Deck 1: Ethical Hacking and Testing

Question 1

our employer has asked you to perform an audit of the passwords for the user accounts for a particular server. What type of test have you been assigned?

A) White Box test
B) Grey Box test
C) Black Box test
D) Grey Hat test

Answer 1

Grey Box test

Question 2

Which of the following phrases is a derogatory term and would only invite retaliation?

A) Script Kiddie
B) Hacker
C) Attacker
D) Consultant

Answer 2

Script Kiddie

Question 3

Webhosting services often give free scripts to customers that pay for minimum level services. Occasionally there are security flaws in these scripts that are never fixed even though thousands of customers might be using them.
This is an example of what type of threat category?

A) PHP
B) SQL Injection
C) Cross Site Scripting
D) Shrink Wrap Code

Answer 3

Shrink Wrap Code

Question 4

Neil is conducting security research on a popular software application and discovers a buffer overflow. He considers reporting his finding to the vendor but realizes the EULA (End User License Agreement)
Forbids this kind of research.
What should Neil do?

A) Neil should sell his exploit on eBay. There is nothing wrong with making an honest dollar this way since the software itself should have been free in the first place.
B) The laws that protect the right to Full Disclosure are in higher standing than the EULA. It is a constitutional issue regarding speech and expression. Neil can reveal his findings without worry.
C) Report the finding to a neutral party such as a CERT coordination center
D) Anonymously report the finding to the bugtraq or "full disclosure" mailing lists

Question 5

Which of the following represents the greatest danger to enterprise networks?

A) Disgruntled Employee
B) Black Hat hacker
C) Negligent management
D) The burdens of government regulations

Question 6

When he is finished footprinting the network the next step an attacker would take is:

A) Launch a vulnerability scanner
B) Enumerate as much as possible about the policies of each system
C) Attack!
D) Take the information they have gathered and start searching Google

Question 7

Which of the following types of hosts are completely exposed to risk?

A) A Windows 2000 server
B) Honeypot
C) Bastion host
D) An open source operating system

Question 8

Which of the following types of hosts are placed on a network to attract the attention of a malicious attacker and allow the administrators to observe their actions?

A) Honeypot
B) Bastion host
C) Intrusion Detection System
D) A Windows 98 machine

Question 9

Hosts can often be attacked in layers. If the target service is not vulnerable then what else should the attacker try? (Choose two)

A) Annoy the administrator of that host with a Denial of Service attack
B) If the target service is secure there is nothing else that can be done
C) Convince a user to accept a malicious file into one of the clients on the host
D) Attack a service on one of the other open ports

Question 10

Another way to describe risk is:

A) A positive or negative event that can impact a resource or process
B) A negative event that can cause damage to a resource or process
C) Bungee jumping
D) A management technique that measures certainty

Question 11

Which of the following is considered to be the most dangerous vector of security threats?

A) Unpatched operating systems
B) Natural Disasters
C) DD0S (Distributed Denial of Service)
D) Social engineering

Question 12

When attackers have gained and then maintained access to a system it is said they have installed a…

A) Backdoor
B) Rootkit
C) Maintenance hook
D) Trojan

Question 13

An attacker wants to make changes to a log file to clear his tracks. Instead of erasing the logs, he just makes changes to some of the entries. What is he trying to do?

A) Throw off the timeline to confuse the investigator
B) Create the appearance of decoy traffic
C) Make an extremely unusual event so it wouldn't be looked at
D) Taunt the administrators

Question 14

If a White Hat researcher discovers a vulnerability in a software product, what should she do with the information?

A) Create a tutorial complete with screenshots and submit the finding to digg.com and slashdot.org
B) Call the vendor and offer to keep quiet if they pay you a finder's fee
C) Prove the exploit works, then sell a script on eBay
D) Report the vulnerability to a regional emergency response organization

Question 15

Someone downloads a tool from the Internet and uses it to experiment with an idea she got from a YouTube video. Another exam you recently passed considers this unethical and inappropriate. A friend of yours just considers this person to be a "script kiddie." You have your own opinions, but what is the most defensive way to respond to this scenario?

A) Lecture the person about ethics and appropriate behavior. Make certain she realizes the trouble she is causing the industry as a whole.
B) Avoid insulting the person, enforce policy in a professional yet objective manner, and consider the idea that this person can be an asset if properly mentored.
C) Explain "Script kiddies are l00s3rs." And agree with your friend that if this l@m3r can't write her own buffer overflow shellcode then she isn't worth a slice of pizza.
D) Shrug your shoulders in indifference and get on with your day knowing your network is so secure that this person poses no possible threat.

Question 16

What is the threshold for the amount of damage an organization must sustain before federal law enforcement will get involved?

A) $1,000
B) $5,000
C) $10,000
D) There is no lower limit

Question 17

Which of the following statutes says that attempts to circumvent copy protection are illegal, regardless of how weak that protection might be?

A) Copyright and Patent Protection Act
B) Freedom of Information Act
C) Digital Millennium Copyright Act
D) It is not illegal; if a protection can be broken it is a right to break it

Question 18

Which of the following statements are most true? (Choose two)

A) The law recognizes a difference between a computer being used in a crime and when a computer is the target of a crime
B) The Freedom of Information Act guarantees the fair use and exchange of all information materials
C) The law has definitive distinctions between what is "important" versus "unimportant" information
D) Penalties increase dramatically if human life has been put in danger

Question 19

If attackers experimenting with the latest botnet tool decided to seize control of some federal computers for the purposes of committing a fraud utilizing symbolic data such as credit card information they would be in violation of:

A) Computer Fraud and Abuse Act Section 1030
B) Federal Computer Breech Act of 1985
C) The Bush Cheney Act of 2006
D) Symbolic Data Protection Act of 2001

Question 20

You want to determine the web server and host operating system of a target. For legal reasons, you worry about getting caught. A passive recon technique that cannot be detected might be a good idea.
Which of the following choices holds the least risk of detection?

A) Use the netcraft website to look up the target's host
B) Use telnet to perform a banner grab
C) Use a common scanner in "paranoid mode"
D) Call them and ask

Question 21

You are researching an adversary and are certain that you saw some incriminating information on their website about six months ago, but it isn't there now. What resource below might be the quickest way to check for this data?

A) Look through the websites that target has partner relationships with
B) Use Google to look through their cache database
C) Learn to program in PERL and create a webcrawler of your own
D) "The Wayback Machine"

Question 22

Which of the following statements is the most correct about the DMCA?

A) Circumventing copyright protections is permissible if they can be defeated. The responsibility lies on the rights holder to enforce protection adequately.
B) The "Librarian of Congress" can issue exceptions to the circumventing of copyright protections that the DMCA addresses.
C) The DMCA stands for the "Digital Mandates for Circumvention of Assets" Act. It implements treaties established by WIPO (World Intellectual Property Organization).
D) The DMCA protects the attacker by defining reverse engineering as "The legitimate act of research" and "an inherent right of each user."

Question 23

Hayley decides to circumvent the copy protection laws by taking an entire movie she recorded on her cell phone in the theatre and appending it with an insightful review and claims this is journalism and free speech. She still gets sued and loses. Why?

A) She didn't have enough money to hire a good attorney.
B) This was an injustice. She should have won the case.
C) She used too much. A clip or two with proper attribution would have been better.
D) It was a flip of the coin; the case could have gone either way.

Question 24

Which of the following protects the rights of individuals in regard to the disclosing of information? (Choose two)

A) The Human Rights act of 1998 (UK)
B) The Google Act of 2003
C) Privacy Act of 1974
D) There are no such rights

Question 25

"Port scanning" is considered what form of attack?

A) Illegal and highly prosecuted
B) Information gathering
C) Rude and impolite
D) Denial of Service

Question 26

In the United States, attacks on financial institutions are handled by:

A) The GLBA (Graham Leach Bliley Act)
B) The FBI
C) The Secret Service
D) A free market society has no such crime. It is a moral imperative that to the winner "goes the spoils." If you can work the system then it works for you.

Question 27

"Periodic assessments of the risk and magnitude of the harm that could result from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency;"
Which act mandates a security program be implemented in a Federal agency that meets the above criteria?

A) Directive 8570
B) FISMA
C) FISO
D) The Homeland Security Act

Question 28

Which of the following statements describes a provision of FERPA?

A) Organizations that provide educational services and receives funding from the department of education must have certain controls over student records, including disclosure to third parties.
B) Organizations that provide financial services must have certain controls over client records, including disclosure to third parties.
C) Individuals that receive TARP funds must protect the identities of the financial officers that brokered their benefits.
D) FISMA and FIDO must not collude to compromise, sell, or distribute information that reveals financial details about a citizen of the United States.

Question 29

Which of the following acts of the UK parliamant make it illegal to modify the contents of a computer with the intent to impair its operation?

A) Computer Operation and Protection Act of 1989
B) Computer Hacking and Modification Act of 1990
C) Computer Fraud and Abuse Act Section 1029
D) Computer Misuse Act of 1990

Question 30

Which of the following (choose two) acts were meant to protect the illegal use of computers by unauthorized parties, but many argue that they in fact had the opposite effect? The laws could enable unsolicited email and usage monitoring.

A) CAN-SPAM ACT
B) SPY Act
C) Intellectual Properties and Protection Act
D) Free Speech in Advertising Act

Question 31

During a pentest, you retrieve a USB key from a box of discarded hardware that was just sitting by a number of other items. You check the key for files and it turns out to have a number of .pdf documents that could have sensitive information. If this information were to get leaked it would be a great risk to your client. In your report you point this out but the customer doesn't see the problem as all of the documents were password protected.
Why isn't this enough to prevent the information leakage?

A) Without knowing the original user of the file the information could be inaccurate or not relevant, however, if something thinks it is they would still try to use it during a social engineering attack.
B) Many tools that are easy to obtain can brute force the passwords. It is also common for documents of this nature to use easy to remember dictionary words that are also often the same for many files.
C) Since the password must always be stored in the file itself, it is fairly easy to use a common hex editor to analyze the file and extract the credentials
D) The passwords are usually stored using a very strong encryption, but notepad will usually open the files in clear text anyway

Question 32

A business manager is arguing with a compliance officer that a pentest would never be necessary for this company since they use single sign on authentication throughout. You are asked for your opinion, and say "IF I can access a network physically I can own it". This sounds a little extreme, but what is not true about this assertion?

A) Booting up to an alternative operating system might allow you to circumvent the local authentication, compromise a credential store, or steal critical data
B) Not being able to login would prevent your host from obtaining network configurations such as an IP address, routing and DNS settings. But sniffing is still possible.
C) There are ways of detecting the presence of new systems on the network such as rogue infrastructure. These techniques should still be tested regularly
D) Physical security is always critical and along with user training should be a constantly run program

Question 33

During an internal pentest, you setup a fake website and that offers some documentation and useful resources. You create a link and send it via email to a few key people. When they visit, code is run on their own machines that compromise their systems.
What form of attack is not taking place?

A) Cross Site Scripting
B) SQL Injection
C) Browser drive-by
D) Social Engineering

Question 34

During a pentest, you notice the organization uses different domains for various internal departments. What phase of the test would this have been discovered?

A) Project scoping
B) Rules of engagement negotiation
C) Vulnerability analysis
D) Passive information gathering

Question 35

Systems that have default configurations are common targets during a pentest. Which of the following is not a default configuration?

A) Setup a webserver that uses a secondary that only invited users will know about
B) Keeping the directory structures the same as installed, for easier maintenance
C) Allowing the sample pages of the webserver to remain so as not to confuse anyone until the real site is built
D) Keeping the default user accounts to make sure access is always available.

Question 36

Milo is trying to learn all he can about a network. He is looking for easy things he can do that might reveal information. Eventually, he can collect all of that data and after analysis learn perhaps enough to have a complete picture. One technique is to send email to email addresses with different status such as; valid users, non-existent addresses, users on vacation, employees that are no longer there, and commonly named email groups.
What would be a reason for doing this?

A) To verify information about the email administrator
B) Gather information about internal hosts
C) See how the IT department responds to a Denial of service attack
D) To learn about the internal policies for handling such events

Question 37

Gary is using an email system that allows web based access and is popular among employees of the company he is attacking. He is testing this system to see if there is a way to gain access to other users accounts. He signs up for an account and begins to use it. He notices in the URL that information about his account name is present:
Http://mail.exampleco.com/inbox.aspx?lang=en&mailbox=Gary+Tennenbaum
He replaces his name with someone else's name in the target company that he gathered from a job posting site. What attack is he attempting?

A) URL obfuscation attack
B) Directory traversal attack
C) Query string parameter manipulation attack
D) A path string attack

Question 38

Maureen returns from lunch and notices her PC has a BSOD but the hard drive activity light is still flashing. What tool is possibly being used?

A) Nessus scans can cause BSODs, she just needs to reboot
B) Her computer is enumerating the network with dumpsec
C) Her computer is using floppyscan
D) A USB key was inserted and caused a IRQ conflict

Question 39

You are conducting a test and got caught. What document will ensure that you are protected from negative consequences within the target company?

A) Indemnity Claus
B) "Get out of jail free" card
C) Rules of engagement
D) Non-disclosure agreement

Question 40

Dave wants to steal the contact database from a rival sales person. He calls his rival's secretary and pretends to be from the IT department. He says "The sales tracking system just crashed, at least we think. We are hopeful that we saved everyone's data, but we need Mr. Shivers username and password
In order to log in and check."
What type of attack is Dave conducting?

A) Identity theft
B) Identity faking
C) Identity spoofing
D) Identity pre-texting

Question 41

Karen gets hired on with disrupttheprocess.org to organize interference in public political events. Her real purpose however, is to figure out where the real funding for these events is coming from, so she can inform the media. She figures out how the power structure works and spies a contact list on the desk of a fellow coworker.
Karen recognized the person who handles finances works out at a gym that Karen also belongs to. Karen arranges to bump into her one day and suggests they do spin class together for awhile. Long story short, this friendship trust eventually results in Karen achieving access to a database of sponsors, which she then provides to the local newspaper.

A) Insider Associate
B) Insider Affiliate
C) Outsider Affiliate
D) Outsider Associate

Question 42

Which of the following are ways to overcome insider threats? (Choose up to 7)

A) Separation of duties
B) Rotation of duties
C) Restrict privileges
D) Controlled access
E) Logging and auditing
F) Legal policies
G) Archiving critical data

Question 43

It is considered that 60%-70% of all attacks come from insiders. Which of the following group or individual is not an insider?

A) Disgruntled Employee
B) Suppliers and Venders
C) CEO
D) Business Partners and consultants

Question 44

What is the most common method of social engineering?

A) LANs
B) Email
C) In Person
D) Telephone

Question 45

Easton is hired by a materials company to investigate why a competitor seems to be able to apply for patents for exactly the same technologies faster than they can. The competitor doesn't even produce or make anything, they seem to exist only to sit on patents.
Easton finds John, a proud father and dog owner that is always bringing new pictures into the office on a USB key. He loads them onto his computer each morning, tries to show them to coworkers as they walk past, then copies them back onto the USB key in the afternoon. Since it is just pictures of his children and his dogs, no one thought anything of it.
At the very least, John might be abusing company time editing his photos, but there is no such software on his system.
What activity does Easton suspect John is up to?

A) Picture fuzzing
B) Steganography
C) Cryptography
D) Reverse Social Engineering

Question 46

Tom sees Jerry walking quickly up to a door that is protected by a proximity card. Jerry looks like he is in a hurry and has something on his mind. Tom runs up alongside him and starts a distracting conversation. As Jerry opens the door, his body language suggests that he wants to get away from Tom but Tom just gets more aggressive and walks in behind him through the door.
Once inside, he gives up and tells Jerry to have a nice day. What has Tom done?

A) Clever talking
B) Door jamming
C) Tailgating
D) Mantrapping

Question 47

Devon has been "dumpster diving". He went through is target's garbage and recycle bins getting all he could. What is the term used to describe what he will most likely do with these documents?

A) Paper Pilfering
B) Trash Tracing
C) Green Grabbing
D) Document Grinding

Question 48

What are the 6 principles of social engineering?

A) Authority, Scarcity, Liking, Reciprocation, Commitment, Intimidation
B) Authority, Scarcity, Liking, Reciprocation, Consistency, Social Validation
C) Authority, Scarcity, Complimenting, Reciprocation, Consistency, Social Validation
D) Intimidation, Scarcity, Liking, Reciprocation, Charisma, Social Validation

Question 49

Sean is having a conversation with a friend, making fun of how foolish spammers are. Clearly, he says "These emails are just sent by the millions and look like it. Only an idiot falls for them." In the meanwhile Sean is reading an email addressed to him. It says:
---
Dear Sean,
I understand you did some work awhile back for an orfanage in Brazil. Sorry to bother you sir, we have never meet, but I am a 13 year old boy whose parents were taken the the states. I need some money to get them to reurn safely or if I can greet them there in the states too. Can you help?
---
Sean remembers his trip to Brazil and thinks of a boy he met there (He met hundreds, but the mind plays tricks like this on the best of us). He wonders for a moment if this might be him.
What technique is Sean about to fall prey too?

A) SPAM & Scam Sandwich
B) Brazilian Spam Squad
C) Spear Phishing
D) South American 419 Scam

Question 50

Once efforts to setup blacklists were created and high profile spammers were starting to get receives prison sentences, one would think they would be discouraged. Nope. Which of the following is a technique that is now used to distribute SPAM and cloak its sender?

A) Social Networks
B) SMS, Skype, and IM SPAM
C) Spear phishing
D) Botnets

Question 51

What are the 3 steps of reverse social engineering?

A) Sabotage, Advertising, Assisting
B) Advertising, Sabotage, Assisting
C) Sabotage, Assisting, Advertising
D) Assisting, Sabotage, Advantage

Question 52

The sales manager for your company nicknamed "Zig", is looking for a creative way to advertise and grow the business. He accesses a popular technical forum website and asks a question he knows many in the group will be able to answer. He thanks them for their help "in advance" (TIA) while suggesting everyone should visit his site for more information about his question.
One poster responds back with a link to a page called http://www.superdupersalesleadsUSA.cx and compliments Zig on his fantastic website. He said he can assist better if Zig could fill out the contact form on that page, and will also refer a number of new clients in case Zig is interested.
The sales manager gets suspicious and asks you for advice. What can you say to him?

A) It looks like a promising link, he should try it out.
B) You tell him the site is not from the USA and would probably not have leads he can use anyway. He should respond to the poster by calling him a jerk for wasting our time.
C) You offer to click the link from your workstation instead, because it is safer.
D) You advise this is not considered good netiquette and that this type of advertising does not present the best image for the company. You ask Zig not to click on the link, do not respond further, and please don't do this again.