You are logged in as a local admin on a Windows 7 system and you need to launch the Computer Management Console from command line. Which command would you use?

______ is a set of extensions to DNS that provide the origin authentication of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attacks types.

What is the purpose of a demilitarized zone on a network?

Which tool allows analysts and pen testers to examine links between data using graphs and link analysis?

You have gained physical access to a Windows 2008 R2 server which has an accessible disc drive. Which Linux-based tool is a software utility for resetting or blanking local passwords used by Windows NT, 2000, XP, Vista, 7, 8, 8.1 and 10. It does this by editing the SAM database where Windows stores password hashes.

The establishment of a TCP connection involves a negotiation called three-way handshake. What type of message does the client send to the server in order to begin this negotiation?

During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network. What is this type of DNS configuration commonly called?

Based on the below log, which of the following sentences are true? Mar 1, 2016, 7:33:28 AM 10.240.250.23 - 54373 10.249.253.15 - 22 tcp_ip

Which of the following is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up to eavesdrop on wireless communications? It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hotspot by posing as a legitimate provider. This type of attack may be used to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up a fraudulent web site and luring people there.

You are working as a Security Analyst in a company XYZ that owns the whole subnet range of 23.0.0.0/8 and 192.168.0.0/8. While monitoring the data, you find a high number of outbound connections. You see that IP's owned by XYZ (Internal) and private IP's are communicating to a Single Public IP. Therefore, the Internal IP's are sending data to the Public IP. After further analysis, you find out that this Public IP is a blacklisted IP, and the internal communicating devices are compromised. What kind of attack does the above scenario depict?

Some clients of TPNQM SA were redirected to a malicious site when they tried to access the TPNQM main site. Bob, a system administrator at TPNQM SA, found that they were victims of DNS Cache Poisoning. What should Bob recommend to deal with such a threat?

Which of the following provides a security professional with most information about the system's security posture?

What is the most common method to exploit the "Bash Bug" or "ShellShock" vulnerability?

A technician is resolving an issue where a computer is unable to connect to the Internet. When the technician examines the IP addresses, he sees the computer is pointing to the Gateway with the IP address of 172.16.20.1 and the IP address of the computer is 192.168.1.24. Which of the following has occurred?

Due to a slowdown of normal network operations, the IT department decided to monitor internet traffic for all of the employees. From a legal stand point, what would be troublesome to take this kind of measure?

In Risk Management, how is the term "likelihood" related to the concept of "threat?"

Internet Protocol Security IPSec is actually a suite of protocols. Each protocol within the suite provides different functionality. Collective IPSec does everything, except?

In an internal security audit, the white hat hacker gains control over a user account and attempts to acquire access to another account's confidential files and information. How can he achieve this?

Bob, a system administrator at TPNQM SA, concluded one day that a DMZ is not needed if he properly configures the firewall to allow access just to servers/ ports, which can have direct internet access, and block the access to workstations. Bob also concluded that DMZ makes sense just when a stateful firewall is available, which is not the case of TPNQM SA. In this context, what can you say?

How does the Address Resolution Protocol (ARP) work?

Which of the following is considered an exploit framework and has the ability to perform automated attacks on services, ports, applications an unpatched security flaws in a computer system?

What is the most secure way to mitigate the theft of corporate information from a laptop that was left in a hotel room?

What is the role of test automation in security testing?

Which Metasploit Framework tool can help penetration tester for evading Anti-virus Systems?

An attacker attaches a rogue router in a network. He wants to redirect traffic to a LAN attached to his router as part of a man-in-the-middle attack. What measure on behalf of the legitimate admin can mitigate this attack?

A penetration test was done at a company. After the test, a report was written and given to the company's IT authorities. A section from the report is shown below:

Access List should be written between VLANs.

Port security should be enabled for the intranet.

A security solution which filters data packets should be set between intranet (LAN) and DMZ. A WAF should be used in front of the web applications.

According to the section from the report, which of the following choice is true?

In IPv6 what is the major difference concerning application layer vulnerabilities compared to IPv4?

An attacker is trying to redirect the traffic of a small office. That office is using their own mail server, DNS server and NTP server because of the importance of their job. The attacker gain access to the DNS server and redirect the direction www.google.com to his own IP address. Now when the employees of the office

The Heartbleed bug was discovered in 2014 and is widely referred to under MITRE's Common Vulnerabilities and Exposures (CVE) as CVE-2014-0160. This bug affects the OpenSSL implementation of the transport layer security (TLS) protocols defined in RFC6520. What type of key does this bug leave exposed to the Internet making exploitation of any compromised system very easy?

What is the correct process for the TCP three-way handshake connection establishment and connection termination?

What is the Shellshock bash vulnerability attempting to do to a vulnerable Linux host?

env x='(){ :;};echo exploit' bash -c 'cat/etc/passwd'

You have successfully logged on a Linux system. You want to now cover your track. Your login attempt may be logged on several files located in /var/log. Which file does NOT belong to the list:

What is the purpose of DNS AAAA record?

You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain. If the DNS server is at 192.168.10.2 and the domain name is abccorp.local, what command would you type at the nslookup prompt to attempt a zone transfer?

Which command can be used to show the current TCP/IP connections?

You are performing information gathering for an important penetration test. You have found pdf, doc, and images in your objective. You decide to extract metadata from these files and analyze it. What tool will help you with the task?

When you are collecting information to perform a data analysis, Google commands are very useful to find sensitive information and files. These files may contain information about passwords, system functions, or documentation. What command will help you to search files using Google as a search engine?

You have just been hired to perform a pen test on an organization that has been subjected to a large-scale attack. The CIO is concerned with mitigating threats and vulnerabilities to totally eliminate risk. What is one of the first things you should do when given the job?

A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?

During a blackbox pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic?

You are attempting to man-in-the-middle a session. Which protocol will allow you to guess a sequence number?

You are tasked to configure the DHCP server to lease the last 100 usable IP addresses in subnet 10.1.4.0/23. Which of the following IP addresses could be leased as a result of the new configuration?

You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. "192.168.8.0/24". What command you would use?

Initiating an attack against targeted business and organizations, threat actors compromise a carefully selected website by inserting an exploit resulting in exploits that target unpatched vulnerabilities. The attackers run exploits on well-known and trusted sites likely to be visited by their targeted victims. Aside from carefully choosing sites to compromise, these attacks are known to incorporate zero-day malware infections. Thus, the targeted entities are left with little or no defense against these exploits. What type of attack is outlined in the scenario?

Which utility will tell you in real time which ports are listening or in another state?

Why are containers less secure than virtual machines?

DHCP snooping is a great solution to prevent rogue DHCP servers on your network. Which security feature on switchers leverages the DHCP snooping database to help prevent man-in-the-middle attacks?

Email is transmitted across the Internet using the Simple Mail Transport Protocol. SMTP does not encrypt email, leaving the information in the message vulnerable to being read by an unauthorized person. SMTP can upgrade a connection between two mail servers to use TLS. TLS is encrypted. What is the name of the command used by SMTP to transmit email over TLS?

Why is a penetration test considered to be more thorough than vulnerability scan?

Given below are the different steps involved in the post-assessment phase of vulnerability management.

1. 1. Remediation

2. 2. Monitoring

3. 3. Risk assessment

4. 4. Verification

Identify the correct sequence of steps in the Post Assessment Phase.

Which of the following types of software vulnerability occurs due to coding errors and allows attackers to gain access to the target system?

In which of the following password attacks does an attacker gather a password database, split each password entry into two- and three-character syllables to develop a new alphabet, and then match it with the existing password database?

Which of the following misconfigured services allows attackers to deploy Windows OS without the intervention of an administrator?

Which of the following types of rootkits replaces original system calls with fake ones to hide information about the attacker?