In many states sending spam is illegal. Thus, the spammers have techniques to try and ensure that no one knows they sent the spam out to thousands of users at a time. Which of the following best describes what spammers use to hide the origin of these types of e-mails?

The collection of potentially actionable, overt, and publicly available information is known as

An IT security engineer notices that the company’s web server is currently being hacked. What should the engineer do next?

A security consultant is trying to bid on a large contract that involves penetration testing and reporting. The company accepting bids wants proof of work so the consultant prints out several audits that have been performed. Which of the following is likely to occur as a result?

What is the most secure way to mitigate the theft of corporate information from a laptop that was left in a hotel room?

Alice encrypts her data using her public key PK and stores the encrypted data in the cloud. Which of the following attack scenario will compromise the privacy of her data?

A hacker is an intelligent individual with excellent computer skills that grant them the ability to explore a computer’s software and hardware without the owner’s permission. Their intention can either be to simply gain knowledge or to illegally make changes. Which of the following class of hacker refers to individual who work both offensively and defensively at various times?

Nation-state threat actors often discover vulnerabilities and hold on to them until they want to launch a sophisticated attack. The Stuxnet attack was an unprecedented style of attack because it used four types of vulnerability. What is this style of attack called?

A newly discovered flaw in a software application would be considered which kind of security vulnerability?

Assume a business-crucial web-site of some company that is used to sell handsets to the customers worldwide. All the developed components are reviewed by the security team on a monthly basis. In order to drive business further, the web-site developer decided to add some 3rd party tools on it. The tools are written in Javascript and can track the customers’ activity on the site. These tools are located on the servers of the marketing company. What is the main security risk associated with this scenario?

An IT employee got a call from one of our best customers. The caller wanted to know about the company’s network infrastructure, systems, and team. New opportunities of integration are in sight for both company and customer. What should this employee do?

A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should he do?

To reduce the attack surface of a system, administrators should perform which of the following processes to remove unnecessary software, services, and insecure configuration settings?

An unauthorized individual enters a building following an employee through the employee entrance after the lunch rush. What type of breach has the individual just performed?

Jimmy is standing outside a secure entrance to a facility. He is pretending to having a tense conversation on his cell phone as an authorized employee badges in. Jimmy, while still on the phone, grabs the door as it begins to close. What just happened?

It is an entity or event with the potential to adversely impact a system through unauthorized access, destruction, disclosure, denial of service or modification of data.

Which of the following terms best matches the definition?

A certified ethical hacker (CEH) is approached by a friend who believes her husband is cheating. She offers to pay to break into her husband’s email account in order to find proof so she can take him to court. What is the ethical response?

A computer technician is using a new version of a word processing software package when it is discovered that a special sequence of characters causes the entire computer to crash. The technician researches the bug and discovers that no one else experienced the problem. What is the appropriate next step?

While you were gathering information as part of security assessments for one of your clients, you were able to gather data that show your client is involved with fraudulent activities. What should you do?

A consultant has been hired by the V.P. of a large financial organization to assess the company’s security posture. During the security testing, the consultant comes across child pornography on the V.P.’s computer.

What is the consultant’s obligation to the financial organization?

Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved in human trafficking.

What should you do?

A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, and the CEH is worried that the company will go out of business and end up not paying. What actions should the CEH take?

An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk assessments. A friend recently started a company and asks the hacker to perform a penetration test and vulnerability assessment of the new company as a favor. What should the hacker’s next step be before starting work on this job?

Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is the best protection that will work for her?

Backing up data is a security must. However, it also has certain level of risks when mishandled. Which of the following is the greatest threat posed by backups?

A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system. What is the first step that the bank should take before enabling the audit feature?

Low humidity in a data center can cause which of the following problems?

Which of the following examples best represents a logical or technical control?

What is one thing a tester can do to ensure that the software is trusted and is not changing or tampering with critical data on the back end of a system it is loaded on?

What would you type on the Windows command line in order to launch the Computer Management Console provided that you are logged in as an admin?

If you are to determine the attack surface of an organization, which of the following security operations is the BEST thing to do?

A big company, who wanted to test their security infrastructure, wants to hire elite pen testers like you. During the interview, they asked you to show sample reports from previous penetration tests. What should you do?

Your next door neighbor, that you do not get along with, is having issues with their network, so he yells to his spouse the network’s SSID and password and you hear them both clearly. What do you do with this information?

What network security concept requires multiple layers of security controls to be placed throughout an IT infrastructure, which improves the security posture of an organization to defend against malicious attacks or potential vulnerabilities?

You are performing a penetration test. You achieved access via a buffer overflow exploit and you proceed to find interesting data, such as files with usernames and passwords. You find a hidden folder that has the administrator’s bank account password and login information for the administrator’s bitcoin account.

What should you do?

Scenario: 1. Victim opens the attacker’s web site.

2. Attacker sets up a web site which contains interesting and attractive content like ‘Do you want to make $1000 in a day?’.

3. Victim clicks to the interesting and attractive content url.

4. Attacker creates a transparent ‘iframe’ in front of the url which victim attempt to click, so victim thinks that he/she clicks to the ‘Do you want to make $1000 in a day?’ url but actually he/she clicks to the content or url that exists in the transparent ‘iframe’ which is setup by the attacker. What is the name of the attack which is mentioned in the scenario?

Which type of security feature stops vehicles from crashing through the doors of a building?

During a security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?

Which of the following is an advantage of utilizing security testing methodologies to conduct a security audit?

Which of the following can the administrator do to verify that a tape backup can be recovered in its entirety?

Knowing the nature of backup tapes, which of the following is the MOST RECOMMENDED way of storing backup tapes?

Security Policy is a definition of what it means to be secure for a system, organization or other entity. For Information Technologies, there are sub-policies like; Computer Security Policy, Information Protection Policy, Information Security Policy, Network Security Policy, Physical Security Policy, Remote Access Policy, User Account Policy. What is main theme of the sub-policies for Information Technologies?

An enterprise recently moved to a new office and the new neighborhood is a little risky. The CEO wants to monitor the physical perimeter and the entrance doors 24 hours. What is the best option to do this job?

If executives are found liable for not properly protecting their company’s assets and information systems, what type of law would apply in this situation?

Which type of security document is written with specific step-by-step details?

A security policy will be more accepted by employees if it is consistent and has the support of

Which of the following is a detective control?

Which of the following is a preventive control?

A Network Administrator was recently promoted to Chief Security Officer at a local university. One of employee’s new responsibilities is to manage the implementation of an RFID card access system to a new server room on campus. The server room will house student enrollment information that is securely backed up to an off-site location.

During a meeting with an outside consultant, the Chief Security Officer explains that he is concerned that the existing security controls have not been designed properly. Currently, the Network Administrator is responsible for approving and issuing RFID card access to the server room, as well as reviewing the electronic access logs on a weekly basis.

Which of the following is an issue with the situation?

A company has hired a security administrator to maintain and administer Linux and Windows-based systems.

Written in the nightly report file is the following:

Firewall log files are at the expected value of 4 MB. The current time is 12am. Exactly two hours later the size has decreased considerably. Another hour goes by and the log files have shrunk in size again.

Which of the following actions should the security administrator take?

The precaution of prohibiting employees from bringing personal computing devices into a facility is what type of security control?

Which of the following business challenges could be solved by using a vulnerability scanner?

How can a policy help improve an employee’s security awareness?

Due to a slowdown of normal network operations, IT department decided to monitor internet traffic for all of the employees. From a legal stand point, what would be troublesome to take this kind of measure?

Craig received a report of all the computers on the network that showed all the missing patches and weak passwords. What type of software generated this report?

Which of the following processes evaluates the adherence of an organization to its stated security policy?

The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company’s external webserver, VPN concentrator, and DNS servers. What should the security team do to determine which alerts to check first?

As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing.

What document describes the specifics of the testing, the associated violations, and essentially protects both the organization’s interest and your liabilities as a tester?

In an internal security audit, the white hat hacker gains control over a user account and attempts to acquire access to another account’s confidential files and information. How can he achieve this?

Least privilege is a security concept that requires that a user is

When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?

Defining rules, collaborating human workforce, creating a backup plan, and testing the plans are within what phase of the Incident Handling Process?

What is the term coined for logging, recording and resolving events in a company?

Describes the specifics of the testing, the associated violations, and essentially protects both the bank’s interest and your liabilities as a tester?

Which initial procedure should an ethical hacker perform after being brought into an organization?

Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?

How do employers protect assets with security policies pertaining to employee surveillance activities?

Which United States legislation mandates that the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) must sign statements verifying the completeness and accuracy of financial reports?

It has been reported to you that someone has caused an information spillage on their computer. You go to the computer, disconnect it from the network, remove the keyboard and mouse, and power it down. What step in incident handling did you just complete?

Which vital role does the U.S. Computer Security Incident Response Team (CSIRT) provide?

Which of the following is a primary service of the U.S. Computer Security Incident Response Team (CSIRT)?

What are the three types of compliance that the Open Source Security Testing Methodology Manual (OSSTMM) recognizes?

Under the “Post-attack Phase and Activities”, it is the responsibility of the tester to restore the systems to a pretest state.

Which of the following activities should not be included in this phase?

I. Removing all files uploaded on the system

II. Cleaning all registry entries

III. Mapping of network state

IV. Removing all tools and maintaining backdoor for reporting

It is a regulation that has a set of guidelines, which should be adhered to by anyone who handles any electronic medical data. These guidelines stipulate that all medical practices must ensure that all necessary measures are in place while saving, accessing, and sharing any electronic medical data to keep patient data secure.

Which of the following regulations best matches the description?

Which of the following act requires employers standard national numbers to identify them on standard transactions

Which of the following tools would be the best choice for achieving compliance with PCI Requirement 11?

Security and privacy of/on information systems are two entities that requires lawful regulations. Which of the following regulations defines security and privacy controls for Federal information systems and organizations?

International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining

What is the name of the international standard that establishes a baseline level of confidence in the security functionality of IT products by providing a set of requirements for evaluation?

Which of the following guidelines or standards is associated with the credit card industry?

This international organization regulates billions of transactions daily and provides security guidelines to protect personally identifiable information (PII). These security controls provide a baseline and prevent low-level hackers sometimes known as script kiddies from causing a data breach. Which of the following organizations is being described?

What is not a PCI compliance recommendation?

When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?

Which of the following is NOT an ideal choice for biometric controls?

What are the three types of authentication?

By using a smart card and pin, you are using a two-factor authentication that satisfies

Which of the following is an example of two factor authentication?

Which set of access control solutions implements two-factor authentication?

Bob learned that his username and password for a popular game has been compromised. He contacts the company and resets all the information. The company suggests he use two-factor authentication, which option below offers that?

Todd has been asked by the security officer to purchase a counter-based authentication system. Which of the following best describes this type of system?

Steve, a scientist who works in a governmental security agency, developed a technological solution to identify people based on walking patterns and implemented this approach to a physical control access. A camera captures people walking and identifies the individuals using Steve’s approach. After that, people must approximate their RFID badges. Both the identifications are required to open the door. In this case, we can say:

Which of the following is optimized for confidential communications, such as bidirectional voice and video?

Which type of scan measures a person’s external features through a digital video camera?

Which type of scan is used on the eye to measure the layer of blood vessels?

What is the main reason the use of a stored biometric is vulnerable to an attack?

What is the best defense against privilege escalation vulnerability?

Which access control mechanism allows for multiple systems to use a central authentication server (CAS) that permits users to authenticate once and gain access to multiple systems?

When purchasing a biometric system, one of the considerations that should be reviewed is the processing speed. Which of the following best describes what it is meant by processing?

A large mobile telephony and data network operator has a data that houses network elements. These are essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS systems. What is the best security policy concerning this setup?

A company recently hired your team of Ethical Hackers to test the security of their network systems. The company wants to have the attack be as realistic as possible. They did not provide any information besides the name of their company. What phase of security testing would your team jump in right away?

Passive reconnaissance involves collecting information through which of the following?

Which results will be returned with the following Google search query? site:target.com -site:Marketing.target.com accounting

Which one of the following Google advanced search operators allows an attacker to restrict the results to those websites in the given domain

This phase will increase the odds of success in later phases of the penetration test. It is also the very first step in Information Gathering, and it will tell you what the “landscape” looks like. Which of the following is the most important phase of ethical hacking wherein you need to spend considerable amount of time?

In which phase of the ethical hacking process can Google hacking be employed? This is a technique that involves manipulating a search string with specific operators to search for vulnerabilities. Example:

allintitle: root passwd

When you are collecting information to perform a data analysis, Google commands are very useful to find sensitive information and files. These files may contain information about passwords, system functions, or documentation.

What command will help you to search files using Google as a search engine?

What tool should you use when you need to analyze extracted metadata from files you collected when you were in the initial stage of penetration test (information gathering)?

What is the way to decide how a packet will move from an untrusted outside host to a protected inside that is behind a firewall, which permits the hacker to determine which ports are open and if the packets can pass through the packet-filtering of the firewall.

Firewalk has just completed the second phase (the scanning phase) and a technician receives the output shown below. What conclusions can be drawn based on these scan results?

TCP port 21 – no response

TCP port 22 – no response

TCP port 23 – Time-to-live exceeded

A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank’s DNS servers, reading news articles online about the bank, watching what times the bank employees come into work and leave from work, searching the bank’s job postings (paying special attention to IT related jobs), and visiting the local dumpster for the bank’s corporate office. What phase of the penetration test is the tester currently in?

Which of the following provides a security professional with most information about the system’s security posture

A Security Engineer at a medium-sized accounting firm has been tasked with discovering how much information can be obtained from the firm’s public facing web servers. The engineer decides to start by using netcat to port 80. The engineer receives this output: HTTP/1.1 200 OK

Server: Microsoft-IIS/6

Expires: Tue, 17 Jan 2011 01:41:33 GMT

Date: Mon, 16 Jan 2011 01:41:33 GMT

Content-Type: text/html

Accept-Ranges: bytes

Last-Modified: Wed, 28 Dec 2010 15:32:21 GMT

ETag: “b0aac0542e25c31:89d”

Content-Length: 7369

Which of the following is an example of what the engineer performed?

A hacker named Jack is trying to compromise a bankís computer system. He needs to know the operating system of that computer to launch further attacks.

What process would help him?

An attacker tries to do banner grabbing on a remote web server and executes the following command.

$ nmap -sV host.domain.com -p 80

He gets the following output.

Starting Nmap 6.47 ( http://nmap.org ) at 2014-12-08 19:10 EST

Nmap scan report for host.domain.com (108.61.158.211)

Host is up (0.032s latency).

PORT STATE SERVICE VERSION

80/tcp open http Apache httpd

Service detection performed. Please report any incorrect results at http://nmap.org/submit/.Nmap done: 1 IP address (1 host up) scanned in 6.42 seconds

What did the hacker accomplish?

Which of the following open source tools would be the best choice to scan a network for potential targets?

Which of the following resources does NMAP need to be used as a basic vulnerability scanner covering several vectors like SMB, HTTP and FTP?

You are using NMAP to resolve domain names into IP addresses for a ping sweep later.

Which of the following commands looks for IP addresses?

Which of the following is an NMAP script that could help detect HTTP Methods such as GET, POST, HEAD, PUT, DELETE, TRACE?

You’re doing an internal security audit and you want to find out what ports are open on all the servers. What is the best way to find out?

NMAP -sn 192.168.11.200-215

The NMAP command above performs which of the following?

You are attempting to run an Nmap port scan on a web server. Which of the following commands would result in a scan of common ports with the least amount of noise in order to evade IDS?

If you want to only scan fewer ports than the default scan using Nmap tool, which option would you use

What would you enter if you wanted to perform a stealth scan using Nmap

Port scanning can be used as part of a technical assessment to determine network vulnerabilities. The TCP XMAS scan is used to identify listening ports on the targeted system. While doing a technical assessment to determine network vulnerabilities, you used the TCP XMAS scan. What would be the response of all open ports?

An attacker scans a host with the below command. Which three flags are set

# nmap -sX host.domain.com

Which of the following will perform an Xmas scan using NMAP? (sX means Xmas)

What is the best Nmap command to use when you want to list all devices in the same network quickly after you successfully identified a server whose IP address is 10.10.0.5?

Which Nmap option would you use if you were not concerned about being detected and wanted to perform a very fast scan

A security engineer is attempting to map a company’s internal network. The engineer enters in the following NMAP command:

NMAP –n –sS –P0 –p 80 ***.***.**.**

What type of scan is this?

A hacker is attempting to see which IP addresses are currently active on a network. Which NMAP switch would the hacker use?

A hacker is attempting to see which ports have been left open on a network. Which NMAP switch would the hacker use?

Which of the following parameters enables NMAP’s operating system detection feature?

What results will the following command yield: ‘NMAP -sS -O -p 123-153 192.168.100.3’?

Which NMAP command combination would let a tester scan every TCP port from a class C network that is blocking ICMP with fingerprinting and service detection?

Which of the following Nmap commands will produce the following output?

Output: Starting Nmap 6.47 (http://nmap.org ) at 2015-05-26 12:50 EDT

Nmap scan report for 192.168.1.1

Host is up (0.00042s latency).

Not shown: 65530 open|filtered ports, 65529 filtered ports

PORT STATE SERVICE

111/tcp open rpcbind

999/tcp open garcon

1017/tcp open unknown

1021/tcp open exp1

1023/tcp open netvenuechat

2049/tcp open nfs

17501/tcp open unknown

111/udp open rpcbind

123/udp open ntp

137/udp open netbios-ns

2049/udp open nfs

5353/udp open zeroconf

17501/udp open|filtered unknown

51857/udp open|filtered unknown

54358/udp open|filtered unknown

56228/udp open|filtered unknown

57598/udp open|filtered unknown

59488/udp open|filtered unknown

60027/udp open|filtered unknown

Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by the network’s IDS?

Emil uses nmap to scan two hosts using this command.

nmap -sS -T4 -O 192.168.99.1 192.168.99.7

He receives this output:Nmap scan report for 192.168.99.1

Host is up (0.00082s latency).

Not shown: 994 filtered ports

PORT STATE SERVICE

21/tcp open ftp

23/tcp open telnet

53/tcp open domain

80/tcp open http

161/tcp closed snmp

MAC Address: B0:75:D5:33:57:74 (ZTE)

Device type: general purpose

Running: Linux 2.6.X

OS CPE: cpe:/o:linux:linux_kernel:2.6

OS details: Linux 2.6.9 – 2.6.33

Network Distance: 1 hop

Nmap scan report for 192.168.99.7

Host is up (0.000047s latency).

All 1000 scanned ports on 192.168.99.7 are closed

Too many fingerprints match this host to give specific OS details

Network Distance: 0 hops

What is his conclusion?

Which of the following tools will scan a network to perform vulnerability checks and compliance auditing?

Your company was hired by a small healthcare provider to perform a technical assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer?

On a Linux device, which of the following commands will start the Nessus client in the background so that the Nessus server can be configured?

Which of the following settings enables Nessus to detect when it is sending too many packets and the network pipe is approaching capacity?

You want to analyze packets on your wireless network. Which program would you use?

In Wireshark, the packet bytes panes show the data of the current packet in which format?

The network administrator contacts you and tells you that she noticed the temperature on the internal wireless router increases by more than 20% during weekend hours when the office was closed. She asks you to investigate the issue because she is busy dealing with a big conference and she doesn’t have time to perform the task.

What tool can you use to view the network traffic being sent and received by the wireless router?

Which of the following problems can be solved by using Wireshark?

When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?

You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What wireshark filter will show the connections from the snort machine to kiwi syslog machine?

What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?

As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?