Cengage 8

Which attack intercepts communications between a web browser and the underlying OS?

• MITM

• MRTR

• MTTR

• MITB

Himari needs to protect against potential attacks on DNS. What are the locations she would need to protect?

• Web server buffer and host DNS server

• Reply referrer and domain buffer

• Web browser and browser add-on

• Local host file and external DNS server

What is the result of an ARP poisoning attack?

• The ARP cache is compromised.

• Users cannot reach a DNS server.

• MAC addresses are altered.

• An internal DNS must be used instead of an external DNS.

Yua has discovered that the network switch is broadcasting all packets to all devices. She suspects it is the result of an attack that has overflowed the switch MAC address table. Which type of attack would she report?

• MAC spoofing attack

• MAC cloning attack

• MAC flooding attack

• MAC overflow attack

Sakura is explaining to a colleague the different types of DNS attacks. Which DNS attack would only impact a single user?

• DNS hijack attack

• DNS poisoning attack

• DNS overflow attack

• DNS resource attack

Which type of monitoring methodology looks for statistical deviations from a baseline?

• Behavioral monitoring

• Signature-based monitoring

• Anomaly monitoring

• Heuristic monitoring

Ichika suspects that there may be infected devices on the network that are sending regular beacons to a threat actor’s C&C server. Which type of analysis would she use to determine if this is true?

• Traffic analysis

• Port analysis

• Packet analysis

• Probe analysis

Akari has been asked to install a packet analysis tool on a Linux web server. Because this server does not do anything unnecessary so it reduces the footprint that a threat actor could exploit, all applications on the server are command-line applications and there is no graphical user interface (GUI). Which tool would Akari install?

• Ethereal

• Tcpdump

• Network General

• Sniffer

Which of the following is NOT a reason that threat actors use PowerShell for attacks?

• It cannot be detected by anti-malware running on the computer.

• It leaves behind no evidence on a hard drive.

• It can be invoked prior to system boot.

• Most applications flag it as a trusted application.

Which attack uses the fewest number of computers to launch the attack?

• DoS

• DDoS

• DoSS

• DooS