organization. Because of the severity, you are paid a good amount of money. Which type of penetration test are you performing?
Bug bounty
What does an IDS that uses signature recognition use to identify attacks?
Comparisons to known attack patterns
____ and ____ are two common command line programs that can be used to download or upload files. An example of using these tools is to download an entire website for offline analysis.Because these tools actively engage with the target, they are considered active reconnaissance tools.
Curl, wget
Intrusion detection system
Device or software that monitors, logs, and detects security breaches, but takes no action to stop or prevent the attack.
Intrusion prevention system
Device that monitors, logs, detects, and can also react to stop or prevent security breaches.
____ is a program that performs DNS enumeration and can find the DNS servers and entries for an organization. This information can help find other information such as usernames, computer names, IP addresses, and more.
Dnsenum
As a security precaution, you have implemented IPsec that is used between any two devices on your network. IPsec provides encryption for traffic between devices. You would like to implement a solution that can scan the contents of the encrypted traffic to prevent any malicious attacks. Which solution should you implement?
Host-based IDS
____ is a security tool that can check connectivity and also analyze the target to gather information.
Hping
Engine
IDS component that analyzes sensor data and events; generates alerts; and logs all activity
Sensor
IDS component that passes data from the source to the analyzer.
____ are special tools that allow a network administrator to scan the entire network to find all connected devices and their IP addresses.
IP scanners
You are concerned about attacks directed at your network firewall. You want to be able to identify and be notified of any attacks. In addition, you want the system to take immediate action to stop or prevent the attack, if possible. Which tool should you use?
IPS
Your organization uses a web server to host an e-commerce site. Because this web server handles financial transactions, you are concerned that it could become a prime target for exploits. You want to implement a network security control that analyzes the contents of each packet going to or from the web server. The security control must be able to identify malicious payloads and block them. What should you do?
Implement an application-aware IPS in front of the web server
Which of the following describes a false positive when using an IPS device?
Legitimate traffic being flagged as malicious
Which step in the penetration testing life cycle is accomplished using rootkits or Trojan horse programs?
Maintain access
You want to use a tool to scan a system for vulnerabilities, including open ports, running services, and missing patches. Which tool should you use?
Nessus
____ is a proprietary vulnerability scanner that is developed by Tenable. It can be used to scan the target for any known vulnerabilities, which can be exploited to gain access to the target.
Nessus
You want to identify all devices on a network along with a list of open ports on those devices. You want the results displayed in a graphical diagram. Which tool should you use?
Network mapper
Gathering as much personally identifiable information (PII) on a target as possible is a goal of which reconnaissance method?
OSINT
The ____ framework is a collection of resources and tools that are separated by common categories. The OSINT Framework makes it easy to gather all sorts of information, making the initial reconnaissance process much more efficient.
OSINT
Which type of reconnaissance is dumpster diving?
Passive
Black box test
Penetration test in which the ethical hacker has no information regarding the target or network. This type of test best simulates an outside attack and ignores the insider threats.
White box test
Penetration test in which the ethical hacker is given full knowledge of the target or network. This test allows for a comprehensive and thorough test, but is not very realistic.
Gray box test
Penetration test in which the ethical hacker is given partial information of the target or network, such as IP configurations, email lists, etc. This test simulates the insider threat.
Which of the following uses hacking techniques to proactively discover internal vulnerabilities?
Penetration testing
An active IDS system often performs which of the following actions? (Select two.)
Performs reverse lookups to identify an intruder, Updates filters to block suspect traffic.
____ is a command line tool that is used to perform a connection test between two network devices.
Ping
Which phase or step of a security assessment is a passive activity?
Reconnaissance
False negative
Scan results that indicate no vulnerability when a vulnerability exists.
False positive
Scan results that indicated a vulnerability, but there is none.
Which of the following is a very detailed document that defines exactly what is going to be included in the penetration test?
Scope of work
Which of the following tools can be used to see if a target has any online IoT devices without proper security?
Shodan
____ is a popular search engines for internet-connected devices. Users are able to search for specific types of devices and locations. This information can be used to see if a target has any online devices without proper security.
Shodan
Which IDS method searches for intrusion or attack attempts by recognizing patterns or identifying entities listed in a database?
Signature-based IDS
____ is a automated scanner that can be used to enumerate and scan for vulnerabilities. It combines the functions of many tools and can be used to find information such as DNS information, open ports, running services, and more
Sn1per
IP scanners
Special tools that allow a network administrator to scan the entire network to find all connected devices and their IP addresses.
Security information and event management
Special tools that gather network information and aggregate it into a central place. SIEM systems can actively read the network information and determine if there is a threat.
What is the primary purpose of penetration testing?
Test the effectiveness of your security perimeter.
Packet sniffing
The act of capturing data packets transmitted across the network and analyzing them for important information.t.
Eavesdropping
The act of covertly listening in on a communication between other people.
War driving
The act of driving around with a wireless device looking for open vulnerable wireless networks.
War flying
The act of using drones or unmanned aerial vehicles to find open wireless networks.
Threat hunting
The human-based, methodical search and monitoring of the network, systems, and software in order to detect any malicious or suspicious activity that has evaded the automated tools.
Vulnerability scan
The process of capturing and analyzing packets to identify any security weaknesses in a network, computer system, local applications, and even web applications.
Passive reconnaissance
The process of gathering information by interacting with the target in some manner.
Intelligence fusion
The sharing of information between multiple government agencies and private security firms.
Which of the following describes the worst possible action by an IDS?
The system identified harmful traffic as harmless and allowed it to pass without generating any alerts.
Bug bounty
These unique tests are setup by organizations such as Google, Facebook, and others. Ethical hackers can receive compensation by reporting bugs and vulnerabilities they discover.
The process of walking around an office building with an 802.11 signal detector is known as:
War driving
You have been promoted to team lead of one of the security operations teams. Which security team are you now a part of?
White
You have been hired to perform a penetration test for an organization. You are given full knowledge of the network before the test begins. Which type of penetration test are you performing?
White box
An ____, also called an IPS, performs the functions of an IDS but can also react when security breaches occur.
active IDS
The ____ command is used in both Windows and Linux. ARP stands for Address Resolution Protocol and is used to match IP addresses to MAC addresses
arp
The ipconfig command (Windows) and the ifconfig command (Linux) are used to display the IP ____ on the local computer.
configuration
In a ____ scan, the scanner uses an administrator or other account's credentials to perform the scan. This method shows a deeper look at the network and is able to identify more vulnerabilities than a non-credentialed scan
credentialed
Which of the following tools can be used to view and modify DNS server information in Linux?
dig
The third phase takes all of the information gathered in the reconnaissance and scanning phases to ____ any discovered vulnerabilities in order to gain access. After gaining access, the pentester can perform lateral moves, pivoting to other machines on the network. The pentester will begin trying to escalate privileges with the goal of gaining administrator access.
exploit
A ____ traffic assessment means that harmful traffic was allowed to pass without any alerts being generated or any actions being taken to prevent or stop it. This is the worst possible scenario.
false negative
A ____ traffic assessment means that the system identified harmless traffic as offensive and generated an alarm or stopped the traffic.
false positive
A ____ scan finds a potential vulnerability and then actively attempts to exploit it. This leads to more accurate results but cannot be done on a live system.
intrusive
Once the pentester has gained access, ____ that access becomes the next priority. This can be done by installing backdoors, rootkits, or Trojans.
maintaining
A ____ traffic assessment means that the system deemed the traffic harmless and let it pass.
negative
The ____ security tool can read and write data across both TCP and UDP network connections. It opens a TCP connection between two devices and can be used to send packets, scan for open ports, and listen in on connections to specific ports.
netcat
Use the ____ command to display a variety of network statistics in both Windows and Linux
netstat
The ____ utility is a network security scanner.
nmap
You need to enumerate the devices on your network and display the network's configuration details. Which of the following utilities should you use?
nmap
With a ____ scan, the security administrator does not authenticate to the system prior to running the scan. This scan shows open ports, protocols, and services that are exposed on a host system. This shows vulnerabilities that an outside attacker might be able to take advantage of.
non-credentialed
A ____ scan is the more common type of scan performed. This method scans the network and lists all potential vulnerabilities but is unable to validate if the system is vulnerable. This type of scan is able to performed on live systems and requires the network defender to take additional actions.
non-intrusive
The ____ and dig commands are used to view and modify DNS settings. These tools can be used to look up DNS server information and also give IP addresses and domain names for a network server.
nslookup
The ____ Windows command line tool combines the tracert and ping tools.
pathping
You need to check network connectivity from your computer to a remote computer. Which of the following tools would be the BEST option to use?
ping
A ____ traffic assessment means that the system detected an attack and the appropriate alarms and notifications were generated or the correct actions were performed to prevent or stop the attack.
positive
Members of the ____ team work on both offense and defense. This team is a combination of the red and blue teams.
purple
The first phase in the pentesting process is ____, also known as footprinting. In this phase, the pentester begins gathering information on the target. This can include gathering publicly available information, using social engineering techniques, or even dumpster diving.
reconnaissance
The ____ team members are the ethical hackers. This team is responsible for performing the penetration tests.
red
The ____ command is used in both Windows and Linux to show the routing table and to make manual changes to the table.
route
____ is used for port scanning. Instead of scanning ports from the hacker machine, it uses exploitation websites to perform port scans. This means the attacker is able to maintain anonymity while scanning the target.
scanless
Running ____ on the target is the second phase. During this phase, the ethical hacker is actively engaged with the target. Enumeration is part of the scanning phase. Enumeration uses scanning techniques to extract information such as: Usernames Computer names Network resources Share names Running services
scans
The final phase is generating the ____ and supporting documentation. After any penetration test, a detailed report must be compiled. Documentation provides extremely important protection for both the penetration tester and the organization.
test results
Which passive reconnaissance tool is used to gather information from a variety of public sources?
theHarvester
____ is a passive reconnaissance tool that is used to gather information from a variety of public sources. The tool gathers emails, names, subdomains, IPs, and URLs using multiple public data sources. These sources include search engines, social media sites, and Shodan.
theHarvester
The _____ tool shows the path a packet takes to reach its destination. Every device the packet passes through is known as a hop.
tracert
The ____ team members are the referees of cybersecurity. This team is responsible for managing the engagement between the red and blue teams. This group typically consists of the managers or team leads.
white
