Question 1

Explain why a simple process like "dumpster diving" can be so effective when gathering information utilizing social engineering?

Accepted Answer

The answer of Explain why a simple process like "dumpster...

Question 2

How can a computer criminal use HTTP methods before running an exploit on a server?

Accepted Answer

The answer of How can a computer criminal use HTTP...

Question 3

How can computer criminals use the Whois utility for their purposes?

Accepted Answer

The answer of How can computer criminals use the Whois...

Question 4

How can DNS be used for footprinting?

Accepted Answer

The answer of How can DNS be used for footprinting?...

Question 5

Which HTTP method is used with a proxy that can dynamically switch to a tunnel connection,such as Secure Socket Layer (SSL)?

Accepted Answer

The CONNECT method is used with a proxy that can dynamically switch to a tunnel connection, such as SSL. It allows the client to establish a secure TLS/SSL connection to the server via the proxy. The other HTTP methods (HEAD, PUT, and GET) do not provide this functionality.

Question 6

Which technique can be used to read PINs entered at ATMs or at other areas when a pin code is entered?

Accepted Answer

Shoulder surfing is the technique used to read PINs entered at ATMs or other areas. It involves observing or spying on someone while they are entering their PIN or password. Footprinting is the process of gathering information about a target system or network. Zone transferring is a DNS (Domain Name System) attack that allows an attacker to query DNS servers and gather information about a target network. Piggybacking refers to the act of following someone into a secured area without authorization.

Question 7

Match each item with a statement below.
-Server understands the request but refuses to comply

Accepted Answer

HTTP 403 Forbidden means that the server understands the request but refuses to fulfill it due to authorization or other issues.

Question 8

What type of information is usually gathered by social engineering?

Accepted Answer

The answer of What type of information is usually gathered...

Question 9

When an attacker chooses to combine social engineering with exploiting vulnerabilities carried out by e-mail,what type of attack is being performed?

Accepted Answer

Spear phishing is a type of attack that combines social engineering with exploiting vulnerabilities carried out by email. It is a targeted attack towards a specific individual or organization, which makes use of personal information to appear more convincing and reliable. The aim is to trick the target into divulging sensitive information or clicking on a malicious link or attachment.

Question 10

What is "competitive intelligence"?

Accepted Answer

The answer of What is "competitive intelligence"?...

Question 11

Match each item with a statement below.
-Request not understood by server

Accepted Answer

HTTP 400 Bad Request is returned when the request made by the client is not understood by the server.

Answer: D
 HTTP 405 Method Not Allowed is returned when the requested HTTP method is not allowed by the server.

Answer: E
 HTTP 408 Request Timeout is returned when the server did not receive a complete request from the client within the server's timeout limit.

Question 12

List at least five tools available for footprinting.

Accepted Answer

The answer of List at least five tools available for...

Question 13

What social engineering tactic can be utilized to acquire old notes that may contain written passwords or other items that document important information?

Accepted Answer

Dumpster diving involves searching through trash or recycling bins to find discarded items that may contain sensitive information such as old notes or documents with passwords or other important information.

Question 14

What tactic is being used when an attacker trailing closely behind an employee enters a restricted area without any security credentials by utilizing their proximity to another employee with security clearance?

Accepted Answer

This is an example of piggybacking, where an unauthorized individual gains access to a restricted area by following closely behind an authorized person without proper identification.

Question 15

Which process utilizes the knowledge of human nature to get information from people to use for executing an attack on a computer network?

Accepted Answer

Social engineering is the process of manipulating people into divulging confidential information or providing access to restricted areas, networks or systems. It exploits human nature, such as trust, fear, greed, obedience, and curiosity, to gain information that can be used to execute an attack on a computer network. Fingerprinting is a reconnaissance technique used to identify the operating systems, services, and applications used on a networked system. Footprinting is the process of gathering information about a target system or network to identify potential vulnerabilities that can be exploited. Zone transferring is a method of replicating the contents of the DNS database across multiple servers, which may reveal sensitive information about the network.

Question 16

Explain the process of "footprinting," and why it is important to a security professional?

Accepted Answer

The answer of Explain the process of "footprinting," and why...

Question 17

Which of the following is a text file generated by a Web server and stored on a user's browser?

Accepted Answer

A cookie is a small text file generated by a web server and stored on a user's browser. It is used to store user-specific information such as login credentials or shopping cart contents. The other options listed (index, server index, and web file) refer to different types of files or server components and are not directly related to cookies.

Question 18

What type of general commands allow a security tester to pull information from a Web server using a web browser?

Accepted Answer

HTTP (Hypertext Transfer Protocol) allows a security tester to communicate with a web server and pull information from it using a web browser. TFTP (Trivial File Transfer Protocol) is used for transferring files between systems but does not allow pulling information from a web server. DNS (Domain Name System) is used for resolving domain names to IP addresses but does not directly allow pulling information from a web server. ARP (Address Resolution Protocol) is used for resolving MAC addresses to IP addresses in a local network but does not allow pulling information from a web server.

Question 19

Which type of social engineering attack attempts to discover personal information through the use of email?

Accepted Answer

Phishing is a type of social engineering attack that uses email as a means to trick users into divulging personal information such as passwords or banking details. The attacker typically sends an email that appears to be from a trusted source (such as a bank or social media site) and asks the user to click a link and enter their login credentials. This information is then used by the attacker to gain unauthorized access to the user's accounts.

Question 20

List and explain the five techniques used by social engineers in their attempts to gain information from unsuspecting people.

Accepted Answer

The answer of List and explain the five techniques used...

Quiz 4: Footprinting and Social Engineering