Network Defense & Countermeasures Modules 5, 6, 8 & 9 Test

If an attacker decides to implement a less obvious port-scan, or stealth attack, which of the following techniques would be appropriate to make their activities more difficult to detect?

limit scan speeds

Attackers typically use ACK scans to get past a firewall or other filtering device. How does the process of an ACK scan work to determine whether or not a filtering device is in place?

A filtering device looks for the SYN packet, the first packet in the three-way handshake. If the attacked port returns an RST packet, the packet filter was fooled, or there's no packet-filtering device.

In an ACK scan, if the attacked port returns an RST packet, the attacked port is considered to be operating in what state?

unfiltered

When a TCP three-way handshake ends, both parties send what type of packet to end the connection?

FIN

What type of scan will attackers typically use to get past a firewall or other filtering device?

ACK

Some attackers want to be hidden from network devices or IDSs that recognize an inordinate amount of pings or packets being sent to their networks. Which of the following attacks are more difficult to detect?

stealth

Why is port scanning useful for hackers?

Port scanning helps hackers to answer questions about open ports and services by enabling them to quickly scan thousands of IP addresses.

A security professional is debating on whether to invest in Nessus Professional or utilize the free version of the software. Which of these is most important to determining which product to use?

The number of IP addresses they will be scanning

Why is it important for a security tester to be able to use Nmap?

Nmap is important for a security tester to be able to use for all of the reasons listed within the choices.

If using ping sweeps, which of the following should not be included?

Broadcast IP address

To ping sweep a range of IP addresses without using an input file, which command would you use?

fping -g BeginningIPAddress EndingIPAddress

Why is depending on ping sweeps to find out which hosts are live a problem?

A computer might not respond even though it is live.

In a Linux script, which of the lines is important because it identifies the file as a script?

#!/bin/sh

Which of the following describes a flexible program that automates a task that takes too much time to perform manually?

customized script

Why is it important for a security tester to understand and be able to create scripts?

Creating a customized script can be a time-saving solution.

What open-source port-scanning tool is considered to be the standard port-scanning tool for security professionals?

NMap

Which of the following would be a good candidate for a script?

a set of commands repeatedly used to perform the same task

One of the limitations when using "ping sweeps" is that many network administrators configure nodes not to respond to ICMP Echo Requests. What type of ICMP Echo message is being disabled by these administrators?

reply

In any *nix system, after saving a script named "script_name," it must be made executable so that it can be run. Which command will accomplish this task from the command line?

chmod +x script_name

When using the text editor vim, what command appends text after the insertion point?

A

Nmap has a GUI front end that makes it easier to work with some of the complex options. Which of the following is the Nmap GUI front end?

Zenmap

What network security tool, usually included with Kali Linux, allows a user to ping multiple IP addresses?

Fping

What open-source network utility allows you to use plug-ins to run test programs (scripts) that can be selected from the client interface?

OpenVAS

During a NULL scan, no packet is received as a response. What is the most likely cause of no packet receipt?

The port is open.

Which of the following best describes enumeration?

Enumeration is the process of accessing and extracting information from a network.

Boasting "groundbreaking malware resistance," Windows 8.1 comes with features that make user-level infection much less dangerous. What security feature was extended to the OS to alert the user when an application is launched on a Windows 8.1 computer?

SmartScreen

Which Windows 10 feature uses virtualization to protect access tokens from theft by attackers?

Credential Guard

What knowledge is helpful in the enumeration process?

Knowledge of operating systems and how they store information.

Which tool is most useful for *nix enumeration?

All of these tools can be used for *nix enumeration.

If you do not have access to Nessus, what NMap procedure can be used to help you to gain information about remote *nix hosts?

script scanning

A quick Internet search will reveal many free password-cracking programs. Why are security testers often able to guess passwords without needing these special programs?

Some users are careless when creating passwords.

Which of the following statements is false regarding enumeration?

Enumeration is performed using the dig command.

A security tester needs to extract usernames or groups assigned on the network along with information about users and recent logon times. What process will allow the security tester to accomplish this?

Enumeration

What feature implemented in Windows 8.1 prevents the execution of non-trusted boot content, preventing rootkits?

SecureBoot

To determine what resources or shares are on a network, security testers must use port scanning and what other procedure first to determine what OS is being used?

footprinting

What utility can be used for enumerating Windows OS's?

NBTscan

A security tester needs to extract information from a network. What information cannot be gathered using enumeration?

purchasing habits of all users on the network

SNMPWalk is a tool useful in enumerating hosts running SNMP with what type of configuration?

default

Windows Server 2012 introduced what protection feature to prevent pass-the-hash attacks?

Authentication Silos

Which of the following is not a best practice in regards to password policies?

Common words

Which of the following is an open-source implementation of CIFS?

Samba

What does a Windows environment use to locate resources in a domain containing thousands or even millions of objects?

GC

For a Windows computer to be able to access a *nix resource, which of the following must be enabled on both systems?

CIFS

Which of the following commands should an attacker use to enumerate anonymous SMB access?

Net view

How should a security analyst review system generated events for signs of intrusion or other problems on the network?

Log monitoring tool

What is the current file system that Windows utilizes that has strong security features?

NTFS

Which of the following is an SELinux OS security mechanism that enforces access rules based on privileges for interactions between processes, files, and users?

Mandatory Access Control

Which standardized remote file system protocol replaced SMB in Windows 2000 Server and later?

Common Internet File System

A systems administrator is trying to harden an externally facing DNS server and wants to disable every port except for DNS. Which port should they leave open?

53 UDP

What critical component of any OS, that can be vulnerable to attacks, is used to store and manage information?

File system

Which of the following Windows utilities includes a suite of tools to help administrators deploy and manage servers and even allows for administrators to control mobile devices running Android, iOS, and Windows Mobile OS?

SCCM

A penetration tester is trying to authenticate a user account which contains most of the information that attackers want to access. Which of the following should they target?

Domain controllers

A Linux Security administrator wants to use a built in tool to implement an OS security mechanism that enforces access rules based on privileges for interactions between processes, files, and users.

SELinux

Which of the following is considered to be the most critical SQL vulnerability?

Null SA password

A security analyst is reviewing assembly code in memory. Early Windows OSs used which of the following programs to interact with a network resource or device?

NetBIOS

Red Hat and Fedora Linux use what command to update and manage their RPM packages?

yum

A security analyst suspects that a machine was recently compromised after a user has been navigating to several suspicious sites. What tool could the administrator use to find files that were downloaded from the internet?

dir /r

A user is looking at SMB traffic which is used to share files and usually runs on top of NetBIOS, NetBEUI, or which of the following?

TCP/IP

Which of the following is a function of a trojan?

Remote administration

A vulnerability manager is trying to get a Linux team manager's buy in for patching systems. They know that if they can convince the manager of the importance, there will not be nearly as much pushback. They want to demonstrate exploiting a server, so they make a copy of one of the server images and put it on a standalone instance for demonstration. Where could they look for active exploits?

Exploit-db.com

Which of the following is an interprocess communication mechanism that allows a program running on one host to run code on a remote host?

RPC

A Linux administrator wants to share files between Windows and Linux servers. What protocol should they use?

Samba

What programming languages are most susceptible to buffer overflow attacks?

C and C++

A user is analyzing their network for devices using embedded systems and is trying to find vulnerabilities associated with those devices. Where on the NVD should they look?

CVE

A device that performs more than one function, such as printing and faxing is called which of the following?

MFD

An IT technician downloaded dd-wrt to experiment with embedded Linux operating systems. What major worm was this previously subjected to?

psyb0t

If you are concerned about the attack surface a system presents, what type of embedded OS configuration would you NOT use?

Multiple embedded

Embedded Linux is an example of which type of operating system?

Monolithic

Which of the following is a software flaw that would cause billions of embedded systems to suddenly stop or fail when the clock struck midnight on the eve of the past millennium?

Y2K

Which of the following is usually considered the biggest security threat to an organization?

Employees

What is the most common motivator behind today's cyber security attacks?

Money

Which malware targeted medical systems due to the problems with patching?

Conficker

Originally, which of the following was used to perform routing and switching before specialized hardware was developed?

General purpose computers

Rootkits that pose the biggest threat to any OS are those that infect what part of the targeted device?

firmware

What open-source embedded OS is found in many space systems because it supports processors designed specifically to operate in space?

RTEMS

Which of the following is a specialized type of embedded OS that is typically used in devices such as programmable thermostats, appliance controls, and even spacecraft?

RTOS

An attacker masquerades as a support technician in order to replace keyboards with key logging keyboards. What technique are they employing?

Social engineering

What type of embedded OS is certified to run multiple levels of classification, such as unclassified, secret, and top secret, on the same CPU without leakage between levels?

MILS