Question 1

You are researching an adversary and are certain that you saw some incriminating information on their website about six months ago, but it isn't there now. What resource below might be the quickest way to check for this data?

Accepted Answer

The site at http://www.archive.org has a feature called "The Wayback Machine" that archives old version of websites.

Question 2

Which of the following statements is the most correct about the DMCA?

Accepted Answer

The "Digital Millennium Copyright" Act does allow exemptions when an access of the properly purchased technology affects access during a non-infringing act.

Question 3

Hayley decides to circumvent the copy protection laws by taking an entire movie she recorded on her cell phone in the theatre and appending it with an insightful review and claims this is journalism and free speech. She still gets sued and loses. Why?

Accepted Answer

The "Fair Use Doctrine" has been challenged on many occasions. The best bet for low risk is to understand that while it is okay to cite sources and then comment on them, the less used is better.

Question 4

Which of the following protects the rights of individuals in regard to the disclosing of information? (Choose two)

Accepted Answer

The Privacy Act of 1974 prevents the disclosure of personal records without written consent for census data. The Human Rights Act of 1998 discusses the privacy rights of an individual, such as the drivers of cars not having to reveal their identity in a photograph.

Question 5

"Port scanning" is considered what form of attack?

Accepted Answer

Port scanning might be considered an attack by internal policy standards, but this could be different in other countries than the USA.

Question 6

In the United States, attacks on financial institutions are handled by:

Accepted Answer

The secret service does more than most people think, but it this is a secret. (Shhhh). The GLBA deals with the handling of financial information.

Question 7

"Periodic assessments of the risk and magnitude of the harm that could result from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency;"
Which act mandates a security program be implemented in a Federal agency that meets the above criteria?

Accepted Answer

FISMA (Federal Information Security Management Act) drives a lot of United States federal requirements.Directive 8570 drives proper training and certification requirements for individuals as a part of FISMA.

Question 8

Which of the following statements describes a provision of FERPA?

Accepted Answer

FERPA is the "Family Educational Rights and Privacy Act."

Question 9

Which of the following acts of the UK parliamant make it illegal to modify the contents of a computer with the intent to impair its operation?

Accepted Answer

The Computer Fraud and Abuse Act of 1990 also criminalizes unauthorized access with the intent to use the computer to commit a crime.

Question 10

Which of the following (choose two) acts were meant to protect the illegal use of computers by unauthorized parties, but many argue that they in fact had the opposite effect? The laws could enable unsolicited email and usage monitoring.

Accepted Answer

Critics argue The CAN-SPAM act does not require advertisers to get permission before sending the UCE (Unsolicited Commercial Email), and that it provides a legal definition for what is not SPAM exactly, thus enabling the sending of UCE if the advertisers go about it the right way. The SPY Act tries to prevent computers from being used as spam spreaders, but gives specific protection to vendors that install software that monitors usage for license enforcement. With not much creativity, it can be imagined how Trojans can be created that are now legally protected, as long as they go about things in just a certain way.

Question 11

During a pentest, you retrieve a USB key from a box of discarded hardware that was just sitting by a number of other items. You check the key for files and it turns out to have a number of .pdf documents that could have sensitive information. If this information were to get leaked it would be a great risk to your client. In your report you point this out but the customer doesn't see the problem as all of the documents were password protected.
Why isn't this enough to prevent the information leakage?

Accepted Answer

The password must be stored in the file, but a strong key can be generated from it to protect the data from being visible to alternative readers. It is possible however, to brute force the file and tools such as those from "Elcomsoft" make short work of most file formats.

Question 12

A business manager is arguing with a compliance officer that a pentest would never be necessary for this company since they use single sign on authentication throughout. You are asked for your opinion, and say "IF I can access a network physically I can own it". This sounds a little extreme, but what is not true about this assertion?

Accepted Answer

If packets can be sent and received there are countless forms of attack that can be attempted. This is true regardless of the type of network, wired or wireless.

Question 13

During an internal pentest, you setup a fake website and that offers some documentation and useful resources. You create a link and send it via email to a few key people. When they visit, code is run on their own machines that compromise their systems.
What form of attack is not taking place?

Accepted Answer

The key words in this attack are "runs code on their own machines". The pentester created a website with deliberate Vulnerabilites then placed the attack in the URL. There could also be the downloading of images or media that exploits the browser. By now, the tester likely knows the version of browsers being used in the environment. SQL Injection works against the web application.

Question 14

During a pentest, you notice the organization uses different domains for various internal departments. What phase of the test would this have been discovered?

Accepted Answer

Project scoping and rules of engagement happen before the test actually begins. The vulnerability analysis comes later in the test, after as much information has been gathered as possible.

Question 15

Systems that have default configurations are common targets during a pentest. Which of the following is not a default configuration?

Accepted Answer

There are many reasons hosts are used in a production network with default configurations. Lack of training and being distracted by too many projects are common reasons along with not having a configuration standard that is part of an appropriate risk management, incident response, and disaster recovery management program.

Question 16

Milo is trying to learn all he can about a network. He is looking for easy things he can do that might reveal information. Eventually, he can collect all of that data and after analysis learn perhaps enough to have a complete picture. One technique is to send email to email addresses with different status such as; valid users, non-existent addresses, users on vacation, employees that are no longer there, and commonly named email groups.
What would be a reason for doing this?

Accepted Answer

Sending email to non-existent addresses might reveal addresses of internal mail relays, but it also tells the attacker about policies for handling such mail including how to handle, bounces, full in-boxes, vacations, ex-employees, undeliverable, and of course spam.

Question 17

Gary is using an email system that allows web based access and is popular among employees of the company he is attacking. He is testing this system to see if there is a way to gain access to other users accounts. He signs up for an account and begins to use it. He notices in the URL that information about his account name is present:
Http://mail.exampleco.com/inbox.aspx?lang=en&mailbox=Gary+Tennenbaum
He replaces his name with someone else's name in the target company that he gathered from a job posting site. What attack is he attempting?

Accepted Answer

If the system authenticated the client via the browser, then changing the name being passed to the account might allow the attacker to assume the identity of the target account. If the parameters are not in the query string, they could be in the http header and Paros could be used to change and resubmit them. Instead of something simple like names, session ID values are commonly used in these attacks.

Question 18

Maureen returns from lunch and notices her PC has a BSOD but the hard drive activity light is still flashing. What tool is possibly being used?

Accepted Answer

Floppyscan is a tool that can be configured to automatically footprint a network and email the results to a predetermined address. While it is scanning, it presents the BSOD so that the computer looks busy.

Question 19

You are conducting a test and got caught. What document will ensure that you are protected from negative consequences within the target company?

Accepted Answer

Make sure the person that issues this document actually has the authority to do so. The penetration test should be sponsored by senior management; who should also issue the other legal documents as well.

Question 20

Dave wants to steal the contact database from a rival sales person. He calls his rival's secretary and pretends to be from the IT department. He says "The sales tracking system just crashed, at least we think. We are hopeful that we saved everyone's data, but we need Mr. Shivers username and password
In order to log in and check."
What type of attack is Dave conducting?

Accepted Answer

Spoofing is a temporary situation. IP address, sources of email, usernames, and in this case, a person can easily be spoofed in a packet or phone call. The attacker can distance himself from the act immediately afterwards. Identity theft or faking is more long term and invlolves actively assuming the identity of the victim for a period of time.

Quiz 1: Ethical Hacking and Testing