ECHA Test Review 1

An attacker has successfully tapped into a network segment and has configured port spanning for his connection, which allows him to see all traffic passing through the switch. Which of the fo1lowing protocols protects any sensitive data from being seen by this attacker?

• SFTP

• IMAP

• SMTP

• SSH

Which of the following techniques can be used to gather information from a fully switched network or to disable some of the traffic isolation features of a switch? (Choose two.)

• DHCP starvation

• MAC flooding

• Promiscuous mode

• ARP spoofing

Examine the following Snort rule:

alert tcp !$HOME_NET any-> $HOME_NET 23 (content:

"admin"; msg: "Telnet at tempt .. admin access";)

Which of the following are true regarding the rule? ( Choose all that apply.)

• This rule will alert on packets coming from the designated home network.

• This rule will alert on packets coming from outside the designated home address

• This rule will alert on packets designated for any port, from port 23, containing the "admin" string.

• This rule will alert on packets designated on port 23, from any port, containing the "admin" string.

You are performing an ACK scan against a target subnet. You previously verified connectivity to several hosts within the subnet but want to verify all live hosts on the subnet. Your scan, however, is not receiving any replies. Which type of firewall is most likely in use at your location?

• Packet filtering

• IPS

• Stateful

• Active

Examine the Wireshark filter shown here:

ip.src == 192.168.1.1 && tcp.srcport == 80

Which of the following correctly describes the capture filter?

• The results will display all traffic from 192.168.1.1 destined for port 80.

• The results will display all HTTP traffic to 192.168.1.1.

• The results will display all HITP traffic from 192.168.1.1.

• No results will display because of invalid syntax.

Which of the following correctly describes brute-force password attacks?

• Feeding a list of words into a cracking program

• Comparing the hash values to lists of prehashed values for a match

• Attempting all possible combinations of letters, numbers, and special characters in succession

• Threatening the user with physical violence unless they reveal their password

You are attempting to hack a Windows machine and want to gain a copy of the SAM file. Where can you find it? (Choose all that apply.)

• c:\winnt\config

• /etc/shadow

• c:\windows\repair

• c:\ windows\system32\config

While performing online banking using a web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another web browser session starts and displays a video of cats playing a piano. The next business day, the user receives what looks like an email from his bank, indicating that his bank account has been accessed from a foreign country. The email asks the user to call his bank and verify the authorization of a funds transfer that took place.

What web browser-based security vulnerability was exploited to compromise the user?

• Cross-Site Request Forgery

• Cross-Site Scripting

• Web form input validation

• Clickjacking

This tool is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attach along with some optimizations like Korek attacks, as well as the PTW attack, thus making the attack much faster compared to other WEP cracking tools.

Which of the following tools is being described?

• Wificracker

• Airguard

• WLAN crack

• Aircrack-ng

> NMAP -sn 192.168.1l.200-2l5

The NMAP command above performs which of the following?

• A ping scan

• A trace sweep

• An operating system detect

• A port scan