Exact2Pass
Which initial procedure should an ethical hacker perform after being brought into an organization?
A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying. What actions should the CEH take?
A computer technician is using a new version of a word processing software package when it is discovered that a special sequence of characters causes the entire computer to crash. The technician researches the bug and discovers that no one else experienced the problem. What is the appropriate next step?
During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.
What is this type of DNS configuration commonly called?
Neil notices that a single address is generating traffic from its port 500 to port 500 of several other machines on the network. This scan is eating up most of the network bandwidth and Neil is concerned. As a security professional, what would you infer from this scan?
A server has been infected by a certain type of Trojan. The hacker intended to utilize it to send and host junk mails. What type of Trojan did the hacker use?
Ricardo wants to send secret messages to a competitor company. To secure these messages, he uses a technique of hiding a secret message within an ordinary message. The technique provides 'security through obscurity'.
What technique is Ricardo using?
A pentester gains access to a Windows application server and needs to determine the settings of the built-in Windows firewall. Which command would be used?
During a penetration test, the tester conducts an ACK scan using NMAP against the external interface of the DMZ firewall. NMAP reports that port 80 is unfiltered. Based on this response, which type of packet inspection is the firewall conducting?
What is the most secure way to mitigate the theft of corporate information from a laptop that was left in a hotel room?
A Network Administrator was recently promoted to Chief Security Officer at a local university. One of employee's new responsibilities is to manage the implementation of an RFID card access system to a new server room on campus. The server room will house student enrollment information that is securely backed up to an off-site location.
During a meeting with an outside consultant, the Chief Security Officer explains that he is concerned that the existing security controls have not been designed properly. Currently, the Network Administrator is responsible for approving and issuing RFID card access to the server room, as well as reviewing the electronic access logs on a weekly basis.
Which of the following is an issue with the situation?
Which of the following business challenges could be solved by using a vulnerability scanner?
Which of the following cryptography attack methods is usually performed without the use of a computer?
Which of the following conditions must be given to allow a tester to exploit a Cross-Site Request Forgery (CSRF) vulnerable web application?
Which of the following examples best represents a logical or technical control?
Which of the following processes evaluates the adherence of an organization to its stated security policy?
What is the main reason the use of a stored biometric is vulnerable to an attack?
A newly discovered flaw in a software application would be considered which kind of security vulnerability?
Which property ensures that a hash function will not produce the same hashed value for two different messages?
The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company's external webserver, VPN concentrator, and DNS servers. What should the security team do to determine which alerts to check first?
Which security strategy requires using several, varying methods to protect IT systems against attacks?
Which of the following is a primary service of the U.S. Computer Security Incident Response Team (CSIRT)?
To reduce the attack surface of a system, administrators should perform which of the following processes to remove unnecessary software, services, and insecure configuration settings?
Company A and Company B have just merged and each has its own Public Key Infrastructure (PKI). What must the Certificate Authorities (CAs) establish so that the private PKIs for Company A and Company B trust one another and each private PKI can validate digital certificates from the other company?
Which of the following describes a component of Public Key Infrastructure (PKI) where a copy of a private key is stored to provide third-party access and to facilitate recovery operations?
Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?
When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is
Which of the following items is unique to the N-tier architecture method of designing software applications?
Which of the following algorithms provides better protection against brute force attacks by using a 160-bit message digest?
While testing the company's web applications, a tester attempts to insert the following test script into the search area on the company's web site:
Afterwards, when the tester presses the search button, a pop-up box appears on the screen with the text: "Testing Testing Testing". Which vulnerability has been detected in the web application?
Which of the following is an application that requires a host application for replication?
In order to show improvement of security over time, what must be developed?
A large company intends to use Blackberry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the corporate network. What tool should the analyst use to perform a Blackjacking attack?
Which of the following is a hardware requirement that either an IDS/IPS system or a proxy server must have in order to properly function?
Which of the following describes the characteristics of a Boot Sector Virus?
Which of the following programs is usually targeted at Microsoft Office products?
Which statement is TRUE regarding network firewalls preventing Web Application attacks?
Bluetooth uses which digital modulation technique to exchange information between paired devices?
Which of the following can the administrator do to verify that a tape backup can be recovered in its entirety?
What is the main disadvantage of the scripting languages as opposed to compiled programming languages?
How does an operating system protect the passwords used for account logins?
A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems. What kind of test is being performed?
An NMAP scan of a server shows port 69 is open. What risk could this pose?
Passive reconnaissance involves collecting information through which of the following?
Which of the following techniques will identify if computer files have been changed?
Which system consists of a publicly available set of databases that contain domain name registration contact information?
The following is a sample of output from a penetration tester's machine targeting a machine with the IP address of 192.168.1.106:
What is most likely taking place?
Which results will be returned with the following Google search query?
site:target.com -site:Marketing.target.com accounting
Which of the following lists are valid data-gathering activities associated with a risk assessment?
The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:
What type of activity has been logged?
Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?
When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?
Which of the following tools would be the best choice for achieving compliance with PCI Requirement 11?
Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering policy, procedure design, and implementation?
How do employers protect assets with security policies pertaining to employee surveillance activities?
Which of the following guidelines or standards is associated with the credit card industry?
Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?
Which type of security document is written with specific step-by-step details?
International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining