Question 1

What are "race conditions"?

Accepted Answer

"Race conditions" refers to situations in which two threads, processes, or applications are able to modify a resource (and therefore interfere with each other) and the programmer has not taken precautions to ensure that the desired sequence of events is completed in the proper order. From a security standpoint, an attacker is looking to exploit the condition whereby a legitimate thread or process is consumed passing a code check and the malicious code slips by unnoticed.

Question 2

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-Designed to crack WEP and WPA-PSK keys to allow packet sniffing and wireless network auditing.

Accepted Answer

H

Question 3

Probably the most popular port scanner is ____, which runs on both UNIX and Windows systems.

Accepted Answer

A)   nmap
B)   hping
C)   wireshark
D)   nipper A

Question 4

Because it accepts firewall and intrusion logs from many sources, ____ is often one of the first organizations to spot network anomalies, and it often traces them to specific malware or vulnerability exploits.

Accepted Answer

A)   Microsoft
B)   the ISC
C)   Mitre
D)   ISACs

Question 5

Allowing users to decide which mobile code to run is the best way to resolve weaknesses introduced with mobile code.

Accepted Answer

A) True 
 B)False

Question 6

A(n) ____________________ vulnerability scanner initiates traffic on the network in order to identify security holes.

Accepted Answer

The answer of A(n) ____________________ vulnerability scanner initiates traffic on...

Question 7

A(n) ____ uses all the techniques and tools available to an attacker in an attempt to compromise or penetrate an organization's defenses.

Accepted Answer

A)   audit
B)   penetration test
C)   ruleset review
D)   hash

Question 8

Which vulnerability can occur if a programmer does not properly validate user input and allows an attacker to include unintended SQL input that can be passed to a database?

Accepted Answer

A)   Rainbow attack
B)   Cross-site request forgery
C)   Command injection
D)   Buffer overflow

Question 9

____ is a vulnerability scoring system designed to provide an open and standardized method for rating IT vulnerabilities.

Accepted Answer

A)   OVAL
B)   COBIT
C)   CVE
D)   CVSS

Question 10

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-When run with the -sI switch, it allows you to bounce your scan across a firewall by using one of the idle DMZ hosts as the initiator of the scan.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 11

If Web software can access parts of the underlying operating system's file system through normal URL mappings, a(n) ____ may occur.

Accepted Answer

A)   DNS resolution error
B)   integer overflow error
C)   active network tap
D)   directory traversal attack

Question 12

The process of exploring the Internet presence of a target is sometimes called ____________________.

Accepted Answer

The answer of The process of exploring the Internet presence...

Question 13

One of the preparatory parts of the attack methodology is the collection of publicly available information about a potential target, a process known as ____.

Accepted Answer

A)   sniffing
B)   reconnaissance
C)   auditing
D)   trapping

Question 14

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-An enhanced Web scanner that, among other things, scans an entire Web site for valuable pieces of information, such as server names and e-mail addresses.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 15

Passive scanners are advantageous in that they do not require vulnerability analysts to get prior approval for testing.

Accepted Answer

A) True 
 B)False

Question 16

Why should you secure open ports?

Accepted Answer

The answer of Why should you secure open ports?...

Question 17

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-A UNIX or Linux systems support tool that allows a remote individual to "mirror" entire Web sites.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 18

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-Uses ICMP to determine the remote OS.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 19

The ____ stage of the attack methodology is a systematic survey of the target organization's Internet addresses, conducted to identify the network services offered by the hosts in that range.

Accepted Answer

A)   auditing
B)   fingerprinting
C)   activating
D)   validating

Question 20

A(n) ____________________ is a network channel or connection point in a data communications system.

Accepted Answer

The answer of A(n) ____________________ is a network channel or...

Exam 9: Network Vulnerability Assessment

What are "race conditions"?

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -Designed to crack WEP and WPA-PSK keys to allow packet sniffing and wireless network auditing.

Probably the most popular port scanner is ____, which runs on both UNIX and Windows systems.

Because it accepts firewall and intrusion logs from many sources, ____ is often one of the first organizations to spot network anomalies, and it often traces them to specific malware or vulnerability exploits.

Allowing users to decide which mobile code to run is the best way to resolve weaknesses introduced with mobile code.

A(n) ____________________ vulnerability scanner initiates traffic on the network in order to identify security holes.

A(n) ____ uses all the techniques and tools available to an attacker in an attempt to compromise or penetrate an organization's defenses.

Which vulnerability can occur if a programmer does not properly validate user input and allows an attacker to include unintended SQL input that can be passed to a database?

____ is a vulnerability scoring system designed to provide an open and standardized method for rating IT vulnerabilities.

If Web software can access parts of the underlying operating system's file system through normal URL mappings, a(n) ____ may occur.

The process of exploring the Internet presence of a target is sometimes called ____________________.

One of the preparatory parts of the attack methodology is the collection of publicly available information about a potential target, a process known as ____.

Passive scanners are advantageous in that they do not require vulnerability analysts to get prior approval for testing.

Why should you secure open ports?

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -A UNIX or Linux systems support tool that allows a remote individual to "mirror" entire Web sites.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -Uses ICMP to determine the remote OS.

The ____ stage of the attack methodology is a systematic survey of the target organization's Internet addresses, conducted to identify the network services offered by the hosts in that range.

A(n) ____________________ is a network channel or connection point in a data communications system.