POST-TEST DAY 2

Which of the following technologies belongs to the application layer and is used to generate dynamic web content?

• PHP

• Linux

• MySQL

• Apache

Which of the following stores a server’s configuration, error, executable, and log files?

• Web proxy

• Server root

• Document root

• Virtual document tree

In which layer of the web application vulnerability stack does an attacker exploit business-logic flaws and technical vulnerabilities to perform input validation attacks such as XSS?

• Layer 4

• Layer 7

• Layer 6

• Layer 5

In which layer of the web-application vulnerability stack does an attacker scan an operating system to find open ports and vulnerabilities and develop viruses/backdoors to exploit them?

• Layer 5

• Layer 2

• Layer 3

• Layer 4

Which of the following attacks exploits vulnerabilities in dynamically generated webpages, which enables malicious attackers to inject client-side scripts into webpages viewed by other users?

• Cross-site scripting

• Security misconfiguration

• Sensitive data exposure

• Broken access control

Which of the following terms is used to refer the technique that uses aggressive SEO tactics such as keyword stuffing, doorway pages, page swapping, and adding unrelated keywords to get higher search engine ranking for their malware pages?

• Malvertising

• Drive-by Downloads

• Blackhat Search Engine Optimization (SEO)

• Spear Phishing

Tina downloaded and installed a 3D screensaver. She is enjoying watching the 3D screensaver but whenever the screensaver gets activated, her computer is automatically scanning the network and sending the results to a different IP address on the network. Identify the malware installed along with the 3D screensaver?

• Worm

• Beacon

• Trojan Horse

• Virus

Which of the following programs is usually targeted at Microsoft Office products?

• Multipart virus

• Macro virus

• Polymorphic virus

• Stealth virus

Which of the following protocols is used to communicate through port 23 and allows an attacker to login to a network machine remotely via a TCP connection to sniff keystrokes, including usernames and passwords, that are sent in cleartext?

• HTTP

• NNTP

• POP

• Telnet

What is the correct pcap filter to capture all transmission control protocol (TCP)traffic going to or from host 192.168.0.125 on port 25?

• host 192.168.0.125:25

• port 25 and host 192.168.0.125

• tcp.src == 25 and ip.host == 192.168.0.125

• tcp.port == 25 and ip.addr == 192.168.0.125