Peter, a disgruntled former employee of Zapmaky Solutions Ltd., is attempting to compromise the company website, http://zapmaky.com. He used the Nmap tool to port-scan the website and obtain information about open ports and their associated services. During the scan, he noticed that the firewall deployed by Zapmaky’s IT personnel was blocking some of his requests, and he wants to bypass it.
To evade the firewall, he wants to use the stealth-scanning technique—an incomplete TCP three-way-handshake method that can effectively bypass firewall rules and logging mechanisms.
Which of the following Nmap commands should Peter run to perform stealth scanning?
Anmap -sT -v zapmaky.com
Bnmap -T4 -A -v zapmaky.com
Cnmap -sX -T4 -A -v zapmaky.com
Dnmap -sN -A zapmaky.com
0
Community Discussion
No comments yet. Be the first to start the discussion!
Adam is an IT administrator at Syncan Ltd. He is assigned various IT tasks, such as creating new user accounts, managing backups/restores, security authentication and passwords, and so on. While carrying out these tasks, he was asked to use the latest and most secure authentication protocol to encrypt users’ passwords stored in Microsoft Windows OS-based systems.
Which of the following authentication protocols should Adam use to meet this objective?
ALANMAN
BKerberos
CNTLM
DNTLMv2
0
Community Discussion
No comments yet. Be the first to start the discussion!
Rhythm Networks Pvt Ltd is a group of ethical hackers. Their client, Zombie, asked Rhythm Networks to determine how an attacker penetrated its firewall. Rhythm found that the attacker altered the addressing information in the IP packet header and the source-address bits field to bypass the firewall.
Which firewall-bypassing technique did the attacker use?
ASource routing
BProxy Server
CHTTP Tunneling
DAnonymous Website Surfing Sites
0
Community Discussion
No comments yet. Be the first to start the discussion!
An employee is attempting to access his company's internal website. When he opened a webpage, he received an error message stating Proxy Authentication Required. He reported the issue to the company's IT department. The IT staff explained that this HTTP error means the server cannot process the request because appropriate client authentication credentials are missing for a proxy server that processes requests between clients and the server.
Identify the HTTP error code that corresponds to the error message received by the employee?
A415
B417
C407
D404
0
Community Discussion
No comments yet. Be the first to start the discussion!
While scanning a test network, Paul sends TCP probe packets with the ACK flag set to a remote device and analyzes the TTL and WINDOW header fields of the received RST packets to determine whether each port is open or closed.
Analyze the scan result below and identify the open port.
APort 22
BPort 23
CPort 21
DPort 20
0
Community Discussion
No comments yet. Be the first to start the discussion!
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Irin has newly joined XYZ Ltd. as a penetration tester. As part of her onboarding training, her trainer instructed her on various legal policies and information security acts. During the training, she learned of a specific information security act concerning conduct and activities such as the following:
Performing DoS attacks on any websites or applications is illegal.
Supplying and owning hacking tools is illegal.
Accessing unauthorized computer material is illegal.
Which type of information security act best applies to the above conduct and activities?
APolice and Justice Act 2006
BData Protection Act 1998
CUSA Patriot Act 2001
DHuman Rights Act 1998
Tecty Motors Pvt. Ltd. recently deployed RFID technology in its vehicles, allowing a car owner to unlock a car through the exchange of a valid RFID signal between a reader and a tag. Jamie, however, is a hacker who decided to exploit this technology to steal a target vehicle. To attack the target vehicle, he first used an automated tool to intercept the signals between the reader and tag and capture a valid RFID signal; he later used that same signal to unlock and steal the victim's car.
Which of the following RFID attacks did Jamie perform in this scenario?
ARFID cloning
BReplay attack
CDoS attack
DPower analysis attack
James, a penetration tester, discovered a SQL injection vulnerability on the website http://www.xsecurity.com. Using sqlmap, he extracted the website's databases from the SQL Server, including one named offices.
Which of the following sqlmap queries does James issue to extract the tables associated with the offices database?
A security analyst at Techsoft Solutions is conducting penetration testing on the company’s critical IT assets. As part of this activity, he is simulating the methods and techniques of a real attacker because he has been given limited or no information about the company and its assets.
Identify the type of testing the security analyst is performing.
AAnnounced testing
BBlind testing
CWhite-box testing
DUnannounced testing
A penetration tester at Trinity Ltd. is conducting IoT device testing. As part of this process, he is checking the IoT devices for open ports with port scanners such as Nmap. After identifying the open ports, he begins using automated tools to check each open port for exploitable vulnerabilities.
Which IoT security issue is the penetration tester attempting to uncover?
AInsecure software/firmware
BLack of transport encryption
CInsecure network services
DInsufficient security configurability
Depp Networks, a leader in ethical-hacking services, was assigned to assess the strength of a client network. After using a wide range of tests, they ultimately focused on ICMP tunneling to bypass the firewall.
What makes ICMP tunneling suitable for bypassing the firewall?
ADeep packet inspection
BFirewalls can not inspect ICMP packets
CFirewalls can not handle the fragmented packets
DThe payload portion is arbitrary and not examined by most firewalls
SecGlobal Corporation hired Michael as a penetration tester. Management requested that Michael conduct cloud penetration testing on the company’s cloud infrastructure.
As part of this assignment, he reviewed all agreements with the cloud service provider and concluded that, because of the division of responsibilities between the company and the Cloud Service Provider (CSP), penetration testing cannot be performed on the cloud services used by the organization.
Identify the type of cloud service deployed by the organization?
APlatform as a service (PaaS)
BSoftware as a service (SaaS)
CAnything as a service (XaaS)
DInfrastructure as a service (IaaS)
Which port does DHCP use for client connections?
AUDP port 67
BUDP port 68
CUDP port 69
DUDP port 66
James is an attacker who intends to attack XYZ Inc. He has performed reconnaissance on all publicly available company resources and identified the official company website, http://xyz.com. He scanned every page of the company website for potential vulnerabilities to exploit. Finally, on the website's user-account login page, he found a user login form containing several fields that accept user input, such as a username and password. He also found that any non-validated query requested can be directly communicated to Active Directory, enabling unauthorized users to gain direct access to the databases. Since James knew an XYZ Inc. employee named Jason, he enters the valid username jason and injects jason)(&)) in the username field. In the password field, James enters blah and clicks the Submit button. Because the complete URL string entered by James becomes `(&(USER=jason)
(&))(PASS=blah)),only the first filter is processed by Microsoft Active Directory; that is, the query(&(USER=jason)(&))` is processed. Because this query always evaluates as true, James successfully logs in to Jason's user account without Jason's valid password.
In the scenario above, identify the type of attack James performed.
ALDAP injection attack
BHTML embedding attack
CShell injection attack
DFile injection attack
Veronica, a penetration tester at a top MNC company, is attempting to breach the company's database as part of SQLi penetration testing. She started using SQLi techniques to test the database security level. She inserted new database commands into the SQL statement and appended a SQL Server EXECUTE command to the vulnerable SQL statements.
Which SQLi technique was used to attack the database?
AFunction call injection
BFile inclusion
CBuffer Overflow
DCode injection
Frank is conducting a wireless penetration test for an organization. Using several wireless attack techniques, he successfully cracked the WPA-PSK key. He is attempting to connect to the wireless network with the WPA-PSK key, but cannot join the WLAN because the target uses MAC filtering.
What is the easiest way for Frank to bypass this and connect to the WLAN?
AAttempt to crack the WEP key
BCrack the Wi-Fi router login credentials and disable the ACL
CSniff traffic off the WLAN and spoof his MAC address to the one that he has captured
DUse deauth command from aircrack-ng to deauthenticate a connected user and hijack the session
Dale is a network administrator at Zero Faults Inc. Recently, the company’s network was compromised and is experiencing highly unusual traffic. Dale investigates the issue that compromised the network. He performed a penetration test on the network’s IDS and determined that an attacker sent spoofed packets to a broadcast address on the network.
Which of the following attacks compromised the network?
AARP Spoofing
BAmplification attack
CMAC Spoofing
DSession hijacking
Thomas is an attacker who reviewed the HTML source code of an online shopping website to look for vulnerabilities he could exploit.
He already knows that when a user selects any items on the online shopping webpage, those selections are typically stored as form-field values and sent to the application in an HTTP request (GET or POST) after the user clicks the Submit button. He also knows that some fields related to the selected items can be modified by the user (such as quantity and color), while others cannot (such as price). While reviewing the HTML code, he found that item price field values were present in the HTML code. He changed the price field values for certain items from $200 to $2 in the HTML code and successfully submitted the request to the application.
Identify the type of attack Thomas performed on the online shopping website?
ASession poisoning attack
BHidden field manipulation attack
CHTML embedding attack
DXML external entity attack
An attacker set out to compromise an organization’s network switches and steal confidential information, such as network subscriber details and passwords. The attacker began transmitting data from one switch to another by creating and sending two 802.1Q tags: one for the attacking switch and another for the victim switch. By sending these frames, the attacker tricks the victim switch into believing that the frame is intended for it. The target switch then forwards the frame to the victim port.
Identify the type of attack the attacker is performing.
ASNMP brute forcing
BMAC flooding
CIP spoofing
DVLAN hopping
Michael, a Licensed Penetration Tester, wants to make an exact copy of an original website so that he can browse it and spend additional time analyzing it.
Which of the following tools would Michael use to accomplish this task?
AVisualRoute
BNetInspector
CBlackWidow
DZaproxy
A hacker sends so many invalid requests to a cloud network host that the host consumes all its resources responding to them and disregards legitimate requests.
Identify the attack type —
ADenial of Service (DoS) attacks
BSide Channel attacks
CMan-in-the-middle cryptographic attacks
DAuthentication attacks
Steven is conducting a wireless network audit. As part of the engagement, he is attempting to crack a WPA-PSK key. Steven has captured enough packets to run aircrack-ng and discover the key, but aircrack-ng produced no result because the capture contained no authentication packets.
Which of the following commands should Steven use to generate authentication packets?
Aaireplay-ng --deauth 11 -a AA:BB:CC:DD:EE:FF
Bairmon-ng start eth0
Cairodump-ng --write capture eth0
Daircrack-ng.exe -a 2 -w capture.cap
Sam was asked to perform penetration testing on one of a client’s internal networks. During the testing process, Sam conducted enumeration to collect information about computers in a domain, the shares on individual hosts in the network, policies, and passwords.
Identify the enumeration technique.
ANTP Enumeration
BNetBIOS Enumeration
CDNS Enumeration
DSMTP Enumeration
Jason is performing a penetration-testing assignment. He is sending customized ICMP packets to a host on the target network, but the ping requests to the target failed with ICMP Time Exceeded Type = 11 error messages.
What can Jason do to resolve this error?
ASet a Fragment Offset
BIncrease the Window size in the packets
CIncrease the TTL value in the packets
DIncrease the ICMP header length
Joseph, a penetration tester employed by Xsecurity Services, was asked to conduct a penetration test of a client’s network. He received no information about the client organization other than its company name.
Identify the type of testing Joseph will perform for the client organization.
Community Discussion