Chapter 11. Vulnerability and Risk Assessment

Which type of vulnerability assessments software can check for weak passwords on the network?

• Wireshark
• Antivirus software
• Performance monitor
• A password cracker

You are contracted to conduct a forensic analysis of the computer. What should you do first?

• Backu up the system
• Analyze the files
• Scan for viruses
• Make changes to the operating system

Which of the following has schemas written in XML?

• OVAL
• 3DES
• WPA
• PAP

Russ is using only documentation to test the security of a system. What type of testing methodology is this known as?

• Active security analysis
• Passive security analysis
• Hybrid security analysis
• Hands-on security analysis

Of the following, which is the best way for a person to find out what security holes exist on the network?

• Run a port scan
• Use a network sniffer
• Perform a vulnerability assessment
• Use an IDS solution

After using Nmap to do a port scan of your server, you find that several ports are open. Which of the following should you do next?

• Leave the ports open and monitor them for malicious attacks.
• Run the port scan again.
• Close all ports.
• Examine the services and/or processes that use those ports.

Which of the following is a vulnerability assessment tool?

• John the Ripper
• Aircrack-ng
• Nessus
• Cain & Abel

You are a consultant for an IT company. Your boss asks you to determine the topology of the network. What is the best device to use in this circumstance?

• Network mapper
• Protocol analyzer
• Port scanner
• Vulnerability scanner

Which of the following can enable you to find all the open ports on an entire network?

• Protocol analyzer
• Network scanner
• Firewall
• Performance monitor

What can hackers accomplish using malicious port scanning?

• “Fingerprint” of the operating system
• Topology of the network
• All the computer names on the network
• All the usernames and passwords