test
Mechanical hard drives are faster than solid state drives.
True
False **
The fastest USB standard is...
USB 1
USB 2
USB 3
USB 3.1 **
The smallest motherboard size covered in the course is:
micro-ATX
mini-ITX **
nano-ATX
Modern CPUs contain at least two processing cores.
True
False**
RAM stands for Random Access Memory.
True**
False
The GPU is essential to the effective running of the CPU.
True
False**
Heat sinks are usually attached to a component using thumb screws.
True
False**
The power supply usually connects to the motherboard, the graphics card(s), the hard drive(s) and the fans.
True**
False
There are 1000 GiB in a TiB.
True
False** 1024 GiB in a TiB**
The number '7' in ASCII is which hexadecimal value?
37**
41
55
Changing the file extension doesn't change the contents of a file.
True**
False
The notation 0h is for hexadecimal numbers.
True
False** 0x is hexadecimal
The maximum value of an ASCII character is 255 in denary.
True** One ASCII character fits in one byte, so the maximum value is (2^8) - 1 or 255. We subtract 1 because we start counting from 0.
False
A file extension is a file header.
True
False** A file extension is an identifier specified as a suffix to the name of a computer file.
A bit is a 'boolean'.
True** A bit is either on or off, so it is a boolean value.
False
In the example: 10^4, the 4 is the exponent.
True**
False
0 AND 1 is...
0 ** The two inputs must be true (1) for the output to be true.
1
0 OR 1 is...
0
1 **
NOT 0 is...
0
1 **
1 NAND 0 is...
0
1 **
0 NOR 1 is...
0**
1
1 XOR 1 is...
0 **
1
A 1kb file stored on a drive with a 32kb cluster size takes up 1kb.
True
False **
Drives formatted as exFAT may not be compatible with Windows 95.
True**
False
The EXT4 file system supports faster disk checking.
True**
False
A cluster is the smallest section of the disk that can be used to store a file.
True**
False
The FAT32 file system supports file permissions.
True
False**
If a file is deleted, then the data remains behind and is marked as overwriteable instead.
True**
False
Salesforce, ZenDesk and Slack are all examples of which type of service model?
SaaS**
IaaS
PaaS
PaaS involves someone else hosting the physical hardware for you, so that you can build what you need on top of it, with full responsibility for all the configuration.
True
False **
SaaS is the only cloud-based service model that means others will manage your application data for you.
True **
False
With IaaS, if you want to increase your bandwidth or storage capacity, you have to commit to the increase for a minimum time period.
True
False **
PaaS providers are more typically focused towards developers than those wanting support with application management.
True **
False
A process gets executed by the processor.
True **
False
Software interrupts ask the kernel to perform tasks on the program's behalf.
True **
False
Which of these is the most common operating system in use today?
Windows **
Mac OS
Linux
A program can create more than one process.
True**
False
Why are bootloaders required?
The BIOS is not capable of loading other programs.
A BIOS that could load many operating systems would be too complex.***
The BIOS is responsible for loading the bootloader.
True**
False
An operating system manages shared resources.
True**
False
The kernel is the last part of the operating system code to be loaded.
True
False**
Kernel code is executed when you plug in a USB device.
True**
False
UEFI is the successor of BIOS.
True**
False
When is an interrupt required?
When something needs processing at a later time.
When immediate processing is required.***
The BIOS is stored on the hard drive.
True
False**
Virtualization is used extensively in cloud hosting providers.
True**
False
A Type 1 hypervisor controls access to the physical hardware of the computer the virtual machines run on.
True**
False
The hardware resources of the physical computer are shared by the virtual machines running on it.
True**
False
Virtualization can allow you to run programs that were designed for a different operating system altogether.
True**
False
The host operating system is the operating system running inside the virtual machine.
True
False**
Type 2 Hypervisors are most commonly used by people on personal computers.
True**
False
Snapshots taken when a virtual machine is powered off are typically smaller than when powered on.
True***
False
A VMware virtual machine defaults to allocating every byte of the virtual disk as real storage to make sure it is available in the future. This is mostly zeros, like carving out space it will use.
True
False**
The dock only shows bookmarked applications.
True
False**
The tilde character (~) is shorthand for the root of the file system in Linux.
True
False**
The system tray can show you system notifications.
True**
False
The Linux terminal is the most powerful way to use Linux.
True**
False
The kernel is the core of any operating system.
True**
False
The terminal runs another program when you open it.
True**
False
The root user is allowed to delete the entire file system.
True**
False
The 'cd' command always requires the full path.
True
False**
The permissions '512' can be written as: -'r-x--x-w-'.
True**
False
In Linux, a file is designated as hidden by the file permissions.
True
False**
The home folder for 'root' is in '/home/root'.
True
False**
The sequence '..' stands for the current directory.
True
False**
The 'l' parameter for the 'ls' command allows us to see file and folder permissions.
True**
False
Environment variables persist over a reboot.
True
False**
Every piece of hardware connected to the system is listed as a file in '/dev'.
True**
False
The PATH environment variable contains a list of folders for the terminal to find programs in, to avoid you having to type the full path to each program.
True**
False
After using 'sudo' the user must enter the root password.
True
False**
The 'ls -l' command will show hidden files.
True
False**
The second set of permissions listed is for the group permissions.
True**
False
After using reverse command search, you can go backwards through previous matches that meet the search criteria with the arrow keys.
True
False**
To autocomplete paths and program names in the terminal, you must press tab twice.
True
False**
CTRL + L and 'clear' both clear the terminal.
True**
False
If the terminal refuses to complete a path, the only possible reason is because it doesn't exist.
True
False***
The command 'history -c' is enough to completely clear the history file.
True
False**
A single dash - usually means the parameter is a full word, while a double dash -- usually means the parameter is a letter.
True
False**
CTRL + Z is used to...
Pause a running process.***
Send a running process to the background.
Bring a background process to the foreground.
It is possible to search back through previously typed commands with CTRL + R.
True***
False
It is possible to search back through previously typed commands with CTRL + R.
True
False**
The 'rm' command can delete folders without any additional parameters.
True
False**
The 'cp' command can be used to copy folders without any parameters.
True
False**
With 'mkdir', the 'm' parameter is used to make multiple directories at once.
True
False**
The 'less' command must be quit by pressing...
END
ESC
Q***
The 'find' command can only be used to find files with a specific filename.
True
False***
The 'mv' command can be used to move folders without any parameters.
True***
False
The 'cat' command is only used for printing the contents of a single file.
True
False**
The 'file' command uses the file extension to determine the type of a file.
True
False**
The 'strings' command will only ever print valid strings.
True
False**
The commands :x and :wq do the same thing in 'vim'.
True**
False
If you run 'which' against a command and nothing comes up, it is likely the program is not in your PATH.
True**
False
The 'nano' text editor shows you the hotkeys that work in the program.
True**
False
To exit 'vim' you must first exit insert mode.
True**
False
The grep command needs to be combined with 'cat' to search the contents of a file.
True
False**
When you start 'vim', before you can type you must first enter insert mode by pressing...
CTRL + C
ESC
CTRL + I
I **
An 'ELF' file is a type of executable file.
True**
False
The 'wget' command is used to download files over HTTP/S.
True**
False
The 'apropos' command is a tool that searches through manual pages for keywords.
True**
False
Packages can be installed using 'rpm' with rpm -i package.rpm.
True**
False
dpkg does not handle dependencies like 'apt' does.
True**
False
The command 'apt update' upgrades all packages on the system.
True
False**
There are two types of redirects; one overwrites an existing file, and one appends to an existing file.
True**
False
The 'apt' package manager is installed on every Linux system.
True
False**
The 'ps' command allows parameters without a '-' prefix.
True**
False
SSH always requires you to enter a password before logging you in.
True
False**
The only way to access the calculator in Google is to type the keyword 'calc' in the search box.
True
False**
The 'filetype' keyword is valid in Google.
True**
False
A Google dork is someone who works at Google.
True
False**
Google understands the context of a query formed as a sentence.
True
False**
Google works by following links from one website to another.
True***
False
A wildcard operator will not match specific formations of words.
True
False**
Putting quotes around a phrase will cause Google to search for that exact phrase in that specific order.
True**
False
A HEAD request is another way of retrieving the contents of a web page.
True
False**
It's easy for a user to tamper with PHP code running on a website, so it is best not to trust it.
True
False**
These days it is common to implement a custom web server using a programming language framework.
True**
False
Cookies are often used to track people across multiple sites by advertising networks.
True**
False
JavaScript is never seen by the user.
True
False**
HTML is a dynamic programming language.
True
False**
A PUT request is used to create files on a web server (where authorised).
True**
False
Port 443 is normally used for unencrypted HTTP traffic.
True
False**
The most commonly used network topology in a LAN is the star topology.
True**
False
Two NICs on a network can share the same MAC address without issue.
True
False**
Switches are less secure than hubs.
True
False**
The TCP port range conflicts with the port range of other protocols.
True
False**
The colour of an Ethernet cable indicates its maximum speed.
True
False**
A MAC address is guaranteed to be globally unique.
True
False**
Both the TCP and UDP protocols have 65536 ports.
True**
False
Multiple computers may share a public IP address.
True**
False
A packet will commonly include a destination IP address.
True**
False
UDP does not require retransmission of a missing or corrupt data packet.
True**
False
A private IP address cannot be used by two computers on a network at the same time.
True**
False
TCP is one of the least-used protocols in existence nowadays.
True
False**
Computers cannot understand each other without both knowing appropriate protocols.
True**
False
Hubs send data to specific computers on the network.
True
False**
A protocol is a set of rules that must be adhered to during communication.
True**
False
Information about the data is stored in the packet headers.
True**
False
The acknowledgement number in a TCP connection always increments by 1.
True
False **
A graceful TCP teardown ends with an RST packet.
True
False**
An IPv6 address is 64 bits long.
True
False** It is 128bits long
The loopback address on IPv4 is 127.0.0.1.
True***
False
The sequence number in a UDP connection starts at 1.
True
False**
NAT allows many computers to share the same public IP address.
True**
False
In CIDR, the number after the '/' at the end of an IP address is the number of bits for the host identifier.
True
False**
The RCPT command prepares the SMTP server to receive an email.
True
False**
The SMTP protocol does not handle authentication.
True**
False
SPF uses cryptographic principles to authenticate a sending server as a valid email server for a particular domain.
True
False**
An IMAP server allows the syncing of multiple devices to the same email account.
True**
False
A webmail client allows you to view your inbox through a website.
True**
False
The SMTP protocol can be used to send and receive email.
True**
False
SPF records are just DNS TXT Records.
True***
False
A reverse lookup transforms an IP address into a domain name.
True**
False
A recursive lookup relies on a DNS server to make each request in turn until it finds the answer and returns it to the client that requested the information.
True**
False
An 'A' record maps a domain name to an IPv6 address.
True
False***
As soon as a DNS record is updated, all clients will use the new value.
True
False**
The TLD server is the DNS server that is authoritative for a domain.
True
False**
DNS is responsible for translating domain names to IP addresses.
True**
False
The DHCP protocol makes it easy to connect systems to a network without having to configure networking each time.
True**
False
HTTP is an example of a transport layer protocol.
True
False**
The TCP/IP model covers the same features as the OSI model, it's just certain features have been combined into one layer.
True**
False
On a local network, the only thing that is important in communicating is the IP address.
True
False**
An ICMP Packet of Type 0 and Code 0 is an ICMP Echo Request (ping packet).
True
False**
At the physical layer, data is converted into electrical signals and transmitted.
True***
False
The Ethernet frame includes a footer.
True**
False
On receiving a packet, the IP header is removed from the packet first.
True
False**
You can use Apache to configure a web server.
True**
False
Nginx comes with a large amount of pre-set functionality by default.
True
False**
When configuring a web server using a remote system, you can lose access if you make a mistake in configuration.
True**
False
Nginx uses PHP FHM to be able to run server-side code and PHP.
True
False**
With a web server, you can have multiple sites running on the same system.
True**
False
An index.html page cannot be set up without any content.
True
False**
It doesn't matter if attackers stumble across a default configuration page.
True
False**
Certbot can manage the automatic renewal of security certificates for you without needing authorisation each time.
True**
False
The first database server was created around the same time as the first web server.
True
False***
Codd's Relational Model for database management from the 1970s is still used by most databases today.
True***
False
The MySQL installation gives you the option to set up an anonymous user, that can log on without having a user account, for testing purposes.
True
False***
The principle of least privilege should be applied when setting user permissions for a database server.
True**
False
The MySQL client can be told to connect to remote systems with -r.
True
False**
You can generically reduce the attack surface area on your server if you don't need to enable remote logins.
True**
False
The mysql history file could expose credentials or configuration to users of the system, compromising security.
True**
False
It is best practice to have your MySQL database running as the root user.
True
False**
DNS acts as a translation service between humans and computers.
True**
False
There are 3 types of DNS server in a typical DNS lookup.
True
False** there are 4 types
TLD stands for top line domain.
True
False**
There are 15 root servers distributed strategically around the world.
True
False**
The authoritative nameserver will retrieve the specific IP address of the origin server for the provided web domain name.
True**
False
After a particular DNS query is made, the resolver will store the origin server's IP address in its cache for a certain time period.
True**
False
Missing patches are one of the most common root causes of compromise.
True**
False
Storing log files on the local system where they are generated is likely more tamper resistant to attackers.
True
False**
LaaS platforms are best defined as which of the following?
Logging as a Service***
Last automated assessment service
Log and Analysis System
Log Anonomaly Analysis Service
Logging servers can only handle hundreds of log events per second by default, but that is enough.
True
False**
Rsyslog will receive all severity messages, you can filter by time and hostname only, not whether the message was a debug or critical message.
True
False**
Rsyslog stores the data files under /var/log and there is no alternative way to store structured log data.
True
False**
The $template is the most modern way to declare a template in the Rsyslog configuration.
True
False**
SMTP stands for Single Mail Transfer Protocol.
True
False**
When the SMTP server processes the email address of the recipient, a key consideration is whether or not the recipient address is on the same domain as that of the sender.
True**
False
To find the recipient's e-mail server, the sender's SMTP server uses DNS.
True**
False
The only way to control your e-mail policies in depth is to run your own e-mail server on premise at your business.
True
False**
When sending SMTP you must send the RCPT TO command before the MAIL FROM according to the standard.
True
False**
SMTP, even today just trusts whatever you tell it. There are no configurations, enhancements or features that can enable verification. Connect and say you are superexec@sans.org and there is no way for the server to know.
True
False**
Postfix can operate in a variety of modes, configured to work locally only or across the network, or Internet.
True**
False
main.cf is the primary Postfix configuration file where you can configure the SMTP banner.
True**
False
The default port of SMTP is which of the following?
110
25***
143
925
Processors can directly understand programming languages.
True
False**
Programs written for Python 3 are guaranteed to work in Python 2.
True
False***
Many high-level programming languages are written in C.
True***
False
High-level programming languages remove a lot of the complexity found in low-level programming languages.
True***
False
Every variable has a type, even in dynamically typed languages.
True**
False
A program that has been compiled is faster to execute than a computer program that has to be interpreted.
True**
False
The name of the variable will shift depending on its contents.
True
False*****
In all cases a char, int and double will have consistent sizes. This applies whichever architecture or system you are compiling on.
True
False**
sizeof() will print the size of a variable based on its type, not the size of bits of data stored within it.
True**
False
A float and a double typically can store the same number of precision points after the decimal point in a number. They can be used interchangeably.
True
False**
puts() and printf() are just aliases for one another. They can both just print text and have identical capabilities.
True
False***
printf() when using the %d format specifier will print the ASCII string text of a passed variable.
True
False**
gcc -o hello hello.c will always use the same compiler options on different systems.
True
False***
The -m32 flag to gcc enables compiling a 32-bit binary on a 64-bit system.
True***
False
int addStuff() {} declares a function. The expected return type of this function is
Functions do not have return types
An integer****
A function pointer
A char array
printf() when using %s will print a string. It knows when to terminate printing based on:
The size of the type presented.
It will enumerate and prints bytes until a NULL terminator.****
It will print values that are in the ASCII char range only.
When assigning a string a length is stored as str.len that can be used to know the output size.
In C */ indicates the start of a multi-line code comment. True or false?
True
False**
The following is correct syntax: else (x > 10) {
True
False**
In the case of the following loop, how many times does the loop execute? for (x = 2; x < 20; x += 3)
4
5
6***
7
True or false, to change the fourth character in a string in C the following syntax would be correct: text[4] = 'A';
True
False**
True or false, the following is generally an unsafe method of accepting user input: scanf("%s", &data);
True**
False
The first command line argument in a C program is the name of the program. True or false?
True***
False
When a variable is passed into a function, what is passed into the function is not the variable itself but a copy of the variable at the time the function is called.
True**
False
If you don't know how much data you need to store at compile time it is best to allocate memory on the stack to store it. True or false?
True
False**
The data in non-relational databases is structured, just like relational databases.
True
False**
The 'WHERE' SQL command is used to filter data that meet certain criteria.
True**
False
To select all data from a table, use the wild card character '!', exclamation point
True
False**
When using the AS command, the renaming of the field is permanent
True
False**
When using the SELECT command, data is returned in alphabetical order
True
False**
To combine results from two or more table queries, you would use the JOIN clause?
True****
False
To retrieve rows that meet defined conditions in 2 tables, use the INNER JOIN command
True**
False
a LEFT JOIN includes matching results from the first table and all results from the second table
True
False**
The first table in a LEFT JOIN will always have all of its records returned in the query no matter what the condition of the join is
True***
False
The first table to be joined is mentioned in the INNER JOIN clause.
True
False**
Operators UNION, IN, LIKE and SOME are examples of Comparison operators
True
False**
When you execute a query that contains a subquery, the subquery is evaluated at the same time as the query
True
False**
The EXISTS operator checks for the existence of records in a subquery before the subquery is evaluated
True
False**
The UNION operator is used to emulate a FULL JOIN, not supported by MySQL
True**
False
The CONSTRAINTS operator is used to define rules for a field in a table
True
False**
Scripting table creation must be done with a scripting language like Python
True
False**
Database fields do not have to have a defined datatype, like they do in programming
True
False***
The default NULL constraint means that if no value is entered into this field for a row then the value defaults to an empty field.
True
False**
Windows Firewall will always ask you for permission to let a program access the internet, even if you previously allowed that program to access the internet in the past.
True
False**
The Windows registry only contains settings that are accessible through the preferences program in Windows.
True
False**
Windows Defender will stay off if you turn it off without any other antivirus product installed.
True
False**
Windows Server can be run without a Graphical User Interface.
True**
False
A Windows log entry will show what username created the entry, if applicable.
True**
False
Active Directory allows administrators to configure settings on Windows desktops that are connected to a Windows server.
True**
False
DHCP is used to automatically configure network settings.
True**
False
All users must enter their password when a UAC prompt is displayed.
True
False**
How many account types are available on Windows 10?
2
3***
5
You can only set permissions for a group.
True
False**
To display hidden files, you must change an option in the Explorer settings.
True**
False
You can set UAC to one of five levels.
True
False**
The Guest account has its data deleted upon log out.
True**
False
The Administrator account is enabled by default.
True
False**
Setting a permission to deny will always override an allow.
True**
False
To mount a network drive from the command line, you can use the 'net use' command.
True**
False
The 'where' command is roughly equivalent to the 'which' command on Linux.
True**
False
The only way to change to a different drive letter is using 'cd'.
True
False**
The command to add a user is 'net user add <username> <password>'
True
False**
On Windows, the 'cp' command is used to copy files.
True
False**
A Windows command prompt runs with administrative privileges by default.
True
False**
The PowerShell ISE stands for Integrated Scripting Engine.
True
False**
You can use '-?' to list the help file for a cmdlet.
True**
False
A PowerShell Cmdlet is not a program that can be accessed outside of PowerShell.
True**
False
The 'rm' command is an alias for the cmdlet 'Remove-Item'.
True**
False
PowerShell variables are declared using the '#' symbol.
True
False**
PowerShell cmdlets return objects rather than simple strings.
True***
False
Instructions and data are clearly delineated in RAM.
True
False**
In ASCII encoding, 2 bytes make up one character.
True
False**
The control unit directs electrical signals around the computer.
True**
False
A stack frame is unique to every function of a running program.
True**
False
It is faster to access RAM than a memory register.
True
False**
The 'AL' register is the higher 8 bits of the 'AX' register.
True
False**
The 'fetch - decode - execute' cycle consists of three steps.
True
False**
The 'ret' instruction loads the return pointer from the bottom of the current stack frame.
True**
False
The logic unit is used to compare data.
True**
False
You need to manually install GDB, the GNU Debugger, before using it on Linux.
True
False**
A breakpoint is a marker that will tell GDB to pause the program when it reaches that point.
True**
False
fgets is a standard C library function for receiving user input from the command line.
True**
False
The use of 'next' will step over function calls.
True**
False
The strcmp function is a C library function used to search for a given character in a string.
True
False**
An ellipsis after examining a memory address as a string indicates the string hasn't been displayed fully.
True**
False
Once GDB is open, you should first run the program, then run 'info func'.
True
False**
RAID is an acronym, which stands for Reactive Array of Independent Disks
True
False**
RAID 0, known as 'striping', is optimised for performance and maximises read/write speed.
True**
False
With RAID 1, if a drive fails, the data is lost.
True
False**
RAID 10 is a combination of RAID 4 and RAID 6.
True
False**
"Striping with parity" requires at least three drives to function.
True**
False
The main disadvantage of mirroring is slow processing speed.
True
False**
In file based storage, data is retrieved by knowing the path to the file.
True**
False
In block storage, data is split up into blocks of various sizes, each of which is assigned a unique identifier.
True
False**
There is no concept of hierarchy in object storage.
True**
False
Docker is designed to containerize a whole operating system.
True
False**
A major advantage to using a container over a virtual machine is how lean it can be.
True**
False
Containers pose a lower security risk than traditional virtualization.
True
False**
You can easily edit the code in a Docker image.
True
False**
You can use containers and virtualization stacked on top of each other.
True**
False
The Docker client is the server that runs in the background, helping us build Docker containers from their images.
True
False**
Version control is implicit in containers, and does not need to be configured explicitly.
True**
False
The hello-world container is maintained by Docker.
True**
False
Symmetric encryption is faster than other forms of encryption.
True**
False
The green lock symbol means the website is secure.
True
False**
Anyone can read encoded data so long as they know the method.
True**
False
DES has an effective key length of 56 bits.
True**
False
Encoding and encryption are the same.
True
False**
Asymmetric encryption is slower than symmetric encryption.
True**
False
If you want to send someone a message using asymmetric encryption, you must know their private key.
True
False**
In HTTPS we initially use symmetric encryption before swapping over to asymmetric encryption.
True
False**
In a Caesar Cipher, if the plaintext is "Hello, World" and the ciphertext is "Spwwz, Hzcwo" then the key is:
2
9
11***
13
It is a bad sign if an encryption algorithm has not published its mathematical formula.
True**
False
Two different pieces of data, when hashed, should not come out to the same hash.
True**
False
It is good practice to store passwords in plaintext in online login systems.
True
False**
The -base64 argument is used to encrypt data with OpenSSL.
True
False**
If something has very poor or no security, but it is clear you shouldn't be there, you are not breaking the law.
True
False**
If you are on a penetration test then you have free reign to target any system on the company network.
True
False**
There are plenty of free places to find legal resources for training on the internet.
True**
False
Your actions, no matter how benign the intentions, could affect thousands of users who use a particular service.
True**
False
Companies are no longer as embarrassed to report cybercrime.
True**
False
The red team is the defending team.
True
False**
A 'Defence in Depth' approach focuses on hardening the outer perimeter of the network.
True
False**
It is important for an attacker to gain an understanding of the target.
True**
False
Integrity is where access to systems is only shared amongst authorised persons or organisations.
True
False**
In a 'Defence in Depth' approach to cyber security, the weakest option is to secure all parts of the system equally.
True**
False
A form of initial exploitation is simply tricking someone.
True**
False
You need to run 'updatedb' before using the 'find' command.
True
False**
Wordlists can be found in /var/share/wordlists in Kali.
True
False**
The Kali distribution is produced by a company called 'Offensive Security'.
True**
False
The Slingshot distribution is available as a .ova.
True**
False
Which of these distributions is the recommended go-to for forensics purposes?
Slingshot
SIFT**
Kali
DNSMap will find every subdomain related to a domain.
True
False**
Exiftool can always remove metadata from files.
True
False**
The robots file is a file that lists all the places on a web server that a search engine shouldn't index.
True**
False
By default, nmap scans only a few commonly used ports, and not the whole port range.
True**
False
The WHOIS system is never anonymous.
True
False**
It is rare for people to use the same password across multiple sites and services.
True
False**
LinkedIn profiles can provide a list of qualifications someone has.
True**
False
Dirb is a very noisy tool that will generate lots of log messages.
True**
False
In nmap, the 'v' parameter is for a version scan.
True
False**
Metagoofil crawls a given domain looking for files of certain types to download.
True
False**
CeWL is a tool that is used to find out what a company does.
True
False**
A forensic investigation does not always have to be performed in a manner that holds up in court.
True**
False
MD5 hash uses a 256-bit hashing algorithm
True
False**
Echo Hiding is a method of audio steganography that hides text into images and audio files
True
False**
Attacking the attacker is part of the Incident Reponse process
True
False**
The purpose of the Purple team is to challenge the security of systems and identify vulnerabilites
True
False**
No two Hash values can ever be the same
True
False**
The time on log files is always in GMT.
True
False**
The chain of custody must be maintained to ensure evidence is considered in court.
True**
False
There are three hives within the registry, these are logical groups of keys, subkeys and values.
True
False*** There are 5
Wear Leveling is a process where files are constantly moved around to prevent certain sections of the disk from wearing out through overuse.
True**
False
The file extension for the expert witness format is '.e0x'.
True
False**
Deleted files can always be recovered.
True
False**
You should always shut down the computer to take a disk capture.
True
False**
SSDs have a feature called 'wear levelling', which may move around data on the drives.
True**
False
FATEXT is a commonly used File System.
True
False**
Base64 is a group of binary to text encoding systems that represent binary data in ASCII format.
True**
False
NTFS stands for New Technology File System.
True**
False
The SAM and SYSTEM registry keys can be used together to obtain NTLM password hashes.
True**
False
The Windows registry can tell us which programs are most commonly used.
True**
False
Prefetch is located in %Windows%\System32.
True
False**
FTK Imager can be used to capture forensic images of hard drives.
True**
False
Disk Forensics is the process of analysing the computer's RAM in order to retrieve forensic information.
True
False**
NotPetya is a type of Ransomware.
True**
False
It is always useful to take a memory capture, no matter what state the computer is in.
True
False**
The command pstree when used with Volatility will show you the parent-process relationships.
True**
False
A memory capture can reveal passwords for encrypted drives.
True
False**
During memory analysis, the computer's RAM is examined to retrieve forensic information.
True**
False
Full packet capture is required by law in all organisations, as it is necessary for analysts to always gain full exposure to network traffic in order to categorise an incident correctly.
True
False**
Starting with Windows Vista, all memory was encrypted in an attempt to thwart malware authors.
True
False**
Wireshark and tcpdump are useful tools in examining memory dumps and disk images.
True
False**
The filter ip.addr, when used in Wireshark, lists packets with the IP address of the specified value.
True**
False
The command volatility -f memdump.mem imageinfo shows you the recommended operating system volatility has identified.
True**
False
Using prepared statements to query the database makes SQL injection impossible.
True**
False
It is safe to implement an XSS filter without understanding every possible method that could be used to perform the attack.
True
False**
A cross-site scripting vulnerability occurs where unsanitised user input is displayed on a page.
True**
False
A Remote File Inclusion vulnerability allows an attacker to load an arbitrary file on the target system.
True**
False
A SQL injection flaw in a page where the result of the SQL query isn't displayed on the page makes it impossible to extract data from the database.
True
False**
The ; character is the only one that can cause a command injection vulnerability.
True
False**
A Local File Inclusion vulnerability makes it absolutely impossible for an attacker to load their own custom code on the target system.
True
False**
A command injection vulnerability can be defeated by checking user input for characters that might be used in the attack.
True**
False
A clickjacking attack will fail if the XFrameOptions do not allow the target site to be loaded into an iframe.
True**
False
A session token is a unique value that identifies a logged in user.
True**
False
Scanners never produce false negative results.
True
False**
A common method of bypassing configuration that restricts which types of files can be uploaded is to upload a '.htaccess' file to override the configuration.
True**
False
The objective in a clickjacking attack is to trick a user into clicking something on the target site without realising it.
True**
False
Session tokens never expire.
True
False**
If a user visits a link that performs a sensitive action without a valid CSRF token, the action should trigger anyway.
True
False**
Scanners can sometimes reset the password of the testing user.
True**
False
A CSRF token is a value unique to a user's session.
True**
False
The sequence ../ is the only way to perform a directory traversal attack.
True
False**
An upload directory with executable permissions set on it is perfectly safe.
True
False**
A directory traversal vulnerability could allow an attacker to execute code on the target.
True
False**
A cyclic pattern is a pattern where any four bytes at any point in the pattern are unique (up to a maximum pattern size).
True**
False
If no format string specifier exists in a format string, the user can submit one and access memory at arbitrary memory locations.
True**
False
Using printf() to print without a format string specifier is not exploitable if there is no user input involved.
True**
False
ASLR prevents an attacker from knowing which memory address to send the CPU to by randomising memory addresses when the program launches.
True**
False
There is never any difference between the memory addresses inside of GDB and outside of GDB.
True
False**
The fgets() function is a C function used to compare two strings.
True
False**
The code rp = struct.pack("<L", "0x565555c7") is valid.
True
False**
A format string allows a variable to be inserted into a string as a placeholder.
True**
False
A format string vulnerability cannot be used to modify memory, only read it.
True
False**
Stepping over function calls prevents those instructions in the called function from executing.
True
False**
Shellcode is data that the CPU can interpret as instructions.
True**
False
NX / DEP relies on marking certain segments of memory as nonexecutable, preventing the CPU from being directed to execute areas of memory that the user has control over.
True**
False
(2^32)-1 represents the highest value a signed integer can hold.
True
False**
The \n character indicates the end of a string.
True
False**
The shadow file on a Linux system is only readable by 'root'.
True**
False
The stack canary provides the CPU with warning that the return pointer may have been altered.
True**
False
GDB doesn't know what format data is supposed to be in at a memory address.
True**
False
The value 0xd34dc0de in little endian format is 0xdec04dd3.
True**
False
The 'Least Significant Bit' (LSB) is used to hold the sign in a signed integer.
True
False**
An unreleased exploit cannot be used by an attacker.
True
False**
Shellcode found on the internet is always safe.
True
False**
It is good practice to not publicly list the version number on web applications which are not custom (that you didn't make).
True**
False
In a responsible disclosure, the security researchers work with the affected company to fix a vulnerability within a set timeframe.
True**
False
A good patch cycle process prioritises systems that contain critical data.
True**
False
RHOST should contain the IP address of the target computer.
True**
False
Microsoft will always patch old versions of Windows.
True
False**
The eval() function decodes a base64 string into PHP.
True
False**
Windows XP is vulnerable to many exploits, simply because it is no longer supported and patched by Microsoft.
True**
False
A common method for CEO fraud is known as 'sharking'.
True
False**
Phishing is typically more convincing than spear phishing.
True
False**
A pretexting attack leverages a target's weakness, such as a desire to be helpful, and uses it against them.
True**
False
Executable files can be embedded into PDFs.
True**
False
By default, Word macros are disabled in Microsoft Word, and require the user to accept a prompt before they can run.
True**
False
Third party browser plugins such as Flash Player are excellent targets for drive-by download attacks.
True**
False
The 'Social Engineer Toolkit' uses Metasploit for some of its functionality.
True**
False
Pretexting is a form of social engineering.
True**
False
CEO fraud rarely goes undetected for very long.
True
False**
A credential harvesting attack involves tricking a user into visiting a malicious page, believing it is genuine.
True**
False
An administrator granting sudo permissions for a user to run only certain programs as root runs a great risk if those programs can be used to execute other commands.
True**
False
The DirtyCOW exploit overwrites the 'passwd' file on the hard disk.
True
False**
Local exploits mean the ability to target software that isn't necessarily listening on a port.
True**
False
Any program which can be used to execute terminal commands is a good target for the wildcard injection exploit.
True**
False
The SUID bit allows a program to run with the privileges of the owner, no matter the privileges of the user that runs the program.
True**
False
The find command will throw many errors by default.
True**
False
To find SUID programs, we can use the 'find' command with the parameter 'perm 2000'.
True
False**
The SUID bit is represented by a capital 'S' in the file permissions breakdown of 'ls l'.
True
False**
Just because a password looks hashed or encrypted, does not mean it is necessarily the case.
True**
False
Unattended installs often leave plaintext passwords behind in configuration files.
True**
False
The metasploit module to find missing patches is: post/windows/enum/patches.
True
False***
To take advantage of AlwaysInstallElevated, two files must be generated.
True**
False
The 'getsystem' meterpreter command will attempt multiple common exploits in order to bypass UAC.
True
False**
After placing some malware to take advantage of an unquoted service path, the malware will not run immediately.
True**
False
Exploiting a program that runs with high privileges will always grant you those privileges.
True
False**
To change the registry and replace an existing service path with some malware, the 'reg' command that is built into Windows will work.
True**
False
One of the easiest ways to bypass UAC is to simply ask the user.
True**
False
We can use 'icacls' to display permissions in a folder.
True**
False
A service will always run as the SYSTEM user.
True**
False
The 'wmic' program can be used to list service paths and find the ones that are unquoted.
True**
False
UAC is a protection against a program performing privileged actions without the user knowing.
True**
False
The WMIC tool can be used to check registry permissions from the command line.
True
False**
The AlwaysInstallElevated setting allows an administrator to install software which will always run with high level privileges.
True
False**
On Windows, the Administrator account is the highest level of privilege.
True
False**
A 'kernelmode' rootkit can hide its presence by intercepting kernel calls.
True**
False
A Microsoft Word template file is launched on every new document created in Word.
True**
False
A bootkit is a less serious version of a rootkit.
True
False**
A valid registry key for launching programs at startup is HKLM\Software\Microsoft\Windows\CurrentVersion\Run
True**
False
Any persistence methods will leave behind indicators of compromise on the target system, which can be detected.
True**
False
Desktop shortcuts can be assigned a hotkey, which will run the linked program when the hotkey is pressed.
True**
False
Yara is capable of analysing the behaviour of files to determine if they are malware or not.
True
False**
The 'netstat' command only works on Windows to list open ports.
True
False**
A Microsoft Word addin is a custom '.dll' file.
True**
False
Runlevel 6 is a normal multiuser mode.
True
False**
On Windows, mimikatz relies on SYSTEM level privileges to be able to access RAM.
True**
False
PowerShell is the only way to portscan if a portscanner cannot be installed.
True
False**
ARP spoofing works by spoofing the IP address of systems.
True
False**
ARP spoofing requires an attacker to constantly send ARP response packets out.
True**
False
Mimikatz can be used to retrieve both password hashes and plaintext passwords.
True**
False
An attacker can always use their own tools to spread throughout the network without restriction.
True
False**
Compromising a system in the DMZ initially is the safest foothold for an attacker.
True
False**
Choosing targets based on a system's ARP table lowers the chances of an attacker being detected.
True**
False
ARP tables are a quick alternative to scanning the network, but the results are not complete.
True**
False
PSExec is malware.
True
False**
The ICMP protocol data field is usually empty.
True**
False
HTTPS traffic is usually allowed out through the firewall.
True**
False
SMTP credentials can be stolen from memory on some workstations.
True**
False
Detecting an attacker exfiltrating data out of your network is about spotting unusual behaviour.
True**
False
Enforcing the use of a proxy server across the organisation is an effective way to catch some attackers.
True**
False
Exfiltration over sound is only effective when the computers are in close physical proximity.
True**
False
Network administrators can read all email traffic leaving the network, no matter what.
True
False**
The IRC protocol is encrypted by default.
True
False**
The 'cloud' means many applications connect to the same set of data centres.
True**
False
Exfiltration over DNS requires the attacker to control a DNS server.
True**
False
Which layer of the osi model is responsible for converting data into a specified format encryption and decryption.... presentation
When debugging a program with pwndbg what is the significance of the s in the x/s 0c5048ef command shown in the screenshot?.... identifies the output format for data at 0x8048ef
Which of the following is a windows database of setting for both the operating system and applications?... reg
What key combination will invoke the reverse search in the Linux terminal session showing in the image? Cntl R
Where are the wordlist located in kali?... use/share/wordlist
Which protocol is being used to find the hardware address of the host in image... ARP
The following image is from the IPv4 setting on a windows device. What protocol is this computer set to use to obtain an ip address... DHCP
Which of the following can best be described as a recipe for building docker containers?... Image
Based on the image what protocol is being used to assign an IPv4 address to the system?... DHCP
Which of the following is considered a reliable transport layer protocol? TCP
Which RAID level is commonly known as Striping? 0
What is the name of the default Linux superuser account? Root
What does the command shown below do:dnsmap sans.org -w .usr/share/wordlist.dnsmat.txt? …. search for subdomains based upon the wordlist provided
When reviewing the contents of windows prefetch what information is available to determine where an application ran?... 8 character hash
A web application is configured to validate a unique token value for each submitted user request. What threat is being mitigated?... cross site request forgery
Which of the following is a shorthand way of writing a subnet mask? CIDR
What can an Apache server admin do to prevent version info from leaking?... disable the banner
What is the weakness of a symmetric encryption algorithm like AES?... key exchange
What would be the output of the shown Linux terminal command? Foo@bar:-/baz pwd ….. /home/foo/baz
How do prepared statements help prevent SQL injection attacks?...Query language is kept separate from user supplied data
What HTTP protocol request asks a web server to retrieve metadata without the data?... HEAD
What type of DNS server is responsible for providing name resolution for a FQDN, such as www.sans.org?... Authoritative
The user starts Microsoft Word and clicks File |open. What does word do as a result?... generates a software interrupt
Which of the following Linux commands will display the files in the directory? …. ls –l
Alice sends bob a message that is encrypted using a asymmetric encryption. Which key will bob use to decrypt the message from Alice? … Bob’s private key
In Git, which of the following allows work on specific features to occur independently? ...Branch
During which stage of incident response should the agency of policies be examined?... lessons learned
How many hexadecimal numbers can be placed in a nibble?... 1
Which of the following programming languages is commonly used for web site development? … JavaScript
Whis is a use case for hashing?... Validating file integrity
What is the purpose of hashing a company policy document?... To validate the integrity of the file contents
Which of the following protects web applications from session guessing attacks?... using randomly generated session identifiers with and expired date
What is the process of preserving and evaluating electronic data in order to reconstruct prior events?... digital forensics
What folder is the root of a Linux file system contains files impacted by hard drive errors? … lost and found
Which exploit takes advantage of a web-page field that does not validate input?... command injection
Which type of DNS server receiver queries from client web browsers?.... Resolver
During which stage of incident response will forensic live captures be taken?.... identification
How many subnets are required for 3 machines to communicate on the same network?....1
Which of the following is an incremental change to the Git repository that has a unique identifier?... commit
A blue team has disabled unauthorized DNS zone transfers on the organizations DNS servers. What method should a Read team use to identify valid subdomains?.... run an enumeration tool with a wordlist against the server
What is the network identifier of the following ip address written CIDR notation>?192.168.0.0/24?.... 192.168.0.0
Which computer component manages ongoing access to a computer’s shared RAM and drive storages resources?... Kernel
Which of the following HTTP response codes indicate that a web request... 200
What vulnerability can be mitigated though the use of robots meta tags in HTML header of website pages?... robots.txt file aggregating all the non-indexed pages on the web-site
Which programming paradigm breaks down task into a series of steps?... procedural
How is an integer overflow/underflow mitigated?... checking that the result of any change to a signed integer falls within a specific range
Which of the following would change the hash value of listofthings.txt?... editing the document and saving it
At which OSI layer dos the TCP handshake occur?... transport
What is found at the bottom of a stack frame when a function is called? Return pointer
During which stage of incident response might a mass password reset for every account on the network be performed?... Recovery
What protocol uses both symmetric and asymmetric encryption?.... HTTPS
Which of the following is one of the four user account controlled (UCA) settings on a Windows system?... Always notify
Which of the following is a defining characteristic of a Type-1 hypervisor?.... virtualization occurs at the firmware level
What is the max transfer speed of a USB 3.0 port?... 4.6 G
Which RAID configuration limits the overall storage capacity of the disk to 50%?... RAID 1
A C program has the following line of code: X--; what does this line of code due?.... Decrements the value of x by one
How can a new user be added to the system with the windows command line?.... ne user/adduser1 p@ssw0rd
What is the main benefit of UDP?... Speed
Which tool was used to create the output shown in the screen capture?
File Name : wrong_file.pdf
Directory : .
File Size : 52 MiB
File Modification Date/Time : 2021:04:28 11:30:03
File Access Date/Time : 2021:04:28 12:43:30
File Indode Change Date/Time : 2021:04:28 15:13:16
File Permissions : rw-r—r--
File Type : PDF
File Type Extension : pdf
MIME Type : application/pdf
PDF Version : 1.6
Linerized : No
Author : mgelardo-quash
Create Date : PScript5.dll Version
….... exiftool
Examine the list from a Python program below. Which statement will display Oregon
PNW_states = [‘Washington’, ‘Oregon’, ‘Idaho’, ‘Montana’, ‘Wyoming’]
….. print(PNW_states[1])
What could explain the absence of a hash in the line corresponding to the user www-data?
Root: $6rghere5uYYE%Yrhe%RHeHFHerhefhersry57eu46u4etj45jeteth3tj75kjrgetjhhnetjutymetjetjeykrhyhwrg
News: *:17268:0:99999:7:::
Uucp: *:17268:0:99999:7:::
Proxy: *:17268:0:99999:7:::
Www-data: *:17268:0:99999:7:::
backup: *:17268:0:99999:7:::
list: *:17268:0:99999:7:::
...The account is set to nologin in the passwd file
What is the significance of the items listed in pwndbg’s backtrace shown in the image
------------------------------------------------------------------[ STACK ]-------------------------------------------------------------------------------
00:0000 | esp oxffffd0ec ---> 0xf7e0f647 (__libc_start_main+247) <--- add esp
01:0004 | bla bla bla bla
02:0008 | bla bla bla
03:000c | bla bla bla
04:0010 | bla bla bla bla bla bla
-----------------------------------------------------------------[ BACKTRACE ]----------------------------------------------------------------------------
> f 0 80484eb main
f 1 f7e0f647 ___libc_start_main+247
--------------------------------------------------------------------------------------------------------------------------------------------------------------
...They are all of the functions called up to this point
What type of attack is being attempted with the below URL?
http://www.theforce.org/view.php?page=%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/mounts
… Directory traversal
The code snippet below is an example of which language?
<body>
<h1>This is a heading</h1>
<p>This is a paragraph of text. . .</p>
<p>This second paragraph goes here.</p>
</body>
… HTML
What is the string below an example of?
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
… Registry key
Consider the TCP communications between two computers shown below. What will Computer A do following Computer B’s response?
Computer A sends 20 bytes of data. Computer B responds with Computer A’s acknowledgement number + 15.
… Resend the entire packet
The malicious shortcut code below was created through which command interface?
$Shortcut.hotkey = “ctrl+c”
$Shortcut.Arguements = ‘shutdown /s /t 0’
… PowerShell
Based on the following image, what will the current directory be after the user hits enter on the command “cd . .”
User@computer> pwd
/
User@computer> cd etc/openvpn
User@computer> cd ..
… /etc
Which Windows CLI command will display the information pictured?
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . . . . : fe80::8494:ac54:8976:b127%8
IPv4 Address . . . . . . . . . . . . . . . . . : 192.168.131.2
Subnet Mask . . . . . . . . . . . . . . . . . : 225.225.225.0
Default Gateway . . . . . . . . . . . . . . :
Ethernet adapter Bluetooth Network Connection :
Media State . . . . . . . . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . . . :
… ipconfig