Choose the BEST answer, if answer is not found in the choices, write E. 1. Bob has been hired to perform a penetration test for a company. Bob wants to attempt to gain additional information on the company’s network through sniffing. Bob attempts to overload the switch’s CAM table so that he will be able to capture more traffic passing through the switch. What method of active sniffing is he performing? A. Man-in-the-middle B. MAC flooding C. Port mirroring D. ARP spoofing 2. An open source vulnerability scanner exists that utilizes a suite of tools to perform various automated tasks. For example, it can perform port scans, test for known exploits, and examine patch levels on computers running Windows. Which tool is being described? A. Nmap B. Wireshark C. Nessus D. Ultimate Scan 999 3. Which switch of the Netcat command line utility enables the server side of the connection? A. -s B. -e C. -l D. -c 4. Dannison, a malicious user has taken advantage of a vulnerability in a web-based form. This allowed the user to corrupt, modify, and steal data. What type of attack is being described? A. Man-in-the-middle B. Session hijacking C. Buffer overflow D. SQL injection 5. Which form of malware has the ability to reproduce itself and is classified as self-contained? A. Worm B. Trojan horse C. Logic bomb D. Virus 6. What is the most common method of locating unsecured wireless networks? A. Piggybacking B. War driving C. War craft D. War dialing 7. Which type of scanning is used to determine the weaknesses of systems on a network? A. Port scanning B. Network scanning C. Windows scanning

D. Vulnerability scanning 8. What is the purpose of ARP? A. To sniff network traffic B. To perform a DNS zone transfer C. To translate IP addresses into MAC addresses D. To translate MAC addresses into IP addresses 9. Which type of hacker is described as a malicious hacker that possesses the skills required to penetrate information systems with the intention of causing harm? A. Gray hats B. Script kiddies C. White hats D. Black hats 10. You need to ensure that traffic transmitted across the network is protected from sniffing. What is the best countermeasure against packet sniffing? A. Encryption B. Firewall C. Two-Factor Authentication D. Use a switch 11. What can a hacker use to prevent their identity from being revealed during an attack? A. Banner Grabbing B. Restarting PC after the attack C. Changing MAC address D. Proxy server 12. You need to prevent unauthorized users from making either malicious or accidental changes to information. Ensuring data and objects remain unchanged unless they are modified by a legitimate source is best described as what? A. Integrity B. Confidentiality C. Availability D. Authenticity 13. What is used by a hacker to transmit one protocol over another? A. Proxy server B. Discovery channel C. Covert channel D. Overt channel 14. Which type of DoS attack consists of an attacker sending an ICMP ping packet to a network’s broadcast address using a victim’s IP address as the source? A. Smurf B. Ping-of-death C. LOIC D. ICMP attack

15. Which term is used to describe a hacker successfully using a tool, technique, or piece of software that results in the loss of system data, integrity, and availability? A. Threat B. Risk C. Exploit D. Vulnerability 16. Which term is a form of computer-based social engineering? A. Spoofing B. Snooping C. Phishing D. Dumpster Diving 17. Which Google search query would be used if you wanted to restrict results to only the documents that contain the words “security” and “tools” in the title? A. intitle:security tools B. allintitle:security tools C. site:security tools D. inurl:security tools 18. What does a hacker use to combine a Trojan with a legitimate application? A. steganography B. Overt channel C. Covert channel D. Wrapper 19. Which type of security threat would be used by an attacker to delete a resource on a specific date or time? A. Virus B. Logic Bomb C. Worm D. Trojan horse 20. Cep needs to extract elements, such as network shares and resources, groups and users, applications, and banners, using active connections and initiated directory inquiries. What will Bob do to accomplish this? A. Gaining access B. Scanning C. Enumeration D. Footprinting 21. Existence of a weakness, design, or implementation error that can lead to an unexpected and undesirable event compromising the security of the system. A. Vulnerability B. Threat C. Risk D. Attack

22. An action or event that might compromise security, it is a potential violation of security. A. Vulnerability B. Threat C. Risk D. Attack 23. A type of Penetration Test where the tester has no prior knowledge of the system or network and its security systems. A. Gray Box B. White Box C. Black Box D. Blue Box 24. Refers to the preparatory phase where an attacker seeks to gather information about a target prior to launching an attack A. Reconnaissance B. Scanning C. Gaining Access D. Maintaining Access 25. Refers to a security strategy where several protection layers are placed throughout an information system. It helps prevent direct attacks against systems and data because a break in one layer only leads the attacker to the next layer. A. Firewall Layered Approach B. Defense in Depth C. Demilitarized Zone D. OSI layers 26. Which Linux commands shows the current working directory? A. ls B. cd C. dir d. pwd 27. Which Linux command lists the running processes on the machine? A. pwd B. ls C. ps D. lp 28. Which of the following is NOT a countermeasure for footprinting? A. Securing trash B. Configuring a honeypot C. Adding sensitive data on DMZ D. Performing footprinting on your network

29. It is used to determine live hosts from a range of IP addresses by sending ICMP ECHO requests to multiple hosts. If a host is live, it will return an ICMP ECHO reply. A. Ping search B. Ping sweep C. Echo sweep D. Echo scan 30. Which of the following will not work on any current version of Microsoft Windows? A. FIN Scan B. NULL Scan C. XMAS Scan D. TCP Connect Scan 31. Which of the following is not a port scanning tool? A. nmap B. SuperScan C. netbus D. hping 32. It is defined as the process of extracting user names, machine names, network resources, shares, and services from a system. A. Enumeration B. Extraction C. Exploitation D. Fragmentation 33. It is a self-replicating program that produces its own code by attaching copies of itself into other executable codes. A. Trojan B. Virus C. Worm D. Rootkit 34. This type of virus can reprogram itself by translating its own code into a temporary representation and then back to the normal code again. A. Flu Virus B. Macro Virus C. Cluster Virus D. Metamorphic Virus 35. These are malicious programs that replicate, execute, and spread across the network connections independently without human interaction. A. Trojan B. Virus C. Worm D. Rootkit 36. Which of the following is not a password cracking tool?

A. Cain and Abel B. John the Ripper C. Hydra D. Netcat 36. It is a token to identify a 802.11 network; by default it is the part of the packet header sent over a wireless local area network. A. IIS B. BSSID C. SSID D. WEP 37. Which of the following is the most secured type of wireless encryption? A. WPA2 Personal B. WPA2 Enterprise C. WEP D. WPA 38. Which of the following tools is used for wep cracking? A. aircrack-ng B. nmap C. loic D. metasploit 39. This is the term used to define the theft of information from a wireless device through a Bluetooth connection A. Bluejacking B. Bluesmaking C. Blue Snarfing D. Blue Stealing 40. Which of the following protocols is the most vulnerable to sniffing? A. SSH B. SFTP C. HTTP D. SCP 41. Which of the following is not a sniffing tool? A. Wireshark B. Tcpdump C. Ettercap D. Lophtcrack 42. It is an attack on a computer or network that prevents legitimate use of its resources. Attackers flood a victim system with non-legitimate service requests or traffic to overload its resources, which prevents it from performing intended tasks A. DoS B. Virus attack

C. Brute force attack D. DDoS 43. It is a huge network of the compromised systems and can be used by an intruder to create denial-of-service attacks A. DMZ B. Botnet C. Intranet D. IRC 44. This term refers to attacks that cause irreversible damage to system hardware and is also known as permanent DOS. A. Flashing B. Flushing C. Phlashing D. Plumbing 45. A computer threat that tries to exploit computer application vulnerabilities that are unknown to others or undisclosed to the software developer. A. Zero-Day B. DoS C. Zero-Hour D. Malware 46. An element of Information security that assures that the information is accessible only to those authorized to have access A. Confidentiality B. Integrity C. Availability D. Non-Repudiation 47. Which type of hackers are professionals that use their skills for defensive purposes? A. Black Hats B. White Hats C. Gray Hats D. Suicide Hackers 48. This is the final step in the hackings phases which refers to the activities carried out by an attacker to hide malicious acts. A. Maintaining Access B. Reconnaissance C. Covering Tracks D. Using Proxy Servers 49. Which of the following is not part of a Vulnerability Research? A. To protect the network from being attacked by intruders B. To get information that helps to prevent the security problems C. To find weaknesses and alert the network administrator before a network attack

D. To do social engineering on a target 50. Hacklec Corp is fighting a law suit against Scamster Inc. Hacklec Corp has assigned a private investigative agency to go through garbage, recycled paper, and other rubbish at Scamster's office site in order to find relevant information. What would you call this kind of activity? A. Credit Investigation B. Scanning C. Dumpster Diving D. Garbage Scooping 51. In which location, SAM hash passwords are stored in Windows 7? A. c:\windows\system32\config\SAM B. c:\winnt\system32\machine\SAM C. c:\windows\etc\drivers\SAM D. c:\windows\config\etc\SAM 52. Greg wants to setup a protocol analyzer on his network that will receive a copy of every packet that passes through the main office switch. What type of port will Greg need to setup in order to accomplish this? A. Greg will have to configure a Bridged port that will copy all packets to the protocol analyzer. B. Greg will need to setup a SPAN port that will copy all packets to the protocol analyzer. C. Greg should setup a netbios port on the switch. D. Greg can use any port on the switch that will copy all packets to the protocol analyzer. 53. Raymond waits for a legitimate employee to swipe his access card and follows him through the open door into a secure systems area. How would you describe Jason's behavior within a security context? A. Camping B. Ninja moves C. Horseback riding D. Tailgating 54. In which part of OSI layer, ARP Poisoning occurs? A. Transport Layer B. Datalink Layer C. Physical Layer D. Application Layer 55. Justine wants to see if SQL Injection would be possible on a web application. What is the first character that Bob should use to attempt breaking valid SQL request? A. Double Quote B. Semi Column C. Exclamation Mark D. Single Quote 56. Which of the following countermeasure can specifically protect against both the MAC Flood and MAC Spoofing attacks? A. Configure Port Security on the switch B. Configure Physical Security on the switch

C. Configure a Span port on the switch D. No security is needed on the switch 57. Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering policy, procedure design, and implementation? A. Social engineering B. Access control list reviews C. Vulnerability scanning D. Penetration testing 58. Windows file servers commonly hold sensitive files, databases, passwords and more. Which of the following choices would be a common vulnerability that usually exposes them? A. Cross-site scripting B. SQL injection C. Missing patches D. Buffer overflow 59. Least privilege is a security concept that requires that a user is A. limited to those functions required to do the job. B. giver root or administrative privileges. C. trusted to keep all data and access to that data under their sole control. D. given privileges equal to everyone else in the department. 60. Which command line switch would be used in NMAP to perform operating system detection? A. -OS B. -sO C. -sP D. -O 61. Which of the following is a hashing algorithm? A. MD5 B. PGP C. DES D. ROT13 62. Which of the following open source tools would be the best choice to scan a network for potential target? A. NMAP B. NIKTO C. CAIN D. John the Ripper 63. A newly discovered flaw in a software application would be considered which kind of security vulnerability? A. Input validation flaw B. HTTP header injection vulnerability C. 0-day vulnerability

D. MS-08-067 vulnerability 64. What sequence of packets is sent during the initial TCP three-way handshake? A. SYN, SYN-ACK, ACK B. SYN, URG, ACK C. SYN, ACK, SYN-ACK D. SYN, ACK, FIN 65. Which Open Web Application Security Project implements a web application full of known vulnerabilities? A. WebBugs B. WebGoat C. WebVuln D. WebScarab 66. Which of the following attacks relies on sending an abnormally large packet size that exceeds TCP/IP specifications? A. Ping of death B. SYN flooding C. TCP hijacking D. Smurf attack 67. This method is used to determine the Operating system and version running on a remote target system. A. Service Degradation B. OS fingerprinting C. Identification Scanning D. Nslookup 68. Which property ensures that a hash function will not produce the same hashed value for two different messages? A. Collision resistance B. Bit length C. Key strength D. Rainbow tables 69. While testing web applications, Jill attempts to insert the following test script into the search area on the company's web site: <script>alert('Test')</script> . What type of web application attack is being done? A. Buffer Overflow B. SQL Injection C. Password Test attack D. Cross Site Scripting 70. It means to break or crack cryptographic systems A. Decoding B. Cryptanalysis C. Encryption

D. Hashing 71. This type of encryption uses the same secret key for encryption and decryption. A. Symmetric Encryption B. Asymmetric Encryption C. Hashing D. Block Cipher 72. It means to hide messages in another container like a picture. A. Digital Signature B. Public Key Encryption C. Hashing D. Steganography 73. Which of the following is not a social engineering countermeasure? A. Social Awareness Training B. Change Management C. Classification of Information D. Firing Employees 74. Which of the following passwords will take the longest time to crack? A. Hacklec B. h@cklec C. H@ckl3c D. hacklec 75. Which of the following is the best way to defend against wireless attacks? A. Disable SSID Broadcast B. Enable MAC address filtering C. Limit the strength of the wireless network D. Use a complex passphrase 76. This mode must be turned on for your network interface card to allow packet sniffing. A. Promiscuous mode B. Sniffing mode C. Data Capture mode D. NIC mode 77. Which is not a DoS/DDoS countermeasure? A. Throttling B. Load Balancing C. Ingress Filtering D. Installing Antivirus Software 78. How can someone determine if an LM hash contains a password that is less than 7 characters long? A. There is no way to tell because a hash cannot be reversed B. The right most portion of the hash is always the same

C. A portion of the hash will be all 0's D. The left most portion of the hash is always the same 79. When discussing passwords, what is considered a brute force attack? A. You attempt every single possibility until you exhaust all possible combinations or discover the password B. You threaten to use the rubber hose on someone unless they reveal their password C. You load a dictionary of words into your cracking program D. You wait until the password expires 80. It is a program in which the malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and cause damage, such as ruining the file allocation table on your hard disk; also known as a backdoor. A. Virus B. Worm C. Adware D. Fake AV Write the service associated with the following port numbers: 81. Port 21 82. Port 22 83. Port 23 84. Port 25 85. Port 53 86. Port 80 87. Port 139 88. Port 123 89. Port 161 90. Port 443 Bonus: Give the port number of the following services: POP3 TFTP IMAP LDAP ISAKMP rlogin syslog RDP NetBus FTPS MSSQL Tacacs Kerberos ICMP