Deck 9: Network Vulnerability Assessment

Question 1

A ____ (sometimes called a network protocol analyzer) is a network tool that collects copies of packets from the network and analyzes them or stores the packets for later analysis.

A) fuzzer
C) packet sniffer
B) trapper
D) war dialer

Answer 1

C

Question 2

____ verify that an organization's security policies are prudent (cover the right issues) and are being implemented correctly.

A) Fuzzers
C) Audits
B) Standards
D) Attack methodologies

Answer 2

C

Question 3

Wired networks are just as vulnerable to sniffing as wireless networks.

Answer 3

True

Question 4

A(n) ____ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software.

A) stealth
C) passive
B) silent
D) encapsulated

Question 5

Probably the most popular port scanner is ____, which runs on both UNIX and Windows systems.

A) nmap
C) wireshark
B) hping
D) nipper

Question 6

Protocol analyzers are commonly referred to as ____.

A) sniffers
C) tappers
B) fuzzers
D) trappers

Question 7

Implementing applications that verify the true communication destination during execution help prevent vulnerabilities associated with ____.

A) trusting network name resolution
C) directory traversal attacks
B) Google hacks
D) race conditions

Question 8

One of the preparatory parts of the attack methodology is the collection of publicly available information about a potential target, a process known as ____.

A) sniffing
C) auditing
B) reconnaissance
D) trapping

Question 9

Which vulnerability can occur if a programmer does not properly validate user input and allows an attacker to include unintended SQL input that can be passed to a database?

A) Rainbow attack
C) Command injection
B) Cross-site request forgery
D) Buffer overflow

Question 10

If Web software can access parts of the underlying operating system's file system through normal URL mappings, a(n) ____ may occur.

A) DNS resolution error
C) active network tap
B) integer overflow error
D) directory traversal attack

Question 11

Organizations are safe from sniffer attacks when their computing environment is primarily a switched network environment.

Question 12

Passive scanners are advantageous in that they do not require vulnerability analysts to get prior approval for testing.

Question 13

Most C++ catastrophe vulnerabilities rely on uninitialized function pointers in a class.

Question 14

Requirements for a complex password system include using a ____ value, implementing strong encryption, requiring periodic password changes, and generally implementing a system where guessing a password or its hash is very difficult.

A) hex
C) zero
B) salt
D) known

Question 15

Allowing users to decide which mobile code to run is the best way to resolve weaknesses introduced with mobile code.

Question 16

The printf (user_input); command in C has the potential to cause a(n) ____ vulnerability.

A) buffer overrun
C) integer overflow
B) format string problem
D) C++ catastrophe

Question 17

The ____ command, available on most popular Web browsers, allows users to see the source code behind the page.

A) View Code
C) View Source
B) Show Code
D) Show Source

Question 18

A(n) ____ uses all the techniques and tools available to an attacker in an attempt to compromise or penetrate an organization's defenses.

A) audit
C) ruleset review
B) penetration test
D) hash

Question 19

SPIKE can fuzz any protocol that utilizes ____.

A) TCP/IP
C) SNMP
B) FTP
D) Telnet

Question 20

The ____ stage of the attack methodology is a systematic survey of the target organization's Internet addresses, conducted to identify the network services offered by the hosts in that range.

A) auditing
C) activating
B) fingerprinting
D) validating

Question 21

The most realistic type of penetration test is a ____ box test.

A) black
C) red
B) gray
D) white

Question 22

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
A free, client-based network protocol analyzer.

Question 23

A(n) ____________________ vulnerability scanner initiates traffic on the network in order to identify security holes.

Question 24

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
When run with the -sI switch, it allows you to bounce your scan across a firewall by using one of the idle DMZ hosts as the initiator of the scan.

Question 25

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
A freeware tool that applies packet sniffing to wireless networks.

Question 26

____________________, also known as "fuzzing," is a straight-forward technique that looks for vulnerabilities in a program or protocol by feeding random input into the program or the network running the protocol.

Question 27

A(n) ____________________ is a network channel or connection point in a data communications system.

Question 28

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
Monitors the airwaves for any new devices or access points.

Question 29

When considered as part of the attack methodology, "____________________" refers to the tools and techniques for breaking into more systems, gaining further network access, or gaining access to more resources.

Question 30

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
A UNIX or Linux systems support tool that allows a remote individual to "mirror" entire Web sites.

Question 31

____ is a vulnerability scoring system designed to provide an open and standardized method for rating IT vulnerabilities.

A) OVAL
C) CVE
B) COBIT
D) CVSS

Question 32

The process of exploring the Internet presence of a target is sometimes called ____________________.

Question 33

Compare integer overflows to stack and heap overflows.

Question 34

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
Uses ICMP to determine the remote OS.

Question 35

The CVSS ____ Score is set by the organization using the software.

A) Base
C) Environmental
B) Temporal
D) Ergonomic

Question 36

Because it accepts firewall and intrusion logs from many sources, ____ is often one of the first organizations to spot network anomalies, and it often traces them to specific malware or vulnerability exploits.

A) Microsoft
C) Mitre
B) the ISC
D) ISACs

Question 37

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
Designed to crack WEP and WPA-PSK keys to allow packet sniffing and wireless network auditing.

Question 38

The ____ mailing list is a widely known, major source of public vulnerability announcements.

A) NetStumbler
C) Bugtraq
B) Wireshark
D) OVAL

Question 39

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
Uses incrementing Time-to-Live (TTL) packets to determine the path into a network as well as the default firewall policy.

Question 40

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
An enhanced Web scanner that, among other things, scans an entire Web site for valuable pieces of information, such as server names and e-mail addresses.

Question 41

Describe how the criticality of the affected assets must be taken into account when conducting a risk assessment for a vulnerability.

Question 42

Describe four common mistakes that may occur when attempting to protect data that is at rest.

Question 43

Describe Google hacking and provide an example.

Question 44

How can an organization ensure that its security policies are implemented?

Question 45

What are "race conditions"?

Question 46

Explain the two points administrators should remember if they are wary of using the same tools that attackers use.

Question 47

Why should you secure open ports?

Question 48

Why can the failure to validate how user input is handled result in a cross-site scripting attack?

Question 49

Describe three philosophical approaches to handling the disclosure of vulnerabilities.