Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
Ethical Hack M6,7,8
| Question | Answer |
|---|---|
| An attacker sends a request to an online university portal site with the information: SELECT * FROM group WHERE attack = ‘network’ AND a-type LIKE ‘ping%’; Which type of vulnerability does the attacker try to exploit? | HTTP parameter pollution |
| Because of an insecure code practice, an attacker can leverage and completely compromise an application or the underlying system. What insecure code practice enabled this catastrophic threat? | use of hard-coded credentials |
| Which type of SQL query is in the SQL statement select * from users where user = “admin”;? | static query |
| What is the best practice to mitigate the vulnerabilities from a lack of proper error handling in an application? | Use a well-thought-out scheme to provide meaningful error messages to the users but no useful information to an attacker. |
| A company uses the Microsoft Active Directory service to manage the authentication and authorization of employee workstations. The company hires a cybersecurity professional to perform compliance penetration testing. Which type of penetration testing can | LDAP injection |
| Which two attributes can be set in a web application cookie to indicate it is a persistent cookie? (Choose two.) | Expires Max-Age |
| A user is using an online shopping website to order laptop computers. Which mechanism is used by the shopping site to securely maintain user authentication during shopping? | session ID |
| What is a potentially dangerous web session management practice? | including the session ID in the URL |
| Which statement describes an example of an out-of-band SQL injection attack? | An attacker launches the attack on a web site and forces the web application to send the query results via an email. |
| A threat actor launches an SQL injection attack against a web site by sending multiple specific statements to the web site and reconstructing the key information the threat actor seeks. What type of SQL injection attack is the threat actor using? | blind |
| Which cloud technology attack method could exploit a bug in a software application to gain access to resources that normally would not be accessible to a user? | privilege escalation |
| What is a common cause of data breaches in attacks against misconfigured cloud assets? | using insecure permission configurations for cloud object storage services |
| Which mobile device vulnerability is targeted when a threat actor reverse engineers a mobile app to see how it creates and stores keys in the iOS Keychain? | insecure storage |
| Which tool could be used to find vulnerabilities that could lead to metadata service attacks? | Nimbostratus |
| Which cloud technology attack method could generate crafted packets to cause a cloud application to crash? | resource exhaustion attack |
| Which two IoT systems should never be exposed to the Internet? (Choose two.) | turbines in a power plant robots in a factory |
| Which term describes when a lower-privileged user accesses functions reserved for higher-privileged users? | vertical privilege escalation |
| Which option is a security vulnerability that affects IoT implementations? | plaintext communication and data leakage |
| Which tool is a set of open-source analysis tools that uses the ClamAV antivirus engine to help detect vulnerabilities, Trojans, backdoors, and malware in Docker images and containers? | Dagda |
| Which cloud technology attack method would require the threat actor to create a malicious application and install it into a SaaS, PaaS, or IaaS environment? | cloud malware injection attack |
| After compromising a system during a penetration testing engagement, all penetration work should be cleaned up, including extra files, system changes, and modified logs. The media sanitation methodology should be discussed with the client and the owner of | NIST SP 800-88 |
| Which resource is a Windows utility that combines the old CMD functionality with a new scripting/cmdlet instruction set with built-in system administration functionality? | PowerShell |
| An attacking system has a listener (port open), and the victim initiates a connection back to the attacking system. What type of vulnerability does this situation describe? | reverse shell |
| Which Sysinternals tool is used by penetration testers to modify Windows registry values and connect a compromised system to another system? | PsExec |
| A cybersecurity student is learning about Netcat commands that could be used in a penetration testing engagement. Which Netcat command is used to connect to a TCP port? | nc -nv |
| Which living-off-the-land post-exploitation technique can get directory listings, copy and move files, get a list of running processes, and perform administrative tasks? | PowerShell |
| After the exploitation phase, it is necessary to maintain a foothold in a compromised system to perform additional tasks. Which way could maintain persistence? | creating a bind or reverse shell |
| Which C2 utility is a PowerShell-based tool that leverages WMI to create a C2 channel? | WMImplant |
| Refer to the exhibit. An attacker opens a port or a listener on the compromised system and waits for a connection. The goal is to connect to the victim from any system, execute commands, and further manipulate the victim. What type of malicious activity i | bind shell |
| Which Meterpreter command is used to execute Meterpreter commands that are listed inside a text file and also to help accelerate the actions taken on the victim system? | resource |
| An organization has developed a network security policy stating that newly purchased routers and switches must be configured with advanced security measures before deploying them to the production network. Which threat does this policy mitigate? | Default credential attack |
| A web application configures client cookies with the HTTPOnly flag. What is the effect of this flag? | It forces the web browser to have the cookies processed only by the server. |
| Which function is provided by HTTP 2.0 to improve performance over HTTP 1.1? | HTTP 2.0 provides HTTP message multiplexing and requires fewer messages to download web content. |
| Which two functions are provided by a web proxy device? (Choose two.) | enabling HTTP transfers across a firewall caching of HTTP messages |
| An attacker launches an SQL injection attack on a web application by trying to force the application requesting the back-end database to perform multiple SELECT queries. Which technique exploits the SQL injection vulnerability on the web application? | Union operator |
| A threat actor has compromised a VM in a cloud environment that shares the same physical hardware as non-compromised VMs. Which cloud technology attack method could now be used to exfiltrate credentials, cryptographic ke | side-channel attack |
| Match the Bluetooth Low Energy (BLEMatch the Bluetooth Low Energy (BLE) phase to the description.) phase to the description. | Transport-specific key distribution |
| Phase 1 | Transport-specific key distribution |
| Phase 2 | Short-term key generation |
| Phase 3 | Pairing feature exchange |
| Which term is an essential characteristic of cloud computing as defined in NIST SP 800-145? | resource pooling |
| Which credential harvesting tool could be used to send a spear phishing email with a link to a malicious site to a target victim? | Social-Engineer Toolkit (SET) |
| Which resource is a single-page JavaScript web application that can be used to find complex attack paths in Microsoft Azure? | BloodHound |
| What task can be accomplished with the steghide tool? | to obfuscate, to evade and to cover the attacker tracks |
| Refer to the exhibit. An attacker opens a port or a listener on the compromised system and waits for a connection. The goal is to connect to the victim from any system, execute commands, and further manipulate the victim. What type of malicious activity i | bind shell |
| What kind of channel is created by a C2 with a system that has been compromised? | covert channel |
| An attacker wants to allow further connections to a compromised system and maintain persistent access. The attacker uses the Windows system command Enable-PSRemoting -SkipNetworkProfileCheck – Force. What tool is being enabled using this command? | WinRM |
| A cybersecurity student is learning about Netcat commands that could be used in a penetration testing engagement. The student wants to use Netcat as a port scanner. What command should be used? | nc -z |
| Which three tools are living-off-the-land post-exploitation techniques? (Choose three.) | PowerSploit Empire WinRM |
Created by:
jxxnixx