Deck 4: Footprinting and Social Engineering

Question 1

____ is a tool that is used to gather IP and domain information.

A)Whois
B)Netcat
C)Metis
D)Dig

Answer 1

A

Question 2

____ enable you to see all the host computers on a network. In other words, they give you an organization's network diagram.

A)Web bugs
B)Footprints
C)Zone transfers
D)Namedroppers

Answer 2

C

Question 3

The HTTP ____ allows data to be sent to a Web server.

A)GET
B)PUT
C)POST
D)HEAD

Answer 3

C

Question 4

Namedroppers is a tool that can be used to capture Web server information and possible vulnerabilities in a Web site's pages that could allow exploits such as SQL injection and buffer overflows.

Question 5

The HTTP ____ method is the same as the GET method, but retrieves only the header information of an HTML document, not the document body.

A)CONNECT
B)PUT
C)POST
D)HEAD

Question 6

To see additional parameters that can be used with the ____ command, you can type nc -h at the command prompt.

A)Nslookup
B)Namedroppers
C)Netcat
D)Whois

Question 7

The HTTP ____ method retrieves data by URI.

A)GET
B)PUT
C)POST
D)HEAD

Question 8

____ is a tool that is used to gather competitive intelligence from Web sites.

A)Whois
B)Netcat
C)Metis
D)Dig

Question 9

Network attacks often begin by gathering information from a company's Web site.

Question 10

The HTTP ____ method requests that the entity be stored under the Request-URI.

A)GET
B)PUT
C)POST
D)HEAD

Question 11

____ is a tool that is used to perform DNS zone transfers.

A)Whois
B)Netcat
C)Metis
D)Dig

Question 12

To limit the amount of information a company makes public, you should have a good understanding of what a competitor would do to discover confidential information.

Question 13

A(n) ____ is a 1-pixel x 1-pixel image file referenced in an tag, and it usually works with a cookie.

A)image bug
B)zone transfer
C)Bugnosis detector
D)Web bug

Question 14

Some cookies can cause security issues because unscrupulous people might store personal information in cookies that can be used to attack a computer or server.

Question 15

____ is the most basic HTTP method.

A)GET
B)PUT
C)CONNECT
D)HEAD

Question 16

The ____ tool can generate a report that can show an attacker how a Web site is structured and lists Web pages that can be investigated for further information.

A)Netcat
B)Paros
C)Dig
D)Whois

Question 17

____ is a Web tool used to gather IP and domain information. It is available for both UNIX and Window OSs.

A)Samba
B)Bugnosis
C)SamSpade
D)FOCA

Question 18

____ is a tool that is used to read and write data to ports over a network.

A)Whois
B)Netcat
C)Metis
D)Dig

Question 19

The HTTP CONNECT method starts a remote application-layer loopback of the request message.

Question 20

Wget is a tool that can be used to retrieve HTTP, HTTPS, and FTP files over the Internet.

Question 21

With commands such as ____, you can perform zone transfers of all DNS records.

A)Dig
B)Whois
C)DNS
D)Netcat

Question 22

____ means using a knowledge of human nature to get information from people.

A)Fingerprinting
B)Footprinting
C)Zone transferring
D)Social engineering

Question 23

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Unable to match request

Question 24

The HTTP ____________________ method is used with a proxy that can dynamically switch to a tunnel connection, such as Secure Socket Layer (SSL).

Question 25

____ can be used to read PINs entered at ATMs or to detect long-distance authorization codes that callers dial.

A)Shoulder surfing
B)Footprinting
C)Zone transferring
D)Social engineering

Question 26

____ is trailing closely behind an employee who has access to an area without the person realizing that you didn't use a PIN or a security badge to enter the area.

A)Shoulder surfing
B)Footprinting
C)Piggybacking
D)Dumpster diving

Question 27

____ can be used to gather information useful for computer criminals, like company phone directories, financial reports, interoffice memos, resumes of employees, etc.

A)Shoulder surfing
B)Footprinting
C)Piggybacking
D)Dumpster diving

Question 28

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Request not made by client in allotted time

Question 29

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Server is unavailable due to maintenance or overload

Question 30

The ____________________ utility gives you information on a company's IP addresses and any other domains the company might be part of.

Question 31

A(n) ____________________ is a text file generated by a Web server and stored on a user's browser.

Question 32

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Request not understood by server

Question 33

To help prevent ____ attacks, you must educate your users not to type logon names and passwords when someone is standing directly behind them-or even standing nearby.

A)shoulder-surfing
B)footprinting
C)piggybacking
D)social engineering

Question 34

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Server received invalid response from upstream server

Question 35

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Request not allowed for the resource

Question 36

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Server understands request but refuses to comply

Question 37

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Request could not be fulfilled by server

Question 38

A(n) ____________________ is a person skilled at reading what users enter on their keyboards, especially logon names and passwords.

Question 39

MATCHING
Match each term with the correct statement below.
a.HTTP 400 Bad Request
f.HTTP 500 Internal Server Error
b.HTTP 403 Forbidden
g.HTTP 502 Bad Gateway
c.HTTP 404 Not Found
h.HTTP 503 Service Unavailable
d.HTTP 405 Method Not Allowed
i.HTTP 504 Gateway Timeout
e.HTTP 408 Request Timeout
Server did not receive a timely response

Question 40

In computer jargon, the process of finding information on a company's network is called ____________________.

Question 41

What is "competitive intelligence"?

Question 42

Why is ATM shoulder surfing much easier than computer shoulder surfing?

Question 43

List at least five tools available for footprinting.

Question 44

List the five techniques used by social engineers in their attempts to gain information from unsuspecting people.

Question 45

How can DNS be used for footprinting?

Question 46

What is the purpose of a Web bug? How do they relate to or differ from spyware?

Question 47

As a security tester, should you use social-engineering tactics?

Question 48

Elaborate on the following statement: "The most difficult job of a security professional is preventing social engineers from getting crucial information from company employees."

Question 49

How can computer criminals use the Whois utility for their purposes?

Question 50

How can a computer criminal use HTTP methods before running an exploit on a server?

Question 51

What type of information is usually gathered by social engineering?