CCC

What would be the purpose of running "wget 192.168.0.15 -q -S" against a web server?. Downloading all the contents of the web page locally for further examination. Flooding the web server with requests to perform a DoS attack. Using wget to perform banner grabbing on the webserver. Performing content enumeration on the web server to discover hidden folders.

As a certified ethical hacker, you are tasked with gaining information about an enterprise's internal network. You are permitted to test the network's security using enumeration techniques. You successfully obtain a list of usernames using email IDs and execute a DNS Zone Transfer. Which enumeration technique would be most effective for your next move given that you have identified open TCP ports 25 (SMTP) and 139 (NetBIOS Session Service)?. Exploit the NFS protocol on TCP port 2049 to gain control over a remote system. Use SNMP to extract usernames given the community strings. Exploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file system. Perform a brute force attack on Microsoft Active Directory to extract valid usernames.

As part of a penetration testing team, you've discovered a web application vulnerable to Cross-Site Scripting (XSS). The application sanitizes inputs against standard XSS payloads but fails to filter out HTML-encoded characters. On further analysis, you've noticed that the web application uses cookies to track session IDs. You decide to exploit the XSS vulnerability to steal users' session cookies. However, the application implements HTTPOnly cookies, complicating your original plan. Which of the following would be the most viable strategy for a successful attack?. Build an XSS payload using HTML encoding and use it to exploit the server-side code, potentially disabling the HTTPOnly flag on cookies. Develop a browser exploit to bypass the HTTPOnly restriction, then use a HTML-encoded XSS payload to retrieve the cookies. Create a sophisticated XSS payload that leverages HTML encoding to bypass the input sanitization, and then use it to redirect users to a malicious site where their cookies can be captured. Utilize an HTML-encoded XSS payload to trigger a buffer overflow attack, forcing the server to reveal the HTTPOnly cookies.

As a certified ethical hacker, you are performing a system hacking process for a company that is suspicious about its security system. You found that the company’s passwords are all known words, but not in the dictionary. You know that one employee always changes the password by just adding some numbers to the old password. Which attack is most likely to succeed in this scenario?. Password Spraying Attack. Rule-based Attack. Hybrid Attack. Brute-Force Attack.

Jack, a professional hacker, targets an organization and performs vulnerability scanning on the target web server to identify any possible weaknesses, vulnerabilities, and misconfigurations. In this process, Jack uses an automated tool that eases his work and performs vulnerability scanning to find hosts, services, and other vulnerabilities in the target server. Which of the following tools is used by Jack to perform vulnerability scanning?. NCollector Studio. WebCopier Pro. Netsparker. Infoga.

This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from the server. By observing the response, an attacker can extract sensitive information. What type of attack is this?. Union SQL injection. Time-based SQL injection. Blind SQL injection. Error-based SQL injection.

During a penetration test, an ethical hacker is exploring the security of a complex web application. The application heavily relies on JavaScript for client- side input sanitization, with an apparent assumption that this alone is adequate to prevent injection attacks. During the investigation, the ethical hacker also notices that the application utilizes cookies to manage user sessions but does not enable the HttpOnly flag. This lack of flag potentially exposes the cookies to client-side scripts. Given these identified vulnerabilities, what would be the most effective strategy for the ethical hacker to exploit this application?. Employ a brute-force attack to decipher user credentials, considering the lack of server-side validation. Launch a Cross-Site Scripting (XSS) attack, aiming to bypass the client-side sanitization and exploit the exposure of session cookies. Implement an SQL Injection attack to take advantage of potential unvalidated input and gain unauthorized database access. Instigate a Distributed Denial of Service (DDoS) attack to overload the server, capitalizing on potential weak server-side security.

An attacker identified that a user and an access point are both compatible with WPA2 and WPA3 encryption. The attacker installed a rogue access point with only WPA2 compatibility in the vicinity and forced the victim to go through the WPA2 four-way handshake to get connected. After the connection was established, the attacker used automated tools to crack WPA2-encrypted messages. What is the attack performed in the above scenario?. Cache-based attack. Timing-based attack. Side-channel attack. Downgrade security attack.

Calvin, a software developer, uses a feature that helps him auto-generate the content of a web page without manual involvement and is integrated with SSI directives. This leads to a vulnerability in the developed web application as this feature accepts remote user inputs and uses them on the page. Hackers can exploit this feature and pass malicious SSI directives as input values to perform malicious activities such as modifying and erasing server files. What is the type of injection attack Calvin's web application is susceptible to?. CRLF injection. Server-side JS injection. Server-side template injection. Server-side includes injection.

An IT security team is conducting an internal review of security protocols in their organization to identify potential vulnerabilities. During their investigation, they encounter a suspicious program running on several computers. Further examination reveals that the program has been logging all user keystrokes. How can the security team confirm the type of program and what countermeasures should be taken to ensure the same attack does not occur in the future?. The program is spyware; the team should use password managers and encrypt sensitive data. The program is a keylogger; the team should employ intrusion detection systems and regularly update the system software. The program is a keylogger; the team should educate employees about phishing attacks and maintain regular backups. The program is a Trojan; the team should regularly update antivirus software and install a reliable firewall.

Stephen, an attacker, targeted the industrial control systems of an organization. He generated a fraudulent email with a malicious attachment and sent it to employees of the target organization. An employee who manages the sales software of the operational plant opened the fraudulent email and clicked on the malicious attachment. This resulted in the malicious attachment being downloaded and malware being injected into the sales software maintained in the victim's system. Further, the malware propagated itself to other networked systems, finally damaging the industrial automation components. What is the attack technique used by Stephen to damage the industrial systems?. HMI-based attack. Reconnaissance attack. Spear-phishing attack. SMishing attack.

Kate dropped her phone and subsequently encountered an issue with the phone's internal speaker. Thus, she is using the phone's loudspeaker for phone calls and other activities. Bob, an attacker, takes advantage of this vulnerability and secretly exploits the hardware of Kate's phone so that he can monitor the loudspeaker's output from data sources such as voice assistants, multimedia messages, and audio files by using a malicious app to breach speech privacy. What is the type of attack Bob performed on Kate in the above scenario?. SIM card attack. Man-in-the-disk attack. Spearphone attack. aLTEr attack.

Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this cached record, he determines the sites recently visited by the organization's user. What is the enumeration technique used by Henry on the organization?. DNS cache snooping. DNSSEC zone walking. DNS cache poisoning. DNS zone walking.

A group of hackers were roaming around a bank office building in a city, driving a luxury car. They were using hacking tools on their laptop with the intention to find a free-access wireless network. What is this hacking process known as?. Wardriving. Spectrum analysis. Wireless sniffing. GPS mapping.

An attacker decided to crack the passwords used by industrial control systems. In this process, he employed a loop strategy to recover these passwords. He used one character at a time to check whether the first character entered is correct; if so, he continued the loop for consecutive characters. If not, he terminated the loop. Furthermore, the attacker checked how much time the device took to finish one complete password authentication process, through which he deduced how many characters entered are correct. What is the attack technique employed by the attacker to crack the passwords of the industrial control systems?. Buffer overflow attack. HMI-based attack. Denial-of-service attack. Side-channel attack.

During a penetration testing assignment, a Certified Ethical Hacker (CEH) used a set of scanning tools to create a profile of the target organization. The CEH wanted to scan for live hosts, open ports, and services on a target network. He used Nmap for network inventory and Hping3 for network security auditing. However, he wanted to spoof IP addresses for anonymity during probing. Which command should the CEH use to perform this task?. Hping3 -1 10.0.0.25 -ICMP. Hping3 -2 10.0.0.25-p 80. Nmap -sS -Pn -n -vw --packet-trace -p- --script discovery -T4. Hping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood.

Which of the following types of SQL injection attacks extends the results returned by the original query, enabling attackers to run two or more statements if they have the same structure as the original one?. Error-based injection. Boolean-based blind SQL injection. Blind SQL injection. Union SQL injection.

An ethical hacker is preparing to scan a network to identify live systems. To increase the efficiency and accuracy of his scans, he is considering several different host discovery techniques. He expects several unused IP addresses at any given time, specifically within the private address range of the LAN, but he also anticipates the presence of restrictive firewalls that may conceal active devices. Which scanning method would be most effective in this situation?. ICMP ECHO Ping Sweep. ARP Ping Scan. TCP SYN Ping. ICMP Timestamp Ping.

Your company, Encryptor Corp, is developing a new application that will handle highly sensitive user information. As a cybersecurity specialist, you want to ensure this data is securely stored. The development team proposes a method where data is hashed and then encrypted before storage. However, you want an added layer of security to verify the integrity of the data upon retrieval. Which of the following cryptographic concepts should you propose to the team?. Switch to elliptic curve cryptography. Suggest using salt with hashing. Apply a digital signature mechanism. Implement a block cipher mode of operation.

An attacker can employ many methods to perform social engineering against unsuspecting employees, including scareware. What is the best example of a scareware attack?. A banner appears to a user stating, "Your Amazon order has been delayed. Click here to find out your new delivery date.". A banner appears to a user stating, "Your account has been locked. Click here to reset your password and unlock your account.". A pop-up appears to a user stating, "Your computer may have been infected with spyware. Click here to install an anti-spyware tool to resolve this issue.". A pop-up appears to a user stating, "You have won a free cruise! Click here to claim your prize!".

You are a cybersecurity consultant for a smart city project. The project involves deploying a vast network of IoT devices for public utilities like traffic control, water supply, and power grid management. The city administration is concerned about the possibility of a Distributed Denial of Service (DDoS) attack crippling these critical services. They have asked you for advice on how to prevent such an attack. What would be your primary recommendation?. Implement regular firmware updates for all IoT devices. Deploy network intrusion detection systems (IDS) across the IoT network. Implement IP address whitelisting for all IoT devices. Establish strong, unique passwords for each IoT device.

You are a cloud security expert at CloudGuard Inc. working with a client who plans to transition their infrastructure to a public cloud. The client expresses concern about potential data breaches and wants to ensure that only authorized personnel can access certain sensitive resources. You propose implementing a Zero Trust security model. Which of the following best describes how the Zero Trust model would enhance the security of their cloud resources?. It operates on the principle of least privilege, verifying each request as if it is from an untrusted source, regardless of its location. It ensures secure data transmission by implementing SSL/TLS protocols. It uses multi-factor authentication for all user accounts. It encrypts all data stored in the cloud, ensuring only authorized users can decrypt it.

Jacob works as a system administrator in an organization. He wants to extract the source code of a mobile application and disassemble the application to analyze its design flaws. Using this technique, he wants to fix any bugs in the application, discover underlying vulnerabilities, and improve defense strategies against attacks. What is the technique used by Jacob in the above scenario to improve the security of the mobile application?. Reverse engineering. Social engineering. Jailbreaking. App sandboxing.

A penetration tester is performing the footprinting process and is reviewing publicly available information about an organization by using the Google search engine. Which of the following advanced operators would allow the pen tester to restrict the search to the organization’s web domain?. [allinurl:]. [link:]. [site:]. [location:].

Alex, a cloud security engineer working in Eyecloud Inc. is tasked with isolating applications from the underlying infrastructure and stimulating communication via well-defined channels. For this purpose, he used an open-source technology that helped him in developing, packaging, and running applications; further, the technology provides PaaS through OS-level virtualization, delivers containerized software packages, and promotes fast software delivery. What is the cloud technology employed by Alex in the above scenario?. Virtual machine. Serverless computing. Docker. Zero trust network.

In an attempt to damage the reputation of a competitor organization, Hailey, a professional hacker, gathers a list of employee and client email addresses and other related information by using various search engines, social networking sites, and web spidering tools. In this process, she also uses an automated tool to gather a list of words from the target website to further perform a brute- force attack on the previously gathered email addresses. What is the tool used by Hailey for gathering a list of words from the target website?. Orbot. Psiphon. CeWL. Shadowsocks.

A cyber attacker has initiated a series of activities against a high-profile organization following the Cyber Kill Chain Methodology. The attacker is presently in the "Delivery" stage. As an Ethical Hacker, you are trying to anticipate the adversary's next move. What is the most probable subsequent action from the attacker based on the Cyber Kill Chain Methodology?. The attacker will attempt to escalate privileges to gain complete control of the compromised system. The attacker will initiate an active connection to the target system to gather more data. The attacker will exploit the malicious payload delivered to the target organization and establish a foothold. The attacker will start reconnaissance to gather as much information as possible about the target.

An ethical hacker is testing the security of a website's database system against SQL Injection attacks. They discover that the IDS has a strong signature detection mechanism to detect typical SQL injection patterns. Which evasion technique can be most effectively used to bypass the IDS signature detection while performing a SQL Injection attack?. Employ IP fragmentation to obscure the attack payload. Leverage string concatenation to break identifiable keywords. Use Hex encoding to represent the SQL query string. Implement case variation by altering the case of SQL statements.

As a budding cybersecurity enthusiast, you have set up a small lab at home to learn more about wireless network security. While experimenting with your home Wi-Fi network, you decide to use a well-known hacking tool to capture network traffic and attempt to crack the Wi-Fi password. However, despite many attempts, you have been unsuccessful. Your home Wi-Fi network uses WPA2 Personal with AES encryption. Why are you finding it difficult to crack the Wi-Fi password?. Your hacking tool is outdated. The network is using MAC address filtering. The Wi-Fi password is too complex and long. The network is using an uncrackable encryption method.

During a red team engagement, an ethical hacker is tasked with testing the security measures of an organization's wireless network. The hacker needs to select an appropriate tool to carry out a session hijacking attack. Which of the following tools should the hacker use to effectively perform session hijacking and subsequent security analysis, given that the target wireless network has the Wi-Fi Protected Access-pre-shared key (WPA-PSK) security protocol in place?. Hetty. FaceNiff. bettercap. DroidSheep.

As a cybersecurity consultant for SafePath Corp, you have been tasked with implementing a system for secure email communication. The key requirement is to ensure both confidentiality and non-repudiation. While considering various encryption methods, you are inclined towards using a combination of symmetric and asymmetric cryptography. However, you are unsure which cryptographic technique would best serve the purpose. Which of the following options would you choose to meet these requirements?. Use the Diffie-Hellman protocol for key exchange and encryption. Apply asymmetric encryption with RSA and use the public key for encryption. Apply asymmetric encryption with RSA and use the private key for signing. Use symmetric encryption with the AES algorithm.

A multinational corporation's computer system was infiltrated by an advanced persistent threat (APT). During forensic analysis, it was discovered that the malware was utilizing a blend of two highly sophisticated techniques to stay undetected and continue its operations. Firstly, the malware was embedding its harmful code into the actual binary or executable part of genuine system files rather than appending or prepending itself to the files. This made it exceptionally difficult to detect and eradicate, as doing so risked damaging the system files themselves. Secondly, the malware exhibited characteristics of a type of malware that changes its code as it propagates, making signature-based detection approaches nearly impossible. On top of these, the malware maintained a persistent presence by installing itself in the registry, making it able to survive system reboots. Given these distinctive characteristics, which two types of malware techniques does this malware most closely embody?. Polymorphic and Metamorphic malware. Polymorphic and Macro malware. Metamorphic and Rootkit malware. Macro and Rootkit malware.

Jane is working as a security professional at CyberSol Inc. She was tasked with ensuring the authentication and integrity of messages being transmitted in the corporate network. To encrypt the messages, she implemented a security model in which every user in the network maintains a ring of public keys. In this model, a user needs to encrypt a message using the receiver’s public key, and only the receiver can decrypt the message using their private key. What is the security model implemented by Jane to secure corporate messages?. Transport Layer Security (TLS). Web of trust (WOT). Secure Socket Layer (SSL). Zero trust network.

As the chief security officer at SecureMobile, you are overseeing the development of a mobile banking application. You are aware of the potential risks of man-in-the-middle (MitM) attacks where an attacker might intercept communication between the app and the bank's servers. Recently, you have learned about a technique used by attackers where they use rogue Wi-Fi hotspots to conduct MitM attacks. To prevent this type of attack, you plan to implement a security feature in the mobile app. What should this feature accomplish?. It should require two-factor authentication for user logins. It should prevent the app from communicating over a network if it detects a rogue access point. It should require users to change their password every 30 days. It should prevent the app from connecting to any unencrypted Wi-Fi networks.

To hide the file on a Linux system, you have to start the filename with a specific character. What is the character?. Underscore (_). Period (.). Tilde (~). Exclamation mark (!).

A post-breach forensic investigation revealed that a known vulnerability in Apache Struts was to blame for the Equifax data breach that affected 143 million customers. A fix was available from the software vendor for several months prior to the intrusion. This is likely a failure in which of the following security processes?. Secure development lifecycle. Patch management. Vendor risk management. Security awareness training.

As a cybersecurity consultant, you are working with a client who wants to migrate their data to a Software as a Service (SaaS) cloud environment. They are particularly concerned about maintaining the privacy of their sensitive data, even from the cloud service provider. Which of the following strategies would best ensure the privacy of their data in the SaaS environment?. Use multi-factor authentication for all user accounts accessing the SaaS applications. Encrypt the data client-side before uploading to the SaaS environment and manage encryption keys independently. Rely on the cloud service provider's built-in security features. Implement a Virtual Private Network (VPN) for accessing the SaaS applications.

Mirai malware targets IoT devices. After infiltration, it uses them to propagate and create botnets that are then used to launch which types of attack?. Birthday attack. DDoS attack. Password attack. MITM attack.

Given below are different steps involved in the vulnerability-management life cycle. 1) Remediation 2) Identify assets and create a baseline 3) Verification 4) Monitor 5) Vulnerability scan 6) Risk assessment Identify the correct sequence of steps involved in vulnerability management. 2 → 5 → 6 → 1 → 3 → 4. 2 → 1 → 5 → 6 → 4 → 3. 2 → 4 → 5 → 3 → 6 → 1. 1 → 2 → 3 → 4 → 5 → 6.

Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to feed data and specifies the incorrect field in case of invalid credentials. Later, Calvin uses this information to perform social engineering. Which of the following design flaws in the authentication mechanism is exploited by Calvin?. Verbose failure messages. Password reset mechanism. Insecure transmission of credentials. User impersonation.

As an IT Security Analyst, you've been asked to review the security measures of an e-commerce website that relies on a SQL database for storing sensitive customer data. Recently, an anonymous tip has alerted you to a possible threat: a seasoned hacker who specializes in SQL Injection attacks may be targeting your system. The site already employs input validation measures to prevent basic injection attacks, and it blocks any user inputs containing suspicious patterns. However, this hacker is known to use advanced SQL Injection techniques. Given this situation, which of the following strategies would the hacker most likely adopt to bypass your security measures?. The hacker might employ a 'blind' SQL Injection attack, taking advantage of the application's true or false responses to extract data bit by bit. The hacker may try to use SQL commands which are less known and less likely to be blocked by your system's security. The hacker may resort to a DDoS attack instead, attempting to crash the server and thus render the e-commerce site unavailable. The hacker could deploy an 'out-of-band' SQL Injection attack, extracting data via a different communication channel, such as DNS or HTTP requests.

Your network infrastructure is under a SYN flood attack. The attacker has crafted an automated botnet to simultaneously send 's' SYN packets per second to the server. You have put measures in place to manage 'f' SYN packets per second, and the system is designed to deal with this number without any performance issues. If 's' exceeds 'f', the network infrastructure begins to show signs of overload. The system's response time increases exponentially (2^k), where 'k' represents each additional SYN packet above the 'f' limit. Now, considering 's=500' and different 'f' values, in which scenario is the server most likely to experience overload and significantly increased response times?. f=510: The server can handle 510 SYN packets per second, which is greater than what the attacker is sending. The system stays stable, and the response time remains unaffected. f=490: The server can handle 490 SYN packets per second. With 's' exceeding 'f' by 10, the response time shoots up (2^10 = 1024 times the usual response time), indicating a system overload. f=505: The server can handle 505 SYN packets per second. In this case, the response time increases but not as drastically (2^5 = 32 times the normal), and the system might still function, albeit slowly. f=495: The server can handle 495 SYN packets per second. The response time drastically rises (2^5 = 32 times the normal), indicating a probable system overload.

Your company, SecureTech Inc., is planning to transmit some sensitive data over an unsecured communication channel. As a cyber security expert, you decide to use symmetric key encryption to protect the data. However, you must also ensure the secure exchange of the symmetric key. Which of the following protocols would you recommend to the team to achieve this?. Switching all data transmission to the HTTPS protocol. Applying the Diffie-Hellman protocol to exchange the symmetric key. Utilizing SSH for secure remote logins to the servers. Implementing SSL certificates on your company's web servers.

Consider a scenario where a Certified Ethical Hacker is attempting to infiltrate a company's network without being detected. The hacker intends to use a stealth scan on a BSD-derived TCP/IP stack, but he suspects that the network security devices may be able to detect SYN packets. Based on this information, which of the following methods should he use to bypass the detection mechanisms and why?. Maimon Scan, because it is very similar to NULL, FIN, and Xmas scans, but the probe used here is FIN/ACK. ACK Flag Probe Scan, because it exploits the vulnerabilities within the BSD-derived TCP/IP stack. TCP Connect/Full-Open Scan, because it completes a three-way handshake with the target machine. Xmas Scan, because it can pass through filters undetected, depending on the security mechanisms installed.

Gregory, a professional penetration tester working at Sys Security Ltd., is tasked with performing a security test of web applications used in the company. For this purpose, Gregory uses a tool to test for any security loopholes by hijacking a session between a client and server. This tool has a feature of intercepting proxy that can be used to inspect and modify the traffic between the browser and target application. This tool can also perform customized attacks and can be used to test the randomness of session tokens. Which of the following tools is used by Gregory in the above scenario?. Wireshark. Burp Suite. CxSAST. Nmap.

As a cybersecurity analyst for SecureNet, you are performing a security assessment of a new mobile payment application. One of your primary concerns is the secure storage of customer data on the device. The application stores sensitive information such as credit card details and personal identification numbers (PINs) on the device. Which of the following measures would best ensure the security of this data?. Enable GPS tracking for all devices using the app. Encrypt all sensitive data stored on the device. Implement biometric authentication for app access. Regularly update the app to the latest version.

You are a security analyst of a large IT company and are responsible for maintaining the organization’s security posture. You are evaluating multiple vulnerability assessment tools for your network. Given that your network has a hybrid IT environment with on-premise and cloud assets, which tool would be most appropriate considering its comprehensive coverage and visibility, continuous scanning, and ability to monitor unexpected changes before they turn into breaches?. Nessus Professional. Qualys Vulnerability Management. Open VAS. GFI LanCuard.

Martin, a Certified Ethical Hacker (CEH), is conducting a penetration test on a large enterprise network. He suspects that sensitive information might be leaking out of the network. Martin decides to use network sniffing as part of his testing methodology. Which of the following sniffing techniques should Martin employ to get a comprehensive understanding of the data flowing across the network?. Raw Sniffing. MAC Flooding. DNS Poisoning. ARP Poisoning.

As an IT intern, you have been asked to help set up a secure Wi-Fi network for a local coffee shop. The owners want to provide free Wi-Fi to their customers, but they are concerned about potential security risks. They are looking for a simple yet effective solution that would not require a lot of technical knowledge to manage. Which of the following security measures would be the most suitable in this context?. Implement WPA2 or WPA3 encryption. Disable the network's SSID broadcast. Require customers to use VPN when connected to the Wi-Fi. Enable MAC address filtering.

George, an employee of an organization, is attempting to access restricted websites from an official computer. For this purpose, he used an anonymizer that masked his real IP address and ensured complete and continuous anonymity for all his online activities. Which of the following anonymizers helps George hide his activities?. https://www.guardster.com. https://karmadecay.com. https://www.wolframalpha.com. https://www.baidu.com.

Jake, a professional hacker, installed spyware on a target iPhone to spy on the target user’s activities. He can take complete control of the target mobile device by jailbreaking the device remotely and record audio, capture screenshots, and monitor all phone calls and SMS messages. What is the type of spyware that Jake used to infect the target device?. Trident. DroidSheep. Zscaler. Androrat.

Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results: TTL: 64 - Window Size: 5840 - What the OS running on the target machine?. Linux OS. Mac OS. Solaris OS. Windows OS.

Rebecca, a security professional, wants to authenticate employees who use web services for safe and secure communication. In this process, she employs a component of the Web Service Architecture, which is an extension of SOAP, and it can maintain the integrity and confidentiality of SOAP messages. Which of the following components of the Web Service Architecture is used by Rebecca for securing the communication?. WS-Security. WS-Work Processes. WS-Policy. WSDL.

Which wireless security protocol replaces the personal pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) and is therefore resistant to offline dictionary attacks?. WPA3-Personal. WPA2-Enterprise. Bluetooth. ZigBee.

John, a professional hacker, targeted CyberSol Inc., an MNC. He decided to discover the IoT devices connected in the target network that are using default credentials and are vulnerable to various hijacking attacks. For this purpose, he used an automated tool to scan the target network for specific types of IoT devices and detect whether they are using the default, factory-set credentials. What is the tool employed by John in the above scenario?. IoTSeeker. IoT Inspector. Azure IoT Central. AT&T IoT Platform.

Miley, a professional hacker, decided to attack a target organization's network. To perform the attack, she used a tool to send fake ARP messages over the target network to link her MAC address with the target system's IP address. By performing this, Miley received messages directed to the victim's MAC address and further used the tool to intercept steal, modify, and block sensitive communication to the target system. What is the tool employed by Miley to perform the above attack?. BetterCAP. Wireshark. DerpNSpoof. Gobbler.

According to the NIST cloud deployment reference architecture, which of the following provides connectivity and transport services to consumers?. Cloud broker. Cloud connector. Cloud carrier. Cloud provider.

Morris, an attacker, wanted to check whether the target AP is in a locked state. He attempted using different utilities to identify WPS-enabled APs in the target wireless network. Ultimately, he succeeded with one special command-line utility. Which of the following command-line utilities allowed Morris to discover the WPS-enabled APs?. wash. macof. ntptrace. net view.

Which of the following web vulnerabilities would an attacker be attempting to exploit if they delivered the following input? Referencë vizuale nga pyetja. SQLi. IDOR. XXS. XXE.

In a large organization, a network security analyst discovered a series of packet captures that seem unusual. The network operates on a switched Ethernet environment. The security team suspects that an attacker might be using a sniffer tool. Which technique could the attacker be using to successfully carry out this attack, considering the switched nature of the network?. The attacker might be compromising physical security to plug into the network directly. The attacker is probably using a Trojan horse with in-built sniffing capability. The attacker might be using passive sniffing, as it provides significant stealth advantages. The attacker might be implementing MAC flooding to overwhelm the switch's memory.

Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks. What is the type of threat intelligence collected by Arnold in the above scenario?. Strategic threat intelligence. Tactical threat intelligence. Technical threat intelligence. Operational threat intelligence.

Robert, a professional hacker, is attempting to execute a fault injection attack on a target IoT device. In this process, he injects faults into the power supply that can be used for remote execution, also causing the skipping of key instructions. He also injects faults into the clock network used for delivering a synchronized signal across the chip. Which of the following types of fault injection attack is performed by Robert in the above scenario?. Frequency/voltage tampering. Power/clock/reset glitching. Temperature attack. Optical, electromagnetic fault injection (EMFI).

A penetration tester is tasked with gathering information about the subdomains of a target organization's website. The tester needs a versatile and efficient solution for the task. Which of the following options would be the most effective method to accomplish this goal?. Analyzing LinkedIn profiles to find employees of the target company and their job titles. Employing a tool like Sublist3r, which is designed to enumerate the subdomains of websites using OSINT. Using a people search service, such as Spokeo or Intelius, to gather information about the employees of the target rganization. Utilizing the Harvester tool to extract email addresses related to the target domain using a search engine like Google or Bing.

Sam, a web developer, was instructed to incorporate a hybrid encryption software program into a web application to secure email messages. Sam used an encryption software, which is a free implementation of the OpenPGP standard that uses both symmetric-key cryptography and asymmetric-key cryptography for improved speed and secure key exchange. What is the encryption software employed by Sam for securing the email messages?. PGP. GPG. SMTP. S/MIME.

A large multinational corporation is in the process of evaluating its security infrastructure to identify potential vulnerabilities. After a comprehensive analysis, they found multiple areas of concern, including time of check/time of use (TOC/TOU) errors, improper input handling, and poor patch management. Which of the following approaches will best help the organization mitigate the vulnerability associated with TOC/TOU errors?. Regular patching of servers, firmware, operating system, and applications. Ensuring atomicity of operations between checking and using data resources. Frequently updating firewall configurations to prevent intrusion attempts. Implementing stronger encryption algorithms for all data transfers.

Roma is a member of a security team. She was tasked with protecting the internal network of an organization from imminent threats. To accomplish this task, Roma fed threat intelligence into the security devices in a digital format to block and identify inbound and outbound malicious traffic entering the organization's network. Which type of threat intelligence is used by Roma to secure the internal network?. Operational threat intelligence. Technical threat intelligence. Tactical threat intelligence. Strategic threat intelligence.

Kevin, an encryption specialist, implemented a technique that enhances the security of keys used for encryption and authentication. Using this technique, Kevin input an initial key to an algorithm that generated an enhanced key that is resistant to brute-force attacks. What is the technique employed by Kevin to improve the security of encryption keys?. Public key infrastructure. Key stretching. Key derivation function. Key reinstallation.

While performing a security audit of a web application, an ethical hacker discovers a potential vulnerability. The application responds to logically incorrect queries with detailed error messages that divulge the underlying database's structure. The ethical hacker decides to exploit this vulnerability further. Which type of SQL Injection attack is the ethical hacker likely to use?. UNION SQL Injection. Error-based SQL Injection. Blind/Inferential SQL Injection. In-band SQL Injection.

During a comprehensive security assessment, your cybersecurity team at XYZ Corp stumbles upon signs that point toward a possible Advanced Persistent Threat (APT) infiltration in the network infrastructure. These sophisticated threats often exhibit subtle indicators that distinguish them from other types of cyberattacks. To confirm your suspicion and adequately isolate the potential APT, which of the following actions should you prioritize?. Scrutinize for repeat network login attempts from unrecognized geographical regions. Investigate for anomalies in file movements or unauthorized data access attempts within your database system. Search for proof of a spear-phishing attempt, such as the presence of malicious emails or risky attachments. Vigilantly monitor for evidence of zero-day exploits that manage to evade your firewall or antivirus software.

BitLocker encryption has been implemented for all the Windows-based computers in an organization. You are concerned that someone might lose their cryptographic key. Therefore, a mechanism was implemented to recover the keys from Active Directory. What is this mechanism called in cryptography?. Key archival. Key escrow. Certificate rollover. Key renewal.

An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a combination of scanning tools to obtain a detailed understanding of the network. Which sequence of actions would provide the most comprehensive information about the network's status?. Start with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan, and finally use Metasploit to exploit detected vulnerabilities. Use Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on identified active hosts, and finally use Metasploit to exploit identified vulnerabilities. Begin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and version detection, and finally perform an SYN flooding with Hping3. Initiate with Nmap for a ping sweep, then use Metasploit to scan for open ports and services, and finally use Hping3 to perform remote OS fingerprinting.

A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system. What is the first step that the bank should take before enabling the audit feature?. Allocate funds for staffing of audit log review. Determine the impact of enabling the audit feature. Perform a cost/benefit analysis of the audit feature. Perform a vulnerability scan of the system.

A sophisticated attacker targets your web server with the intent to execute a Denial of Service (DoS) attack. His strategy involves a unique mixture of TCP SYN, UDP, and ICMP floods, using 'r' packets per second. Your server, reinforced with advanced security measures, can handle 'h' packets per second before it starts showing signs of strain. If 'r' surpasses 'h', it overwhelms the server, causing it to become unresponsive. In a peculiar pattern, the attacker selects 'r' as a composite number and 'h' as a prime number, making the attack detection more challenging. Considering 'r=2010' and different values for 'h', which of the following scenarios would potentially cause the server to falter?. h=2003 (prime): The server can manage more packets than the attacker is sending, hence it stays operational. h=1987 (prime): The attacker's packet rate exceeds the server's capacity, causing potential unresponsiveness. h=1993 (prime): Despite being less than 'r', the server's prime number capacity keeps it barely operational, but the risk of alling is imminent. h=1999 (prime): Despite the attacker's packet flood, the server can handle these requests, remaining responsive.

Which among the following is the best example of the third step (delivery) in the cyber kill chain?. An intruder's malware is installed on a targets machine. An intruder sends a malicious attachment via email to a target. An intruder's malware is triggered when a target opens a malicious email attachment. An intruder creates malware to be used as a malicious attachment to an email.

Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions. Which of the following master components is explained in the above scenario?. Kube-apiserver. Kube-scheduler. Kube-controller-manager. Etcd cluster.

What useful information is gathered during a successful Simple Mail Transfer Protocol (SMTP) enumeration?. A list of all mail proxy server addresses used by the targeted host. The two internal commands VRFY and EXPN provide a confirmation of valid users, email addresses, aliases, and mailing lists. Reveals the daily outgoing message limits before mailboxes are locked. The internal command RCPT provides a list of ports open to message traffic.

Tony wants to integrate a 128-bit symmetric block cipher with key sizes of 128, 192, or 256 bits into a software program, which involves 32 rounds of computational operations that include substitution and permutation operations on four 32-bit word blocks using 8-variable S-boxes with 4-bit entry and 4-bit exit. Which of the following algorithms includes all the above features and can be integrated by Tony into the software program?. CAST-128. Serpent. TEA. RC5.

What information security law or standard aims at protecting stakeholders and the general public from accounting errors and fraudulent activities within organizations?. PCI-DSS. SOX. ISO/IEC 27001:2013. FISMA.

Dayn, an attacker, wanted to detect if any honeypots are installed in a target network. For this purpose, he used a time-based TCP fingerprinting method to validate the response to a normal computer and the response of a honeypot to a manual SYN request. Which of the following techniques is employed by Dayn to detect honeypots?. Detecting the presence of Honeyd honeypots. Detecting the presence of Snort_inline honeypots. Detecting the presence of Sebek-based honeypots. Detecting honeypots running on VMware.

Bill has been hired as a penetration tester and cyber security auditor for a major credit card company. Which information security standard is most applicable to his role?. PCI-DSS. Sarbanes-Oxley Act. HITECH. FISMA.

Being a Certified Ethical Hacker (CEH), a company has brought you on board to evaluate the safety measures in place for their network system. The company uses a network time protocol server in the demilitarized zone. During your enumeration, you decide to run a ntptrace command. Given the syntax: ntptrace [-n] [-m maxhosts] [servername/IP_address], which command usage would best serve your objective to find where the NTP server obtains the time from and to trace the list of NTP servers connected to the network?. ntptrace 192.168.1.1. ntptrace -n -m 5192.168.1.1. ntptrace -n localhost. ntptrace -m 5192.168.1.1.

What is the following command used for?. Enumerating the databases in the DBMS for the URL. Creating backdoors using SQL injection. Searching database statements at the IP address given. Retrieving SQL statements being executed on the database.

John, a security analyst, is analyzing a server suspected of being compromised. The attacker has used a non admin account and has already gained a foothold on the system. John discovers that a new Dynamic Link Library is loaded in the application directory of the affected server. This DLL does not have a fully qualified path and seems to be malicious. What privilege escalation technique has the attacker likely used to compromise this server?. DLL Hijacking. Exploiting Misconfigured Services. Spectre and Meltdown Vulnerabilities. Named Pipe Impersonation.

You have been hired as an intern at a start-up company. Your first task is to help set up a basic web server for the company's new website. The team leader has asked you to make sure the server is secure from common threats. Based on your knowledge from studying for the CEH exam, which of the following actions should be your priority to secure the web server?. Regularly updating and patching the server software. Limiting the number of concurrent connections to the server. Encrypting the company's website with SSL/TLS. Installing a web application firewall.

Clark, a professional hacker, attempted to perform a Btlejacking attack using an automated tool, BtleJack, and hardware tool, micro:bit. This attack allowed Clark to hijack, read, and export sensitive information shared between connected devices. To perform this attack, Clark executed various btlejack commands. Which of the following commands was used by Clark to hijack the connections?. btlejack -f 0x129f3244 -j. btlejack -f 0x9c68fd30 -t -m 0x1fffffffff. btlejack -d /dev/ttyACM0 -d /dev/ttyACM2 -s. btlejack -c any.

A large e-commerce organization is planning to implement a vulnerability assessment solution to enhance its security posture. They require a solution that imitates the outside view of attackers, performs well-organized inference- based testing, scans automatically against continuously updated databases, and supports multiple networks. Given these requirements, which type of vulnerability assessment solution would be most appropriate?. Service-based solution offered by an auditing firm. Inference-based assessment solution. Product-based solution installed on a private network. Tree-based assessment approach.

A Certified Ethical Hacker is attempting to gather information about a target organization's network structure through network footprinting. During the operation, they encounter ICMP blocking by the target system's firewall. The hacker wants to ascertain the path that packets take to the host system from a source, using an alternative protocol. Which of the following actions should the hacker consider next?. Use UDP Traceroute in the Linux operating system by executing the 'traceroute' command with the destination IP or domain name. Utilize the Path Analyzer Pro to trace the route from the source to the destination target systems. Use the ARIN Whois database search tool to find the network range of the target network. Use the ICMP Traceroute on the Windows operating system as it is the default utility.

Which type of attack attempts to overflow the content-addressable memory (CAM) table in an Ethernet switch?. MAC flooding. Evil twin attack. DNS cache flooding. DDoS attack.

The security team of Debry Inc. decided to upgrade Wi-Fi security to thwart attacks such as dictionary attacks and key recovery attacks. For this purpose, the security team started implementing cutting-edge technology that uses a modern key establishment protocol called the simultaneous authentication of equals (SAE), also known as dragonfly key exchange, which replaces the PSK concept. What is the Wi-Fi encryption technology implemented by Debry Inc.?. WPA3. WPA. WPA2. WEP.

A large corporate network is being subjected to repeated sniffing attacks. To increase security, the company's IT department decides to implement a combination of several security measures. They permanently add the MAC address of the gateway to the ARP cache, switch to using IPv6 instead of IPv4, implement the use of encrypted sessions such as SSH instead of Telnet, and use Secure File Transfer Protocol instead of FTP. However, they are still faced with the threat of sniffing. Considering the countermeasures, what should be their next step to enhance network security?. Implement network scanning and monitoring tools. Use HTTP instead of HTTPS for protecting usernames and passwords. Retrieve MAC addresses from the OS. Enable network identification broadcasts.

James is working as an ethical hacker at Technix Solutions. The management ordered James to discover how vulnerable its network is towards footprinting attacks. James took the help of an open-source framework for performing automated reconnaissance activities. This framework helped James in gathering information using free tools and resources. What is the framework used by James to conduct footprinting and reconnaissance activities?. OSINT framework. SpeedPhish Framework. Browser Exploitation Framework. WebSploit Framework.

An ethical hacker is testing a web application of a financial firm. During the test, a 'Contact Us' form's input field is found to lack proper user input validation, indicating a potential Cross-Site Scripting (XSS) vulnerability. However, the application has a stringent Content Security Policy (CSP) disallowing inline scripts and scripts from external domains but permitting scripts from its own domain. What would be the hacker's next step to confirm the XSS vulnerability?. Utilize a script hosted on the application's domain to test the form. Load a script from an external domain to test the vulnerability. Inject a benign script inline to the form to see if it executes. Try to disable the CSP to bypass script restrictions.

In the process of footprinting a target website, an ethical hacker utilized various tools to gather critical information. The hacker encountered a target site where standard web spiders were ineffective due to a specific file in its root directory. However, they managed to uncover all the files and web pages on the target site, monitoring the resulting incoming and outgoing traffic while browsing the website manually. What technique did the hacker likely employ to achieve this?. User-directed spidering with tools like Burp Suite and WebScarab. Using Photon to retrieve archived URLs of the target website from archive.org. Examining HTML source code and cookies. Using the Netcraft tool to gather website information.

An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure. During the scan, he discovers an active host with multiple open ports running various services. The hacker uses TCP communication flags to establish a connection with the host and starts communicating with it. He sends a SYN packet to a port on the host and receives a SYN/ACK packet back. He then sends an ACK packet for the received SYN/ACK packet, which triggers an open connection. Which of the following actions should the ethical hacker perform next?. Conduct a vulnerability scan on the open port to identify any potential weaknesses. Scan another port on the same host using the SYN, ACK, and RST flags. Send a PSH packet to inform the receiving application about the buffered data. Send a FIN or RST packet to close the connection.

While working as an intern for a small business, you have been tasked with managing the company's web server. The server is being bombarded with requests, and the company's website is intermittently going offline. You suspect that this could be a Distributed Denial of Service (DDoS) attack. As an ethical hacker, which of the following steps would be your first course of action to mitigate the issue?. Contact your Internet Service Provider (ISP) for assistance. Increase the server's bandwidth. Implement IP address whitelisting. Install a newer version of the server software.

When considering how an attacker may exploit a web server, what is web server footprinting?. When an attacker creates a complete profile of the site's external links and file structures. When an attacker gathers system-level data, including account details and server names. When an attacker implements a vulnerability scanner to identity weaknesses. When an attacker uses a brute-force attack to crack a web-server password.

A security analyst is preparing to analyze a potentially malicious program believed to have infiltrated an organization's network. To ensure the safety and integrity of the production environment, the analyst decided to use a sheep dip computer for the analysis. Before initiating the analysis, what key step should the analyst take?. Store the potentially malicious program on an external medium, such as a CD-ROM. Connect the sheep dip computer to the organization's internal network. Run the potentially malicious program on the sheep dip computer to determine its behavior. Install the potentially malicious program on the sheep dip computer.

A security analyst uses Zenmap to perform an ICMP timestamp ping scan to acquire information related to the current time from the target host machine. Which of the following Zenmap options must the analyst use to perform the ICMP timestamp ping scan?. -PP. -PU. -PY. -Pn.

A penetration tester is conducting an assessment of a web application for a financial institution. The application uses form-based authentication and does not implement account lockout policies after multiple failed login attempts. Interestingly, the application displays detailed error messages that disclose whether the username or password entered is incorrect. The tester also notices that the application uses HTTP headers to prevent clickjacking attacks but does not implement Content Security Policy (CSP). With these observations, which of the following attack methods would likely be the most effective for the penetration tester to exploit these vulnerabilities and attempt unauthorized access?. The tester could execute a Brute Force attack, leveraging the lack of account lockout policy and the verbose error messages to guess the correct credentials. The tester could launch a Cross-Site Scripting (XSS) attack to steal authenticated session cookies, potentially bypassing the clickjacking protection. The tester could exploit a potential SQL Injection vulnerability to manipulate the application's database. The tester could execute a Man-in-the-Middle (MitM) attack to intercept and modify the HTTP headers for a Clickjacking attack.