Question 1

KC comes into work about 30 minutes early to start a ARP poisoned attack to sniff traffic between the workstation of a fellow coworker, Greg, and the domain controller. His boss compliments him for being so early and likes his work ethic.
KC waits until Greg comes to work logs in to the domain. He sniffs the passwords and spends the rest of the afternoon cracking it. What tool can be used to perform this entire sequence?

Accepted Answer

A)  Rainbowcrack 
B)  L0phtcrack 
C)  Kerbcrack version 6 
D)  Cain and Abel

Question 2

There are many products that take a variety of approaches to protecting laptops from being stolen. They range from physically altering the laptop to make it impossible to resell, to biometric controls to complete drive encryption. Which of the following places a tracking device that can help with locating the physical location of the stolen or misplaced laptop?

Accepted Answer

A)  Stop-Lock 
B)  PAL PC Tracker 
C)  Inspice Trace 
D)  ZTrace Gold

Question 3

Carter is evaluating ways to detect intrusions on his Linux system. He has log file analysis under control as he needs to be able to easily create status reports for his boss. He is looking for tools that monitor modifications to files.
Which of the following is an option?

Accepted Answer

A)  Firewalk 
B)  Whisker 
C)  He should write his own scripts using the find command 
D)  AIDE

Question 4

Darren wants to run a stealth nmap scan that will require root privileges. Observing best practices, he does not want to be logged in as root. What is the best way to run the command?

Accepted Answer

A)  root nmap -sS 
B)  runas nmap -sS 
C)  sudo nmap -sS 
D)  start nmap -sS

Question 5

If the hash of a password is sent across the network, it might be possible to capture and replay it without ever having to attack the hash itself. In order to prevent this, and also keep the hash from being transmitted in the clear, what method can be used?

Accepted Answer

A)  Challenge / Response 
B)  SSL 
C)  Cryptographic Authentication 
D)  Cross Realm Authentication

Question 6

The ITU Protocol for sending audio-visual data across any packet based network is called:

Accepted Answer

A)  H.323 
B)  H.636 
C)  X.500 
D)  X.509

Question 7

Tabatha wants to implement two-factor authentication that includes the use of hardware devices but she doesn't have the budget for smart cards. Which of the following is her next best option?

Accepted Answer

A)  OTP (One Time Passwords) 
B)  Security Token 
C)  Proximity Cards 
D)  Biometric Devices

Question 8

Lucas is an Email administrator. He is extremely sick and tired of spam and convinces his boss to let him focus entirely on the email system for awhile. He puts into place a list of countermeasures that include: Spam prevention software at the edge of his network, DNSBLs (DNS Based Black Lists), and Mail Exchanger Callbacks. Still the SPAM comes in.
He decides the next best thing to try is a system that slows down connections to known SPAM relays to at least reduce the volume of traffic that just gets blasted in. What is this technique known as?

Accepted Answer

A)  SPAM Cannibal 
B)  Sender Policy Framework 
C)  Teergrubbing (Tar Pit) 
D)  SMTP Cannonball

Question 9

A one time, unique value that is added to an algorithm to ensure a truly random output is called ______?

Accepted Answer

A)  Nonce 
B)  IV 
C)  Salt 
D)  Seed

Question 10

Where are password hashes stored on a Linux system?

Accepted Answer

A)  /etc/credentials 
B)  /etc/passwd 
C)  /etc/shadow 
D)  /etc/sam

Question 11

Doug was just told about a set of tools known as the "dsniff' suite that runs nicely under Backtrack Linux. Which tool can he use to capture a file transfer that took place over NFS?

Accepted Answer

A)  filesnarf 
B)  urlsnarf 
C)  mailsnarf 
D)  nsfsnarf

Question 12

Using the HTTP/S Connect(), an attacker can create a:

Accepted Answer

A)  Covert tunnel 
B)  E-Commerce site 
C)  SQL Connection 
D)  Send Email

Question 13

What statement best describes the way to prevent a key generating algorithm from create the same keys, weak keys, or a batch of keys that have a lot in common?

Accepted Answer

A)  A different algorithm should be used each time to confuse the cryptanalyst 
B)  The algorithm should be salted with a one-time random value before each key is made 
C)  Only one time keys should be used, it is impossible to prevent a computer from repeating a process 
D)  Keys should always be created offline, by a dedicated system

Question 14

A method for verifying that a message is being exchanged only by two members with a prior association and that its integrity has also been maintained is called:

Accepted Answer

A)  Diffie Hellman 
B)  Message Digest Fingerprint 
C)  Message Authentication Code 
D)  Digital Watermarking

Question 15

April is noticing in her network monitoring software that an unusual amount of UDP traffic is being sent to ports 1026 and 1027 toward various hosts. He sets up a honeypot by opening a port and listening in case any of this traffic heads in his direction.
A few minutes later he sees text appear on the command console that reads and recognizes this as messenger spam. "Windows has discovered 31 critical errors. The following steps must be taken immediately: [the rest goes on to recommend a download and other destructive suggestions]"
What did April do to receive and view this message?

Accepted Answer

A)  Used Netcat with the command: nc -l -p 1026 -u -v 
B)  Used Netcat with the command: nc -l -p 31 -u -v 
C)  Used Windump with the command: windump -l -p 1026 -u -v 
D)  Sent a message back to the source asking for clarification

Question 16

Which of the following is not a block cipher?

Accepted Answer

A)  DES 
B)  Blowfish 
C)  RC4 
D)  Rijndael

Question 17

ExampleFinancial got attacked by a group of hackers from Elbonia. Forensic analysis shows that a home users machine was infected with a spreading Trojan that got into the corporate network through the VPN. The attackers wanted to use it to capture important source code but also ended up using it to obtain information from the dataset of customer information.
What policy can they implement to avoid this in the future?

Accepted Answer

A)  Enable a 25 character password for all VPN access 
B)  Do not allow VPN access from home computers 
C)  Use only dial-up connections for VPN access to a segmented gateway 
D)  Require bio-metric authentication

Question 18

There is a windows tweak that allows the storage of different login credentials using the "Stored Usernames and Passwords" applet. Which command will allow access to this tool?

Accepted Answer

A)  runas passmgr.exe 
B)  net use \server\ShowKMgr 
C)  rundll32.exe keymgr.dll, KRShowKeyMgr 
D)  runas winpassmgr.bat

Question 19

Which of the true is not correct in regards to one-time pads?

Accepted Answer

A)  There are the same or greater length than the message being encrypted 
B)  The pad itself must be exchanged out of band 
C)  A truly random pad is considered unbreakable 
D)  If the pad is generated the same way by each party, they don't need to exchange it, therefore it is never exposed to risk

Question 20

Caden is considering an email encryption technology. It must be available for multiple types of systems. Which one is his best choice?

Accepted Answer

A)  S/MIME 
B)  SSH 
C)  PGP 
D)  Yahoo

Exam 4: Operating Systems and Applications

Carter is evaluating ways to detect intrusions on his Linux system. He has log file analysis under control as he needs to be able to easily create status reports for his boss. He is looking for tools that monitor modifications to files. Which of the following is an option?