Deck 4: Footprinting and Social Engineering

Question 1

Which HTTP method starts a remote Application-layer loopback of the request message?

A) TRACE
B) PUT
C) GET
D) HEAD

Answer 1

A

Question 2

The HTTP CONNECT method starts a remote application-layer loopback of the request message.

Answer 2

False

Question 3

Wget is a *nix system command that can be used to retrieve HTTP,HTTPS,and FTP files over the Internet.

Answer 3

True

Question 4

What is the HTTP method that retrieves data by URI?

A) GET
B) PUT
C) CONNECT
D) HEAD

Question 5

Which process enables you to see all the host computers on a network and basically give you a diagram of an organization's network?

A) Web bugs
B) footprints
C) zone transfers
D) namedroppers

Question 6

What HTTP method is the same as the GET method,but retrieves only the header information of an HTML document,not the document body?

A) CONNECT
B) PUT
C) POST
D) HEAD

Question 7

When an individual attempts to discover as much information legally possible about their competition,what information gathering technique are they performing?

A) competitive study
B) packet study
C) basic information
D) competitive intelligence

Question 8

Which utility can extract meta-data and documents on a Website to reveal the document creator's network login,e-mail address,IP address,and other important information?

A) Samba
B) Bugnosis
C) SamSpade
D) FOCA

Question 9

Which HTTP method requests that the entity is stored under the Request-URI?

A) GET
B) PUT
C) POST
D) HEAD

Question 10

What area of a network is a major area of potential vulnerability because of the use of URLs?

A) DNS
B) SOA
C) DHCP
D) POST

Question 11

Namedroppers is a tool that can be used to capture Web server information and vulnerabilities in a Web site's pages that could allow exploits such as SQL injection and buffer overflows.

Question 12

Network attacks can often begin by gathering information from a company's Web site.

Question 13

Walking is an automated way to discover pages of a Web site by following links.

Question 14

Which HTTP error informs you the server understands the request but refuses to comply?

A) 401 Unauthorized
B) 404 Not Found
C) 403 Forbidden
D) 409 Conflict

Question 15

Which tool can be used to gather competitive intelligence from Web sites?

A) Whois
B) Netcat
C) Metis
D) Dig

Question 16

What tool can be used to read and write data to ports over a network?

A) Whois
B) Netcat
C) Metis
D) Dig

Question 17

What utility can be used to intercept detailed information from a company's Web site?

A) JavaAttack
B) Zed Attack Proxy
C) Trace
D) WebAnalysis

Question 18

Which utility is used to gather IP and domain information?

A) Whois
B) Netcat
C) Metis
D) Dig

Question 19

To see additional parameters that can be used with the Netcat command,what should you type at the command prompt?

A) nc -lookup
B) nc -z
C) nc -h
D) nc -up

Question 20

What is the passive process of finding information on a company's network called?

A) footprinting
B) searching
C) calling
D) digging

Question 21

Explain why a simple process like "dumpster diving" can be so effective when gathering information utilizing social engineering?

Question 22

How can a computer criminal use HTTP methods before running an exploit on a server?

Question 23

How can computer criminals use the Whois utility for their purposes?

Question 24

How can DNS be used for footprinting?

Question 25

Which HTTP method is used with a proxy that can dynamically switch to a tunnel connection,such as Secure Socket Layer (SSL)?

A) HEAD
B) CONNECT
C) PUT
D) GET

Question 26

Which technique can be used to read PINs entered at ATMs or at other areas when a pin code is entered?

A) shoulder surfing
B) footprinting
C) zone transferring
D) piggybacking

Question 27

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Server understands the request but refuses to comply

Question 28

What type of information is usually gathered by social engineering?

Question 29

When an attacker chooses to combine social engineering with exploiting vulnerabilities carried out by e-mail,what type of attack is being performed?

A) spear phishing
B) email surfing
C) personal
D) email phishing

Question 30

What is "competitive intelligence"?

Question 31

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Request not understood by server

Question 32

List at least five tools available for footprinting.

Question 33

What social engineering tactic can be utilized to acquire old notes that may contain written passwords or other items that document important information?

A) shoulder-surfing
B) dumpster diving
C) piggybacking
D) desk surfing

Question 34

What tactic is being used when an attacker trailing closely behind an employee enters a restricted area without any security credentials by utilizing their proximity to another employee with security clearance?

A) Shoulder surfing
B) Footprinting
C) Piggybacking
D) Dumpster diving

Question 35

Which process utilizes the knowledge of human nature to get information from people to use for executing an attack on a computer network?

A) fingerprinting
B) footprinting
C) zone transferring
D) social engineering

Question 36

Explain the process of "footprinting," and why it is important to a security professional?

Question 37

Which of the following is a text file generated by a Web server and stored on a user's browser?

A) index
B) cookie
C) server index
D) web file

Question 38

What type of general commands allow a security tester to pull information from a Web server using a web browser?

A) TFTP
B) DNS
C) HTTP
D) ARP

Question 39

Which type of social engineering attack attempts to discover personal information through the use of email?

A) email surfing
B) footprinting
C) spamming
D) phishing

Question 40

List and explain the five techniques used by social engineers in their attempts to gain information from unsuspecting people.

Question 41

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Request couldn't be fulfilled by the server

Question 42

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Server didn't receive a timely response

Question 43

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Unable to match request

Question 44

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Server is unavailable because of maintenance or overload

Question 45

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Server received invalid response from the upstream server

Question 46

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Request not allowed for the resource

Question 47

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Request couldn't be completed because of an inconsistency

Question 48

Match each item with a statement below.a.HTTP 400 Bad Request
b.HTTP 403 Forbidden
c.HTTP 404 Not Found
d.HTTP 405 Method Not Allowed
e.HTTP 408 Request Timeout
f.HTTP 500 Internal Server Error
g.HTTP 502 Bad Gateway
h.HTTP 503 Service Unavailable
i.HTTP 504 Gateway Timeout
j.HTTP 409 Conflict
Request not made by client in allotted time