Certified Ethical Hacker 312-50v11 Practice Test

These questions are part of the practice quiz. Start practicing

• Which control is commonly used to enforce authentication of devices before they are granted network access?
• In a browser-based attack, which vulnerability allows an attacker to perform actions on a web application using the victim’s authenticated session without the user’s consent?
• Which of the following is an extremely common IDS evasion technique in the web world?
• Which attack technique allows an attacker to monitor and read activity on an iPhone even after the device is out of communication range when the device was connected to an infected public computer via iTunes Wi-Fi sync?
• What term describes intercepting and taking control of an existing TCP session by manipulating sequence numbers?
• If users can reach a site via its IP address but not by its URL, what network issue is most likely?
• By using a smart card and pin, you are using a two-factor authentication that satisfies
• Which tool is commonly used as an intrusion detection system to monitor network traffic for suspicious activity?
• Which Nmap command retrieves vendor name, product code, device name, and IP for Ethernet/IP devices?
• Identify the web application vulnerability where attackers inject client-side scripts into pages viewed by other users.
• Which protocol provides secure file transfer by encrypting data in transit?
• What is the name of the attack where DNS is manipulated to redirect traffic to the attacker's IP?
• Which information is commonly revealed by Whois footprinting?
• What is the primary purpose of a honeypot in network defense?
• During a LAN party, two friends access Jane's wireless network without a password while Jane's router uses a long, complex password. What attack is illustrated?
• Which best describes processing in a biometric system?
• In the OSI model, encryption and decryption of data using PKI typically occurs at which layer?
• Which type of cryptography are PGP, SSL, and IKE examples of?
• What should Bob recommend to deal with DNS cache poisoning threat?
• There are multiple cloud deployment options depending on isolation of resources. A community cloud involves sharing a cloud environment among a group of users or organizations. What is this deployment option called?
• An FTP server allows anonymous login and an attacker uploads and executes files; what vulnerability enables this remote attack?
• During a security assessment, which tool is used to probe web server configurations and known risky files?
• A rootkit that remains hidden in the core components of the OS—what type of rootkit is this?
• Which statement best describes a digital signature?
• In ethical hacking, infecting a system with malware and using phishing to gain credentials are examples of which phase of the ethical hacking methodology?
• Which Nmap scan type is a TCP connect scan?
• Which NIC mode passes all traffic it receives to the CPU, not just frames addressed to it?
• Todd is evaluating a counter-based authentication system. Which description best describes this type of system?
• In a cloud-hosted solution where the provider handles hardware, operating system, and software, including patching and monitoring, and the customer only manages user accounts, which service model is this?
• Which of the following is the best physical security control to protect servers in a data center?
• In the five-tier container architecture, which tier corresponds to the testing and accreditation phase?
• Which programming language is most susceptible to buffer overflow attacks due to lack of built-in bounds checking?
• Which system contains a publicly available set of databases that hold domain name registration contact information?
• What type of vulnerability assessment is performed when unusual internal network traffic is observed aimed at cracking the authentication mechanism, prompting a test of weak and outdated security controls?
• Which of the following is assured by the use of a hash?
• Automatic deletion of HTTP cookies when a web browser closes primarily mitigates which security risk?
• A security risk assessment shows the risk for a main application at 50%. After implementing controls, risk drops to 10% and the risk threshold is 20%. Which risk decision is best for maximizing business profitability?
• In TCP, which message does the client send to begin the three-way handshake?
• A new web-based software package requires three separate servers and must be accessible on the Internet. What is the recommended architecture in terms of server placement?
• You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly. What is the best Nmap command you will use?
• Don installed a gaming app from a third-party app store, resulting in all legitimate apps being replaced by deceptive ones and numerous ads. What is the attack called?
• What is the role of test automation in security testing?
• Which attack uses ARP to associate the attacker's MAC address with the gateway's IP?
• Which mechanism allows SMTP to upgrade a plain connection to a secure TLS connection?
• Using Wireshark to examine captured traffic, which display filter can be used to find unencrypted file transfers?
• Which stage of the cyber kill chain best fits the scenario of harvesting emails and delivering a client-side backdoor via email?
• Which statement best distinguishes vulnerability assessment from penetration testing?
• An attacker sends a malicious link by email that redirects the victim to a malicious webpage to steal data; what type of attack is this?
• What is the BEST defense against network sniffing?
• The collection of potentially actionable, overt, and publicly available information is known as _________________.
• Which intrusion detection system runs on individual hosts to monitor the security state of that host?
• John targeted an organization that uses LDAP for accessing distributed directory services. Which tool did he use to gather information from the LDAP service?
• During vulnerability assessment, a tester inventories the protocols on machines to determine ports and services, then selects relevant vulnerabilities and tests. What type of vulnerability assessment solution is this?
• In the NIST cloud deployment model, which role is responsible for auditing and verifying cloud security controls and compliance?
• Which Bluetooth hacking technique involves stealing information from a device via Bluetooth?
• Which testing method involves automatically generating unusual or invalid inputs to cause a program to crash or behave unexpectedly?
• To identify a target IoT device model and its certifications, which online resource is commonly used?
• Which tool performs comprehensive tests against web servers, including dangerous files and CGIs?
• Which tool is used to analyze the files produced by packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?
• Which port is associated with FTP in the NMAP scan results?
• In IPsec, AH provides which security service?
• In a digital signature scenario, who uses the public key to verify the signature?
• What is the first step to take before enabling auditing on a bank's system?
• Which tool is commonly used to identify vulnerabilities on Windows systems during security assessments?
• Which type of attack occurs when a user is redirected to a malicious site because the DNS responses have been manipulated?
• In a captured log that shows a connection utilizing port 22, which service is most likely being used?
• A hacker encoded packets with Unicode to evade IDS; the target web server could decode them. What technique was used?
• What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?
• What is the risk when credentials like usernames and passwords are transmitted in plaintext, enabling attackers to hijack sessions?
• Which wireless security protocol provides 192-bit minimum-strength security and supports GCMP-256, HMAC-SHA384, and ECDSA on a 384-bit curve?
• Which web application vulnerability occurs when attackers inject client-side script into pages viewed by other users?
• Which of the following is the best countermeasure to encrypting ransomwares?
• In security testing, an assessment performed with no prior knowledge about the target system is called?
• Which command would scan common ports with the least noise to evade IDS during an Nmap scan?
• Which type of malware can bypass application whitelisting by operating without files and using legitimate processes?
• In the bank security questions scenario, what is the most likely explanation for the compromise?
• If you want to scan fewer ports than the default in Nmap, which option would you use?
• Which UDP port is used by Network Time Protocol (NTP) as its primary means of communication?
• What is the primary function of a firewall in a network security design?
• Which of the following is not a PCI compliance recommendation?
• Which term describes a misclassification by a vulnerability scanner as benign when it is actually harmful?
• In cryptanalysis, a rubber-hose attack primarily relies on what method to obtain secrets?
• What is the primary purpose of a DMZ in a network?
• Which Linux command will resolve a domain name into an IP address?
• Which description correctly characterizes a boot sector virus?
• DHCP snooping is a great solution to prevent rogue DHCP servers on your network. Which security feature on switches leverages the DHCP snooping database to help prevent man-in-the-middle attacks?
• Which security control is designed to monitor network activity and detect unauthorized or anomalous events?
• What is the minimum number of network connections in a multihomed firewall?
• Which malware class spreads by infecting both boot sectors and executable files?
• Which countermeasure helps protect against rainbow table attacks by using random data added to each password's hash?
• In a security system, which type of device or system would contain a rule such as alert tcp any any -> 192.168.100.0/24 21 (msg: FTP on the network!);?
• The Heartbleed vulnerability exposes which cryptographic material on compromised servers?
• Which vulnerability allows executing arbitrary SQL commands by injecting malicious input into a query?
• What security feature is primarily used to prevent vehicles from crashing through building doors?
• Which cloud attack describes compromising an MSP to reach the target's cloud services?
• What is the purpose of a Demilitarized Zone (DMZ) in a network?
• Which protocol is used to securely transfer files by encrypting data and using digital certificates?
• What is the primary purpose of DNS footprinting in reconnaissance?
• Abel follows the five-tier container technology architecture and is currently verifying image contents, signing images, and sending them to registries. Which tier is this?
• Which statement best describes the information gathered during DNS footprinting?
• You have gained physical access to a Windows server and can’t guess the password. Which Linux-based tool can change any user’s password from a LiveCD?
• In a scenario where a computer cannot reach the Internet while its IP address and gateway stay within 192.168.1.0/24, which diagnosis best explains this issue?
• In the scenario where a hacker impersonates a legitimate support executive to gain access and collects passwords and documents, what attack technique was used?
• What social engineering technique did Steve use in the described scenario?
• To secure backup tapes in transit, which two measures are most appropriate?
• If a tester needs to elicit a response from a host when ICMP is blocked, which tool is commonly used to craft TCP packets for this purpose?
• How are MIB contents typically retrieved in the described SNMP setup?
• To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program. What term is commonly used when referring to this type of testing?
• In Samuel's attack, what type of attack was performed when he spoofed packets using a predicted ISN?
• A(n) __________________ is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hotspot by posing as a legitimate provider. This type of attack may be used to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up a fraudulent web site and luring people there.
• What is the attack technique employed by Jane when she copied the entire website to view its directory and file structure?
• Which file determines the basic configuration, including activities, services, and broadcast receivers, in an Android application?
• A layer 7 DDoS attack described as sending partial HTTP requests to keep connections open is called what?
• DNS cache snooping involves checking whether a resource address is present in DNS cache. Which command checks this for a given domain?
• What is the role of a MIB in SNMP?
• What is the primary purpose of the WHOIS service?
• Which of the following tools can be used for passive OS fingerprinting?
• An Intrusion Detection System (IDS) has alerted the network administrator to a possibly malicious sequence of packets sent to a Web server in the network's external DMZ. The packet traffic was captured by the IDS and saved to a PCAP file. What type of network tool can be used to determine if these packets are genuinely malicious or simply a false positive?
• Which MIB is associated with Windows Internet Name Service (WINS)?
• Which term describes the risk present before countermeasures are deployed?
• Which test would help determine whether his computer is infected by a trojan by examining network activity?
• Which activity distinguishes a penetration test from a vulnerability scan?
• Which of the following is commonly used as an IDS evasion technique in web traffic?
• Andrew is tasked with discovering all active devices hidden by a restrictive firewall in the IPv4 range. Which host discovery technique must he use?
• A new wireless client can see a 802.11 network but cannot connect, and the access point does not respond to association requests. What is a possible cause?
• Which of the following is a command line packet analyzer similar to GUI-based Wireshark?
• What technique did John use to bypass the firewall by embedding malicious data into DNS protocol packets that DNSSEC cannot detect?
• Which Nmap option combination achieves a TCP SYN ping scan?
• During a man-in-the-middle attack using a rogue wireless access point, an attacker injects HTML into HTTP responses. Which tool is commonly used to inject such HTML code?
• Which security control creates a decoy environment to attract attackers and observe them?
• Which command should John use to perform a TCP SYN ping scan using Nmap?
• Which property of a hash function makes it suitable for verifying document integrity after transmission?
• Which type of malware is primarily responsible for displaying advertisements and pop-ups on a system?
• Which SQL injection type leverages a database server's ability to make DNS requests to pass data to an attacker?
• Which hardware on a computer's motherboard stores encryption keys and releases only a portion of the key to prevent decryption on new hardware?
• Which MIB represents the standard MIB-II set of commonly used network management objects?
• A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a single server. Based on this information, what should be one of your key recommendations to the bank?
• To filter Google search results to show only files with extensions, which dork operator should be used?
• Which Bluetooth technique allows attackers to gain unauthorized backdoor access to a device?
• Which TTL value is associated with Windows operating systems when performing OS fingerprinting using TTL analysis?
• Which language feature helps prevent buffer overflow by automatically enforcing array bounds?
• What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?
• After a successful STP manipulation attack on a small network, what is the attacker likely to do next?
• Which Unix-like system file controls user privileges for sudo access?
• What term describes copying an entire website to a local drive to inspect its structure and links?
• During a security assessment, you find DNS servers in a DMZ and on the internal network. What is this DNS configuration commonly called?
• Which biometric characteristic is least likely to be used for a large company's access control?
• Which technique involves forging the sender address to mislead recipients?
• To test the response time of a true/false SQL injection result, which two techniques would be suitable?
• In an SQL injection test, what is the typical goal of using an 'or 1=1' payload within a login query?
• What social engineering term describes an attacker posing as a trustworthy contact to elicit information?
• ________ is a set of extensions to DNS that provide origin authentication of DNS data to resolvers to reduce DNS poisoning.
• To make a wireless network undiscoverable and accessible only to those who know it, which measure is used?
• To allow only HTTPS access to a bank site from the 10.10.10.0/24 network, which firewall rule would satisfy this requirement?
• What does the TTL value in a network packet help infer in OS fingerprinting?
• In a public key infrastructure scenario, which keys are used to encrypt a message for the recipient and to verify the sender's digital signature?
• What measure by the legitimate administrator can mitigate a rogue router MITM attack?
• Which option is not a block cipher algorithm?
• In CVSS v3.0, which score is used to reflect the overall severity of a vulnerability based on core characteristics such as impact and exploitability?
• Which statement best describes the AndroidManifest.xml file?
• Which vulnerability occurs when an attacker can change data by modifying URL parameters in a web request?
• Which intrusion detection system is best suited for large environments where critical assets require extra scrutiny on sensitive network segments?
• From a legal standpoint, what aspect could be troublesome when monitoring Internet traffic for all employees without informing them?
• To ensure the integrity of financial statements after CFO approval, which option would be useful?
• What does the -oX flag do in an Nmap scan?
• Which practice helps verify identity when receiving unsolicited messages claiming to be from a bank?
• What is the primary purpose of exfiltration in a data breach?
• Which Bluetooth hacking technique refers to theft of information from a wireless device via Bluetooth?
• Which TLS vulnerability involves decrypting sessions by abusing SSLv2 and a shared private key across servers?
• Which term describes vulnerabilities that were correctly identified and confirmed during testing?
• Richard used footprinting to gather domain information such as the target domain name, owner contact details, expiry date, and creation date to map the organization's network. What type of footprinting technique is this?
• In a wireless security scenario, what is the name of the attack where a rogue base station intercepts traffic between a user and the legitimate network?
• In the cyber kill chain theory model, data exfiltration occurs at which stage?
• What does MIB stand for in SNMP?
• Which DNS technique allows an attacker to piggyback data on DNS queries to bypass certain firewall rules?
• Which physical security device is primarily used to prevent vehicles from entering a restricted area?
• During the described APT operation, which lifecycle phase is being executed when spear-phishing and exploiting publicly available servers leads to malware deployment and outbound connectivity?
• In a form of encryption, blocks are 64-bit and use three 56-bit keys. Which algorithm is described?
• An organization automates operation of critical infrastructure and connects OT systems to the Internet; which tool should be used to protect against cyber espionage, zero-day attacks, and malware?
• In the captured log, which statement is most accurate about the SSH session indicated by port 22?
• Which of the following is not a Bluetooth attack?
• The Gray-box testing methodology enforces what kind of restriction?
• During a black-box pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic?
• Which tool is commonly used to test the strength of passwords by offline cracking?
• Boney uses an MITM approach to obtain a valid session ID and reuse it to connect from a victim; what is the attack called?
• Which Nmap option is used in the command to skip host discovery?
• To demonstrate a BlackBerry perimeter bypass technique, which tool would the analyst most likely use for a Blackjacking attack?
• A post-breach investigation revealed a known vulnerability in Apache Struts with a vendor fix available for months prior; this indicates a failure in which security process?
• As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing. What document describes the specifics of the testing, the associated violations, and essentially protects both the organization's interest and your liabilities as a tester?
• A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer's software and hardware without the owner's permission. Which class of hacker refers to someone who works both offensively and defensively at various times?
• In PCI DSS guidance, which statement best describes the firewall's role with cardholder data?
• Which web server configuration file is commonly misconfigured in a way that reveals verbose error messages and other information?
• In network monitoring, which term describes configuring a switch to mirror traffic to a monitoring port?
• John the Ripper is a technical assessment tool used to test the weakness of which of the following?
• Which file is a rich target to discover the structure of a website during web-server footprinting?
• For DNS tunneling using NSTX, on which port should the tool operate?
• Targeted phishing messages that mimic internal corporate emails—using logos and CEO names—are commonly called what?
• You are a Network Security Officer. Two machines: 192.168.0.99 with Snort and 192.168.0.150 with Kiwi Syslog. Which Wireshark filter will show the connections from the Snort machine to the Kiwi Syslog machine (port 514)?
• An IDS alert was logged when the administrator accessed an external router to update its configuration. What type of alert is this most likely?
• A test email indicates the gateway failed to prevent which of the following attacks?
• What term describes malware that changes its code to evade signature-based antivirus detection?
• When analyzing a web server, which Nmap script will help you determine the available HTTP methods (GET, POST, PUT, DELETE, TRACE)?
• In vulnerability management, which phase follows remediation to verify effectiveness?
• Taylor uses a tool to monitor her company's website, analyze traffic, and track the geographical location of visitors. Which tool did she employ?
• Which file guides web crawlers on which parts of a site should not be crawled?
• What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?
• Which PKI component issues and signs digital certificates to bind identities to public keys?
• Which structure is designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?
• What does a firewall examine to prevent certain ports and applications from entering an organization?
• Which RFC defines the TLS protocol that Heartbleed exploits?
• Which type of malware is typically associated with macros in Microsoft Office documents?
• What type of virus can change its own code and cipher itself multiple times as it replicates?
• What is the method to determine how a packet moves from an outside host to an internal network behind a firewall, allowing the tester to see which ports are open?
• What is the port to block first if you suspect an IoT device has been compromised?
• What type of web service API uses HTTP methods like PUT, POST, GET, and DELETE to manage resources?
• Based on the Nmap scan results showing open ports 21, 23, 80, and 139, which type of device is most likely on the target?
• Which API design approach emphasizes resources identified by URLs and uses standard HTTP methods to operate on those resources?
• In spanning-tree protocol terminology, what is the root bridge?
• Which option is best for discovering vulnerabilities on a Windows-based computer during a security assessment?
• An incident investigator attempts to correlate event logs from multiple devices, but the sequence of events does not align. What is the most likely cause?
• Which tool is commonly used to enumerate information about an email address and check breaches via the Have I Been Pwned API?
• Which Linux shell history file records the commands you type and can reveal sensitive activity if not secured?
• Which HTTP methods are considered potentially dangerous because they can modify server data?
• Which tool is commonly used to capture and inspect network traffic for security analysis?
• At which OSI layer does encryption and decryption typically occur when securing an application message?
• Mr. Omkar performed tool-based vulnerability assessment and found two vulnerabilities that are not true vulnerabilities. What will you call these issues?
• Which incident handling phase is responsible for defining rules, coordinating human resources, creating a backup plan, and testing the plans for an organization?
• After gaining MSP access, what did the attacker do with the target customer data?
• To protect against DNS cache poisoning, which security extension provides authentication of DNS data?
• Shellshock vulnerability did not directly affect which operating system?
• Which statement correctly describes DMZ relevance when an organization has internet-facing servers, regardless of firewall type?
• In a clickjacking scenario, attacker uses a transparent iframe to trick the user into clicking content underneath; what is this attack called?
• What is the effect of not applying a strong password policy to Windows accounts in a data center?
• To generate a Windows reverse TCP payload as an executable with MSFvenom, which command correctly outputs shell.exe?
• Which mode of IPSec should you use to assure security and confidentiality of data within the same LAN?
• A DHCP starvation attack floods the DHCP server with requests to exhaust IP addresses. What is this attack called?
• To create a botnet, an attacker collects information about many vulnerable machines, forms a list, infects them, and employs a spreading process across compromised machines. Which scanning technique describes this approach?
• Which defense helps prevent password-guessing attacks by limiting login attempts?
• Identify the IDS evasion technique that involves varying the payload to avoid detection, such as altering a basic injection statement.
• What is the common name for a vulnerability disclosure program opened by companies in platforms such as HackerOne?
• A hidden image loads code that steals session cookies; which risk occurred to users who clicked the image?
• In an internal security audit, a white hat who gains control over a user account attempts to access another account's confidential files. Which technique enables this?
• During web reconnaissance, which Linux command combination is most effective for extracting all links from the main page?
• Which MSFvenom command is correct to generate a Windows reverse TCP shellcode in executable form?
• Which combination of SQL injection techniques is used to determine if a condition is true via time delays or response differences?
• What is the name of the SMTP command used to transmit email over TLS?
• In the described social engineering scenario, what technique did the attacker use by contacting Sibertech and convincing them to run commands and install malicious files?
• Which MIB would you consult to access objects related to DHCP servers in a SNMP context?
• Which SMTP command is used to verify a user exists on the server?
• What kind of detection technique is used in antivirus software when malware is detected by collecting data from multiple protected systems and performing analysis in a provider's environment rather than locally?
• In the provided C code example with a buffer of size 8 being copied with a longer string, what runtime error is most likely?
• In CVSS v3.1, which range corresponds to a medium severity vulnerability?
• Which Google advanced search operator restricts results to a specific website domain?
• In a Microsoft SQL Server login form, with Username: attack or 1=1 and Password: 123456, which SQL command would be executed if injection is present?
• Which DNS record type maps hostnames to IPv4 addresses?
• In a scenario where internal hosts communicate with a single blacklisted public IP due to compromised machines, what type of attack does this illustrate?
• Which MIB defines a broad set of standard network management objects commonly used in practice?
• In cryptography, what is a collision attack?
• Which option would you use to scan fewer ports than the default in Nmap?
• Which of the following is NOT a best countermeasure against ransomware?
• Why is a penetration test considered to be more thorough than a vulnerability scan?
• Which footprinting term refers to gathering domain ownership and creation details to map a target domain?
• What is the best security policy for a data center whose perimeter is protected by firewalls and IDS/IPS, and houses Linux-based network elements?
• What is the term for a decoy system placed in a network to attract attackers?
• Which PKI component vouches for the identity of an individual or company by issuing digital certificates?
• During a penetration test, you established a connection via SMB and occasionally entered your login and password in plaintext. Which file do you have to clean to clear the password?
• Which type of attack exploits a vulnerability before a patch is released?
• In risk management, which item is commonly described as an administrative safeguard?
• What is the known plaintext attack used against DES which demonstrates that encrypting plaintext with one DES key followed by encrypting it with a second DES key is not more secure than using a single key?
• IPsec operates at which layer of the OSI model?
• Which function is NOT performed by IPsec in its suite?
• What is a key legal concern when monitoring employee Internet usage without notifying staff?
• What is the first step typically followed by vulnerability scanners before probing services on a network?
• Your company performs penetration tests and security assessments for small and medium-sized businesses in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking. What should you do?
• What initial tactic did the attacker use to infiltrate the target MSP provider and access cloud services?
• Which layer 3 protocol would provide end-to-end encryption for FTP traffic?
• To securely communicate using PGP, which key should be used to encrypt the message for the recipient?
• Which document outlines the testing boundaries, timeframes, and permitted methods for a security engagement?
• To redirect a user to a phishing site by editing a local file, which file would an attacker modify?
• Which tool did Gerard use to perform DNS footprinting and gather DNS domain names, computer names, IP addresses, DNS records, and network Whois records?
• Peter is surfing the internet looking for information about a company. Which hacking process is he performing?
• Which method of password cracking takes the most time and effort?
• What is one advantage of using both symmetric and asymmetric cryptography in SSL/TLS?
• A vulnerability with a CVSS v3.0 base score of 4.0 is usually classified as which severity?
• Which practice improves availability in a data center by preparing for downtime and ensuring continuity?
• Which virus tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?
• In cryptanalysis, what is meant by a rubber-hose attack?
• If a TCP ACK to a known closed port elicits no RST, what does this indicate about the firewall?
• In Docker architecture, which component acts as the server processing API requests and managing containers, volumes, images, and networks?
• Which cloud attack described in the scenario was performed by Alice, who infiltrated an MSP provider, accessed customer profiles, compressed data, and stored it in the MSP before launching further attacks?
• Which class of malware is most commonly associated with macros in productivity software?
• Which formula correctly represents the relationship between ALE, SLE, and ARO?
• In a vulnerability-management program, which phase involves applying fixes to vulnerable systems to reduce impact?
• What is the primary purpose of DNSSEC?
• In a PKI-based email, which key does the recipient use to verify the sender's digital signature?
• Which footprinting technique is described by encrypting browsing activity and using anonymity tools to gather information about government databases before an attack?
• In risk management, what does ARO stand for?
• What two conditions must a digital signature meet?
• The Heartbleed bug is cataloged under which CVE number?
• Dorian signs a digitally signed email to Poly. Which key is used to sign, and how will Poly verify the signature?
• A text message from a bank asks you to contact for a vital transaction. Which statement is most accurate?
• In a campus network, to prevent students from using wired ports for Internet access, which control should be implemented?
• Which program infects the system boot sector and the executable files at the same time?
• The time a hacker spends performing research to locate information about a company for phishing is known as?
• An attacker harvests two employees' emails from public sources and creates a client-side backdoor to deliver it to the employees via email. Which stage of the cyber kill chain best fits this activity?
• In a MITM scenario, a rogue wireless access point is used to intercept traffic. What is the attacker primarily trying to achieve with the traffic?
• The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1(100%). What is the closest approximate cost of this replacement and recovery operation per year?
• Which regulation defines security and privacy controls for Federal information systems and organizations?
• Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?
• In a risk assessment, which element is typically considered an administrative safeguard?
• During a penetration test, which testing method involves impersonating a trusted contact to obtain sensitive information from employees?
• Which symmetric key block cipher uses a 128-bit block size and supports key sizes up to 256 bits?
• A hidden script attached to images causes users to have a cookie theft issue; which outcome describes what occurred to the user?
• Which of the following attacks can be performed by exploiting a server that supports SSLv2 and uses the same private key on another server?
• Which statement best reflects the role of a DMZ when an organization hosts internet-facing servers?
• Which of the following is a low-tech way of gaining unauthorized access to systems?
• Which port is typically used for HTTPS traffic?
• Which command is commonly used on a Linux system to verify which network ports are listening?
• Which tool is used to detect wireless LANs that conform to the 802.11a/b/g/n standards on a Linux platform?
• In the NIST cloud deployment reference architecture, under which category does the telecom company fall when providing internet connectivity and transport services between the organization and the cloud service provider?
• In cloud service models, which service provides a platform with runtime and middleware managed by the provider, while the customer manages applications and data?
• Disabling unnecessary ISAPI filters primarily mitigates which threat?
• John is investigating web-application firewall logs and observes a code snippet: char buff[10]; buff[10] = 'a'; What type of attack is this?
• During a penetration test, which technique involves impersonating a trusted contact to obtain sensitive information from employees?
• Which switch security feature uses the DHCP snooping database to validate ARP responses and prevent ARP spoofing?
• In a scenario where a person is identified by walking patterns and RFID badges to gain physical access, which statement is correct?
• Clark used a public registry to identify the target’s IP and then queried an online registry tool to retrieve network range and topology. Which online tool did he use?
• In the described SNMP setup, which type of MIB is accessed to view the managed objects?
• Port scanning technique where FIN/ACK probes yield an RST response indicating closed ports is known as what?
• Which results will be returned with the Google search query: site:target.com -site:Marketing.target.com accounting?