Question 1

What type of reconnaissance is a penetration tester performing if they are using tools that do not raise any alarms?

Accepted Answer

A) active 
B) passive 
C) invasive 
D) evasive 
A) active 
B) passive 
C) invasive 
D) evasive B

Question 2

What process does a penetration tester rely on to access an ever higher level of resources?

Accepted Answer

A) pivot 
B) spinning 
C) persistence 
D) continuous exploitation 
A) pivot 
B) spinning 
C) persistence 
D) continuous exploitation C

Question 3

In white box and gray box testing,the first task of the tester is to perform preliminary information gathering on their own from outside the organization,sometimes called open source intelligence (OSINT).

Accepted Answer

A) True 
 B)False  False

Question 4

If a penetration tester has gained access to a network and then tries to move around inside the network to other resources,what procedure is the tester performing?

Accepted Answer

A) pivot 
B) spinning 
C) persistence 
D) secondary exploitation 
A) pivot 
B) spinning 
C) persistence 
D) secondary exploitation

Question 5

What is the name of the process that basically takes a snapshot of the current security of an organization?

Accepted Answer

A) threat analysis 
B) vulnerability appraisal 
C) risk assessment 
D) threat assessment 
A) threat analysis 
B) vulnerability appraisal 
C) risk assessment 
D) threat assessment

Question 6

The second step in a vulnerability assessment is to determine the assets that need to be protected.

Accepted Answer

A) True 
 B)False

Question 7

What term is defined as the state or condition of being free from public attention to the degree that you determine?

Accepted Answer

A) freedom 
B) secure 
C) privacy 
D) contentment 
A) freedom 
B) secure 
C) privacy 
D) contentment

Question 8

List at least four things that a vulnerability scanner can do.

Accepted Answer

A vulnerability scanner can do the follo

Question 9

Which item below is the standard security checklist against which systems are evaluated for a security posture?

Accepted Answer

A) profile 
B) threat 
C) control 
D) baseline 
A) profile 
B) threat 
C) control 
D) baseline

Question 10

An administrator needs to view packets and decode and analyze their contents.What type of application should the administrator use?

Accepted Answer

A) application analyzer 
B) protocol analyzer 
C) threat profiler 
D) system analyzer 
A) application analyzer 
B) protocol analyzer 
C) threat profiler 
D) system analyzer

Question 11

Which of the following is the goal of a vulnerability scan? (Choose all that apply. )

Accepted Answer

A) identify vulnerabilities 
B) identify common misconfigurations 
C) identify threat actors 
D) identify a lack of security controls 
A) identify vulnerabilities 
B) identify common misconfigurations 
C) identify threat actors 
D) identify a lack of security controls

Question 12

Discuss one type of asset that an organization might have.

Accepted Answer

An organization has many different types

Question 13

Which security procedure is being demonstrated if an administrator is using Wireshark to watch for specific inbound and outbound traffic?

Accepted Answer

A) application search 
B) application control 
C) firewall monitoring 
D) virus control 
A) application search 
B) application control 
C) firewall monitoring 
D) virus control

Question 14

Which is the term for a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic,yet they are imitations of real data files?

Accepted Answer

A) port scanner 
B) honeynet 
C) honeypot 
D) honeycomb 
A) port scanner 
B) honeynet 
C) honeypot 
D) honeycomb

Question 15

List and describe the three categories that TCP/IP divides port numbers into.

Accepted Answer

Well-known port numbers (0-1023).Reserve

Question 16

Which of the following groups categorize the risks associated with the use of private data? (Choose all that apply. )

Accepted Answer

A) Statistical inferences. 
B) Associations with groups. 
C) Private and consumer data 
D) Individual inconveniences and identity theft. 
A) Statistical inferences. 
B) Associations with groups. 
C) Private and consumer data 
D) Individual inconveniences and identity theft.

Question 17

Describe a penetration testing report.

Accepted Answer

The end product of a penetration test is

Question 18

Explain the concepts of personal data theft and identity theft.

Accepted Answer

Personal data theft involves user person

Question 19

During a vulnerability assessment,what type of software can be used to search a system for port vulnerabilities?

Accepted Answer

A) threat scanner 
B) vulnerability profiler 
C) port scanner 
D) application profiler 
A) threat scanner 
B) vulnerability profiler 
C) port scanner 
D) application profiler

Question 20

What process addresses how long data must be kept and how it is to be secured?

Accepted Answer

A) legal retention 
B) data retention 
C) legal and compliance 
D) data methodology 
A) legal retention 
B) data retention 
C) legal and compliance 
D) data methodology

What type of reconnaissance is a penetration tester performing if they are using tools that do not raise any alarms?

What process does a penetration tester rely on to access an ever higher level of resources?

In white box and gray box testing,the first task of the tester is to perform preliminary information gathering on their own from outside the organization,sometimes called open source intelligence (OSINT).

If a penetration tester has gained access to a network and then tries to move around inside the network to other resources,what procedure is the tester performing?

What is the name of the process that basically takes a snapshot of the current security of an organization?

The second step in a vulnerability assessment is to determine the assets that need to be protected.

What term is defined as the state or condition of being free from public attention to the degree that you determine?

List at least four things that a vulnerability scanner can do.

Which item below is the standard security checklist against which systems are evaluated for a security posture?

An administrator needs to view packets and decode and analyze their contents.What type of application should the administrator use?

Which of the following is the goal of a vulnerability scan? (Choose all that apply. )

Discuss one type of asset that an organization might have.

Which security procedure is being demonstrated if an administrator is using Wireshark to watch for specific inbound and outbound traffic?

Which is the term for a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic,yet they are imitations of real data files?

List and describe the three categories that TCP/IP divides port numbers into.

Which of the following groups categorize the risks associated with the use of private data? (Choose all that apply. )

Describe a penetration testing report.

Explain the concepts of personal data theft and identity theft.

During a vulnerability assessment,what type of software can be used to search a system for port vulnerabilities?

What process addresses how long data must be kept and how it is to be secured?

Introduction to Security

Malware and Social Engineering Attacks

Basic Cryptography

Advanced Cryptography and PKI

Networking and Server Attacks

Network Security Devices, Design, and Technology

Administering a Secure Network

Wireless Network Security

Client and Application Security

Mobile and Embedded Device Security

Authentication and Account Management

Access Management

Business Continuity

Risk Mitigation

Filters

Exam 13: Vulnerability Assessment and Data Security

What type of reconnaissance is a penetration tester performing if they are using tools that do not raise any alarms?

What process does a penetration tester rely on to access an ever higher level of resources?

In white box and gray box testing,the first task of the tester is to perform preliminary information gathering on their own from outside the organization,sometimes called open source intelligence (OSINT).

If a penetration tester has gained access to a network and then tries to move around inside the network to other resources,what procedure is the tester performing?

What is the name of the process that basically takes a snapshot of the current security of an organization?

The second step in a vulnerability assessment is to determine the assets that need to be protected.

What term is defined as the state or condition of being free from public attention to the degree that you determine?

List at least four things that a vulnerability scanner can do.

Which item below is the standard security checklist against which systems are evaluated for a security posture?

An administrator needs to view packets and decode and analyze their contents.What type of application should the administrator use?

Which of the following is the goal of a vulnerability scan? (Choose all that apply. )

Discuss one type of asset that an organization might have.

Which security procedure is being demonstrated if an administrator is using Wireshark to watch for specific inbound and outbound traffic?

Which is the term for a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic,yet they are imitations of real data files?

List and describe the three categories that TCP/IP divides port numbers into.

Which of the following groups categorize the risks associated with the use of private data? (Choose all that apply. )

Describe a penetration testing report.

Explain the concepts of personal data theft and identity theft.

During a vulnerability assessment,what type of software can be used to search a system for port vulnerabilities?

What process addresses how long data must be kept and how it is to be secured?

Introduction to Security

Malware and Social Engineering Attacks

Basic Cryptography

Advanced Cryptography and PKI

Networking and Server Attacks

Network Security Devices, Design, and Technology

Administering a Secure Network

Wireless Network Security

Client and Application Security

Mobile and Embedded Device Security

Authentication and Account Management

Access Management

Business Continuity

Risk Mitigation

Filters