Question 1

our employer has asked you to perform an audit of the passwords for the user accounts for a particular server. What type of test have you been assigned?
A) White Box test
B) Grey Box test
C) Black Box test
D) Grey Hat test

Accepted Answer

A Grey Box test has a specific objective but not all of the information needed has necessarily been provided. It is a limited test.

Question 2

Which of the following phrases is a derogatory term and would only invite retaliation?
A) Script Kiddie
B) Hacker
C) Attacker
D) Consultant

Accepted Answer

There is a famous story behind this question. Start by reading this wiki article at:
http://en.wikipedia.org/wiki/WkD_Bot

Question 3

Webhosting services often give free scripts to customers that pay for minimum level services. Occasionally there are security flaws in these scripts that are never fixed even though thousands of customers might be using them.
This is an example of what type of threat category?
A) PHP
B) SQL Injection
C) Cross Site Scripting
D) Shrink Wrap Code

Accepted Answer

This is an example of reusing code and spreading a security risk.

Question 4

Neil is conducting security research on a popular software application and discovers a buffer overflow. He considers reporting his finding to the vendor but realizes the EULA (End User License Agreement)
Forbids this kind of research.
What should Neil do?
A) Neil should sell his exploit on eBay. There is nothing wrong with making an honest dollar this way since the software itself should have been free in the first place.
B) The laws that protect the right to Full Disclosure are in higher standing than the EULA. It is a constitutional issue regarding speech and expression. Neil can reveal his findings without worry.
C) Report the finding to a neutral party such as a CERT coordination center
D) Anonymously report the finding to the bugtraq or "full disclosure" mailing lists

Accepted Answer

Neutral third parties exist that will protect the anonymity of the person or organization that submits an incident or vulnerability. From there, the proper vendor can be notified. There is philosophical debate within the security community regarding whether or not to leak the information out after the vendor has been given fair time to respond but chosen not to. Most agree however that immediate full disclosure is a grey area at least.

Question 5

Which of the following represents the greatest danger to enterprise networks?
A) Disgruntled Employee
B) Black Hat hacker
C) Negligent management
D) The burdens of government regulations

Accepted Answer

While Black Hat hackers may have the skills to pull off an attack, they may not have the best position in the network. Disgruntled employees will have been insiders and likely have many contacts that are willing to collude with them. The most common form of disgruntled employee attack it to report the former employee to the BSA (Business Software Alliance) and claim they are using unlicensed software.

Question 6

When he is finished footprinting the network the next step an attacker would take is:
A) Launch a vulnerability scanner
B) Enumerate as much as possible about the policies of each system
C) Attack!
D) Take the information they have gathered and start searching Google

Accepted Answer

A vulnerability scanner is too noisy to use in most cases, even though common tools such as Nessus will do most of the footprinting work for the attacker. It is safer to pick the interesting machines one by one and try to find out as much as possible about them as it might be possible to choose an attack strategy without a vulnerability scan at all.

Question 7

Which of the following types of hosts are completely exposed to risk?
A) A Windows 2000 server
B) Honeypot
C) Bastion host
D) An open source operating system

Accepted Answer

Bastion hosts are fully hardened machines designed to withstand any kind of abuse because they will have no help. It is usually a matter of access, for instance a web server in the DMZ (De-Militarized Zone) might need to be fully exposed on port 80 to the entire world, so at least where that port is concerned it needs to hold up to attack.

Question 8

Which of the following types of hosts are placed on a network to attract the attention of a malicious attacker and allow the administrators to observe their actions?
A) Honeypot
B) Bastion host
C) Intrusion Detection System
D) A Windows 98 machine

Accepted Answer

Honeypots are hosts with no production value that serve to attract the attention of an attacker. When designed properly, they blend in with the other hosts on the network, including not having exaggerated levels of weaknesses. While a honeypot is accessible, it is not necessarily completely exposed to all risks.

Question 9

Hosts can often be attacked in layers. If the target service is not vulnerable then what else should the attacker try? (Choose two)
A) Annoy the administrator of that host with a Denial of Service attack
B) If the target service is secure there is nothing else that can be done
C) Convince a user to accept a malicious file into one of the clients on the host
D) Attack a service on one of the other open ports

Accepted Answer

It is often best to begin attacking from the lowest layer of the OSI model that can be accessed. If possible, a physical attack is always best. Remote attacks against enabled services might allow access to the OS. Then attack the application either as a remote client or from within using social engineering. There are many ways to get in.

Question 10

Another way to describe risk is:
A) A positive or negative event that can impact a resource or process
B) A negative event that can cause damage to a resource or process
C) Bungee jumping
D) A management technique that measures certainty

Accepted Answer

Risk is sometimes called a "measurement of uncertainty." It is neither positive nor negative until the impact is determined. Opportunities can sometimes be identified and if the plan is right in the end, risk management improves an organization overall.

Question 11

Which of the following is considered to be the most dangerous vector of security threats?
A) Unpatched operating systems
B) Natural Disasters
C) DD0S (Distributed Denial of Service)
D) Social engineering

Accepted Answer

All of the answers present dangerous possibilities, but social engineering is always considered the most exposed and hardest to completely countermeasure. Training is considered to be the most cost effective solution.

Question 12

When attackers have gained and then maintained access to a system it is said they have installed a…
A) Backdoor
B) Rootkit
C) Maintenance hook
D) Trojan

Accepted Answer

The maintaining access step is about installing backdoors so access can be gained at anytime. A backdoor can be a privileged user account (noisy), or an illicit server (installed via a Trojan), or a variety of processes that were hidden by a rootkit.

Question 13

An attacker wants to make changes to a log file to clear his tracks. Instead of erasing the logs, he just makes changes to some of the entries. What is he trying to do?
A) Throw off the timeline to confuse the investigator
B) Create the appearance of decoy traffic
C) Make an extremely unusual event so it wouldn't be looked at
D) Taunt the administrators

Accepted Answer

Be careful on the wording here: If false entries looked like decoy traffic it would only show someone is in there messing around. Unusual events are often false positives but should be confirmed. The timeline is the most valuable thing an investigator can determine when tracking down events. Part of the clearing tracks phase of an attack is to take investigators off the scent, ideally without them realizing they are even playing the game at all.

Question 14

If a White Hat researcher discovers a vulnerability in a software product, what should she do with the information?
A) Create a tutorial complete with screenshots and submit the finding to digg.com and slashdot.org
B) Call the vendor and offer to keep quiet if they pay you a finder's fee
C) Prove the exploit works, then sell a script on eBay
D) Report the vulnerability to a regional emergency response organization

Accepted Answer

Reporting vulnerabilities can be tricky. There is a fear of retribution for doing the research in the first place, there is the desire to be given recognition and credit, there might be financial incentives for using the exploit, and there is always leverage; trying to force the vendor to respond under threat of full disclosure. The question specified "Whitehat" and CERTs often provide a way to report vulnerabilities in a way that reduces risks to all parties as much as possible.

Question 15

Someone downloads a tool from the Internet and uses it to experiment with an idea she got from a YouTube video. Another exam you recently passed considers this unethical and inappropriate. A friend of yours just considers this person to be a "script kiddie." You have your own opinions, but what is the most defensive way to respond to this scenario?
A) Lecture the person about ethics and appropriate behavior. Make certain she realizes the trouble she is causing the industry as a whole.
B) Avoid insulting the person, enforce policy in a professional yet objective manner, and consider the idea that this person can be an asset if properly mentored.
C) Explain "Script kiddies are l00s3rs." And agree with your friend that if this l@m3r can't write her own buffer overflow shellcode then she isn't worth a slice of pizza.
D) Shrug your shoulders in indifference and get on with your day knowing your network is so secure that this person poses no possible threat.

Accepted Answer

Hopefully no further explanation is required here.

Question 16

What is the threshold for the amount of damage an organization must sustain before federal law enforcement will get involved?
A) $1,000
B) $5,000
C) $10,000
D) There is no lower limit

Accepted Answer

$5,000 is considered the threshold. Be aware of "Salami Attacks" which are those kept intentionally under the damage limit. It would be necessary to forensically prove a connection between the separate attacks through log files and other monitoring mechanisms.

Question 17

Which of the following statutes says that attempts to circumvent copy protection are illegal, regardless of how weak that protection might be?
A) Copyright and Patent Protection Act
B) Freedom of Information Act
C) Digital Millennium Copyright Act
D) It is not illegal; if a protection can be broken it is a right to break it

Accepted Answer

Demonstrating the intent to protect copyright is enough, and however weak that protection might be is no excuse for cracking it in the eyes of the courts.

Question 18

Which of the following statements are most true? (Choose two)
A) The law recognizes a difference between a computer being used in a crime and when a computer is the target of a crime
B) The Freedom of Information Act guarantees the fair use and exchange of all information materials
C) The law has definitive distinctions between what is "important" versus "unimportant" information
D) Penalties increase dramatically if human life has been put in danger

Accepted Answer

These are two important statements when interpreting legal matters when it comes to ethical hacking. Computers contain data which is often a valuable target. They can also be used as tools to disrupt other systems. In both cases when human life or rescue services are affected the penalties increase dramatically.

Question 19

If attackers experimenting with the latest botnet tool decided to seize control of some federal computers for the purposes of committing a fraud utilizing symbolic data such as credit card information they would be in violation of:
A) Computer Fraud and Abuse Act Section 1030
B) Federal Computer Breech Act of 1985
C) The Bush Cheney Act of 2006
D) Symbolic Data Protection Act of 2001

Accepted Answer

Section 1030 (a) (1) states in part: "having knowingly accessed a computer without authorization or exceeding authorized access…." Section 1030 (a) (2) (A) states in part: "information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);"

Question 20

You want to determine the web server and host operating system of a target. For legal reasons, you worry about getting caught. A passive recon technique that cannot be detected might be a good idea.
Which of the following choices holds the least risk of detection?
A) Use the netcraft website to look up the target's host
B) Use telnet to perform a banner grab
C) Use a common scanner in "paranoid mode"
D) Call them and ask

Accepted Answer

http://www.netcraft.com keeps track of the uptime and version information of Internet accessible webhosts. They send a periodic request to the server that will produce an error. The banner grab that results is collated into a searchable database.

Quiz 1: Ethical Hacking and Testing

our employer has asked you to perform an audit of the passwords for the user accounts for a particular server. What type of test have you been assigned?

Which of the following phrases is a derogatory term and would only invite retaliation?

Webhosting services often give free scripts to customers that pay for minimum level services. Occasionally there are security flaws in these scripts that are never fixed even though thousands of customers might be using them. This is an example of what type of threat category?

Neil is conducting security research on a popular software application and discovers a buffer overflow. He considers reporting his finding to the vendor but realizes the EULA (End User License Agreement) Forbids this kind of research. What should Neil do?

Which of the following represents the greatest danger to enterprise networks?

When he is finished footprinting the network the next step an attacker would take is:

Which of the following types of hosts are completely exposed to risk?

Which of the following types of hosts are placed on a network to attract the attention of a malicious attacker and allow the administrators to observe their actions?

Hosts can often be attacked in layers. If the target service is not vulnerable then what else should the attacker try? (Choose two)

Another way to describe risk is:

Which of the following is considered to be the most dangerous vector of security threats?

When attackers have gained and then maintained access to a system it is said they have installed a…

An attacker wants to make changes to a log file to clear his tracks. Instead of erasing the logs, he just makes changes to some of the entries. What is he trying to do?

If a White Hat researcher discovers a vulnerability in a software product, what should she do with the information?

What is the threshold for the amount of damage an organization must sustain before federal law enforcement will get involved?

Which of the following statutes says that attempts to circumvent copy protection are illegal, regardless of how weak that protection might be?

Which of the following statements are most true? (Choose two)

If attackers experimenting with the latest botnet tool decided to seize control of some federal computers for the purposes of committing a fraud utilizing symbolic data such as credit card information they would be in violation of:

You want to determine the web server and host operating system of a target. For legal reasons, you worry about getting caught. A passive recon technique that cannot be detected might be a good idea. Which of the following choices holds the least risk of detection?