Mock Test

An administrative control usually consists of policies or directives that give the organization a general format to comply with. For example, a security policy may state that the only means to log in to a workstation is through a common access card. An administrative control is also known as a soft control.

Using a /27, network administrators can successfully plan for 8 different networks. The octet value of a /27 is 32. If you count the bits in the Class C range (/25 is 128, /26 is 64, and /27 is 32), the total will be 224. Subtract 224 from 256 (the entire Class C octet value), which results in a value of 32. If you divide 256 by 32, you will receive 8, which is the number of subnets you can use, and 32 is the number of available addresses you can use per network.

Telnet uses a default port number of 23 for connection and communication.

When converting to binary, remember that we use only 0 to 9 and A to E in terms of a hexadecimal value. Anything outside of that range is invalid.

Digital Signature Authority, or DSA, is an algorithm that is used to provide digital signatures on files and email to provide nonrepudiation and authenticity. It does not provide confidentiality or integrity.

The American Registry for Internet Numbers (ARIN) is the organization that tracks and records all matters that deal with Internet matters for North America and surrounding territories. It tracks IPv4, IPv6, and autonomous system numbers as well.

Address Resolution Protocol, or ARP, is utilized at the Network layer because querying computers for their IP address is directly related to the Network layer in the OSI model.

A fence standing 8 feet tall with razor wire is considered a preventative measure because the goal is to prevent the adversary from entering the premises. It is not considered a deterrent because deterrents do not keep a persistent adversary out

The IEEE 802.11i standard does not define a Wi-Fi spectrum; it amends to the 802.11 standards to include and implement Wi-Fi Protected Access II (also known as WPA2).

In Linux, the read and execute permission value is 6 because of the number of bits set on the file record. If we wanted to give permission only to read, the value would be set to 1; for only write, the value would be 4; if we wanted to give read, write, and execute permissions, the value would be 7 because it’s the sum of 4, 2, and 1.

DHCP follows this simple process: the client discovers a DHCP server, the DHCP server offers an IP address to the client, the client requests that IP address for usage and the server acknowledges the leasing of the offered IP address to the client. The IP address is then removed from the DHCP leasing pool and is no longer reserved.

The AES algorithm uses 128-, 192-, and 256-bit keyspace for encryption.

A logic bomb is a malware that lies dormant until a certain event is cued, such as date, time, keystrokes, or even opening applications in sequential order.

. The majority of botnets are managed by the Internet Relay Chat (IRC) application, which functions as a chat room. Using this capability, the bot or zombie master is able to send commands and control functions to their bots.

This policy is called the clean desk policy. It is widely used in industries where it’s important to keep confidential and sensitive information secured by cleaning up before the workday ends. It prevents coworkers, cleaning crews, and other bystanders from pilfering and mishandling critical information.

An intranet provides access to the organization’s internal network and network applications.

A circuit-level gateway operates at the Session layer because that is the OSI layer that sets up, establishes, and terminates sessions.

With an incremental backup, only files with the archive bit set are backed up. Only the files that have been changed since the last backup are chosen to be archived.

Impersonation is a term that is associated with masquerading. It is not considered identity theft because it doesn’t involve personally identifiable information (PII) such as Social Security numbers and birthdates. The attacker merely uses a means of communication such as a phone call to fool the victim into believing that they are who they say they are.

A rootkit is a malware that embeds itself at the kernel level. It is extremely difficult to discover and remediate because of the inherent security measures that are present at the beginning in the kernel.

The Trusted Platform Module (TPM) is a chip that is soldered onto the motherboard with pre-programmed cryptographic keys. It allows the hard drive that is bonded to the motherboard to be accessible. If the hard drive is removed, it will not be accessible by any other means.

A dictionary attack is the fastest method because the adversary has a file loaded with the most commonly used passwords. Because this file is finite, this type of attack does not always work. For a guaranteed way of cracking an account, the adversary may resort to the brute force method, but this can take much longer than other methods, and in most cases, it’s not even feasible.

The user identifier, or UID, is the designator that uniquely identifies each user on the workstation.

Using Nmap, the -sU switch command allows the administrator to scan for UDP connections on a target workstation. If you receive an ICMP message of “port unreachable,” it means that the port is closed.

A top-level parent is usually represented as .org, .com, .net, .gov, and .edu. Countries also have their own parent domains, such as .ru for Russia and .kr for South Korea.

When Telnet is being used, traffic is sent in the clear, which is not beneficial because information can be compromised. This is, however, beneficial to the security administrator because they can see exactly what methods and activities the adversary is using in Telnet. When SSH came on board, it removed the capability of eavesdropping on the connections the adversary was using, and thus the security administrator lost situational awareness because the traffic was encrypted.

All through a DoS or DDoS is the actual result of the attack, the reason is that the adversary is conducting an SYN flood attack.

“Network Unknown” falls under the ICMP Type 3 (Destination Unreachable), Code 6 category.

Frequency-hopping spread spectrum is a process in which the receiver frequently hops around the frequency spectrum to avoid jamming, creating interference, and eavesdropping. The client needs to be on the same timing source as the broadcaster or the client will not be able to match the intervals in which the frequency changes.

The chance of the adversary conducting similar probing techniques on your servers from different locations is an indication that the adversary is using a web proxy service. The adversary is trying to mask their actual IP address in order to escape possible prosecution and other legal actions.

Whois.net is a free service that you can use to capture critical information for part of your footprinting when targeting a victim.

. RFC 18 covers non-routable IP addresses which are the private IP addresses. Private IP addresses are 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, and 192.168.0.0–192.168.255.255.

Type 8 is the formal ICMP echo request. There is no code associated with it. Type 8 Code 0 =, which is the ICMP echo reply.

A. In most cases, a host-based intrusion detection system (HIDS) uses a signature-based detection method to protect the host. Most HIDS, such as Tripwire and CyberSafe, download the newest rules to the client to provide protection; however, the HIDS falls sort when defending against zero-day attacks because of no known countermeasure as of yet.

In a PKI environment, the registration authority (RA) is the subject that validates a user and then vouches for their authenticity to the certificate authority, which then releases a certificate.

The method of cracking or breaking an encryption algorithm to discover either the key and/or the backdoor is called cryptanalysis.

Whenever we XOR a bit, if the two inputs are the same such as 1 and 1 or 0 and 0, then the XOR return value, or output, will always equal 0. If the two input values are different, such as 1 and 0 or 0 and 1, the return value will always be 1.

In promiscuous mode, the network adapter does not alter any of the frames that it receives. It simply just copies the frames for analysis using a protocol analyzer such as Wireshark.

The Cipher Block Chaining Message Authentication Code Protocol is an algorithm that uses a 128-bit key, which is based on the AES algorithm.

In a Fraggle attack. the adversary forges the source address, which is the webserver. The adversary will then ping the broadcast address, which causes all of the clients in that subnet to respond back to the webserver. This, in turn, causes a DDoS, but it is not the culprit. The actual attack was caused by the adversary through packet crafting and forging the source IP address of the webserver.

The final event in establishing the TCP three-way handshake is ACK.

A token is a Type 1 authentication factor, which is “something you have.”

Pharming is an attack in which you direct users to a website that looks legitimate. The goal is to trick the users into entering their credentials so that you can use them at a later date. One tool that is designed to do this is Metasploit’s Social Engineering framework.

A. If you reuse a protocol analyzer and craft a packet for an XMAS scan using URG, PSH, and FIN, you will see in the TCP header the binary format of 00101001 being set.

Soft controls usually consist of policies, procedures, guidelines, or regulations that put in or recommend control measures for effective governance.

When a backdoor is installed, it allows the adversary to conduct remote call procedures such as a reverse terminal session or remote desktop procedures. The adversary can then conduct arbitrary operations as if they are logged in locally.

Biometrics is the method of collecting and using human characteristics such as fingerprints, facial recognition, and speech pattern in order to provide authentication for system access.

RC4 is a stream symmetric cryptography stream. It is the only stream cipher in the symmetric category. RC5 and RC6 are block cipher encryption algorithms.

Digital Signature Authority, or DSA, uses symmetric encryption to provide nonrepudiation. The recipient would use their key to decrypt the hash. Then the recipient would hash the value and compare it to the sender’s hash. If the hash values match, the recipient knows that the message is authentic and came from the sender.

The inherent flaw in WEP is the IV because it is only 24 bits long and transmitted in cleartext. Using a tool called Aircrack, you can successfully exploit the vulnerability in WEP’s poor IV design; you can crack WEP within 2 minutes.

Enumeration is the act of actively engaging the target system and gathering information.

. Using nmap, the switch -sP is a ping sweep command and -O is the command to fingerprint the operating system.

POP3 is reserved for port 110. POP3 is a client/server protocol used to push email to clients.

Dig is the command used to query information about a server using its domain name.

For DNS queries, geektools.com is a sufficient resource to gain intelligence about your intended target. Whois (www.whois.net) is another popular site for DNS queries.

Telnet is an application you can use to conduct banner grabbing. If Telnet is operational on the target system, even though port 23 may be closed, it is possible to learn what type of server is being used to host by using port 80 if you are probing a web server.

Giving the owner a list of vulnerabilities is the correct answer because patched systems, disabled accounts, and revoked certificates are objects that are already accounted for.

IEEE 802.1x is the protocol for port-base network access that requires authentication.

Bonk uses UDP crafted packets to conduct a DoS on a Windows system. The UDP packets are oversized and when reconstructed can cause a crash on the target server.

A worm is an application that does not need a host of other resources from the computer to carry out its payload. It is a self-contained application, and it only needs to be introduced to the computer once to exploit the vulnerabilities found.