SEC504 Hacker Tools, Techniques, Exploits and Incident Handling Questions and Answers

Which of the following rootkits patches, hooks, or replaces system calls with versions that hide information about the attacker?

You are responsible for security at a company that uses a lot of Web applications. You are most concerned about flaws in those applications allowing some attacker to get into your network. What method would be best for finding such flaws?

Which of the following statements are true about a keylogger?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following nmap command parameters is used for TCP SYN port scanning?

You are the Administrator for a corporate network. You are concerned about denial of service attacks.

Which of the following measures would be most helpful in defending against a Denial-of-Service (DoS) attack?

Andrew, a bachelor student of Faulkner University, creates a gmail account. He uses ' Faulkner ' as the password for the gmail account. After a few days, he starts receiving a lot of e-mails stating that his gmail account has been hacked. He also finds that some of his important mails have been deleted by someone. Which of the following methods has the attacker used to crack Andrew ' s password?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following reads and writes data across network connections by using the TCP/IP protocol?

You have inserted a Trojan on your friend ' s computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we-aresecure.com Web site. For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless whether the ports are open or close. Sometimes, IPID is being incremented by more than one value.

What may be the reason?

Adam, a malicious hacker is sniffing the network to inject ARP packets. He injects broadcast frames onto the wire to conduct Man-in-The-Middle attack.

Which of the following is the destination MAC address of a broadcast frame?

John visits an online shop that stores the IDs and prices of the items to buy in a cookie. After selecting the items that he wants to buy, the attacker changes the price of the item to 1.

Original cookie values:

ItemID1=2

ItemPrice1=900

ItemID2=1

ItemPrice2=200

Modified cookie values:

ItemID1=2

ItemPrice1=1

ItemID2=1

ItemPrice2=1

Now, he clicks the Buy button, and the prices are sent to the server that calculates the total price.

Which of the following hacking techniques is John performing?

You work as an Incident handling manager for a company. The public relations process of the company includes an event that responds to the e-mails queries. But since few days, it is identified that this process is providing a way to spammers to perform different types of e-mail attacks. Which of the following phases of the Incident handling process will now be involved in resolving this process and find a solution?

Each correct answer represents a part of the solution. Choose all that apply.

Which of the following attacks are examples of Denial-of-service attacks (DoS)?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following is a type of computer security vulnerability typically found in Web applications that allow code injection by malicious Web users into the Web pages viewed by other users?

Which of the following tools is used to attack the Digital Watermarking?

Fill in the blank with the appropriate term.

_______is the practice of monitoring and potentially restricting the flow of information outbound from one network to another

Which of the following are the primary goals of the incident handling team?

Each correct answer represents a complete solution. Choose all that apply.

John works as a Professional Penetration Tester. He has been assigned a project to test the Website security of www.we-are-secure Inc. On the We-are-secure Website login page, he enters = ' or ' ' = ' as a username and successfully logs on to the user page of the Web site. Now, John asks the we-aresecure Inc. to improve the login page PHP script. Which of the following suggestions can John give to improve the security of the we-are-secure Website login page from the SQL injection attack?

Fill in the blank with the correct numeric value.

ARP poisoning is achieved in ______ steps.

Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping the conversation and keeps the password. After the interchange is over, Eve connects to Bob posing as Alice; when asked for a proof of identity, Eve sends Alice ' s password read from the last session, which Bob accepts. Which of the following attacks is being used by Eve?

Fill in the blank with the appropriate word.

StackGuard (as used by Immunix), ssp/ProPolice (as used by OpenBSD), and Microsoft ' s /GS option use ______ defense against buffer overflow attacks.

Your company has been hired to provide consultancy, development, and integration services for a company named Brainbridge International. You have prepared a case study to plan the upgrade for the company. Based on the case study, which of the following steps will you suggest for configuring WebStore1?

Each correct answer represents a part of the solution. Choose two.

Which of the following statements are true about netcat?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following tools will you use to prevent from session hijacking?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following US Acts emphasized a " risk-based policy for cost-effective security " and makes mandatory for agency program officials, chief information officers, and inspectors general (IGs) to conduct annual reviews of the agency ' s information security program and report the results to Office of Management and Budget?

In which of the following attacks does the attacker gather information to perform an access attack?

Which of the following programs can be used to detect stealth port scans performed by a malicious hacker?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following techniques is used when a system performs the penetration testing with the objective of accessing unauthorized information residing inside a computer?

Which of the following malicious code can have more than one type of trigger, multiple task capabilities, and can replicate itself in more than one manner?

Which of the following functions can you use to mitigate a command injection attack?

Each correct answer represents a part of the solution. Choose all that apply.

Which of the following Denial-of-Service (DoS) attacks employ IP fragmentation mechanism?

Each correct answer represents a complete solution. Choose two.

Which of the following statements about Denial-of-Service (DoS) attack are true?

Each correct answer represents a complete solution. Choose three.

In which of the following attacking methods does an attacker distribute incorrect IP address?

In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?

Maria works as a professional Ethical Hacker. She is assigned a project to test the security of www.we-are-secure.com. She wants to test a DoS attack on the We-are-secure server. She finds that the firewall of the server is blocking the ICMP messages, but it is not checking the UDP packets. Therefore, she sends a large amount of UDP echo request traffic to the IP broadcast addresses. These UDP requests have a spoofed source address of the We-are-secure server. Which of the following DoS attacks is Maria using to accomplish her task?

Which of the following refers to the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system?

You work as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The company wants to fix potential vulnerabilities existing on the tested systems. You use Nessus as a vulnerability scanning program to fix the vulnerabilities. Which of the following vulnerabilities can be fixed using Nessus?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following is a computer worm that caused a denial of service on some Internet hosts and dramatically slowed down general Internet traffic?

Ryan, a malicious hacker submits Cross-Site Scripting (XSS) exploit code to the Website of Internet forum for online discussion. When a user visits the infected Web page, code gets automatically executed and Ryan can easily perform acts like account hijacking, history theft etc. Which of the following types of Cross-Site Scripting attack Ryan intends to do?

Which of the following tools can be used to perform brute force attack on a remote database?

Each correct answer represents a complete solution. Choose all that apply.

You are hired as a Database Administrator for Jennifer Shopping Cart Inc. You monitor the server health through the System Monitor and found that there is a sudden increase in the number of logins.

Which of the following types of attack has occurred?

Which of the following statements about reconnaissance is true?

In the DNS Zone transfer enumeration, an attacker attempts to retrieve a copy of the entire zone file for a domain from a DNS server. The information provided by the DNS zone can help an attacker gather user names, passwords, and other valuable information. To attempt a zone transfer, an attacker must be connected to a DNS server that is the authoritative server for that zone. Besides this, an attacker can launch a Denial of Service attack against the zone ' s DNS servers by flooding them with a lot of requests. Which of the following tools can an attacker use to perform a DNS zone transfer?

Each correct answer represents a complete solution. Choose all that apply.

Fill in the blank with the appropriate name of the attack.

______ takes best advantage of an existing authenticated connection

Which of the following DoS attacks affects mostly Windows computers by sending corrupt UDP packets?

Adam works as a Network Administrator for PassGuide Inc. He wants to prevent the network from DOS attacks. Which of the following is most useful against DOS attacks?

Against which of the following does SSH provide protection?

Each correct answer represents a complete solution. Choose two.

Which of the following types of malware can an antivirus application disable and destroy?

Each correct answer represents a complete solution. Choose all that apply.

Who are the primary victims of smurf attacks on the contemporary Internet system?

Which of the following takes control of a session between a server and a client using TELNET , FTP , or any other non-encrypted TCP/IP utility?

Which of the following types of attacks is mounted with the objective of causing a negative impact on the performance of a computer or network?

Which of the following tools can be used for stress testing of a Web server?

Each correct answer represents a complete solution. Choose two.

You see the career section of a company ' s Web site and analyze the job profile requirements. You conclude that the company wants professionals who have a sharp knowledge of Windows server 2003 and Windows active directory installation and placement. Which of the following steps are you using to perform hacking?

Which of the following is a network worm that exploits the RPC sub-system vulnerability present in the Microsoft Windows operating system?

You work as a System Administrator in SunSoft Inc. You are running a virtual machine on Windows Server 2003. The virtual machine is protected by DPM. Now, you want to move the virtual machine to another host. Which of the following steps can you use to accomplish the task?

Each correct answer represents a part of the solution. Choose all that apply.

You work as a Network Administrator for Marioxnet Inc. You have the responsibility of handling two routers with BGP protocol for the enterprise ' s network. One of the two routers gets flooded with an unexpected number of data packets, while the other router starves with no packets reaching it. Which of the following attacks can be a potential cause of this?

John works as a Penetration Tester in a security service providing firm named you-are-secure Inc. Recently, John ' s company has got a project to test the security of a promotional Website www.missatlanta.com and assigned the pen-testing work to John. When John is performing penetration testing, he inserts the following script in the search box at the company home page:

<</b> script > alert( ' Hi, John ' ) <</b> /script >

After pressing the search button, a pop-up box appears on his screen with the text - " Hi, John. " Which of the following attacks can be performed on the Web site tested by john while considering the above scenario?