Deck 2: Types of Attacks

Question 1

Which is NOT a typical adverse result of a virus?

A)Deletion of files
B)Changing system settings
C)Increased network traffic
D)Increased network functionality and responsiveness

Answer 1

D

Question 2

Which method of defense against a SYN flood involves altering the response timeout?

A)Micro blocks
B)RST cookies
C)SYN cookies
D)Stack tweaking

Answer 2

D

Question 3

Which attack occurs by sending packets that are too large for the target machine to handle?

A)SYN flood
B)ICMP flood
C)Ping of death
D)Stack tweaking

Answer 3

C

Question 4

Which attack causes Internet routers to attack the target systems without actually compromising the routers themselves?

A)Distributed Reflection Denial of Service
B)ICMP flood
C)SYN flood
D)Tribal Flood Network

Question 5

Which of the following is NOT a denial of service attack?

A)Ping of Death
B)SYN flood
C)Smurf attack
D)Stack tweaking

Question 6

Which of the following denial of service attacks results from a client's failure to respond to the server's reply to a request for connection?

A)ICMP flood
B)SYN flood
C)Tribal flood
D)UDP flood

Question 7

What do many analysts believe was the reason for the MyDoom virus\worm?

A)A DoS attack against Microsoft.com
B)A DoS attack targeting Microsoft Windows IIS servers
C)An e-mail attack targeting Bill Gates
D)A DDoS attack targeting Santa Cruz Operations

Question 8

Which is NOT true about a buffer overflow attack?

A)Susceptibility to a buffer overflow is entirely contingent on software flaws.
B)A hacker does not need a good working knowledge of some programming language to create a buffer overflow.
C)A buffer overflow can load malicious data into memory and run it on a target machine.
D)A careful programmer will write applications so the buffer will truncate or reject data that exceeds the buffer length.

Question 9

Which router configuration is potentially least vulnerable to an attack?

A)Routers to external networks that support multiple internal interfaces
B)Routers that filter packets with source addresses in the local domain
C)Routers with two interfaces that support subnetting on the internal network
D)Proxy firewalls where the proxy applications use the source IP address for authentication

Question 10

Which attack relies on broadcast packets to cause a network to actually flood itself with ICMP packets?

A)ICMP flood
B)SYN flood
C)Tribal flood
D)Smurf attack

Question 11

Which of the following activities do security professionals recommend to limit the chances of becoming a target for a Trojan horse?

A)Only open e-mail attachments from friends or co-workers
B)Prevent employees from downloading and installing any programs
C)Only download jokes,animated Flash files,or utility programs from popular sites
D)Download and install Windows updates and patches monthly

Question 12

Configuring routers to not forward directed broadcast packets can help defend against a ____________ attack.

Question 13

Which copies itself into the Windows directory and creates a registry key to load itself at startup?

A)Bagle
B)MyDoom
C)Sasser
D)Slammer

Question 14

One of the most common types of attacks via the Internet is:

A)Buffer overflow
B)Denial of service
C)IP spoofing
D)Session hacking

Question 15

Shutting down router and firewall ports 5554 and 9996 will block most damage from which of these?

A)Bagle
B)Sasser
C)Sobig
D)Trojan horses

Question 16

Which presented itself as an e-mail from the system administrator informing the user of a virus infection and gave directions to open an e-mail attachment which would then scan for e-mail addresses and shared folders?

A)Bagle
B)Minmail
C)Sasser
D)Sobig

Question 17

Which created a domestic "cyber terrorism" attack against a Unix distributor?

A)Blaster
B)MyDoom
C)Slammer
D)W32.Storm.Worm

Question 18

The spread of viruses can be minimized by all of the following EXCEPT:

A)using a virus scanner
B)never opening attachments you are unsure of
C)using a code word with friends to determine if attachments are legitimate
D)immediately following instructions in security alerts e-mailed to you from Microsoft

Question 19

Which created a buffer overflow attack against a Windows flaw called the DCOM RPC vulnerability?

A)Blaster
B)MyDoom
C)Slammer
D)SoBig

Question 20

How does the SYN cookie work?

A)Replaces cookies left by virus\worm programs.
B)Enables encryption of outbound packets.
C)Prevents memory allocation until third part of SYN ACK handshaking.
D)Causes server to send wrong SYNACK to the client.

Question 21

A ____________ can help reduce system vulnerability by preventing disclosure of IP addresses much like a firewall.

Question 22

A program that self-replicates is,by definition,called a(n)____________.

Question 23

The Distributed Denial of Service attack initiated by the ____________ worm is considered by many to be a clear example of cyber-terrorism.

Question 24

A Distributed Reflection DoS attack takes advantage of the fact that most Internet routers communicate on port ____________.

Question 25

Trin00 can run as a ___________,a program that usually has no visual interface and provides some background service.

Question 26

Trojan horses often gain access to users machines by appearing as a funny or useful file sent as an e-mail ____________.

Question 27

The ____________ is probably the most used and most widely known DoS tool.