Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
Ethical Hack M9&M10
| Question | Answer |
|---|---|
| Which example of technical control is recommended to mitigate and prevent vulnerabilities such as cross-site scripting, cross-site request forgery, SQL injection, and command injection? | user input sanitization |
| Which item is included in the environmental metric group used by CVSS? | confidentiality requirements |
| Which tool can ingest the results from many penetration testing tools a cybersecurity analyst uses and help this professional produce reports in formats such as CSV, HTML, and PDF? | Dradis |
| Which three items are included in the base metric group used by CVSS? (Choose three.) | attack complexity integrity impact user interaction |
| Which two items are examples of technical controls that can be recommended as mitigations and remediation of the vulnerabilities found during a pen test? (Choose two.) | multifactor authentication certificate management |
| A recent pen-test results in a cybersecurity analyst report, including information on process-level remediation, patch management, and secrets management solutions. Which control category is represented by this example? | technical |
| Which control category includes information on mandatory vacations and user training in the cybersecurity analyst report? | operational |
| Which kind of event is a successful identification of a security attack? | true positive |
| Which kinds of events are malicious activities not detected by a network security device? | false negatives |
| Which example of administrative controls enables administrators to control what users can do at both broad and granular levels? | RBAC |
| Which domain name database query utility has been restricted by the European Union´s General Data Protection Regulation (GDPR) to protect privacy? | Whois |
| Which programming language elements perform similar tasks? | Procedures and functions |
| Which two items are data structures used in programming languages? (Choose two.) | Lists Arrays |
| What is the definition of a procedure used in an application software? | It is a section of code that is created to perform a specific task. |
| Which popular Linux penetration testing distribution is based on Debian GNU/Linux and has evolved from WHoppiX, WHAX, and BackTrack? | Kali Linux |
| What is the definition of a library in application software? | It is a collection of resources that can be reused by programs. |
| Which tool is designed to find metadata and hidden information in documents? | FOCA |
| What are two tools that can be used to perform credential attacks? (Choose two.) | Mimikatz Patator |
| Which option is a PowerShell-based post-exploitation tool that can maintain persistence on a compromised system and run PowerShell agents without the need for powershell.exe? | Empire |
| Which option is a Linux distribution tool for forensic evidence collection? | CAINE |
| How is the score that CVSS provides interpreted? | scores are rated from 0 to 10, with 10 being the most severe |
| What kind of events diminishes the value and urgency of real alerts? | false positives |
| Match the term to the respective description. | e |
| false negative | malicious activities that are not detected by a network security device |
| true negative | an intrusion detection device identifies an activity as acceptable behavior and the activity is acceptable |
| false positive | a security device triggers an alarm, but there is no malicious activity or actual attack taking place |
| true positive | a successful identification of a security attack or a malicious event |
| Which vulnerability catalog creates a list of publicly known vulnerabilities, each assigned an ID number, description, and reference? | CVE |
| Which item is included in the temporal metric group used by CVSS? | exploit code maturity |
| Which document provides several cheat sheets and detailed guidance on preventing vulnerabilities such as cross-site scripting, SQL injection, and command injection? | OWASP |
| Which encoding method can secretly exfiltrate confidential data in the payload of DNS packets? | Base64 |
| Which programming language element is a block of code that can be reused multiple times to execute a specific task? | Function |
| What kind of data structure in Python is represented in the example below? | List |
| Which term describes a programming language component such as JavaScript Object Notation (JSON)? | Data structures |
| What are two tools that can be used to perform active reconnaissance? (Choose two.) | Enum4linux Zenmap |
| Which Linux distribution comes with more than 1900 security penetration testing tools? | BlackArch Linux |
Created by:
jxxnixx