Question 1

This technology is used to measure and analyze human body characteristics for authentication purposes.
A)Footprinting
B)Biometrics
C)JBOD
D)Anthropomorphism

Accepted Answer

Biometrics is the technology used for measuring and analyzing physical or behavioral characteristics of humans for authentication or identification purposes, such as fingerprints, facial recognition, or voice patterns.

Question 2

__________ is an electronic or paper log used to track computer activity.
A)Traceroute
B)Cookie
C)Weblog
D)Audit trail

Accepted Answer

An audit trail is a record or log that tracks computer activity, used for various purposes such as security monitoring, compliance, and operational analysis.

Question 3

This is a series of messages sent by someone attempting to break into a computer to learn which computer network services the computer provides.
A)Bit robbing
B)Web services description language (WSDL)
C)Jabber
D)Port scan

Accepted Answer

A port scan is a method used by attackers to identify open ports and available services on a target computer or network system.

Question 4

This is the name for a group of programmers who are hired to expose errors or security holes in new software or to find out why a computer network's security is being broken.
A)ERM group
B)Computer emergency response tea
C)Tiger team
D)Silicone cockroach

Accepted Answer

A "Tiger team" is a term used to describe a group of experts, often in programming or security, tasked with testing the effectiveness of an organization's security measures by simulating the actions of potential attackers. They aim to expose vulnerabilities and errors in software or network security before they can be exploited maliciously.

Question 5

This is a mechanism for ensuring that only authorized users can copy or use specific software applications.
A)Authorized program analysis report
B)Private key
C)Service level agreement
D)Dongle

Accepted Answer

Dongles are hardware devices designed to provide a secure way of ensuring that only authorized users can access or use specific software applications, often by requiring the device to be physically present in order to run the application.

Question 6

At which two traffic layers do most commercial IDSes generate signatures?
A)Application layer
B)Network layer
C)Session layer
D)Transport layer

Accepted Answer

The answer of At which two traffic layers do most...

Question 7

This is a Peripheral Component Interconnect (PCI) card that offloads SSL processing to speed up secure transactions on e-commerce Web sites.
A)PCMCIA card
B)Smart card
C)Server accelerator card
D)Network interface card

Accepted Answer

Server accelerator cards are designed to offload specific tasks such as SSL (Secure Sockets Layer) processing from the main CPU, thereby speeding up operations like secure transactions on e-commerce websites.

Question 8

___________is a form of eavesdropping used to pick up telecommunication signals by monitoring the electromagnetic fields produced by the signals.
A)Reverse engineering
B)Magneto resistive head technology
C)Van Eck phreaking
D)Electronic data processing (EDP)

Accepted Answer

Van Eck phreaking is the technique of eavesdropping on electronic devices through their unintentional radio emissions, allowing the interception of data such as monitor images or keystrokes without physically tapping into the device's wired connections.

Question 9

This enables users of a basically unsecure public network such as the Internet to securely and privately exchange data and money through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority.
A)Security Identifier (SID)
B)Public key infrastructure (PKI)
C)Internet Assigned Numbers Authority (IANA)
D)Private Branch Exchange (PBX)

Accepted Answer

Public Key Infrastructure (PKI) is the technology for securing communications and transactions on the Internet through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority. PKI provides a framework that enables a range of network security activities, including secure communications, authentication, and digital signatures.

Question 10

This is an assault on the integrity of a security system in which the attacker substitutes a section of cipher text (encrypted text) with a different section that looks like (but is not the same as) the one removed.
A)Trojan horse
B)Hashing
C)Switching fabric
D)Cut and paste attack

Accepted Answer

The correct answer is D) Cut and paste attack. This type of attack involves an attacker substituting a section of cipher text with a different section that appears similar but is not the same as the one removed, thereby compromising the integrity of a security system without necessarily breaking the encryption.

Question 11

Which of the following is an advantage of anomaly detection?
A)Rules are easy to define.
B)Custom protocols can be easily analyzed.
C)The engine can scale as the rule set grows.
D)Malicious activity that falls within normal usage patterns is detected.

Accepted Answer

The answer of Which of the following is an advantage...

Question 12

A false positive can be defined as…
A)An alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior.
B)An alert that indicates nefarious activity on a system that is not running on the network.
C)The lack of an alert for nefarious activity.
D)Both a. and b.

Accepted Answer

The answer of A false positive can be defined as…
A)An...

Question 13

This is an encryption/decryption key known only to the party or parties that exchange secret messages.
A)E-signature
B)Digital certificate
C)Private key
D)Security token

Accepted Answer

A private key is part of a key pair in public-key cryptography, used for decryption or signing, and is known only to the owner, facilitating secure communication or document signing.

Question 14

What is the purpose of a shadow honeypot?
A)To flag attacks against known vulnerabilities
B)To help reduce false positives in a signature-based IDS.
C)To randomly check suspicious traffic identified by an anomaly detection system.
D)To enhance the accuracy of a traditional honeypot.

Accepted Answer

Shadow honeypots are used to validate alerts from an anomaly detection system by checking suspicious traffic, thereby reducing false positives and improving the accuracy of threat detection without directly engaging attackers.

Question 15

This is is the hiding of a secret message within an ordinary message and the extraction of it at its destination.
A)Secret key algorithm
B)Message queuing
C)Spyware
D)Steganography

Accepted Answer

Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video. It's a way of hiding a secret message within an ordinary message and then extracting it at its destination to ensure that the message remains confidential between the sender and the recipient.

Question 16

An IDS follows a two-step process consisting of a passive component and an active component. Which of the following is part of the active component?
A)Inspection of password files to detect inadvisable passwords
B)Mechanisms put in place to reenact known methods of attack and record system responses
C)Inspection of system to detect policy violations
D)Inspection of configuration files to detect inadvisable settings

Accepted Answer

The active component of an IDS (Intrusion Detection System) involves proactive measures such as simulating attacks to understand how the system responds, which is described in option B. This helps in identifying potential vulnerabilities and improving the system's defenses.

Question 17

When discussing IDS/IPS, what is a signature?
A)An electronic signature used to authenticate the identity of a user on the network
B)Attack-definition file
C)It refers to "normal," baseline network behavior
D)None of the above

Accepted Answer

A signature in the context of IDS (Intrusion Detection Systems) and IPS (Intrusion Prevention Systems) refers to a set of rules or patterns (attack-definition file) used to detect typical malicious activity. It is like a fingerprint for identifying known threats based on specific sequences of bytes or packet characteristics.

Question 18

"Semantics-aware" signatures automatically generated by Nemean are based on traffic at which two layers?
A)Application layer
B)Network layer
C)Session layer
D)Both a and c

Accepted Answer

Nemean generates "semantics-aware" signatures based on traffic at both the Application layer and the Session layer, hence the correct answer is both A and C, which is option D.

Question 19

In what type of attack does an intruder manipulate a URL in such a way that the Web server executes or reveals the contents of a file anywhere on the server, including those lying outside the document root directory?
A)Cross-site scripting
B)Command injection
C)SQL injection
D)Path traversal attacks

Accepted Answer

Path traversal attacks involve manipulating a URL to access files or directories that are not intended to be accessible through the web. This can allow attackers to read or execute files on the server that are outside the web server's root directory.

Question 20

Which of the following is true of improper error handling?
A)Attackers can use error messages to extract specific information from a system.
B)Attackers can use unexpected errors to knock an application off line, creating a denial-of- service attack.
C)Unexpected errors can provide an attacker with a buffer or stack overflow condition that sets the stage for an arbitrary code execution.
D)All of the above.

Accepted Answer

All of the options provided are true regarding improper error handling. Attackers can exploit detailed error messages to gain insights into the underlying system, use unexpected errors to cause a denial-of-service attack, and potentially exploit buffer or stack overflow conditions from these errors to execute arbitrary code.

Quiz 1: Cybersecurity and Technology

This technology is used to measure and analyze human body characteristics for authentication purposes.

__________ is an electronic or paper log used to track computer activity.

This is a series of messages sent by someone attempting to break into a computer to learn which computer network services the computer provides.

This is the name for a group of programmers who are hired to expose errors or security holes in new software or to find out why a computer network's security is being broken.

This is a mechanism for ensuring that only authorized users can copy or use specific software applications.

At which two traffic layers do most commercial IDSes generate signatures?

This is a Peripheral Component Interconnect (PCI) card that offloads SSL processing to speed up secure transactions on e-commerce Web sites.

___________is a form of eavesdropping used to pick up telecommunication signals by monitoring the electromagnetic fields produced by the signals.

This enables users of a basically unsecure public network such as the Internet to securely and privately exchange data and money through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority.

This is an assault on the integrity of a security system in which the attacker substitutes a section of cipher text (encrypted text) with a different section that looks like (but is not the same as) the one removed.

Which of the following is an advantage of anomaly detection?

A false positive can be defined as…

This is an encryption/decryption key known only to the party or parties that exchange secret messages.

What is the purpose of a shadow honeypot?

This is is the hiding of a secret message within an ordinary message and the extraction of it at its destination.

An IDS follows a two-step process consisting of a passive component and an active component. Which of the following is part of the active component?

When discussing IDS/IPS, what is a signature?

"Semantics-aware" signatures automatically generated by Nemean are based on traffic at which two layers?

In what type of attack does an intruder manipulate a URL in such a way that the Web server executes or reveals the contents of a file anywhere on the server, including those lying outside the document root directory?

Which of the following is true of improper error handling?