Question 1

The most realistic type of penetration test is a ____ box test.
A) black
B) gray
C) red
D) white

Accepted Answer

A black box test is the most realistic type of penetration test because the tester has no prior knowledge of the network or system being tested, simulating an attack from an external hacker.

Question 2

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-A free, client-based network protocol analyzer.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 3

A(n) ____________________ vulnerability scanner initiates traffic on the network in order to identify security holes.

Accepted Answer

The answer of A(n) ____________________ vulnerability scanner initiates traffic on...

Question 4

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-When run with the -sI switch, it allows you to bounce your scan across a firewall by using one of the idle DMZ hosts as the initiator of the scan.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 5

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-A freeware tool that applies packet sniffing to wireless networks.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 6

____________________, also known as "fuzzing," is a straight-forward technique that looks for vulnerabilities in a program or protocol by feeding random input into the program or the network running the protocol.

Accepted Answer

The answer of ____________________, also known as "fuzzing," is a...

Question 7

A(n) ____________________ is a network channel or connection point in a data communications system.

Accepted Answer

The answer of A(n) ____________________ is a network channel or...

Question 8

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-Monitors the airwaves for any new devices or access points.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 9

When considered as part of the attack methodology, "____________________" refers to the tools and techniques for breaking into more systems, gaining further network access, or gaining access to more resources.

Accepted Answer

The answer of When considered as part of the attack...

Question 10

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-A UNIX or Linux systems support tool that allows a remote individual to "mirror" entire Web sites.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 11

____ is a vulnerability scoring system designed to provide an open and standardized method for rating IT vulnerabilities.
A) OVAL
B) COBIT
C) CVE
D) CVSS

Accepted Answer

CVSS (Common Vulnerability Scoring System) is designed to provide an open and standardized method for rating IT vulnerabilities, allowing for the assessment of the severity of vulnerabilities in various systems.

Question 12

The process of exploring the Internet presence of a target is sometimes called ____________________.

Accepted Answer

The answer of The process of exploring the Internet presence...

Question 13

Compare integer overflows to stack and heap overflows.

Accepted Answer

The answer of Compare integer overflows to stack and heap...

Question 14

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-Uses ICMP to determine the remote OS.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 15

The CVSS ____ Score is set by the organization using the software.
A) Base
B) Temporal
C) Environmental
D) Ergonomic

Accepted Answer

The Environmental Score in the Common Vulnerability Scoring System (CVSS) is determined by the organization using the software, as it reflects the specific impact of a vulnerability within the user's environment, taking into account mitigations and other factors unique to that environment.

Question 16

Because it accepts firewall and intrusion logs from many sources, ____ is often one of the first organizations to spot network anomalies, and it often traces them to specific malware or vulnerability exploits.
A) Microsoft
B) the ISC
C) Mitre
D) ISACs

Accepted Answer

The Internet Systems Consortium (ISC) is known for accepting firewall and intrusion logs from a wide variety of sources, which positions it as one of the first organizations to detect network anomalies and often allows it to trace these anomalies back to specific malware or vulnerability exploits.

Question 17

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-Designed to crack WEP and WPA-PSK keys to allow packet sniffing and wireless network auditing.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 18

The ____ mailing list is a widely known, major source of public vulnerability announcements.
A) NetStumbler
B) Wireshark
C) Bugtraq
D) OVAL

Accepted Answer

Bugtraq is a well-known mailing list for the detailed discussion and announcement of computer security vulnerabilities.

Question 19

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-Uses incrementing Time-to-Live (TTL) packets to determine the path into a network as well as the default firewall policy.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Question 20

Match each item with a statement below.
a.Sam Spade
f.NetStumbler
b.Wget
g.AirSnare
c.Nmap "Idle scanning" option
h.Aircrack-ng
d.Firewalk
i.Wireshark
e.XProbe2
-An enhanced Web scanner that, among other things, scans an entire Web site for valuable pieces of information, such as server names and e-mail addresses.

Accepted Answer

The answer of Match each item with a statement below.
a.Sam...

Quiz 9: Network Vulnerability Assessment

The most realistic type of penetration test is a ____ box test.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -A free, client-based network protocol analyzer.

A(n) ____________________ vulnerability scanner initiates traffic on the network in order to identify security holes.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -A freeware tool that applies packet sniffing to wireless networks.

____________________, also known as "fuzzing," is a straight-forward technique that looks for vulnerabilities in a program or protocol by feeding random input into the program or the network running the protocol.

A(n) ____________________ is a network channel or connection point in a data communications system.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -Monitors the airwaves for any new devices or access points.

When considered as part of the attack methodology, "____________________" refers to the tools and techniques for breaking into more systems, gaining further network access, or gaining access to more resources.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -A UNIX or Linux systems support tool that allows a remote individual to "mirror" entire Web sites.

____ is a vulnerability scoring system designed to provide an open and standardized method for rating IT vulnerabilities.

The process of exploring the Internet presence of a target is sometimes called ____________________.

Compare integer overflows to stack and heap overflows.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -Uses ICMP to determine the remote OS.

The CVSS ____ Score is set by the organization using the software.

Because it accepts firewall and intrusion logs from many sources, ____ is often one of the first organizations to spot network anomalies, and it often traces them to specific malware or vulnerability exploits.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -Designed to crack WEP and WPA-PSK keys to allow packet sniffing and wireless network auditing.

The ____ mailing list is a widely known, major source of public vulnerability announcements.

Match each item with a statement below. a.Sam Spade f.NetStumbler b.Wget g.AirSnare c.Nmap "Idle scanning" option h.Aircrack-ng d.Firewalk i.Wireshark e.XProbe2 -Uses incrementing Time-to-Live (TTL) packets to determine the path into a network as well as the default firewall policy.