Question 1

An attacker sends email to a domain toward an invalid address intentionally. A bounce back is sent and the attacker uses the header to determine internal mail relays. How is a header read to determine the path the bounce took?
A) From the bottom up
B) From the top down
C) With a sniffer
D) Headers are not useful, the source of the email is always spoofed

Accepted Answer

While it is true that the source of a message can be spoofed, they aren't always. Headers are worth looking at just in case, if the bounce doesn't work, the attacker can also try to get someone in the company to send them an email.

Question 2

Password hashes are stored on a Windows machine in several locations. Sometimes only the system account has access, but because this is data at rest booting to an alternate OS or remotely access via a call with system rights could work.
Where could password hashes be stored on a Windows host? (choose four)
A) The registry
B) ERD
C) The SAM file
D) A repair file
E) In RAM

Accepted Answer

All of these locations store credentials. Syskey is no help if the attacker knows how to use the right tool.

Question 3

Sara has managed to get access to the passwd file in the Linux system. Which of the following entries shows a user that is in the root permissions group?
Rkuby:x:1001:1001:Ron Kuby:/home/rkuby:/bin/bash dhcp:x:1002:1002::/home/dns:/bin/bash monticore:x:1003:0::/home/monticore:/bin/bash awright:x:1004:500:Amber Wright:/home/awright:/bin/bash
A) awright
B) monticore
C) dhcp
D) The group cannot be determined in the /etc/passwd file

Accepted Answer

The passwd file is a database of comma delimited entries. The first column is the user name. The second column is the user id and the third column is the group id. A group id of 0 is the root group. Not all fields need to have data in them; two consecutive colons just means the field is empty.

Quiz 4: Operating Systems and Applications

An attacker sends email to a domain toward an invalid address intentionally. A bounce back is sent and the attacker uses the header to determine internal mail relays. How is a header read to determine the path the bounce took?