Question 1

Which HTTP method starts a remote Application-layer loopback of the request message?
A) TRACE
B) PUT
C) GET
D) HEAD

Accepted Answer

The TRACE method is used to retrieve the original request message sent by the client in a remote loopback. It is mainly used for testing or debugging purposes. PUT method is used to upload or update a resource on the server, GET method is used to retrieve a resource from the server, and HEAD method is used to retrieve only the header information of a resource from the server. Therefore, among the given options, A is the best choice for the given question.

Question 2

The HTTP CONNECT method starts a remote application-layer loopback of the request message.

Accepted Answer

The HTTP CONNECT method is used to establish a tunnel to a server identified by the target resource, typically to facilitate a secure connection through an HTTP proxy.

Question 3

Wget is a *nix system command that can be used to retrieve HTTP,HTTPS,and FTP files over the Internet.

Accepted Answer

Wget is a command-line tool mainly used to download files from the internet. It is available on most *nix systems, including Linux and macOS, and can retrieve files via HTTP, HTTPS, and FTP protocols.

Question 4

What is the HTTP method that retrieves data by URI?
A) GET
B) PUT
C) CONNECT
D) HEAD

Accepted Answer

The HTTP method that retrieves data by URI is the GET method. This method requests access to the resource identified by the URI and retrieves the data associated with that resource.

Question 5

Which process enables you to see all the host computers on a network and basically give you a diagram of an organization's network?
A) Web bugs
B) footprints
C) zone transfers
D) namedroppers

Accepted Answer

Zone transfers are a process used in DNS (Domain Name System) to replicate DNS data across a number of DNS servers, which can inadvertently or deliberately reveal the structure of a network, including the host computers within that network. This can be used by administrators for legitimate purposes or by attackers for reconnaissance.

Question 6

What HTTP method is the same as the GET method,but retrieves only the header information of an HTML document,not the document body?
A) CONNECT
B) PUT
C) POST
D) HEAD

Accepted Answer

The HEAD method is used to retrieve only the header information of an HTML document, not the document body. This is useful when you want to check if a resource exists, get information about a resource, or check its modification date without actually downloading the resource itself.

Question 7

When an individual attempts to discover as much information legally possible about their competition,what information gathering technique are they performing?
A) competitive study
B) packet study
C) basic information
D) competitive intelligence

Accepted Answer

Competitive intelligence involves legally gathering as much information as possible about competitors in order to gain a strategic advantage. A competitive study may be part of the process, but competitive intelligence encompasses a broader range of information gathering techniques. A packet study and basic information are not specific techniques for gathering information about competitors.

Question 8

Which utility can extract meta-data and documents on a Website to reveal the document creator's network login,e-mail address,IP address,and other important information?
A) Samba
B) Bugnosis
C) SamSpade
D) FOCA

Accepted Answer

FOCA is a tool used for extracting metadata and hidden information from documents on websites, which can include details like the document creator's network login, email address, and IP address.

Question 9

Which HTTP method requests that the entity is stored under the Request-URI?
A) GET
B) PUT
C) POST
D) HEAD

Accepted Answer

The PUT method is used to request that a resource be stored under the Request-URI. The entity enclosed in the request is stored under the supplied Request-URI. If the Request-URI refers to an already existing resource, the enclosed entity should be considered as a modified version of the original resource.

Question 10

What area of a network is a major area of potential vulnerability because of the use of URLs?
A) DNS
B) SOA
C) DHCP
D) POST

Accepted Answer

DNS (Domain Name System) is the area of a network that is a major area of potential vulnerability because of the use of URLs (Uniform Resource Locators). URLs are used to identify and locate resources on the internet, and typically contain domain names that are resolved by DNS servers. If a DNS server is compromised or a DNS lookup is intercepted, it can result in users being directed to malicious or fake websites, leading to potential security risks such as phishing, malware, or data theft.

Question 11

Namedroppers is a tool that can be used to capture Web server information and vulnerabilities in a Web site's pages that could allow exploits such as SQL injection and buffer overflows.

Accepted Answer

Namedroppers is not a tool for capturing Web server information and vulnerabilities; it is more commonly associated with domain name search and DNS query tools. Tools for capturing Web server vulnerabilities include scanners like Nessus, OpenVAS, and SQLmap.

Question 12

Network attacks can often begin by gathering information from a company's Web site.

Accepted Answer

Network attackers often use information from a company's website to plan and successfully execute their attacks. This highlights the importance of implementing security measures to protect not only sensitive information but also any seemingly innocuous data available on the website.

Question 13

Walking is an automated way to discover pages of a Web site by following links.

Accepted Answer

Walking, in the context of web browsing, typically refers to manually navigating through a website by clicking on links. Automated discovery of web pages is usually referred to as "crawling" and is performed by web crawlers or spiders, not by walking.

Question 14

Which HTTP error informs you the server understands the request but refuses to comply?
A) 401 Unauthorized
B) 404 Not Found
C) 403 Forbidden
D) 409 Conflict

Accepted Answer

The 403 Forbidden error indicates that the server understood the request, but is refusing to fulfill it. This can happen for various reasons, such as the request being blocked by a firewall or the user not having proper authorization to access the requested resource. The 401 Unauthorized error, on the other hand, indicates that authentication is required, and the user has not provided valid credentials. The 404 Not Found error indicates that the requested resource was not found on the server, and the 409 Conflict error indicates that the request cannot be completed due to a conflict with the current state of the server.

Question 15

Which tool can be used to gather competitive intelligence from Web sites?
A) Whois
B) Netcat
C) Metis
D) Dig

Accepted Answer

Metis is a tool that can be used to gather competitive intelligence from websites. It allows users to collect data on website traffic, keywords, and other metrics.

Question 16

What tool can be used to read and write data to ports over a network?
A) Whois
B) Netcat
C) Metis
D) Dig

Accepted Answer

Netcat can be used to read and write data to ports over a network. It is a versatile tool that can establish connections with TCP and UDP ports, allowing for communication between systems.

Question 17

What utility can be used to intercept detailed information from a company's Web site?
A) JavaAttack
B) Zed Attack Proxy
C) Trace
D) WebAnalysis

Accepted Answer

Zed Attack Proxy is a powerful open-source web application scanner tool that can be used to intercept detailed information from a company's web site. It can identify vulnerabilities and weaknesses in the target application that can be used for further exploitation. The other options provided, JavaAttack, Trace, and WebAnalysis, do not offer the same level of functionality as Zed Attack Proxy.

Question 18

Which utility is used to gather IP and domain information?
A) Whois
B) Netcat
C) Metis
D) Dig

Accepted Answer

Whois is a utility tool used to obtain information about IP addresses, domain names, and other information related to internet resources.

Question 19

To see additional parameters that can be used with the Netcat command,what should you type at the command prompt?
A) nc -lookup
B) nc -z
C) nc -h
D) nc -up

Accepted Answer

Typing "nc -h" will display the help menu for Netcat, which includes a list of additional parameters that can be used with the command.

Question 20

What is the passive process of finding information on a company's network called?
A) footprinting
B) searching
C) calling
D) digging

Accepted Answer

Footprinting is the process of gathering information about a target network and its components, without actively engaging with those components. This can include techniques such as open-source intelligence gathering, social engineering, and other methods of passive reconnaissance.

Quiz 4: Footprinting and Social Engineering

Which HTTP method starts a remote Application-layer loopback of the request message?

The HTTP CONNECT method starts a remote application-layer loopback of the request message.

Wget is a *nix system command that can be used to retrieve HTTP,HTTPS,and FTP files over the Internet.

What is the HTTP method that retrieves data by URI?

Which process enables you to see all the host computers on a network and basically give you a diagram of an organization's network?

What HTTP method is the same as the GET method,but retrieves only the header information of an HTML document,not the document body?

When an individual attempts to discover as much information legally possible about their competition,what information gathering technique are they performing?

Which utility can extract meta-data and documents on a Website to reveal the document creator's network login,e-mail address,IP address,and other important information?

Which HTTP method requests that the entity is stored under the Request-URI?

What area of a network is a major area of potential vulnerability because of the use of URLs?

Namedroppers is a tool that can be used to capture Web server information and vulnerabilities in a Web site's pages that could allow exploits such as SQL injection and buffer overflows.

Network attacks can often begin by gathering information from a company's Web site.

Walking is an automated way to discover pages of a Web site by following links.

Which HTTP error informs you the server understands the request but refuses to comply?

Which tool can be used to gather competitive intelligence from Web sites?

What tool can be used to read and write data to ports over a network?

What utility can be used to intercept detailed information from a company's Web site?

Which utility is used to gather IP and domain information?

To see additional parameters that can be used with the Netcat command,what should you type at the command prompt?

What is the passive process of finding information on a company's network called?