Exam 1: Ethical Hacking and Testing

A business manager is arguing with a compliance officer that a pentest would never be necessary for this company since they use single sign on authentication throughout. You are asked for your opinion, and say "IF I can access a network physically I can own it". This sounds a little extreme, but what is not true about this assertion?

During an internal pentest, you setup a fake website and that offers some documentation and useful resources. You create a link and send it via email to a few key people. When they visit, code is run on their own machines that compromise their systems. What form of attack is not taking place?

What is the most common method of social engineering?

During a pentest, you notice the organization uses different domains for various internal departments. What phase of the test would this have been discovered?

Dave wants to steal the contact database from a rival sales person. He calls his rival's secretary and pretends to be from the IT department. He says "The sales tracking system just crashed, at least we think. We are hopeful that we saved everyone's data, but we need Mr. Shivers username and password In order to log in and check." What type of attack is Dave conducting?

Karen gets hired on with disrupttheprocess.org to organize interference in public political events. Her real purpose however, is to figure out where the real funding for these events is coming from, so she can inform the media. She figures out how the power structure works and spies a contact list on the desk of a fellow coworker. Karen recognized the person who handles finances works out at a gym that Karen also belongs to. Karen arranges to bump into her one day and suggests they do spin class together for awhile. Long story short, this friendship trust eventually results in Karen achieving access to a database of sponsors, which she then provides to the local newspaper.

Which of the following acts of the UK parliamant make it illegal to modify the contents of a computer with the intent to impair its operation?

Webhosting services often give free scripts to customers that pay for minimum level services. Occasionally there are security flaws in these scripts that are never fixed even though thousands of customers might be using them. This is an example of what type of threat category?

Which of the following statements describes a provision of FERPA?

Which of the following statutes says that attempts to circumvent copy protection are illegal, regardless of how weak that protection might be?

What are the 3 steps of reverse social engineering?

An attacker wants to make changes to a log file to clear his tracks. Instead of erasing the logs, he just makes changes to some of the entries. What is he trying to do?