Which of the following act requires employer's standard national numbers to identify them on standard transactions?

A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer's software and hardware without the owner's permission. Their intention can either be to simply gain knowledge or to illegally make changes. Which of the following class of hacker refers to an individual who works both offensively and defensively at various times?

When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?

What is not a PCI compliance recommendation?

The white box testing methodology enforces what kind of restriction?

Bob, your senior colleague, has sent you a mail regarding a deal with one of the clients. You are requested to accept the offer and you oblige. After 2 days, Bob denies that he had ever sent a mail. What do you want to "know" to prove yourself that it was Bob who had send a mail?

The collection of potentially actionable, overt, and publicly available information is known as

A hacker named Jack is trying to compromise a bank's computer system. He needs to know the operating system of that computer to launch further attacks. What process would help him?

DNS cache snooping is a process of determining if the specified resource address is present in the DNS cache records. It may be useful during the examination of the network to determine what software update resources are used, thus discovering what software is installed. What command is used to determine if the entry is present in DNS cache?

What is the main theme of the sub-policies for Information Technologies?

What is the least important information when you analyze a public IP address in a security alert?

On performing a risk assessment, you need to determine the potential impacts when some of the critical business process of the company interrupt its service. What is the name of the process by which you can determine those critical business?

What type of analysis is performed when an attacker has partial knowledge of inner-workings of the application?

Which of the following is a low-tech way of gaining unauthorized access to systems?

Which regulation defines security and privacy controls for Federal information systems and organizations?

Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking. What should you do?

It has been reported to you that someone has caused an information spillage on their computer. You go to the computer, disconnect it from the network, remove
the keyboard and mouse, and power it down. What step in incident handling did you just complete? What step in incident handling did you just complete?

What network security concept requires multiple layers of security controls to be placed throughout an IT infrastructure, which improves the security posture of an organization to defend against malicious attacks or potential vulnerabilities?

If executives are found liable for not properly protecting their company's assets and information systems, what type of law would apply in this situation?

The company ABC recently contract a new accountant. The accountant will be working with the financial statements. Those financial statements need to be
approved by the CFO and then they will be sent to the accountant but the CFO is worried because he wants to be sure that the information sent to the
accountant was not modified once he approved it. What is the following options can be useful to ensure the integrity of the data?

Which access control mechanism allows for multiple systems to use a central authentication server (CAS) that permits users to authenticate once and gain access to multiple systems?

A Security Engineer at a medium-sized accounting firm has been tasked with discovering how much information can be obtained from the firm's public facing web servers. The engineer decides to start by using netcat to port 80. The engineer receives this output: HTTP/1.1 200 OK Server: Microsoft-IIS/6 Expires: Tue, 17 Jan 2011 01:41:33 GMT Date: Mon, 16 Jan 2011 01:41:33 GMT Content-Type: text/html Accept-Ranges: bytes Last-Modified: Wed, 28 Dec 2010 15:32:21 GMT ETag: "b0aac0542e25c31:89d" Content-Length: 7369

Look at the following output. What did the hacker accomplish (picture Q156.jpg)?

A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system. What is the first step that the bank should take before enabling the audit feature?

A large mobile telephony and data network operator has a data that houses network elements. These are essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS systems. What is the best security policy concerning this setup?

Which of the following incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an organization?

Which type of security feature stops vehicles from crashing through the doors of a building?

In which phase of the ethical hacking process can Google hacking be employed? This is a technique that involves manipulating a search string with specific operators to search for vulnerabilities.

Seth is starting a penetration test from inside the network. He hasn't been given any information about the network. What type of test is he conducting?

You are performing a penetration test. You achieved access via a buffer overflow exploit and you proceed to find interesting data, such as files with usernames and passwords. You find a hidden folder that has the administrator's bank account password and login information for the administrator's bitcoin account. What should you do?

Which system consists of a publicly available set of databases that contain domain name registration contact information?

It is a regulation that has a set of guidelines, which should be adhered to by anyone who handles any electronic medical data. These guidelines stipulate that all medical practices must ensure that all necessary measures are in place while saving, accessing, and sharing any electronic medical data to keep patient data secure.

Which results will be returned with the following Google search query? site:target.com -site:Marketing.target.com accounting

As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing. What document describes the specifics of the testing, the associated violations, and essentially protects both the organization's interest and your liabilities as a tester?

A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should he do?

Your team has won a contract to infiltrate an organization. The company wants to have the attack be as realistic as possible; therefore, they did not provide any information besides the company name. What should be the first step in security testing the client?

A medium-sized healthcare IT business decides to implement a risk management strategy. Which of the following is NOT one of the five basic responses to risk?

John is an incident handler at a financial institution. His steps in a recent incident are not up to the standards of the company. John frequently forgets some steps. Which of the following actions should John take to overcome this problem?

It is an entity or event with the potential to adversely impact a system through unauthorized access, destruction, disclosure, denial of service or modification of data. Which of the following terms best matches the definition?

When you return to your desk after a lunch break, you notice a strange email in your inbox. The sender is someone you did business with recently, but the subject line has strange characters in it. What should you do?

The "gray box testing" methodology enforces what kind of restriction?

The "black box testing" methodology enforces what kind of restriction?

This phase will increase the odds of success in later phases of the penetration test. It is also the very first step in Information Gathering and it will tell you the "landscape" looks like. What is the most important phase of ethical hacking in which you need to spend a considerable amount of time?

Which of the following is assured by the use of a hash?

Risks=Threats x Vulnerabilities is referred to as the:

During the security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?

What is the process of logging, recording, and resolving events that take place in an organization?

The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE.

Assume the EF = 1(100%). What is the closest approximate cost of this replacement and recovery operation per year?

This international organization regulates billions of transactions daily and provides security guidelines to protect personally identifiable information (PII). These security controls provide a baseline and prevent low-level hackers sometimes known as script kiddies from causing a data breach. Which of the following organization is being described?

Which of these options is the most secure procedure for storing backup tapes?

Which security strategy requires using several, varying methods to protect IT systems against attacks?

Which of the following statements regarding ethical hacking is incorrect?

Which of the following is a component of a risk assessment?

Peter is surfing the internet looking for information about DX Company. Which hacking process is Peter doing?

Jim's company regularly performs backups of their critical servers. But the company cannot afford to send backup tapes to an off-site vendor for long-term storage and archiving. Instead, Jim's company keeps the backup tapes in a safe in the office. Jim's company is audited each year, and the results from this year's audit show a risk because backup tapes are not stored off-site. The Manager of Information Technology has a plan to take the backup tapes home with him and wants to know what two things he can do to secure the backup tapes while in transit?

Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers. Which phase does this activity belong to?

Your business has decided to add credit card numbers to the data it backs up to tape. Which of the following represents the best practice your business should observe?

Suppose your company has just passed a security risk assessment exercise. The results display that the risk of the breach in the main company application is 50%. Security staff has taken some measures and implemented the necessary controls. After that, another security risk assessment was performed showing that risk has decreased to 10%. The risk threshold for the application is 20%. Which of the following risk decisions will be the best for the project in terms of its successful continuation with the most business profit?

Which of the following steps for risk assessment methodology refers to vulnerability identification?

Which of the following is the trustworthiness of data or resources in the prevention of improper and unauthorized changes—the assurance that information is sufficiently accurate for its purpose?

In which of the following hacking phases does an attacker try to detect listening ports to find information about the nature of services running on the target machine?

What type of information is gathered by an attacker through Whois database analysis and tracerouting?

What is the output returned by search engines when extracting critical details about a target from the Internet?

Which of the following techniques is used to create complex search engine queries?