Module 13-17 Tech 171
How can a DNS tunneling attack be mitigated?
by using a filter that inspects DNS traffic
A user receives a phone call from a person who claims to represent IT services and then asks that user for confirmation of username and password for auditing purposes. Which security threat does this phone call represent?
social engineering
What is the goal of a white hat hacker?
protecting data
used to capture traffic and show what is happening on the network
protocol analyzer
Which type of Trojan horse security breach uses the computer of the victim as the source device to launch other attacks?
proxy
A network administrator is checking the system logs and notices unusual connectivity tests to multiple well-known ports on a server. What kind of potential network attack could this indicate?
reconnaissance
Which type of attack is carried out by threat actors against a network to determine which IP addresses, protocols, and ports are allowed by ACLs?
reconnaissance
Why would an attacker want to spoof a MAC address?
so that a switch on the LAN will start forwarding frames to the attacker instead of to the legitimate host
gather intelligence or commit sabotage on specific goals on behalf of their government
state-sponsored attackers
What is the significant characteristic of worm malware?
A worm can execute independently of the host system.
Once a cyber threat has been verified, the US Cybersecurity Infrastructure and Security Agency (CISA) automatically shares the cybersecurity information with public and private organizations. What is this automated system called?
AIS
What is the result of a passive ARP poisoning attack?
Confidential information is stolen.
What is a vulnerability that allows criminals to inject scripts into web pages viewed by users?
Cross-site scripting
The IT department is reporting that a company web server is receiving an abnormally high number of web page requests from different locations simultaneously. Which type of security attack is occurring?
DDoS
Which cyber attack involves a coordinated attack from a botnet of zombie computers?
DDoS
An attacker is redirecting traffic to a false default gateway in an attempt to intercept the data traffic of a switched network. What type of attack could achieve this?
DHCP spoofing
What technique is a security attack that depletes the pool of IP addresses available for legitimate hosts?
DHCP starvation
In what type of attack is a cybercriminal attempting to prevent legitimate users from accessing network services?
DoS
Which type of security attack would attempt a buffer overflow?
DoS
Which protocol is exploited by cybercriminals who create malicious iFrames?
HTTP
This is a forensic tool that can be used by white hat hackers to find any trace of evidence existing in a particular computer system.
Helix
What kind of ICMP message can be used by threat actors to create a man-in-the-middle attack?
ICMP redirects
monitors traffic and compares it against configured rules
IPS
What are three functionalities provided by SOAR? (Choose three.)
It automates complex incident response procedures and investigations. It uses artificial intelligence to detect incidents and aid in incident analysis and response. It provides case management tools that allow cybersecurity personnel to research and investigate incidents.
Which statement describes the function of the SPAN tool used in a Cisco switch?
It copies the traffic from one switch port and sends it to another switch port that is connected to a monitoring device.
What functionality is provided by Cisco SPAN in a switched network?
It mirrors traffic that passes through a switch port or VLAN to another port for traffic analysis.
Which two functions are provided by NetFlow? (Choose two.)
It provides a complete audit trail of basic information about every IP flow forwarded on a device. It provides 24×7 statistics on packets that flow through a Cisco router or multilayer switch.
copies frames received on one or more ports to a port connected to an analysis device
SPAN
This is a packet crafting tool that uses specially crafted forged packets to probe and test the robustness of a firewall.
Socat
Which technology is a proprietary SIEM system?
Splunk
threat actors who steal government secrets, gather intelligence, and sabotage networks of foreign governments, terrorist groups, and corporations
State-sponsored
A user is curious about how someone might know a computer has been infected with malware. What are two common malware behaviors? (Choose two.)
The computer gets increasingly slower to respond. The computer freezes and requires reboots.
Which type of security threat would be responsible if a spreadsheet add-on disables the local software firewall?
Trojan horse
What are the three major components of a worm attack? (Choose three.)
a payload. a propagation mechanism. an enabling vulnerability.
What are two examples of DoS attacks? (Choose two.)
buffer overflow. ping of death.
What would be the target of an SQL injection attack?
database
What are two methods used by cybercriminals to mask DNS attacks? (Choose two.)
domain generation algorithms. fast flux.
a mechanism used to compromise an asset
exploit
A white hat hacker is using a security tool called Skipfish to discover the vulnerabilities of a computer system. What type of tool is this?
fuzzer
Which two types of hackers are typically classified as grey hat hackers? (Choose two.)
hacktivists. vulnerability brokers.
Which two characteristics describe a worm? (Choose two)
is self-replicating. travels to new computers without any intervention or knowledge of the user.
hacktivists
make political statements in order to create an awareness of issues that are important to them
Which attack involves threat actors positioning themselves between a source and destination with the intent of transparently monitoring, capturing, and controlling the communication?
man-in-the-middle attack
What are two evasion methods used by hackers? (Choose two.)
resource exhaustion. encryption.
the likelihood of undesirable consequences
risk
An administrator discovers a vulnerability in the network. On analysis of the vulnerability the administrator decides the cost of managing the risk outweighs the cost of the risk itself. The risk is accepted, and no action is taken. What risk management strategy has been adopted?
risk acceptance
inexperienced threat actors running existing scripts, tools, and exploits, to cause harm, but typically not for profit
script kiddies
a potential danger to an asset
threat
What is the function of a gratuitous ARP sent by a networked device when it boots up?
to advise connected devices of its MAC address
Why would a rootkit be used by a hacker?
to gain access to a device without being detected
What are two purposes of launching a reconnaissance attack on a network? (Choose two.)
to scan for accessibility. to gather information about the network and devices.
a weakness in a system
vulnerability
discover exploits and report them to vendors
vulnerability brokers
This is a debugger tool that can be used by black hats to revers engineer binary files when writing exploits. It can also be used by white hats when analyzing malware.
IDA Pro
Which statement describes an operational characteristic of NetFlow?
NetFlow collects basic information about the packet flow, not the flow data itself.
This is a wireless hacking tool that can be used to hack into a wireless network to detect security vulnerabilities.
NetStumbler
Which two types of attacks are examples of reconnaissance attacks? (Choose two.)
port scan. ping sweep.
Which devices should be secured to mitigate against MAC address spoofing attacks?
Layer 2 devices
Which two characteristics describe a virus? (Choose two.)
Malicious code that can remain dormant before executing an unwanted action. Malware that relies on the action of a user or a program to activate.
Which type of network attack involves randomly opening many Telnet requests to a router and results in a valid network administrator not being able to access the device?
SYN flooding
What scenario describes a vulnerability broker?
a threat actor attempting to discover exploits and report them to vendors, sometimes for prizes or rewards
What causes a buffer overflow?
attempting to write more data to a memory location than that location can hold
threat actors that publicly protest against organizations or governments by posting articles, videos, leaking sensitive information, and performing distributed denial of service (DDoS) attacks
hacktivists
Which field in the IPv6 header points to optional network layer information that is carried in the IPv6 packet?
next header