POST-TEST DAY 3

John is a pen tester working with an information security consultant based in Paris. As part of a penetration testing assignment, he was asked to perform wireless penetration testing for a large MNC. John knows that the company provides free Wi-Fi access to its employees on the company premises. He sets up a rogue wireless access point with the same SSID as that of the company’s Wi-Fi network just outside the company premises. He sets up this rogue access point using the tools that he has and hopes that the employees might connect to it. What type of wireless confidentiality attack is John trying to do?

• KRACK Attack

• WEP Cracking

• Evil Twin AP

• War Driving

Which of the following Encryption technique is used in WPA?

• DES

• AES

• TKIP

• RSA

Which of the following is not a mobile platform risk?

• Malicious Apps in App Store

• Sandboxing

• Jailbreaking and Rooting

• Mobile Malware

 

James, an attacker, attempted to gain illegitimate access to a user’s bank account. To achieve his goal, James tricked mobile phone sellers into providing PII of the target user and exploited the instant message service on the user’s device, which helped him reset the password and access the victim’s account.

Identify the type of attack performed by James in the above scenario.

• Brute-force attack

• Cross-site request forgery

• OTP hijacking

• DNS poisoning

Which of the following layers in the IoT architecture has security issues such as validation of the inputted string, AuthN, AuthZ, no automatic security updates, and default passwords?

• Mobile

• Network

• Application

• Cloud

Which of the following Nmap commands is used by an attacker to identify the IPv6 capabilities of a target IoT device?

• nmap -n -Pn -sS -pT:0-65535 -v -A -oX <Name> <IP>

• nmap -n -Pn -sSU -pT:0-65535,U:0-65535 -v -A -oX <Name> <IP>

• nmap -p 80,81,8080,8081 <Target IP address range>

• nmap -6 -n -Pn -sSU -pT:0-65535,U:0-65535 -v -A -oX <Name> <IP>

In which of the following levels of the Purdue model can the analysis and alteration of the physical process be performed?

• Level 2

• Level 3

• Level 1

• Level 0

Which of the following components of an industrial control system contains a centralized supervisory control unit used to control multiple local controllers, thousands of input/output (I/O) points, and various other field devices that are part of the overall production process?

• DCS

• BPCS

• SIS

• SCADA

Which of the following three service models are the standard cloud service models?

• SaaS, IaaS, and hybrid

• XaaS, private, and public

• Private, public, and community

• SaaS, PaaS, and IaaS

In which of the following cloud deployment models does the provider make services such as applications, servers, and data storage available to the public over the Internet?

• Hybrid cloud

• Community cloud

• Public cloud

• Private cloud