Question 1

There is a "Chunked Encoding Transfer Heap Overflow" vulnerability in IIS. You telnet into port 80 of a possible target and enter the following commands:
A)POST /iisstart.asp HTTP/1.1
B)Accept: */*
C)Host: acme.com
D)Content

Accepted Answer

The first line tells the server you want to use the POST method to communicate with the iisstart.asp file. You then pass it the rest of the data. Many remote exploits work simply by accessing the open port using telnet or netcat and knowing what to type.

Question 2

You are looking at some code and notice something that concerns you. What is the dangerous function in the code below?
Void myMethod(char * pStr)
{
Char pBuff[10];
Int nCount = 0;
Strcpy(pBuff, pStr);
}
Void foo()
{
}
A) void foo()
B) myMethod
C) strcpy
D) fgets

Accepted Answer

Strcpy is the dangerous function in this script. The fgets function is also dangerous but is not in the example code.

Question 3

When succesfully executing a buffer overflow, what level of privilege will the attacker have?
A) Buffer overflows always have system
B) Buffer overflows always have root, or admin
C) The same context of the service or application that was running
D) Its indetermined, depends on the exploit

Accepted Answer

Whatever context the owner of the process has is what the attacker gets.

Question 4

Sergio wants to get back at his competitor for winning the gold medal in a town fair BBQ contest. He pays his nephew to attack their website. The competitor doesn't realize this until they notice it is not accessible, there is an error message about the authentication system, and a simple reboot is enough to
Fix it.
What type of attack is this most likely? (Choose the best description)
A) Distributed Denial of Service that relies on accidental traffic
B) Denial of Service based on a well known LSASS vulnerability
C) Distributed Denial of Service that overloads resources
D) Denial of Service that requires human interaction to restore service

Accepted Answer

Seems like a strange question, but be prepared to consider scenarios and describe them to a level of detail that is similar to the question. LSASS is the access control subsystem for Windows, and if it is crached it will result in a denial of service. It did take human interaction to restore, but this is a better answer.

Question 5

Clive notices that one of his hosts keeps getting DoS'd. A quick view of the traffic on the wire shows a lot of traffic that has both the destinate and host address the same as the victim. What type of attack is this?
A) Land
B) Fraggle
C) Smurf
D) Ping of Death

Accepted Answer

A land attack is when the attacker sends traffic toward a host spoofing its own address as the source. Its ACK counter does not increment the way it should (because it didn't send the traffic in the first place), causing it to "re-ack" for the same sequence number over and over.

Question 6

Which is the best description of an unnamed attack?
A) A 0-day attack that researchers have not yet identified
B) An attack that have not been identified by the IDS
C) Reducing offset values to cause a short packet on reassembly
D) Increasing offset values to cause a long packet on reassembly

Accepted Answer

Decreasing offset values is a teardrop attack. The other two answers have specific terms: 0-day, and false negative.

Question 7

Mary notices her machine has internet access for about 10 minutes then it seems to slow down. She reboots, everything is fine for ten minutes again. What is the most likely problem?
A) Her internet filter is metering her usage and throttling her down
B) Her ISP sucks
C) The website she is visiting is down
D) Her host is vulnerable to slammer.

Accepted Answer

Slammer exploited a problem with Windows SQL server desktop edition whish is present in Windows XP machines and forward. It was only memory resident, so a reboot would remove it, however, and vulnerable machine would likely be re-infected within minutes.

Question 8

Tony wants to clear his afternoon to play a video game. He needs to manufacture an emergency and tell his boss that the servers are vulnerable to an "Evil Bit" attack, and it will take all afternoon to fix them. This sounds bad, so the boss tells him to get right on it.
What is Tony really talking about?
A) He is referring to a character in his video game, but the boss doesn't realize this
B) He just gave the boss a simple explanation for a real attack knowing he wouldn't understand the right
One
C) The high order bit in the fragment offset field is set, but it is supposed to be reserved with a value 0, and most IP stacks have not been updated to understand it. It crashes the system
D) This is an IT inside Joke

Accepted Answer

Read RFC 3514 and the Wikipedia article here: http://en.wikipedia.org/wiki/Evil_bit

Question 9

Which if the following tool is not a demonstration of an Asymmetric attack (or a tool)?
A) Tribe Flood Network
B) Trinoo
C) C2myazz
D) Stacheldraht

Accepted Answer

C2myazz is malware that steals passwords. The others tools are DDoS tools, which are asymmetric in nature.

Question 10

A host is bombarded with packets intended to exploit stateful network protocols. Every time it gets a packet, it allocates memory for the expected connection. The connection is never fully established by the sender.
What form of attack is this?
A) SYN Flood
B) Smurf
C) Ping of Death
D) Stachledraught

Accepted Answer

The attacker sends packets with the SYN flag set to an open port. The server responds with a SYN-ACK, but the attacker never sends the final ACK to complete the handshake. In the meanwhile the server has allocated memory for the connection and eventually runs out.

Question 11

Which of the following tools means "Barbed Wire" in German?
A) Zertifizierte
B) Stacheldraht
C) Barbenkwier
D) Zschwiedlfenken

Accepted Answer

There might be some trivia questions on the real exam. This is to make sure you actually read the material. But not enough to be the difference on the exam, in other words, if you get the trivial questions wrong that won't really be the reason for not passing. Don't let it get to you.

Question 12

Knowing her company is about to spend 45% of their marketing budget for the year on one commercial during the Super Bowl, Contessa decides to test the load of the servers. This way, capacity problems won't cause the site to go down if the commercial is successful.
What tool can she use?
A) UDP Flood
B) Jolt2
C) Blast
D) MStream

Accepted Answer

Blast is a TCP stress testing tool. Never perform asymmetric tests on your network from the Internet.

Question 13

What is a possible countermeasure for SYN floods?
A) SPI Firewall
B) SYN Cookies
C) Block all flags with the SYN flag set, in or out
D) Disable outgoing SYN traffic

Accepted Answer

The other answers might work but would go too far or not be applicable in all situations. SYN cookies allow the receiving host to dump its SYN queue as it sends out the SYN-ACK. If nothing comes back, no harm done. If an ACK is returned, the original SYN queue can be reconstructed based on the SEQ number the receive host chose in its first response.

Question 14

Which of the following tools is known for having a menu of choices available to the attacker?
A) TFN2K
B) Targa
C) Kismet
D) Wikto

Accepted Answer

Targa is capable of several "protocol based" attacks including: Nestea, Syndrop, Teardrop, Bonk, and ping of death

Question 15

Blair and Lee work in the NOCs (Network Operation Center)s of two different ISPs. They are on the late shift and bored. Blair sends a series of packets that are 65537 bytes in length trying to irritate Lee.
What is he doing?
A) Ping of Death
B) Invite of Death
C) Generate false positives on the IDS that Lee will have to explain
D) Nothing, packets can be up to 2^32 in size because the Datagram length field is 15 bits and the 16th bit is a multiplier.

Accepted Answer

The multiplier concept has to do with the way window sizes in TCP work. IP packets cannot be larger than 65536 (0-65535) according to RFC 791. Attempting to send a larger one might result in a denial of service, crashing the IP stack on the receiver. An INVITE of Death is a type of VoIP attack.

Question 16

Sterling sends a flood of UDP traffic toward port 19 on an old UNIX mainframe, spoofing the broadcast address of the subnet and source port 7.
What is he trying to do?
A) Smurf attack
B) Fraggle attack
C) FrickaFrack Attack
D) SmallService Attack

Accepted Answer

This is a description of the UDP version of a smurf, traffic is sent to the Chargen port of the UNIX mainframe, which will respond back to the echo ports on all of the other machines, who would all then echo the chargen traffic until the network itself is flooded.

Question 17

Gary assembles an ACL for his Cisco router that looks something like this:
Access-list 111 deny ip 10.0.0.0 0.255.255.255 any
Access-list 111 deny ip 172.16.0.0 0.15.255.255 any
Access-list 111 deny ip 192.168.0.0 0.0.255.255 any
Access-list 111 deny ip 127.0.0.1 0.255.255.255 any
Access-list 111 deny ip 224.0.0.0 31.255.255.255 any
Access-list 111 deny ip host 0.0.0.0 any
The list is applied to an outside interface. What is this list trying to accomplish?
A) Defining private IPs
B) Defining internal networks
C) Anti-NAT attacks
D) Anti-spoofing

Accepted Answer

There is never a time when it makes sense for packets to come from the outside that have a source address of an inside segment. This might also be the anti-smurf, and anti-fraggle countermeasure. Read RFC 2827. (http://www.ietf.org/rfc/rfc2827.txt)

Question 18

Landon sends a "Chernobyl Packet" into a network. What does this mean?
A) A packet that causes a kernel panic
B) A packet that causes a broadcast storm
C) A packet than contains a virus
D) A packet that causes a BSOD

Accepted Answer

A Chernobyl packet is so named because it "meltsdown" the network segment. There is a Chernobyl virus, that affected the CMOS of individual hosts, close answer but different attack.

Quiz 3: Malicious Code

There is a "Chunked Encoding Transfer Heap Overflow" vulnerability in IIS. You telnet into port 80 of a possible target and enter the following commands:

You are looking at some code and notice something that concerns you. What is the dangerous function in the code below? Void myMethod(char * pStr) { Char pBuff[10]; Int nCount = 0; Strcpy(pBuff, pStr) ; } Void foo() { }

When succesfully executing a buffer overflow, what level of privilege will the attacker have?

Clive notices that one of his hosts keeps getting DoS'd. A quick view of the traffic on the wire shows a lot of traffic that has both the destinate and host address the same as the victim. What type of attack is this?

Which is the best description of an unnamed attack?

Mary notices her machine has internet access for about 10 minutes then it seems to slow down. She reboots, everything is fine for ten minutes again. What is the most likely problem?

Which if the following tool is not a demonstration of an Asymmetric attack (or a tool) ?

A host is bombarded with packets intended to exploit stateful network protocols. Every time it gets a packet, it allocates memory for the expected connection. The connection is never fully established by the sender. What form of attack is this?

Which of the following tools means "Barbed Wire" in German?

Knowing her company is about to spend 45% of their marketing budget for the year on one commercial during the Super Bowl, Contessa decides to test the load of the servers. This way, capacity problems won't cause the site to go down if the commercial is successful. What tool can she use?

What is a possible countermeasure for SYN floods?

Which of the following tools is known for having a menu of choices available to the attacker?

Blair and Lee work in the NOCs (Network Operation Center) s of two different ISPs. They are on the late shift and bored. Blair sends a series of packets that are 65537 bytes in length trying to irritate Lee. What is he doing?

Sterling sends a flood of UDP traffic toward port 19 on an old UNIX mainframe, spoofing the broadcast address of the subnet and source port 7. What is he trying to do?

Landon sends a "Chernobyl Packet" into a network. What does this mean?