Question 1

Janet wants a no cost solution to blocking certain applications from lauching pop-up windows while she is surfing the web. She had tried everything her old Windows XP computer can run. Alternative browsers, freeware spyware scanner, nothing helps.

Accepted Answer

A)  She needs to understand that these pop ups are pat of using the internet and that it is impolaite to block them because the sites she is visiting for free depend on them for revenue. 
B)  SP2 upgrade with the windows firewall enabled 
C)  She needs to use Linux instead 
D)  She needs to modify the hosts file daily to point all addresses that generate the pop-ups to 0.0.0.0 to keep them from resolving.

Question 2

Dylan found a vulnerability on a web application that let him copy the sessionID out of a local cookie and place it into another cookie, therefore assuming the identity of the original user. The problem is that the server also associates the originating IP address. Dylan simply spoofs that address but he then finds he cannot establish an interactive session with the server. Why?

Accepted Answer

A)  The attack should work as stated. 
B)  There is a NAT firewall preventing this activity 
C)  Dylan cannot spoof his address over HTTP 
D)  The server will send all replies back to the spoofed IP.

Question 3

An SSID is: (Choose the best statement)

Accepted Answer

A)  Secure Set Identifier Determination 
B)  Secure Service Identification Detection 
C)  A security vulnerability 
D)  A password

Question 4

Bruno wishes to carry out a session hijack attack between hosts "Jaguar" and "Puma". They are in an established state. Puma has a receive window of 300 and Jaguar has a receive window of 350. Jaguar has just received byte 500 from Puma and Acknowledged.
What is the range of sequence numbers that Jaguar will now accept from Puma?

Accepted Answer

A)  501-851 
B)  500-850 
C)  350-500 
D)  501-801

Question 5

Using Hping, you wish to enumerate the rules of a firewall. You direct the traffic to a confirmed host and set the TTL value to one hop past the firewall, also incrementing the destination port by one with each packet. Return ICMP type 11 messages will tell you want the firewall allowed to pass.
What is this technique called?

Accepted Answer

A)  Firewall footprinting 
B)  Firewalking 
C)  Firewall enumeration 
D)  Bounce scanning

Question 6

Using netcat, cryptcat, or ncat to transfer files across a network is a common practice for a pentester because any port that will pass through the filters between the target and tiger box can be used. Which of the following commands will transfer a binary file on a commonly unfiltered web port?

Accepted Answer

A)  nc -l -u -p 8080 > /home/tiger/foo.txt 
B)  nc -l -u -p 8080 < /home/tiger/foo.txt 
C)  nc -l 8080 -u -p < /home/tiger/foo.txt 
D)  nc -l 1080 -u -p < /home/tiger/foo.txt

Question 7

You just hired a new graphic artist to work on your web site. You are cheap, and don't want to spring for a programmer because web design is all the same anyway. The new guy you hired is an expert at photoshop but hates coding tell him "Look, this makes no sense. Just follow a few of these pointers and you will be fine."
In the interest of security, what is one of the things you will tell him?

Accepted Answer

A)  Visitors enjoy it when one page of content is broken up into 5 pages. They get to click often and we get to show more advertisements. It is the best way to avoid making enimies 
B)  Never decorate text with the color blue or green as visitors will think these are links and spend all day trying to click them, they will get angry and DoS us. 
C)  Most application vulnerabilities stem from a lack of sanitizing input. They will be his fault, but no pressure. 
D)  Section 508 details all security best practices. It will get him up to speed

Question 8

Which of the following tools can be used to collect webpages for offline browsing?

Accepted Answer

A)  url snarf 
B)  mget 
C)  wget 
D)  black spider

Question 9

Curtis works for a small company. His boss isn't too interested in security issues as he isn't certain the risk is high enough. Still, Curtis wants to implement something that can collect data about just how often they are attacked, and from this, perhaps create a business case for why security must be taken seriously. He needs to know even when a simple scan is taking place.
That tool can he use?

Accepted Answer

A)  GFI Guard 
B)  NMap 
C)  Genius 
D)  Snort

Question 10

Jeremy knows that the network has been breached and several important files have been modified. After analyzing the access and firewall logs, he can't come to any sort of conclusion about exactly what happened. In the future, he wants to make sure he can detect when certain files change, then maybe use honey tokens to catch the intruders.
Of the following will accomplish this task?

Accepted Answer

A)  Kismet 
B)  Strataguard 
C)  Snortsam 
D)  Tripwire

Question 11

Assuming your own address is 192.168.1.1, what display filter could be used to show all traffic other than web and mail.

Accepted Answer

A)  host 192.168.1.1 and not (port 80 or port 25) 
B)  host 192.168.1.1 and not port 80 and not port 25 
C)  ip.addr 192.168.1.1 && ! tcp.port == 80 && ! tcp.port == 25 
D)  ip.addr 192.168.1.1 & ! tcp.port = 80 & ! tcp.port = 25

Question 12

You have been asked to setup a wireless intrusion detection system. Which of the following products fills this function?

Accepted Answer

A)  Airsnort 
B)  LIDZ 
C)  WIDS 
D)  WIPS

Question 13

What is the most accurate statement below regarding the following snort rule:
Alert tcp any any -> any 111 (content:"|00 01 86 A5|"; \ msg: "mountd access";)

Accepted Answer

A)  An alert is generated when a packet originates from anywhere and destined for any IP and port 111 
B)  An alert is generated when a packet orginates from port 111 and destined for any IP and port 
C)  An alert is generated when the string 00 01 6 A5 is seen in the payload 
D)  An alert is generated when the command mountd access is seen in a packet that is destined for port
111

Question 14

Which of the following snort rules looks for FTP login attempts?

Accepted Answer

A)  Alert tcp any any -> any any 21 (content:"user root"; msg:"FTP Login attempt";) 
B)  Alert ftp -> any port 21 (content:"user login";) 
C)  -A INPUT -j LOG -dport 21 -p TCP 
D)  Tcp.port == 21 && host eq any

Question 15

Which of the following attacks are not considered "Active Sniffing"?

Accepted Answer

A)  ARP Poisoning 
B)  MAC Flooding 
C)  MAC Spoofing 
D)  SMAC Fueling

Question 16

Which of the following forms of attack depends on an already established connection between hosts?

Accepted Answer

A)  Smurfing 
B)  Spoofing 
C)  Man in the Middle 
D)  Session hijacking

Question 17

ARP spoofing works in part because Ethernet hardware has no way of knowing if there is another NIC on the network with the same MAC address or not. True or False?

Accepted Answer

A) True 
 B)False

Question 18

You wish to capture a set of data for about 10 minutes from a host that you only have command line access to. You use TCPDump for the capture, but find it is hard to work with. You aren't so much interested in the data within the packets but statistics about how much data and of what type is being sent.
Which of the following tools can be used along with your sniffer to collect this data?

Accepted Answer

A)  IDS Wakeup 
B)  TCP Slice 
C)  Win Dump 
D)  WinpCap

Question 19

Leo wants to secure his wireless network. He implements WAP2, installs directional antennas and implements rouge infrastructure testing. What else does he need to consider? (choose up to 4)

Accepted Answer

A)  Denial of service attacks are always a threat but they are hard to prevent. A proper incident response plan must also be established 
B)  Associating with a WAP only secures the hosts. The users operating the hosts are a whole separate
Issue. 
C)  WEP provides similar functionality to a network switch. Sniffing is then improbable so that is one threat that is no longer an issue. Key distribution is the most important challenge at this point. 
D)  Interference with other items within the 2.4Ghz band might cause issues. It is important to select a channel within the range that is less populated.

Question 20

Which of the following tools cannot be used to perform a dictionary guessing attack on a web application?

Accepted Answer

A)  THC-Hydra 
B)  John the ripper 
C)  Brutus 
D)  Nikto

Exam 5: Networks and Services