Deck 8: Desktop and Server Os Vulnerabilities

Question 1

NetBIOS is not a protocol; it usually works with ____, a fast, efficient protocol that requires little configuration.

A)TCP/IP
B)NBT
C)NetBT
D)NetBEUI

Answer 1

D

Question 2

Windows Server 2003 and 2008 ____ are used to authenticate user accounts, so they contain much of the information that attackers want to access.

A)SMB controllers
B)domain controllers
C)CIFS servers
D)file servers

Answer 2

B

Question 3

SMB usually runs on top of NetBIOS, NetBEUI, or ____.

A)Winsock
B)CIFS
C)TCP/IP
D)IPX/SPX

Answer 3

C

Question 4

NetBIOS over TCP/IP is called ____ in Windows 2000 Server.

A)NBT
B)NetBEUI
C)NetBT
D)NetTCP/IP

Question 5

Complete instructions for MBSA are available from the MBSA Help interface or the ____ site.

A)Microsoft Security Tools Web
B)Microsoft Knowledge Base
C)Windows Help
D)Windows On-line Help

Question 6

____ is a client/server technology designed to manage patching and updating systems software from the network.

A)Systems Management Server (SMS)
B)Software Update Services (SUS)
C)Automatic Update
D)Patch Manager

Question 7

The Conficker worm took advantage of a vulnerability in ____ to run arbitrary code on susceptible hosts.

A)SQL Server
B)RPC
C)Windows Registry
D)NetBIOS

Question 8

The MBSA can check for missing security updates.

Question 9

The best way to protect a network from SMB attacks is to make sure routers filter out ports 137 to 139 and ____.

A)135
B)389
C)445
D)636

Question 10

Rootkits containing Trojan binary programs ready to be installed are more dangerous than typical Trojan programs.

Question 11

____ is an open-source implementation of CIFS.

A)Samba
B)GNUCIFS
C)GCIFS
D)OpenCIFS

Question 12

NetBIOS over TCP/IP is called ____ in Windows Server 2003.

A)NBT
B)NetBEUI
C)NetBT
D)NetTCP/IP

Question 13

To determine whether a system is vulnerable to an RPC-related issue, the best tool is ____.

A)Nessus
B)Winfingerprint
C)MBSA
D)Unicornscan

Question 14

Samba is as an closed-source implementation of CIFS.

Question 15

Red Hat and Fedora Linux use the ____ command to update and manage RPM packages.

A)yum
B)get
C)dir
D)alert

Question 16

____ is an interprocess communication mechanism that allows a program running on one host to run code on a remote host.

A)RPC
B)NetBIOS
C)Winsock
D)NetBEUI

Question 17

The MBSA can check for user account passwords that have dictionary words in them.

Question 18

Early Windows OSs communicated with each other by using ____.

A)Microsoft RPC
B)IPX/SPX
C)Winsock
D)NetBIOS

Question 19

Microsoft's Systems Management Server (SMS) can manage security patches for all computers on a network.

Question 20

MBSA has its origins in the ____ scanner.

A)MDAC
B)HFNetChk
C)MSXML
D)Mbsacli

Question 21

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
to harden Microsoft systems, you should disable this account

Question 22

You can use _____________________________________________ information when testing Linux computers for known vulnerabilities.

Question 23

Trusted Computer Solutions____ program is used to tighten Linux system security configuration by using templates.

A)OpenVAS
B)MBSA
C)SQL Server
D)Security Blanket

Question 24

SELinux contains several features and modules that use ____, an OS security mechanism that enforces access rules based on privileges for interactions between processes, files, and users.

A)Mandatory Access Control (MAC)
B)Server Message Block (SMB)
C)Common Internet File System (CIFS)
D)Microsoft Baseline Security Analyzer (MBSA)

Question 25

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
HTTP is associated with this port

Question 26

In Microsoft systems, an excellent resource for finding configuration errors, missing patches, and so on is the ________________________________________.

Question 27

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
almost useless if it isn't updated regularly

Question 28

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
gives an intruder a potential point of entry into a network

Question 29

The Trojan program called Sheepshank makes HTTP GET requests over port ____.

A)25
B)80
C)129
D)139

Question 30

If the LRK5 rootkit is installed on a Linux computer, entering the Trojaned ____ command allows the attacker's processes to continue running, even though the Linux administrator thinks all processes were killed.

A)Killall
B)Get
C)target
D)Dir

Question 31

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
DNS is associated with this port

Question 32

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
HTTPS is associated with this port

Question 33

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
LDAP is associated with this port

Question 34

SMB stands for _________________________.

Question 35

A common Linux rootkit is ____.

A)Back Orfice
B)Kill Trojans
C)Packet Storm Security
D)Linux Rootkit 5

Question 36

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
to harden Microsoft systems, you should rename this account

Question 37

MATCHING
Match each term with the correct statement below.
a.antivirus software
f.port 80
b.port 389
g.unused services
c.Guest
h.Administrator
d.port 53
i.blank
e.port 443
no account should have this type of password

Question 38

For a Windows computer to be able to access a *nix resource, ____ must be enabled on both systems.

A)NetBIOS
B)SMB
C)CIFS
D)NetBEUI

Question 39

RPC stands for ________________________.

Question 40

To perform MBSA-style scans you can run the tool from the command line by using ____________________.exe.

Question 41

What functions do most Trojan programs perform?

Question 42

Why is NetBIOS still used sometimes?

Question 43

What is the purpose of a file system?

Question 44

What is Server Message Block (SMB) used for in Windows? Can hacking tools still damage a network using SMB?

Question 45

What is Samba used for?

Question 46

What is the Common Internet File System (CIFS) protocol?

Question 47

What should a password policy include?

Question 48

What can a security tester using enumeration tools do?

Question 49

In Windows Server 2003 and 2008, how does a domain controller locate resources in a domain?

Question 50

Why should you review logs regularly? How should you accomplish this task?