AAAA

In your cybersecurity class, you are learning about common security risks associated with web servers. One topic that comes up is the risk posed by using default server settings. Why is using default settings on a web server considered a security risk, and what would be the best initial step to mitigate this risk?. Default settings allow unlimited login attempts; setup account lockout. Default settings reveal server software type; change these settings. Default settings cause server malfunctions; simplify the settings. Default settings enable auto-updates; disable and manually patch.

You are a cybersecurity consultant for a healthcare organization that utilizes Internet of Medical Things (IoMT) devices, such as connected insulin pumps and heart rate monitors, to provide improved patientcare. Recently, the organization has been targeted by ransomware attacks. While the IT infrastructure was unaffected due to robust security measures, they are worried that the IoMT devices could be potential entry points for future attacks. What would be your main recommendation to protect these devices from such threats?. Disable all wireless connectivity on IoMT devices. Regularly change the IP addresses of all IoMT devices. Implement multi-factor authentication for all IoMT devices. Use network segmentation to isolate IoMT devices from the main network.

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?. dnsrecon -r 162.241.216.0/24 -d example.com -t brt. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std. dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk. dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr.

As the Chief Information Security Officer (CISO) at a large university, you are responsible for the security of a campus-wide Wi-Fi network that serves thousands of students, faculty, and staff. Recently, there has been a rise in reports of unauthorized network access, and you suspect that some users are sharing their login credentials. You are considering deploying an additional layer of security that could effectively mitigate this issue. What would be the most suitable measure to implement in this context?. Enforce a policy of regularly changing Wi-Fi passwords. Implement 802.1X authentication. Deploy a VPN for the entire campus. Implement network segmentation.

During an attempt to perform an SQL injection attack, a certified ethical hacker is focusing on the identification of database engine type by generating an ODBC error. The ethical hacker, after injecting various payloads, finds that the web application returns a standard, generic error message that does not reveal any detailed database information. Which of the following techniques would the hacker consider next to obtain useful information about the underlying database?. Utilize a blind injection technique that uses time delays or error signatures to extract information. Use the UNION operator to combine the result sets of two or more SELECT statements. Attempt to compromise the system through OS-level command shell execution. Try to insert a string value where a number is expected in the input field.

A certified ethical hacker is conducting a Whois footprinting activity on a specific domain. The individual is leveraging various tools such as Batch IP Converter and Whois Analyzer Pro to retrieve vital details but is unable to gather complete Whois information from the registrar for a particular set of data. As the hacker, what might be the probable data model being utilized by the domain's registrar for storing and looking up Whois information?. Thin Whois model working correctly. Thick Whois model working correctly. Thick Whois model with a malfunctioning server. Thin Whois model with a malfunctioning server.

There have been concerns in your network that the wireless network component is not sufficiently secure. You perform a vulnerability scan of the wireless network and find that it is using an old encryption protocol that was designed to mimic wired encryption. What encryption protocol is being used?. WEP. WPA3. WPA. RADIUS.

You are a cybersecurity consultant at SecureIoT Inc. A manufacturing company has contracted you to strengthen the security of their Industrial IoT (IIoT) devices used in their operational technology (OT)environment. They are concerned about potential attacks that could disrupt their production lines and compromise safety. They have an advanced firewall system in place, but you know this alone is not enough. Which of the following measures should you suggest to provide comprehensive protection for their IIoT devices?. Implement network segmentation to separate IIoT devices from the rest of the network. Rely on the existing firewall and install antivirus software on each IIoT device. Use the same encryption standards for IIoT devices as for IT devices. Increase the frequency of changing passwords on all IIoT devices.

As a junior security analyst for a small business, you are tasked with setting up the company's first wireless network. The company wants to ensure the network is secure from potential attacks. Given that the company's workforce is relatively small and the need for simplicity in managing network security, which of the following measures would you consider a priority to protect the network?. Enable WPA2 or WPA3 encryption on the wireless router. Implement a MAC address whitelist. Establish a regular schedule for changing the network password. Hide the network SSID.

An ethical hacker is scanning a target network. They initiate a TCP connection by sending an SYN packet to a target machine and receiving a SYN/ACK packet in response. But instead of completing the three-way handshake with an ACK packet, they send an RST packet. What kind of scan is the ethical hacker likely performing and what is their goal?. They are performing an SYN scan to stealthily identify open ports without fully establishing a connection. They are performing a vulnerability scan to identify any weaknesses in the target system. They are performing a TCP connect scan to identify open ports on the target machine. They are performing a network scan to identify live hosts and their IP addresses.

A large organization has recently performed a vulnerability assessment using Nessus Professional, and the security team is now preparing the final report. They have identified a high-risk vulnerability, named XYZ, which could potentially allow unauthorized access to the network. In preparing the report, which of the following elements would NOT be typically included in the detailed documentation for this specific vulnerability?. The total number of high, medium, and low-risk vulnerabilities detected throughout the network. The CVE ID of the vulnerability and its mapping to the vulnerability's name, XYZ. The list of all affected systems within the organization that are susceptible to the identified vulnerability. Proof of concept (PoC) of the vulnerability, if possible, to demonstrate its potential impact on the system.

A skilled ethical hacker was assigned to perform a thorough OS discovery on a potential target. They decided to adopt an advanced fingerprinting technique and sent a TCP packet to an open TCP port with specific flags enabled. Upon receiving the reply, they noticed the flags were SYN and ECN-Echo. Which test did the ethical hacker conduct and why was this specific approach adopted?. Test 1: The test was conducted because SYN and ECN-Echo flags enabled to allow the hacker to probe the nature of the response and subsequently determine the OS fingerprint. Test 6: The hacker selected this test because a TCP packet with the ACK flag enabled sent to a closed TCP port would yield more information about the OS. Test 2: This test was chosen because a TCP packet with no flags enabled is known as a NULL packet and this would allow the hacker to assess the OS of the target. Test 3: The test was executed to observe the response of the target system when a packet with URC, PSH, SYN, and FIN flags was sent, thereby identifying the OS.

During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?. Use the IDLE/IPID header scan technique with the command "-sI". Use the ACK flag probe scanning technique with the command "-sA". Use UDP Raw ICMP Port Unreachable Scanning with the command "-sU". Use SCTP INIT Scan with the command "-sY".

In a recent cyber-attack against a large corporation, an unknown adversary compromised the network and began escalating privileges and lateral movement. The security team identified that the adversary used a sophisticated set of techniques, specifically targeting zero-day vulnerabilities. As a Certified Ethical Hacker (CEH) hired to understand this attack and propose preventive measures, which of the following actions will be most crucial for your initial analysis?. Analyzing the initial exploitation methods, the adversary used. Investigating the data exfiltration methods used by the adversary. Checking the persistence mechanisms used by the adversary in compromised systems. Identifying the specific tools used by the adversary for privilege escalation.

You are the chief security officer at AlphaTech, a tech company that specializes in data storage solutions. Your company is developing a new cloud storage platform where users can store their personal files. To ensure data security, the development team is proposing to use symmetric encryption for data at rest. However, they are unsure of how to securely manage and distribute the symmetric keys to users. Which of the following strategies would you recommend to them?. Implement the Diffie-Hellman protocol for secure key exchange. Use digital signatures to encrypt the symmetric keys. Use HTTPS protocol for secure key transfer. Use hash functions to distribute the keys.

Attacker Lauren has gained the credentials of an organization’s internal server system, and she was often logging in during irregular times to monitor the network activities. The organization was skeptical about the login times and appointed security professional Robert to determine the issue. Robert analyzed the compromised device to find incident details such as the type of attack, its severity, target, impact, method of propagation, and vulnerabilities exploited. What is the incident handling and response (IH&R) phase, in which Robert has determined these issues?. Incident triage. Incident recording and assignment. Eradication. Preparation.

Steve, an attacker, created a fake profile on a social media website and sent a request to Stella. Stella was enthralled by Steve’s profile picture and the description given for his profile, and she initiated a conversation with him soon after accepting the request. After a few days, Steve started asking about her company details and eventually gathered all the essential information regarding her company. What is the social engineering technique Steve employed in the above scenario?. Honey trap. Diversion theft. Piggybacking. Baiting.

An organization suspects a persistent threat from a cybercriminal. They hire an ethical hacker, John, to evaluate their system security. John identifies several vulnerabilities and advises the organization on preventive measures. However, the organization has limited resources and opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability. Which of the following statements best describes this scenario?. The organization is at fault because it did not fix all identified vulnerabilities. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities. John is at fault because he did not emphasize the necessity of patching all vulnerabilities. The organization is not at fault because they used their resources as per their understanding.

A penetration tester is performing an enumeration on a client's network. The tester has acquired permission to perform enumeration activities. They have identified a remote inter-process communication (IPC) share and are trying to collect more information about it. The tester decides to use a common enumeration technique to collect the desired data. Which of the following techniques would be most appropriate for this scenario?. Conduct a DNS zone transfer. Extract usernames using email IDs. Brute force Active Directory. Probe the IPC share by attempting to brute force admin credentials.

A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for offline cracking. But the attacker was stopped before he could complete his attack. The system administrator needs to investigate and remediate the potential breach. What should be the immediate step the system administrator takes?. Perform a system reboot to clear the memory. Invalidate the TGS the attacker acquired. Delete the compromised user's account. Change the NTLM password hash used to encrypt the ST.

An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?. The SAM file has been encrypted using the SYSKEY function. The passwords exceeded 14 characters in length and therefore, the LM hashes were set to a “dummy" value. The Windows system is using the Kerberos authentication protocol as the default method. The Windows system is Vista or a later version, where LM hashes are disabled by default.

Which file is a rich target to discover the structure of a website during web- server footprinting?. domain.txt. index.html. Document root. Robots.txt.

A large enterprise has been experiencing sporadic system crashes and instability, resulting in limited access to its web services. The security team suspects it could be a result of a Denial of Service (DoS) attack. A significant increase in traffic was noticed in the network logs, with patterns suggesting packet sizes exceeding the prescribed size limit. Which among the following DoS attack techniques best describes this scenario?. Smurf attack. UDP flood attack. Pulse wave attack. Ping of Death attack.

Given the complexities of an organization’s network infrastructure, a threat actor has exploited an unidentified vulnerability, leading to a major data breach. As a Certified Ethical Hacker (CEH). you are tasked with enhancing the organization's security stance. To ensure a comprehensive security defense, you recommend a certain security strategy. Which of the following best represents the strategy you would likely suggest and why?. Develop an in-depth Risk Management process, involving identification, assessment, treatment, tracking, and review of risks to control the potential effects on the organization. Implement an Information Assurance (IA) policy focusing on ensuring the integrity, availability, confidentiality, and authenticity of information systems. Adopt a Continual/Adaptive Security Strategy involving ongoing prediction, prevention, detection, and response actions to ensure comprehensive computer network defense. Establish a Defense-in-Depth strategy, incorporating multiple layers of security measures to increase the complexity and decrease the likelihood of a successful attack.

An organization decided to harden its security against web-application and web-server attacks. John, a security personnel in the organization, employed a security scanner to automate web-application security testing and to guard the organization's web infrastructure against web-application threats. Using that tool, he also wants to detect XSS, directory transversal problems, fault injection, SQL injection, attempts to execute commands, and several other attacks. Which of the following security scanners will help John perform the above task?. AlienVault® OSSIMTM. Saleae Logic Analyzer. Cisco ASA. Syhunt Hybrid.

A Certified Ethical Hacker (CEH) is given the task to perform an LDAP enumeration on a target system. The system is secured and accepts connections only on secure LDAP. The CEH uses Python for the enumeration process. After successfully installing LDAP and establishing a connection with the target, he attempts to fetch details like the domain name and naming context but is unable to receive the expected response. Considering the circumstances, which of the following is the most plausible reason for this situation?. The system failed to establish a connection due to an incorrect port number. The Python version installed on the CEH's machine is incompatible with the Idap3 library. The enumeration process was blocked by the target system's intrusion detection system. The secure LDAP connection was not properly initialized due to a lack of 'use_ssl = True' in the server object creation.

An organization has been experiencing intrusion attempts despite deploying an Intrusion Detection System (IDS) and Firewalls. As a Certified Ethical Hacker, you are asked to reinforce the intrusion detection process and recommend a better rule-based approach. The IDS uses Snort rules and the new recommended tool should be able to complement it. You suggest using YARA rules with an additional tool for rule generation. Which of the following tools would be the best choice for this purpose and why?. Koodous - Because it combines social networking with antivirus signatures and YARA rules to detect malware. YaraRET - Because it helps in reverse engineering Trojans to generate YARA rules. AutoYara - Because it automates the generation of YARA rules from a set of malicious and benign files. yarGen - Because it generates YARA rules from strings identified in malware files while removing strings that also appear in goodware files.

You are the chief cybersecurity officer at CloudSecure Inc., and your team is responsible for securing a cloud based application that handles sensitive customer data. To ensure that the data is protected from breaches, you have decided to implement encryption for both data-at-rest and data-in-transit. The development team suggests using SSL/TLS for securing data in transit. However, you want to also implement a mechanism to detect if the data was tampered with during transmission. Which of the following should you propose?. Use the cloud service provider's built-in encryption services. Implement IPsec in addition to SSL/TLS. Encrypt data using the AES algorithm before transmission. Switch to using SSH for data transmission.

You are a cybersecurity consultant for a major airport that offers free Wi-Fi to travelers. The management is concerned about the possibility of "Evil Twin" attacks, where a malicious actor sets up a rogue access point that mimics the legitimate one. They are looking for a solution that would not significantly impact the user experience or require travelers to install additional software. What is the most effective security measure you could recommend that fits these constraints, considering the airport's unique operational environment?. Regularly change the SSID of the airport's Wi-Fi network. Implement WPA3 encryption for the airport's Wi-Fi network. Display a captive portal page that warns users about the possibility of Evil Twin attacks. Use MAC address filtering on the airport's Wi-Fi network.

Mason, a professional hacker, targets an organization and spreads Emotet malware through malicious script. After infecting the victim's device, Mason further used Emotet to spread the infection across local networks and beyond to compromise as many machines as possible. In this process, he used a tool, which is a self-extracting RAR file, to retrieve information related to network resources such as writable share drives. What is the tool employed by Mason in the above scenario?. WebBrowserPassView. Credential enumerator. Outlook scraper. NetPass.exe.

Jane invites her friends Alice and John over for a LAN party. Alice and John access Jane’s wireless network without a password. However, Jane has a long, complex password on her router. What attack has likely occurred?. Wardriving. Evil twin. Piggybacking. Wireless sniffing.

You are the lead cybersecurity analyst at a multinational corporation that uses a hybrid encryption system to secure inter-departmental communications. The system uses RSA encryption for key exchange and AES for data encryption, taking advantage of the strengths of both asymmetric and symmetric encryption. Each RSA key pair has a size of 'n' bits, with larger keys providing more security at the cost of slower performance. The time complexity of generating an RSA key pair is O(n^2), and AES encryption has a time complexity of O(n). An attacker has developed a quantum algorithm with time complexity O((log n)^2) to crack RSA encryption. Given 'n=4000' and variable 'AES key size', which scenario is likely to provide the best balance of security and performance?. AES key size=256 bits: This configuration provides a high level of security, but RSA key generation may be slow. AES key size=192 bits: This configuration is a balance between options A and B, providing moderate security and performance. AES key size=512 bits: This configuration provides the highest level of security but at a significant performance cost due to the large AES key size. AES key size=128 bits: This configuration provides less security than option A, but RSA key generation and AES encryption will be faster.

Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers. The time a hacker spends performing research to locate this information about a company is known as?. Exploration. Reconnaissance. Enumeration. Investigation.

A certified ethical hacker is carrying out an email footprinting exercise on a targeted organization using eMailTrackerPro. They want to map out detailed information about the recipient's activities after receiving the email. Which among the following pieces of information would NOT be directly obtained from eMailTrackerPro during this exercise?. Geolocation of the recipient. The email accounts related to the domain of the organization. The time recipient spent reading the email. Tvpe of device used to open the email.

An experienced cyber attacker has created a fake LinkedIn profile, successfully impersonating a high-ranking official from a well-established company, to execute a social engineering attack. The attacker then connected with other employees within the organization, receiving invitations to exclusive corporate events and gaining access to proprietary project details shared within the network. What advanced social engineering technique has the attacker primarily used to exploit the system and what is the most likely immediate threat to the organization?. Baiting and Involuntary Data Leakage. Whaling and Targeted Attacks. Spear Phishing and Spam. Pretexting and Network Vulnerability.

During a recent vulnerability assessment of a major corporation's IT systems, the security team identified several potential risks. They want to use a vulnerability scoring system to quantify and prioritize these vulnerabilities. They decide to use the Common Vulnerability Scoring System (CVSS). Given the characteristics of the identified vulnerabilities, which of the following statements is the most accurate regarding the metric types used by CVSS to measure these vulnerabilities?. Temporal metric represents the inherent qualities of a vulnerability. Base metric represents the inherent qualities of a vulnerability. Temporal metric involves measuring vulnerabilities based on a specific environment or implementation. Environmental metric involves the features that change during the lifetime of the vulnerability.

Your company suspects a potential security breach and has hired you as a Certified Ethical Hacker to investigate. You discover evidence of footprinting through search engines and advanced Google hacking techniques. The attacker utilized Google search operators to extract sensitive information. You further notice queries that indicate the use of the Google Hacking Database (CHDB) with an emphasis on VPN footprinting. Which of the following Google advanced search operators would be the LEAST useful in providing the attacker with sensitive VPN-related information?. intitle: This operator restricts results to only the pages containing the specified term in the title. location: This operator finds information for a specific location. link: This operator searches websites or pages that contain links to the specified website or page. inurl: This operator restricts the results to only the pages containing the specified word in the URL.

While browsing his Facebook feed, Matt sees a picture one of his friends posted with the caption, “Learn more about your friends!”, as well as a number of personal questions. Matt is suspicious and texts his friend, who confirms that he did indeed post it. With assurance that the post is legitimate, Matt responds to the questions on the post. A few days later, Matt’s bank account has been accessed, and the password has been changed. What most likely happened?. Matt’s computer was infected with a keylogger. Matt inadvertently provided the answers to his security questions when responding to the post. Matt inadvertently provided his password when responding to the post. Matt’s bank account login information was brute forced.

You are a cybersecurity specialist at CloudTech Inc., a company providing cloud- based services. You are managing a project for a client who wants to migrate their sensitive data to a public cloud service. To comply with regulatory requirements, the client insists on maintaining full control over the encryption keys even when the data is at rest on the cloud. Which of the following practices should you implement to meet this requirement?. Encrypt data client-side before uploading to the cloud and retain control of the encryption keys. Use the cloud service provider's encryption services but store keys on-premises. Rely on Secure Sockets Layer (SSL) encryption for data at rest. Use the cloud service provider's default encryption and key management services.

A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?. Implement endpoint detection and response solution to oversee endpoint activities. Set up a honeypot to attract potential attackers into a controlled environment for analysis. Deploy more security personnel to physically monitor key points of access. Organize regular employee awareness training regarding social engineering techniques and preventive measures.

In an advanced digital security scenario, a multinational enterprise is being targeted with a complex series of assaults aimed to disrupt operations, manipulate data integrity, and cause serious financial damage. As the Lead Cybersecurity Analyst with CEH and CISSP certifications, your responsibility is to correctly identify the specific type of attack based on the following indicators: The attacks are exploiting a vulnerability in the target system's hardware, inducing misprediction of future instructions in a program's control flow. The attackers are strategically inducing the victim process to speculatively execute instructions sequences that would not have been executed in the absence of the misprediction, leading to subtle side effects. These side effects, which are observable from the shared state, are then utilized to infer the values of in- flight data. What type of attack best describes this scenario?. Rowhammer Attack. Privilege Escalation Attack. Watering Hole Attack. Side-Channel Attack.

Your company has been receiving regular alerts from its IDS about potential intrusions. On further investigation, you notice that these alerts have been false positives triggered by certain goodware files. In response, you are planning to enhance the IDS with YARA rules, reducing these false positives while improving the detection of real threats. Based on the scenario and the principles of YARA and IDS, which of the following strategies would best serve your purpose?. Writing YARA rules specifically to identify the goodware files triggering false positives. Incorporating YARA rules to detect patterns in all files regardless of their nature. Creating YARA rules to examine only the private database for intrusions. Implementing YARA rules that focus solely on known malware signatures.

As a cybersecurity professional, you are responsible for securing a high-traffic web application that uses MySQL as its backend database. Recently, there has been a surge of unauthorized login attempts, and you suspect that a seasoned black-hat hacker is behind them. This hacker has shown proficiency in SQL Injection and appears to be using the 'UNION' SQL keyword to trick the login process into returning additional data. However, your application’s security measures include filtering special characters in user inputs, a method usually effective against such attacks. In this challenging environment, if the hacker still intends to exploit this SQL Injection vulnerability, which strategy is he most likely to employ?. The hacker attempts to bypass the special character filter by encoding his malicious input, which could potentially enable him to successfully inject damaging SQL queries. The hacker switches tactics and resorts to a 'time-based blind' SQL Injection attack, which would force the application to delay its response, thereby revealing information based on the duration of the delay. The hacker alters his approach and injects a DROP TABLE' statement, a move that could potentially lead to the loss of vital data stored in the application's database. The hacker tries to manipulate the 'UNION' keyword in such a way that it triggers a database error, potentially revealing valuable information about the database's structure.

An ethical hacker is hired to evaluate the defenses of an organization's database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system's signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing. Implementing sophisticated matches such as "OR john' = 'john'" in place of classical matches like "OR 1=1". Manipulating white spaces in SQL queries to bypass signature detection. Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form.

You have been given the responsibility to ensure the security of your school's web server. As a step towards this, you plan to restrict unnecessary services running on the server. In the context of web server security, why is this step considered important?. Unnecessary services could contain vulnerabilities; minimize the attack surface. Unnecessary services slow down the server; optimize server speed. Unnecessary services reveal server software; hide software details. Unnecessary services eat up server memory; save memory resources.

Which of the following protocols can be used to secure an LDAP service against anonymous queries?. RADIUS. SSO. WPA. NTLM.

Which of the following Bluetooth hacking techniques refers to the theft of information from a wireless device through Bluetooth?. Bluesmacking. Bluejacking. Bluebugging. Bluesnarfing.

A company recently experienced a debilitating social engineering attack that led to substantial identity theft. An inquiry found that the employee inadvertently provided critical information during an innocuous phone conversation. Considering the specific guidelines issued by the company to thwart social engineering attacks, which countermeasure would have been the most successful in averting the incident?. Conduct comprehensive training sessions for employees on various social engineering methodologies and the risks associated with revealing confidential data. Reinforce physical security measures to limit access to sensitive zones within the company premises, thereby warding off unauthorized intruders. Adopt a robust software policy that restricts the installation of unauthorized applications. Implement a well-documented change management process for modifications related to hardware or software.

You are a cybersecurity consultant for a global organization. The organization has adopted a Bring Your Own Device (BYOD)policy, but they have recently experienced a phishing incident where an employee's device was compromised. In the investigation, you discovered that the phishing attack occurred through a third-party email app that the employee had installed. Given the need to balance security and user autonomy under the BYOD policy, how should the organization mitigate the risk of such incidents? Moreover, consider a measure that would prevent similar attacks without overly restricting the use of personal devices. Provide employees with corporate-owned devices for work-related tasks. Conduct regular cybersecurity awareness training, focusing on phishing attacks. Implement a mobile device management solution that restricts the installation of non- approved applications. Require all employee devices to use a company-provided VPN for internet access.

An ethical hacker has been tasked with assessing the security of a major corporation's network. She suspects the network uses default SNMP community strings. To exploit this, she plans to extract valuable network information using SNMP enumeration. Which tool could best help her to get the information without directly modifying any parameters within the SNMP agent’s management information base (MIB)?. SnmpWalk, with a command to change an OID to a different value. OpUtils, are mainly designed for device management and not SNMP enumeration. Nmap, with a script to retrieve all running SNMP processes and associated ports. snmp-check (snmp_enum Module) to gather a wide array of information about the target.

You are a cybersecurity trainee tasked with securing a small home network. The homeowner is concerned about potential "Wi-Fi eavesdropping," where unauthorized individuals could intercept the wireless communications. What would be the most effective first step to mitigate this risk, considering the simplicity and the residential nature of the network?. Disable the network's SSID broadcast. Enable MAC address filtering. Reduce the signal strength of the wireless router. Enable encryption on the wireless network.

As part of a college project, you have set up a web server for hosting your team’s application. Given your interest in cybersecurity, you have taken the lead in securing the server. You are aware that hackers often attempt to exploit server misconfigurations. Which of the following actions would best protect your web server from potential misconfiguration-based attacks?. Regularly backing up server data. Implementing a firewall to filter traffic. Enabling multi-factor authentication for users. Performing regular server configuration audits.

A penetration tester was assigned to scan a large network range to find live hosts. The network is known for using strict TCP filtering rules on its firewall, which may obstruct common host discovery techniques. The tester needs a method that can bypass these firewall restrictions and accurately identify live systems. What host discovery technique should the tester use?. ICMP Timestamp Ping Scan. UDP Ping Scan. ICMP ECHO Ping Scan. TCP SYN Ping Scan.

A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack. In the scenario described, which of the following steps should the analyst take next?. Carry out a passive wire sniffing operation using Internet packet sniffers. Request a service ticket for the service principal name of the target service account. Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz. Perform a PRobability INfinite Chained Elements (PRINCE) attack.

Jake, a network security specialist, is trying to prevent network-level session hijacking attacks in his company. While studying different types of such attacks, he learns about a technique where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets. Which of the following types of network-level session hijacking attacks is Jake studying?. TCP/IP Hijacking. Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing. UDP Hijacking. RST Hijacking.

During a reconnaissance mission, an ethical hacker uses Maltego, a popular footprinting tool, to collect information about a target organization. The information includes the target's Internet infrastructure details (domains, DNS names, Netblocks, IP address information). The hacker decides to use social engineering techniques to gain further information. Which of the following would be the least likely method of social engineering to yield beneficial information based on the data collected?. Impersonating an ISP technical support agent to trick the target into providing further network details. Shoulder surfing to observe sensitive credentials input on the target’s computers. Dumpster diving in the target company's trash bins for valuable printouts. Eavesdropping on internal corporate conversations to understand key topics.

During your summer internship at a tech company, you have been asked to review the security settings of their web server. While inspecting, you notice the server reveals detailed error messages to users, including database query errors and internal server errors. As a cybersecurity beginner, what is your understanding of this setting, and how would you advise the company?. Retain the setting as it aids in troubleshooting user issues. Implement stronger encryption to secure the error messages. Suppress detailed error messages, as they can expose sensitive information. Increase the frequency of automated server backups.

Consider a hypothetical situation where an attacker, known for his proficiency in SQL Injection attacks, is targeting your web server. This adversary meticulously crafts 'q' malicious SQL queries, each inducing a delay of 'd' seconds in the server response. This delay in response is an indicator of a potential attack. If the total delay, represented by the product 'q*d', crosses a defined threshold 'T', an alert is activated in your security system. Furthermore, it is observed that the attacker prefers prime numbers for 'q', and 'd' follows a pattern in the Fibonacci sequence. Now, consider 'd=13' seconds (a Fibonacci number) and various values of 'q' (a prime number) and 'T'. Which among the following scenarios will most likely trigger an alert?. q=17, T=220: Even though the attacker increases 'q', the total delay ('q*d' = 221 seconds) just surpasses the threshold, possibly activating an alert. q=19, T=260: Despite the attacker's increased effort, the total delay ('q*d' = 247 seconds) does not exceed the threshold, thus no alert is triggered. q=13, T=180: In this case, the total delay caused by the attacker ('q*d' = 169 seconds) breaches the threshold, likely leading to the triggering of a security alert. q=11, T=150: Here, the total delay induced by the attacker ('q*d' = 143 seconds) does not surpass the threshold, so the security system remains dormant.

As a cybersecurity analyst at IoT Defend, you are working with a large utility company that uses Industrial Control Systems (ICS) in its operational technology (OT) environment. The company has recently integrated IoT devices into this environment to enable remote monitoring and control. They want to ensure these devices do not become a weak link in their security posture. To identify potential vulnerabilities in the IoT devices, which of the following actions should you recommend as the first step?. Use stronger encryption algorithms for data transmission between IoT devices. Conduct a vulnerability assessment specifically for the IoT devices. Install the latest antivirus software on each IoT device. Implement network segmentation to isolate IoT devices from the rest of the network.

An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?. m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time. m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant. m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection. m=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower.

As the lead security engineer for a retail corporation, you are assessing the security of the wireless networks in the company's stores. One of your main concerns is the potential for "Wardriving" attacks, where attackers drive around with a Wi-Fi-enabled device to discover vulnerable wireless networks. Given the nature of the retail stores, you need to ensure that any security measures you implement do not interfere with customer experience, such as their ability to access in-store Wi-Fi. Taking into consideration these factors, which of the following would be the most suitable measure to mitigate the risk of Wardriving attacks?. Limit the range of the store's wireless signals. Implement WPA3 encryption for the store's Wi-Fi network. Disable SSID broadcasting. Implement MAC address filtering.

You are a security analyst for CloudSec, a company providing cloud security solutions. One of your clients, a financial institution, wants to shift its operations to a public cloud while maintaining a high level of security control. They want to ensure that they can monitor all their cloud resources continuously and receive real-time alerts about potential security threats. They also want to enforce their security policies consistently across all cloud workloads. Which of the following solutions would best meet these requirements?. Deploy a Cloud Access Security Broker (CASB). Use multi-factor authentication for all cloud user accounts. Implement a Virtual Private Network (VPN) for secure data transmission. Use client-side encryption for all stored data.

A multinational organization has recently faced a severe information security breach. Investigations reveal that the attacker had a high degree of understanding of the organization’s internal processes and systems. This knowledge was utilized to bypass security controls and corrupt valuable resources. Considering this event, the security team is contemplating the type of attack that occurred and the steps they could have taken to prevent it. Choose the most plausible type of attack and a countermeasure that the organization could have employed: Insider attacks and the organization should have implemented robust access control and monitoring. Active attack and the organization could have used network traffic analysis. Passive attack and the organization should have used encryption techniques. Distribution attack and the organization could have ensured software and hardware integrity checks.

At what stage of the cyber kill chain theory model does data exfiltration occur?. Actions on objectives. Weaponization. Command and control. Installation.

In an intricate web application architecture using an Oracle database, you, as a security analyst, have identified a potential SQL Injection attack surface. The database consists of 'x' tables, each with 'y' columns. Each table contains 'z' records. An attacker, well-versed in SQLi techniques, crafts 'u' SQL payloads, each attempting to extract maximum data from the database. The payloads include 'UNION SELECT' statements and 'DBMS_XSLPROCESSOR.READ2CLOB' to read sensitive files. The attacker aims to maximize the total data extracted 'E=xyz*u'. Assuming 'x=4', 'y=2', and varying 'z' and 'u', which situation is likely to result in the highest extracted data volume?. z=600, u=2: The attacker devises 2 SQL payloads, each aimed at tables holding 600 records, affecting all columns across all tables. z=500, u=3: The attacker creates 3 SQL payloads and targets tables with 500 records each, exploiting all columns and tables. z=550, u=2: Here, the attacker formulates 2 SQL payloads and directs them towards tables containing 550 records, impacting all columns and tables. z=400, u=4: The attacker constructs 4 SQL payloads, each focusing on tables with 400 records, influencing all columns of all tables.

A large organization is investigating a possible identity theft case where an attacker has created a new identity by combining multiple pieces of information from different victims to open a new bank account. The attacker also managed to receive government benefits using a fraudulent identity. Given the circumstances, which type of identity theft is the organization dealing with?. Identity Cloning and Concealment. Social Identity Theft. Child Identity Theft. Synthetic Identity Theft.

Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed. What is the port scanning technique used by Sam to discover open ports?. Xmas scan. ACK flag probe scan. IDLE/IPID header scan. TCP Maimon scan.

You're the security manager for a tech company that uses a database to store sensitive customer data. You have implemented countermeasures against SQL injection attacks. Recently, you noticed some suspicious activities and suspect an attacker is using SQL injection techniques. The attacker is believed to use different forms of payloads in his SQL queries. In the case of a successful SQL injection attack, which of the following payloads would have the most significant impact?. UNION SELECT NULL, NULL, NULL -- : This payload manipulates the UNION SQL operator, enabling the attacker to retrieve data from different database tables. ' OR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERE clause with a destructive action, causing data loss. ' OR username LIKE '%': This payload uses the LIKE operator to search for a specific pattern in a column. ' OR '1'='l: This payload manipulates the WHERE clause of an SQL statement, allowing the attacker to view unauthorized data.

An IT company has just implemented new security controls to their network and system setup. As a Certified Ethical Hacker, your responsibility is to assess the possible vulnerabilities in the new setup. You are given the information that the network and system are adequately patched with the latest updates, and all employees have gone through recent cybersecurity awareness training. Considering the potential vulnerability sources, what is the best initial approach to vulnerability assessment?. Conducting social engineering tests to check if employees can be tricked into revealing sensitive information. Checking for hardware and software misconfigurations to identify any possible loopholes. Evaluating the network for inherent technology weaknesses prone to specific types of attacks. Investigating if any ex-employees still have access to the company's system and data.

Johnson, an attacker, performed online research for the contact details of reputed cybersecurity firms. He found the contact number of sibertech.org and dialed the number, claiming himself to represent a technical support team from a vendor. He warned that a specific server is about to be compromised and requested sibertech.org to follow the provided instructions. Consequently, he prompted the victim to execute unusual commands and install malicious files, which were then used to collect and pass critical information to Johnson’s machine. What is the social engineering technique Steve employed in the above scenario?. Diversion theft. Quid pro quo. Elicitation. Phishing.

Which of the following Metasploit post-exploitation modules can be used to escalate privileges on Windows systems?. getsystem. keylogrecorder. autoroute. getuid.

As a cybersecurity analyst at TechSafe Inc., you are working on a project to improve the security of a smart home system. This IoT-enabled system controls various aspects of the home, from heating and lighting to security cameras and door locks. Your client wants to ensure that even if one device is compromised, the rest of the system remains secure. Which of the following strategies would be most effective for this purpose?. Recommend using a strong password for the smart home system's main control panel. Advise using a dedicated network for the smart home system, separate from the home's main Wi-Fi network. Propose frequent system resets to clear any potential malware. Suggest implementing two-factor authentication for the smart home system's mobile app.

Juliet, a security researcher in an organization, was tasked with checking for the authenticity of images to be used in the organization's magazines. She used these images as a search query and tracked the original source and details of the images, which included photographs, profile pictures, and memes. Which of the following footprinting techniques did Rachel use to finish her task?. Google advanced search. Reverse image search. Advanced image search. Meta search engines.

Sarah, a system administrator, was alerted of potential malicious activity on the network of her company. She discovered a malicious program spread through the instant messenger application used by her team. The attacker had obtained access to one of her teammate's messenger accounts and started sending files across the contact list. Which best describes the attack scenario and what measure could have prevented it?. Insecure Patch Management; updating application software regularly. Instant Messenger Applications; verifying the sender's identity before opening any files. Rogue/Decoy Applications; ensuring software is labeled as TRUSTED. Portable Hardware Media/Removable Devices; disabling Autorun functionality.

During the enumeration phase, Lawrence performs banner grabbing to obtain information such as OS details and versions of services running. The service that he enumerated runs directly on TCP port 445. Which of the following services is enumerated by Lawrence in this scenario?. Remote procedure call (RPC). Server Message Block (SMB). Network File System (NFS). Telnet.

In the process of setting up a lab for malware analysis, a cybersecurity analyst is tasked to establish a secure environment using a sheep dip computer. The analyst must prepare the testbed while adhering to best practices. Which of the following steps should the analyst avoid when configuring the environment?. Installing malware analysis tools on the guest OS. Connecting the system to the production network during the malware analysis. Simulating Internet services using tools such as INetSim. Installing multiple guest operating systems on the virtual machine(s).

In the process of implementing a network vulnerability assessment strategy for a tech company, the security analyst is confronted with the following scenarios: 1) A legacy application is discovered on the network, which no longer receives updates from the vendor. 2) Several systems in the network are found running outdated versions of web browsers prone to distributed attacks. 3) The network firewall has been configured using default settings and passwords. 4) Certain TCP/IP protocols used in the organization are inherently insecure. The security analyst decides to use vulnerability scanning software. Which of the following limitations of vulnerability assessment should the analyst be most cautious about in this context?. Vulnerability scanning software cannot define the impact of an identified vulnerability on different business operations. Vulnerability scanning software is not immune to software engineering flaws that might lead to serious vulnerabilities being missed. Vulnerability scanning software is limited in its ability to perform live tests on web applications to detect errors or unexpected behavior. Vulnerability scanning software is limited in its ability to detect vulnerabilities at a given point in time.

Mary, a penetration tester, has found password hashes in a client system she managed to breach. She needs to use these passwords to continue with the test, but she does not have time to find the passwords that correspond to these hashes. Which type of attack can she implement in order to continue?. Pass the hash. LLMNR/NBT-NS poisoning. Pass the ticket. Internal monologue attack.

XYZ company recently discovered a potential vulnerability on their network, originating from misconfigurations. It was found that some of their host servers had enabled debugging functions and unknown users were granted administrative permissions. As a Certified Ethical Hacker, what would be the most potent risk associated with this misconfiguration?. Unauthorized users may perform privilege escalation using unnecessarily created accounts. An attacker may be able to inject a malicious DLL into the current running process. An attacker may carry out a Denial-of-Service assault draining the resources of the server in the process. Weak encryption might be allowing man-in-the-middle attacks, leading to data tampering.

Heather’s company has decided to use a new customer relationship management tool. After performing the appropriate research, they decided to purchase a subscription to a cloud-hosted solution. The only administrative task that Heather will need to perform is the management of user accounts. The provider will take care of the hardware, operating system, and software administration including patching and monitoring. Which of the following is this type of solution?. SaaS. IaaS. PaaS. CaaS.

As a security analyst for SkySecure Inc., you are working with a client that uses a multi-cloud strategy, utilizing services from several cloud providers. The client wants to implement a system that will provide unified security management across all their cloud platforms. They need a solution that allows them to consistently enforce security policies, identify and respond to threats, and maintain visibility of all their cloud resources. Which of the following should you recommend as the best solution?. Use a Cloud Access Security Broker (CASB). Implement separate security management tools for each cloud platform. Rely on the built-in security features of each cloud platform. Use a hardware-based firewall to secure all cloud resources.

A well-resourced attacker intends to launch a highly disruptive DDoS attack against a major online retailer. The attacker aims to exhaust all the network resources while keeping their identity concealed. Their method should be resistant to simple defensive measures such as IP-based blocking. Based on these objectives, which of the following attack strategies would be most effective?. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals. The attacker should execute a simple ICMP flood attack from a single IP, exploiting the retailer's ICMP processing. The attacker should instigate a protocol-based SYN flood attack, consuming connection state tables on the retailer's servers. The attacker should initiate a volumetric flood attack using a single compromised machine to overwhelm the retailer's network bandwidth.

Jason, a certified ethical hacker, is hired by a major e-commerce company to evaluate their network's security. As part of his reconnaissance, Jason is trying to gain as much information as possible about the company's public-facing servers without arousing suspicion. His goal is to find potential points of entry and map out the network infrastructure for further examination. Which technique should Jason employ to gather this information without alerting the company's intrusion detection systems (IDS)?. Jason should use passive reconnaissance techniques such as WHOIS lookups, NS lookups, and web research. Jason should perform a ping sweep to identify all the live hosts in the company's IP range. Jason should use a DNS zone transfer to gather information about the company's servers. Jason should directly connect to each server and attempt to exploit known vulnerabilities.

An organization has automated the operation of critical infrastructure from a remote location. For this purpose, all the industrial control systems are connected to the Internet. To empower the manufacturing process, ensure the reliability of industrial networks, and reduce downtime and service disruption, the organization decided to install an OT security tool that further protects against security incidents such as cyber espionage, zero-day attacks, and malware. Which of the following tools must the organization employ to protect its critical infrastructure?. Flowmon. Robotium. IntentFuzzer. BalenaCloud.

As a part of an ethical hacking exercise, an attacker is probing a target network that is suspected to employ various honeypot systems for security. The attacker needs to detect and bypass these honeypots without alerting the target. The attacker decides to utilize a suite of techniques. Which of the following techniques would NOT assist in detecting a honeypot?. Implementing a brute force attack to verify system vulnerability. Analyzing the MAC address to detect instances running on VMware. Using honeypot detection tools like Send-Safe Honeypot Hunter. Probing system services and observing the three-way handshake.

John, a professional hacker, decided to use DNS to perform data exfiltration on a target network. In this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique, John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server. What is the technique employed by John to bypass the firewall?. DNS tunneling method. DNS enumeration. DNSSEC zone walking. DNS cache snooping.

During an ethical hacking engagement, you have been assigned to evaluate the security of a large organization's network. While examining the network traffic, you notice numerous incoming requests on various ports from different locations that show a pattern of an orchestrated attack. Based on your analysis, you deduce that the requests are likely to be automated scripts being run by unskilled hackers. What type of hacker classification does this scenario most likely represent?. Script Kiddies trying to compromise the system using pre-made scripts. Black Hats trying to exploit system vulnerabilities for malicious intent. White Hats conducting penetration testing to identify security weaknesses. Gray Hats testing system vulnerabilities to help vendors improve security.

A Certified Ethical Hacker (CEH) is analyzing a target network. To do this, he decides to utilize an IDLE/IPID header scan using Nmap. The network analysis reveals that the IPID number increases by 2 after following the steps of an IDLE scan. Based on this information, what can the CEH conclude about the target network?. The ports on the target network are open. The target network has a stateful firewall present. The ports on the target network are closed. The target network has no firewall present.

Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments. When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack. Which of the following measures would be the most effective in preventing such attacks?. Applying the latest patches and updating software programs. Regularly scan systems for any new files and examine them. Disabling Autorun functionality on all drives. Avoiding the use of outdated web browsers and email software.

As a cybersecurity analyst for a large corporation, you are auditing the company's mobile device management (MDM) policy. One of your areas of concern is data leakage from company-provided smartphones. You are worried about employees unintentionally installing malicious apps that could access sensitive corporate data on their devices. Which of the following would be an effective measure to prevent such data leakage?. Enforce a policy that only allows app installations from approved corporate app stores. Mandate the use of VPNs when accessing corporate data. Require biometric authentication for unlocking devices. Regularly change Wi-Fi passwords used by the devices.

In an advanced persistent threat scenario, an adversary follows a detailed set of procedures in the cyber kill chain. During one such instance, the adversary has successfully gained access to a corporate network and now attempts to obfuscate malicious traffic within legitimate network traffic. Which of the following actions would most likely be part of the adversary's current procedures?. Initiating DNS tunneling to communicate with the command-and-control server. Establishing a command-and-control server to communicate with compromised systems. Conducting internal reconnaissance using PowerShell scripts. Employing data staging techniques to collect and aggregate sensitive data.

You are a cybersecurity professional managing cryptographic systems for a global corporation. The company uses a mix of Elliptic Curve Cryptography (ECC) for key exchange and symmetric encryption algorithms for data encryption. The time complexity of ECC key pair generation is O(n^3), where 'n' is the size of the key. An advanced threat actor group has a quantum computer that can potentially break ECC with a time complexity of O((log n)^2). Given that the ECC key size is 'n=512' and varying symmetric encryption algorithms and key sizes, which scenario would provide the best balance of security and performance?. Data encryption with AES-128: Provides moderate security and fast encryption, offering a balance between the two. Data encryption with Blowfish using a 448-bit key: Offers high security but potential compatibility issues due to Blowfish's less widespread use. Data encryption with AES-256: Provides high security with better performance than 3DES, but not as fast as other AES key sizes. Data encryption with 3DES using a 168-bit key: Offers high security but slower performance due to 3DES's inherent inefficiencies.

As a security consultant, you are advising a startup that is developing an IoT device for home security. The device communicates with a mobile app, allowing homeowners to monitor their homes in real time. The CEO is concerned about potential Man-in-the-Middle (MitM) attacks that could allow an attacker to intercept and manipulate the device's communication. Which of the following solutions would best protect against such attacks?. Use CAPTCHA on the mobile app's login screen. Limit the range of the IoT device's wireless signals. Implement SSL/TLS encryption for data transmission between the IoT device and the mobile app. Frequently change the IoT device's IP address.

What is the file that determines the basic configuration (specifically activities, services, broadcast receivers, etc.) in an Android application?. resources.asrc. classes.dex. AndroidManifest.xml. APK.info.

You are an ethical hacker contracted to conduct a security audit for a company. During the audit, you discover that the company's wireless network is using WEP encryption. You understand the vulnerabilities associated with WEP and plan to recommend a more secure encryption method. Which of the following would you recommend as a suitable replacement to enhance the security of the company's wireless network?. Open System authentication. WPA2-PSK with AES encryption. MAC address filtering. SSID broadcast disabling.

You are an ethical hacker tasked with conducting an enumeration of a company's network. Given a Windows Answered Marked for Review 37.6% system with NetBIOS enabled, port 139 open, and file and printer sharing active, you are about to run some nbtstat commands to enumerate NetBIOS names. The company uses IPv6 for its network. Which of the following actions should you take next?. Use nbtstat -c to get the contents of the NetBIOS name cache. Switch to an enumeration tool that supports IPv6. Utilize Nmap Scripting Engine (NSE) for NetBIOS enumeration. Use nbtstat -a followed by the IPv6 address of the target machine.

Morris, a professional hacker, performed a vulnerability scan on a target organization by sniffing the traffic on the network to identify the active systems, network services, applications, and vulnerabilities. He also obtained the list of the users who are currently accessing the network. What is the type of vulnerability assessment that Morris performed on the target organization?. External assessment. Passive assessment. Internal assessment. Credentialed assessment.

Alice needs to send a confidential document to her coworker, Bryan. Their company has public key infrastructure set up. Therefore, Alice both encrypts the message and digitally signs it. Alice uses _______________ to encrypt the message, and Bryan uses _______________ to confirm the digital signature. Bryan’s public key; Bryan’s public key. Bryan’s public key; Alice’s public key. Bryan’s private key; Alice’s public key. Alice’s public key; Alice’s public key.

You work as a cloud security specialist at SkyNet Solutions. One of your clients is a healthcare organization that plans to migrate its electronic health record (EHR) system to the cloud. This system contains highly sensitive personal and medical data. As part of your job, you need to ensure the security and privacy of this data while it is being transferred and stored in the cloud. You recommend that data should be encrypted during transit and at rest. However, you also need to ensure that even if a cloud service provider(CSP) has access to encrypted data, they should not be able to decrypt it. Which of the following would be the most suitable strategy to meet this requirement?. Utilize the CSP's built-in data encryption services. Use client-side encryption and manage encryption keys independently of the CSP. Rely on network-level encryption protocols for data transfer. Use SSL/TLS for data transfer and allow the CSP to manage encryption keys.

Attacker Simon targeted the communication network of an organization and disabled the security controls of NetNTLMv1 by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic. He then extracted all the non-network logon tokens from all the active processes to masquerade as a legitimate user to launch further attacks. What is the type of attack performed by Simon?. Rainbow table attack. Internal monologue attack. Dictionary attack. Combinator attack.