Certified Ethical Hacker 312-50v11 Practice Test

These questions are part of the practice quiz. Start practicing

• The Heartbleed vulnerability exposes which cryptographic material on compromised servers?
• What is the minimum number of network connections in a multihomed firewall?
• Which class of malware is most commonly associated with macros in productivity software?
• Which statement best describes a digital signature?
• Which statement best reflects the role of a DMZ when an organization hosts internet-facing servers?
• What two conditions must a digital signature meet?
• Which switch security feature uses the DHCP snooping database to validate ARP responses and prevent ARP spoofing?
• Based on the Nmap scan results showing open ports 21, 23, 80, and 139, which type of device is most likely on the target?
• Which countermeasure helps protect against rainbow table attacks by using random data added to each password's hash?
• To identify a target IoT device model and its certifications, which online resource is commonly used?
• Which MIB defines a broad set of standard network management objects commonly used in practice?
• Which option would you use to scan fewer ports than the default in Nmap?
• What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?
• Which protocol provides secure file transfer by encrypting data in transit?
• Which tool performs comprehensive tests against web servers, including dangerous files and CGIs?
• To ensure the integrity of financial statements after CFO approval, which option would be useful?
• Which term describes the risk present before countermeasures are deployed?
• Which of the following is assured by the use of a hash?
• An organization automates operation of critical infrastructure and connects OT systems to the Internet; which tool should be used to protect against cyber espionage, zero-day attacks, and malware?
• In IPsec, AH provides which security service?
• Mr. Omkar performed tool-based vulnerability assessment and found two vulnerabilities that are not true vulnerabilities. What will you call these issues?
• A post-breach investigation revealed a known vulnerability in Apache Struts with a vendor fix available for months prior; this indicates a failure in which security process?
• John targeted an organization that uses LDAP for accessing distributed directory services. Which tool did he use to gather information from the LDAP service?
• Which formula correctly represents the relationship between ALE, SLE, and ARO?
• In spanning-tree protocol terminology, what is the root bridge?
• During a LAN party, two friends access Jane's wireless network without a password while Jane's router uses a long, complex password. What attack is illustrated?
• Using Wireshark to examine captured traffic, which display filter can be used to find unencrypted file transfers?
• In the described SNMP setup, which type of MIB is accessed to view the managed objects?
• John is investigating web-application firewall logs and observes a code snippet: char buff[10]; buff[10] = 'a'; What type of attack is this?
• Which hardware on a computer's motherboard stores encryption keys and releases only a portion of the key to prevent decryption on new hardware?
• A(n) __________________ is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hotspot by posing as a legitimate provider. This type of attack may be used to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up a fraudulent web site and luring people there.
• At which OSI layer does encryption and decryption typically occur when securing an application message?
• Which SQL injection type leverages a database server's ability to make DNS requests to pass data to an attacker?
• The Gray-box testing methodology enforces what kind of restriction?
• You are a Network Security Officer. Two machines: 192.168.0.99 with Snort and 192.168.0.150 with Kiwi Syslog. Which Wireshark filter will show the connections from the Snort machine to the Kiwi Syslog machine (port 514)?
• In a digital signature scenario, who uses the public key to verify the signature?
• Port scanning technique where FIN/ACK probes yield an RST response indicating closed ports is known as what?
• To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program. What term is commonly used when referring to this type of testing?
• In the captured log, which statement is most accurate about the SSH session indicated by port 22?
• A new web-based software package requires three separate servers and must be accessible on the Internet. What is the recommended architecture in terms of server placement?
• Todd is evaluating a counter-based authentication system. Which description best describes this type of system?
• Which SMTP command is used to verify a user exists on the server?
• After a successful STP manipulation attack on a small network, what is the attacker likely to do next?
• Which Bluetooth hacking technique refers to theft of information from a wireless device via Bluetooth?
• In a scenario where a computer cannot reach the Internet while its IP address and gateway stay within 192.168.1.0/24, which diagnosis best explains this issue?
• In network monitoring, which term describes configuring a switch to mirror traffic to a monitoring port?
• In security testing, an assessment performed with no prior knowledge about the target system is called?
• Identify the web application vulnerability where attackers inject client-side scripts into pages viewed by other users.
• Which results will be returned with the Google search query: site:target.com -site:Marketing.target.com accounting?
• Which statement best describes the information gathered during DNS footprinting?
• In vulnerability management, which phase follows remediation to verify effectiveness?
• Which intrusion detection system is best suited for large environments where critical assets require extra scrutiny on sensitive network segments?
• In a cloud-hosted solution where the provider handles hardware, operating system, and software, including patching and monitoring, and the customer only manages user accounts, which service model is this?
• From a legal standpoint, what aspect could be troublesome when monitoring Internet traffic for all employees without informing them?
• In the five-tier container architecture, which tier corresponds to the testing and accreditation phase?
• Which malware class spreads by infecting both boot sectors and executable files?
• What type of virus can change its own code and cipher itself multiple times as it replicates?
• Which DNS technique allows an attacker to piggyback data on DNS queries to bypass certain firewall rules?
• A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a single server. Based on this information, what should be one of your key recommendations to the bank?
• Which web application vulnerability occurs when attackers inject client-side script into pages viewed by other users?
• To protect against DNS cache poisoning, which security extension provides authentication of DNS data?
• Which option is best for discovering vulnerabilities on a Windows-based computer during a security assessment?
• Which vulnerability allows executing arbitrary SQL commands by injecting malicious input into a query?
• An attacker sends a malicious link by email that redirects the victim to a malicious webpage to steal data; what type of attack is this?
• Which command is commonly used on a Linux system to verify which network ports are listening?
• For DNS tunneling using NSTX, on which port should the tool operate?
• Which combination of SQL injection techniques is used to determine if a condition is true via time delays or response differences?
• What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?
• Which term describes vulnerabilities that were correctly identified and confirmed during testing?
• During a penetration test, you established a connection via SMB and occasionally entered your login and password in plaintext. Which file do you have to clean to clear the password?
• DHCP snooping is a great solution to prevent rogue DHCP servers on your network. Which security feature on switches leverages the DHCP snooping database to help prevent man-in-the-middle attacks?
• Which mechanism allows SMTP to upgrade a plain connection to a secure TLS connection?
• Richard used footprinting to gather domain information such as the target domain name, owner contact details, expiry date, and creation date to map the organization's network. What type of footprinting technique is this?
• The Heartbleed bug is cataloged under which CVE number?
• Which structure is designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?
• Which tool is commonly used to test the strength of passwords by offline cracking?
• What is the role of test automation in security testing?
• Which term describes a misclassification by a vulnerability scanner as benign when it is actually harmful?
• What is the first step typically followed by vulnerability scanners before probing services on a network?
• Dorian signs a digitally signed email to Poly. Which key is used to sign, and how will Poly verify the signature?
• In an SQL injection test, what is the typical goal of using an 'or 1=1' payload within a login query?
• Which MSFvenom command is correct to generate a Windows reverse TCP shellcode in executable form?
• Which regulation defines security and privacy controls for Federal information systems and organizations?
• During a man-in-the-middle attack using a rogue wireless access point, an attacker injects HTML into HTTP responses. Which tool is commonly used to inject such HTML code?
• Andrew is tasked with discovering all active devices hidden by a restrictive firewall in the IPv4 range. Which host discovery technique must he use?
• In a scenario where a person is identified by walking patterns and RFID badges to gain physical access, which statement is correct?
• Which of the following is a low-tech way of gaining unauthorized access to systems?
• Which physical security device is primarily used to prevent vehicles from entering a restricted area?
• Which type of malware can bypass application whitelisting by operating without files and using legitimate processes?
• A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer's software and hardware without the owner's permission. Which class of hacker refers to someone who works both offensively and defensively at various times?
• A security risk assessment shows the risk for a main application at 50%. After implementing controls, risk drops to 10% and the risk threshold is 20%. Which risk decision is best for maximizing business profitability?
• What security feature is primarily used to prevent vehicles from crashing through building doors?
• Which tool is commonly used to enumerate information about an email address and check breaches via the Have I Been Pwned API?
• Which statement correctly describes DMZ relevance when an organization has internet-facing servers, regardless of firewall type?
• In cryptanalysis, what is meant by a rubber-hose attack?
• An IDS alert was logged when the administrator accessed an external router to update its configuration. What type of alert is this most likely?
• An Intrusion Detection System (IDS) has alerted the network administrator to a possibly malicious sequence of packets sent to a Web server in the network's external DMZ. The packet traffic was captured by the IDS and saved to a PCAP file. What type of network tool can be used to determine if these packets are genuinely malicious or simply a false positive?
• There are multiple cloud deployment options depending on isolation of resources. A community cloud involves sharing a cloud environment among a group of users or organizations. What is this deployment option called?
• Boney uses an MITM approach to obtain a valid session ID and reuse it to connect from a victim; what is the attack called?
• What is the effect of not applying a strong password policy to Windows accounts in a data center?
• In a security system, which type of device or system would contain a rule such as alert tcp any any -> 192.168.100.0/24 21 (msg: FTP on the network!);?
• Which Unix-like system file controls user privileges for sudo access?
• In ethical hacking, infecting a system with malware and using phishing to gain credentials are examples of which phase of the ethical hacking methodology?
• Which information is commonly revealed by Whois footprinting?
• In the scenario where a hacker impersonates a legitimate support executive to gain access and collects passwords and documents, what attack technique was used?
• During web reconnaissance, which Linux command combination is most effective for extracting all links from the main page?
• What initial tactic did the attacker use to infiltrate the target MSP provider and access cloud services?
• Which port is typically used for HTTPS traffic?
• A new wireless client can see a 802.11 network but cannot connect, and the access point does not respond to association requests. What is a possible cause?
• Which of the following is the best countermeasure to encrypting ransomwares?
• Which attack uses ARP to associate the attacker's MAC address with the gateway's IP?
• Which of the following is commonly used as an IDS evasion technique in web traffic?
• Which UDP port is used by Network Time Protocol (NTP) as its primary means of communication?
• To secure backup tapes in transit, which two measures are most appropriate?
• Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?
• What is the risk when credentials like usernames and passwords are transmitted in plaintext, enabling attackers to hijack sessions?
• If you want to scan fewer ports than the default in Nmap, which option would you use?
• What is one advantage of using both symmetric and asymmetric cryptography in SSL/TLS?
• In a browser-based attack, which vulnerability allows an attacker to perform actions on a web application using the victim’s authenticated session without the user’s consent?
• After gaining MSP access, what did the attacker do with the target customer data?
• To demonstrate a BlackBerry perimeter bypass technique, which tool would the analyst most likely use for a Blackjacking attack?
• Which type of malware is primarily responsible for displaying advertisements and pop-ups on a system?
• Which of the following is NOT a best countermeasure against ransomware?
• A rootkit that remains hidden in the core components of the OS—what type of rootkit is this?
• Which system contains a publicly available set of databases that hold domain name registration contact information?
• Taylor uses a tool to monitor her company's website, analyze traffic, and track the geographical location of visitors. Which tool did she employ?
• Which function is NOT performed by IPsec in its suite?
• If users can reach a site via its IP address but not by its URL, what network issue is most likely?
• What term describes copying an entire website to a local drive to inspect its structure and links?
• What is the primary purpose of a DMZ in a network?
• Which HTTP methods are considered potentially dangerous because they can modify server data?
• What is the first step to take before enabling auditing on a bank's system?
• What does MIB stand for in SNMP?
• Which file guides web crawlers on which parts of a site should not be crawled?
• In a Microsoft SQL Server login form, with Username: attack or 1=1 and Password: 123456, which SQL command would be executed if injection is present?
• Which programming language is most susceptible to buffer overflow attacks due to lack of built-in bounds checking?
• Which technique involves forging the sender address to mislead recipients?
• Which activity distinguishes a penetration test from a vulnerability scan?
• DNS cache snooping involves checking whether a resource address is present in DNS cache. Which command checks this for a given domain?
• What social engineering term describes an attacker posing as a trustworthy contact to elicit information?
• A hidden script attached to images causes users to have a cookie theft issue; which outcome describes what occurred to the user?
• What is the primary purpose of DNSSEC?
• In cloud service models, which service provides a platform with runtime and middleware managed by the provider, while the customer manages applications and data?
• What type of vulnerability assessment is performed when unusual internal network traffic is observed aimed at cracking the authentication mechanism, prompting a test of weak and outdated security controls?
• Which tool is commonly used to identify vulnerabilities on Windows systems during security assessments?
• Which tool is used to detect wireless LANs that conform to the 802.11a/b/g/n standards on a Linux platform?
• Which type of malware is typically associated with macros in Microsoft Office documents?
• What is the attack technique employed by Jane when she copied the entire website to view its directory and file structure?
• Which defense helps prevent password-guessing attacks by limiting login attempts?
• Targeted phishing messages that mimic internal corporate emails—using logos and CEO names—are commonly called what?
• A hidden image loads code that steals session cookies; which risk occurred to users who clicked the image?
• A layer 7 DDoS attack described as sending partial HTTP requests to keep connections open is called what?
• In CVSS v3.1, which range corresponds to a medium severity vulnerability?
• What is the primary purpose of the WHOIS service?
• Which attack technique allows an attacker to monitor and read activity on an iPhone even after the device is out of communication range when the device was connected to an infected public computer via iTunes Wi-Fi sync?
• What type of web service API uses HTTP methods like PUT, POST, GET, and DELETE to manage resources?
• What is the best security policy for a data center whose perimeter is protected by firewalls and IDS/IPS, and houses Linux-based network elements?
• The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1(100%). What is the closest approximate cost of this replacement and recovery operation per year?
• In a scenario where internal hosts communicate with a single blacklisted public IP due to compromised machines, what type of attack does this illustrate?
• In CVSS v3.0, which score is used to reflect the overall severity of a vulnerability based on core characteristics such as impact and exploitability?
• The collection of potentially actionable, overt, and publicly available information is known as _________________.
• Why is a penetration test considered to be more thorough than a vulnerability scan?
• Which practice helps verify identity when receiving unsolicited messages claiming to be from a bank?
• To create a botnet, an attacker collects information about many vulnerable machines, forms a list, infects them, and employs a spreading process across compromised machines. Which scanning technique describes this approach?
• Your company performs penetration tests and security assessments for small and medium-sized businesses in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking. What should you do?
• What is the common name for a vulnerability disclosure program opened by companies in platforms such as HackerOne?
• What does the -oX flag do in an Nmap scan?
• What technique did John use to bypass the firewall by embedding malicious data into DNS protocol packets that DNSSEC cannot detect?
• In a clickjacking scenario, attacker uses a transparent iframe to trick the user into clicking content underneath; what is this attack called?
• Which type of attack occurs when a user is redirected to a malicious site because the DNS responses have been manipulated?
• In the described social engineering scenario, what technique did the attacker use by contacting Sibertech and convincing them to run commands and install malicious files?
• During the described APT operation, which lifecycle phase is being executed when spear-phishing and exploiting publicly available servers leads to malware deployment and outbound connectivity?
• What is the role of a MIB in SNMP?
• Which control is commonly used to enforce authentication of devices before they are granted network access?
• Which of the following is an extremely common IDS evasion technique in the web world?
• Don installed a gaming app from a third-party app store, resulting in all legitimate apps being replaced by deceptive ones and numerous ads. What is the attack called?
• In PCI DSS guidance, which statement best describes the firewall's role with cardholder data?
• Which Linux command will resolve a domain name into an IP address?
• Which practice improves availability in a data center by preparing for downtime and ensuring continuity?
• In a PKI-based email, which key does the recipient use to verify the sender's digital signature?
• What is the method to determine how a packet moves from an outside host to an internal network behind a firewall, allowing the tester to see which ports are open?
• Which tool is commonly used to capture and inspect network traffic for security analysis?
• In an internal security audit, a white hat who gains control over a user account attempts to access another account's confidential files. Which technique enables this?
• Which API design approach emphasizes resources identified by URLs and uses standard HTTP methods to operate on those resources?
• Disabling unnecessary ISAPI filters primarily mitigates which threat?
• An FTP server allows anonymous login and an attacker uploads and executes files; what vulnerability enables this remote attack?
• What does a firewall examine to prevent certain ports and applications from entering an organization?
• Which NIC mode passes all traffic it receives to the CPU, not just frames addressed to it?
• In a form of encryption, blocks are 64-bit and use three 56-bit keys. Which algorithm is described?
• Which wireless security protocol provides 192-bit minimum-strength security and supports GCMP-256, HMAC-SHA384, and ECDSA on a 384-bit curve?
• Which Bluetooth hacking technique involves stealing information from a device via Bluetooth?
• What measure by the legitimate administrator can mitigate a rogue router MITM attack?
• Which Nmap option combination achieves a TCP SYN ping scan?
• Which mode of IPSec should you use to assure security and confidentiality of data within the same LAN?
• Which MIB represents the standard MIB-II set of commonly used network management objects?
• Which type of cryptography are PGP, SSL, and IKE examples of?
• In Samuel's attack, what type of attack was performed when he spoofed packets using a predicted ISN?
• What is the primary purpose of exfiltration in a data breach?
• Which command would scan common ports with the least noise to evade IDS during an Nmap scan?
• Which of the following is the best physical security control to protect servers in a data center?
• Which statement best describes the AndroidManifest.xml file?
• Which of the following is a command line packet analyzer similar to GUI-based Wireshark?
• During a penetration test, which technique involves impersonating a trusted contact to obtain sensitive information from employees?
• Shellshock vulnerability did not directly affect which operating system?
• During a penetration test, which testing method involves impersonating a trusted contact to obtain sensitive information from employees?
• To redirect a user to a phishing site by editing a local file, which file would an attacker modify?
• Which command should John use to perform a TCP SYN ping scan using Nmap?
• Which protocol is used to securely transfer files by encrypting data and using digital certificates?
• What is the term for a decoy system placed in a network to attract attackers?
• ________ is a set of extensions to DNS that provide origin authentication of DNS data to resolvers to reduce DNS poisoning.
• An attacker harvests two employees' emails from public sources and creates a client-side backdoor to deliver it to the employees via email. Which stage of the cyber kill chain best fits this activity?
• What is the known plaintext attack used against DES which demonstrates that encrypting plaintext with one DES key followed by encrypting it with a second DES key is not more secure than using a single key?
• In the bank security questions scenario, what is the most likely explanation for the compromise?
• As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing. What document describes the specifics of the testing, the associated violations, and essentially protects both the organization's interest and your liabilities as a tester?
• A hacker encoded packets with Unicode to evade IDS; the target web server could decode them. What technique was used?
• Which footprinting term refers to gathering domain ownership and creation details to map a target domain?
• Which of the following is not a PCI compliance recommendation?
• Which biometric characteristic is least likely to be used for a large company's access control?
• Which Linux shell history file records the commands you type and can reveal sensitive activity if not secured?
• During a black-box pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic?
• Which option is not a block cipher algorithm?
• Which program infects the system boot sector and the executable files at the same time?
• Which TLS vulnerability involves decrypting sessions by abusing SSLv2 and a shared private key across servers?
• Which statement best distinguishes vulnerability assessment from penetration testing?
• Which stage of the cyber kill chain best fits the scenario of harvesting emails and delivering a client-side backdoor via email?
• Which RFC defines the TLS protocol that Heartbleed exploits?
• A test email indicates the gateway failed to prevent which of the following attacks?
• What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?
• In a vulnerability-management program, which phase involves applying fixes to vulnerable systems to reduce impact?
• Clark used a public registry to identify the target’s IP and then queried an online registry tool to retrieve network range and topology. Which online tool did he use?
• During a security assessment, which tool is used to probe web server configurations and known risky files?
• To allow only HTTPS access to a bank site from the 10.10.10.0/24 network, which firewall rule would satisfy this requirement?
• In risk management, which item is commonly described as an administrative safeguard?
• Which symmetric key block cipher uses a 128-bit block size and supports key sizes up to 256 bits?
• Peter is surfing the internet looking for information about a company. Which hacking process is he performing?
• Which method of password cracking takes the most time and effort?
• What is the name of the attack where DNS is manipulated to redirect traffic to the attacker's IP?
• What term describes intercepting and taking control of an existing TCP session by manipulating sequence numbers?
• Which of the following is not a Bluetooth attack?
• Which file determines the basic configuration, including activities, services, and broadcast receivers, in an Android application?
• You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly. What is the best Nmap command you will use?
• What is the primary purpose of DNS footprinting in reconnaissance?
• To securely communicate using PGP, which key should be used to encrypt the message for the recipient?
• Which test would help determine whether his computer is infected by a trojan by examining network activity?
• What is a key legal concern when monitoring employee Internet usage without notifying staff?
• Which incident handling phase is responsible for defining rules, coordinating human resources, creating a backup plan, and testing the plans for an organization?
• In cryptography, what is a collision attack?
• In Docker architecture, which component acts as the server processing API requests and managing containers, volumes, images, and networks?
• What is the primary function of a firewall in a network security design?
• Which of the following attacks can be performed by exploiting a server that supports SSLv2 and uses the same private key on another server?
• What is the primary purpose of a honeypot in network defense?
• In a risk assessment, which element is typically considered an administrative safeguard?
• You have gained physical access to a Windows server and can’t guess the password. Which Linux-based tool can change any user’s password from a LiveCD?
• If a TCP ACK to a known closed port elicits no RST, what does this indicate about the firewall?
• Which Nmap scan type is a TCP connect scan?
• What is the purpose of a Demilitarized Zone (DMZ) in a network?
• In a captured log that shows a connection utilizing port 22, which service is most likely being used?
• Which intrusion detection system runs on individual hosts to monitor the security state of that host?
• When analyzing a web server, which Nmap script will help you determine the available HTTP methods (GET, POST, PUT, DELETE, TRACE)?
• Which vulnerability occurs when an attacker can change data by modifying URL parameters in a web request?
• Which cloud attack describes compromising an MSP to reach the target's cloud services?
• Which layer 3 protocol would provide end-to-end encryption for FTP traffic?
• IPsec operates at which layer of the OSI model?
• What term describes malware that changes its code to evade signature-based antivirus detection?
• Which tool did Gerard use to perform DNS footprinting and gather DNS domain names, computer names, IP addresses, DNS records, and network Whois records?
• What is the port to block first if you suspect an IoT device has been compromised?
• In a MITM scenario, a rogue wireless access point is used to intercept traffic. What is the attacker primarily trying to achieve with the traffic?
• To make a wireless network undiscoverable and accessible only to those who know it, which measure is used?
• During a security assessment, you find DNS servers in a DMZ and on the internal network. What is this DNS configuration commonly called?
• In the OSI model, encryption and decryption of data using PKI typically occurs at which layer?
• In the provided C code example with a buffer of size 8 being copied with a longer string, what runtime error is most likely?
• In the NIST cloud deployment model, which role is responsible for auditing and verifying cloud security controls and compliance?
• In a campus network, to prevent students from using wired ports for Internet access, which control should be implemented?
• Which footprinting technique is described by encrypting browsing activity and using anonymity tools to gather information about government databases before an attack?
• What kind of detection technique is used in antivirus software when malware is detected by collecting data from multiple protected systems and performing analysis in a provider's environment rather than locally?
• If a tester needs to elicit a response from a host when ICMP is blocked, which tool is commonly used to craft TCP packets for this purpose?
• Which description correctly characterizes a boot sector virus?
• In cryptanalysis, a rubber-hose attack primarily relies on what method to obtain secrets?
• In the NIST cloud deployment reference architecture, under which category does the telecom company fall when providing internet connectivity and transport services between the organization and the cloud service provider?
• Which Nmap command retrieves vendor name, product code, device name, and IP for Ethernet/IP devices?
• Which Google advanced search operator restricts results to a specific website domain?
• A vulnerability with a CVSS v3.0 base score of 4.0 is usually classified as which severity?
• In risk management, what does ARO stand for?
• During vulnerability assessment, a tester inventories the protocols on machines to determine ports and services, then selects relevant vulnerabilities and tests. What type of vulnerability assessment solution is this?
• Which tool is commonly used as an intrusion detection system to monitor network traffic for suspicious activity?
• What social engineering technique did Steve use in the described scenario?
• In a public key infrastructure scenario, which keys are used to encrypt a message for the recipient and to verify the sender's digital signature?
• Which file is a rich target to discover the structure of a website during web-server footprinting?
• Which web server configuration file is commonly misconfigured in a way that reveals verbose error messages and other information?
• Which DNS record type maps hostnames to IPv4 addresses?
• Which property of a hash function makes it suitable for verifying document integrity after transmission?
• In TCP, which message does the client send to begin the three-way handshake?
• Which virus tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?
• The time a hacker spends performing research to locate information about a company for phishing is known as?
• What should Bob recommend to deal with DNS cache poisoning threat?
• Which PKI component vouches for the identity of an individual or company by issuing digital certificates?
• Which tool is used to analyze the files produced by packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?
• Which PKI component issues and signs digital certificates to bind identities to public keys?
• Which port is associated with FTP in the NMAP scan results?
• In a wireless security scenario, what is the name of the attack where a rogue base station intercepts traffic between a user and the legitimate network?
• What is the name of the SMTP command used to transmit email over TLS?
• John the Ripper is a technical assessment tool used to test the weakness of which of the following?
• By using a smart card and pin, you are using a two-factor authentication that satisfies
• Abel follows the five-tier container technology architecture and is currently verifying image contents, signing images, and sending them to registries. Which tier is this?
• To generate a Windows reverse TCP payload as an executable with MSFvenom, which command correctly outputs shell.exe?
• A DHCP starvation attack floods the DHCP server with requests to exhaust IP addresses. What is this attack called?
• Which of the following tools can be used for passive OS fingerprinting?
• In the cyber kill chain theory model, data exfiltration occurs at which stage?
• Which testing method involves automatically generating unusual or invalid inputs to cause a program to crash or behave unexpectedly?
• Which cloud attack described in the scenario was performed by Alice, who infiltrated an MSP provider, accessed customer profiles, compressed data, and stored it in the MSP before launching further attacks?
• To filter Google search results to show only files with extensions, which dork operator should be used?
• Which document outlines the testing boundaries, timeframes, and permitted methods for a security engagement?
• A text message from a bank asks you to contact for a vital transaction. Which statement is most accurate?
• Which security control is designed to monitor network activity and detect unauthorized or anomalous events?
• Which security control creates a decoy environment to attract attackers and observe them?
• Which Nmap option is used in the command to skip host discovery?
• What is the BEST defense against network sniffing?
• To test the response time of a true/false SQL injection result, which two techniques would be suitable?
• Which type of attack exploits a vulnerability before a patch is released?
• Which best describes processing in a biometric system?
• An incident investigator attempts to correlate event logs from multiple devices, but the sequence of events does not align. What is the most likely cause?
• Automatic deletion of HTTP cookies when a web browser closes primarily mitigates which security risk?
• Which language feature helps prevent buffer overflow by automatically enforcing array bounds?
• Which Bluetooth technique allows attackers to gain unauthorized backdoor access to a device?
• Which TTL value is associated with Windows operating systems when performing OS fingerprinting using TTL analysis?
• How are MIB contents typically retrieved in the described SNMP setup?
• Identify the IDS evasion technique that involves varying the payload to avoid detection, such as altering a basic injection statement.
• What does the TTL value in a network packet help infer in OS fingerprinting?
• Which MIB would you consult to access objects related to DHCP servers in a SNMP context?
• Which MIB is associated with Windows Internet Name Service (WINS)?