Which of the following is the best countermeasure to encrypting ransomwares?

Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?

In Wireshark, the packet bytes panes show the data of the current packet in which format?

Which of the following is the BEST way to defend against network sniffing?

You have successfully gained access to a Linux server and would like to ensure that the succeeding outgoing traffic from this server will not be caught by Network-Based Intrusion Detection Systems (NIDS).
What is the best way to evade the NIDS?

The security administrator of ABC needs to permit Internet traffic in the host 10.0.0.2 and UDP traffic in the host 10.0.0.3. He also needs to permit all FTP traffic
to the rest of the network and deny all other traffic. After he applied his ACL configuration in the router, nobody can access to the ftp, and the permitted hosts
cannot access the Internet. According to the next configuration, what is happening in the network?

When conducting a penetration test, it is crucial to use all means to get all available information about the target network. One of the ways to do that is by sniffing the network. Which of the following cannot be performed by the passive network sniffing?

Steve, a scientist who works in a governmental security agency, developed a technological solution to identify people based on walking patterns and implemented this approach to a physical control access. A camera captures people walking and identifies the individuals using Steve's approach. After that, people must approximate their RFID badges. Both the identifications are required to open the door. In this case, we can say:

Which Intrusion Detection System is the best applicable for large environments where critical assets on the network need extra security and is ideal for observing sensitive network segments?

Which protocol is used for setting up secure channels between two devices, typically in VPNs?

You need a tool that can do network intrusion prevention and intrusion detection, function as a network sniffer, and record network activity. What tool would you most likely select?

Firewalls are the software or hardware systems that are able to control and monitor the traffic coming in and out the target network based on pre-defined set of rules. Which of the following types of firewalls can protect against SQL injection attacks?

Shellshock allowed an unauthorized user to gain access to a server. It affected many Internet-facing services, which OS did it not directly affect?

Which of the following program infects the system boot sector and the executable files at the same time?

An IT employee got a call from one of our best customers. The caller wanted to know about the company's network infrastructure, systems, and team. New opportunities of integration are in sight for both company and customer. What should this employee do?

What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?

A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd. How can he use it?

Chandler works as a pen-tester in an IT-firm in New York. As a part of detecting viruses in the systems, he uses a detection method where the anti-virus executes the malicious codes on a virtual machine to simulate CPU and memory activities. Which type of virus detection method did Chandler use in this context?

You are monitoring the network of your organizations. You notice that: There are huge outbound connections from your Internal Network to External IPs. On further investigation, you see that the external IPs are blacklisted, some connections are accepted, and some are dropped. You find that it is a CnC communication. Which of the following solution will you suggest?

Which of the following security policies defines the use of VPN for gaining access to an internal corporate network?

To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program. What term is commonly used when referring to this type of testing?

Which of the following statements is TRUE?

Bob finished a C programming course and created a small C application to monitor the network traffic and produce alerts when any origin sends "many" IP packets, based on the average number of packets sent by all origins and using some thresholds. In concept, the solution developed by Bob is actually:

When tuning security alerts, what is the best approach?

You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address was blacklisted just before the alert. You are staring an investigation to roughly analyze the severity of the situation. Which of the following is appropriate to analyze?

A virus that attempts to install itself inside the file it is infecting is called?

Sam is working as a pen-tester in an organization in Houston. He performs penetration testing on IDS in order to find the different ways an attacker uses. What is the primary goal of Sam's penetration testing on IDS?

Sam sends a large amount of packets to the target IDS that generates alerts, which enable Sam to hide the real traffic. What type of method is Sam using to evade IDS?

An Internet Service Provider (ISP) has a need to authenticate users connecting via analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Frame Relay network. Which AAA protocol is the most likely able to handle this requirement?

Bob received this text message on his mobile phone: "Hello, this is Scott Smelby from the Yahoo Bank. Kindly contact me for a vital transaction on: scottsmelby@yahoo.com". Which statement below is true?

An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

Which access control mechanism allows for multiple systems to use a central authentication server (CAS) that permits users to authenticate once and gain
access to multiple systems?

Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being
run?

If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?

ShellShock had the potential for an unauthorized user to gain access to a server. It affected many internet-facing services, which OS did it not directly affect?

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named "nc." The FTP server's access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port.
What kind of vulnerability must be present to make this remote attack possible?

By using a smart card and pin, you are using a two-factor authentication that satisfies

An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an
organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of
many of the logged events do not match up. What is the most likely cause?

An enterprise recently moved to a new office and the new neighborhood is a little risky. The CEO wants to monitor the physical perimeter and the entrance doors
24 hours. What is the best option to do this job?

Bob learned that his username and password for a popular game has been compromised. He contacts the company and resets all the information. The company
suggests he use two-factor authentication; which option below offers that?

Which of the following programs is usually targeted at Microsoft Office products?

What does a firewall check to prevent particular ports and applications from getting packets into an organization?

Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack of a built-in-bounds checking mechanism?
Code:
#include <string.h> int main(){ char buffer[8];
strcpy(buffer, ""11111111111111111111111111111"");
}
Output:
Segmentation fault

A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a
user from the IT department had a dial-out modem installed. Which security policy must the security analyst check to see if dial-out modems are allowed?

Jimmy is standing outside a secure entrance to a facility. He is pretending to have a tense conversation on his cell phone as an authorized employee badges in.
Jimmy, while still on the phone, grabs the door as it begins to close.
What just happened?

In both pharming and phishing attacks an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable
information from its victims. What is the difference between pharming and phishing attacks?

A hacker has successfully infected an internet-facing server which he will then use to send junk mail, take part in coordinated attacks, or host junk email content.
Which sort of trojan infects this server?

Todd has been asked by the security officer to purchase a counter-based authentication system. Which of the following best describes this type of system?

In many states sending spam is illegal. Thus, the spammers have techniques to try and ensure that no one knows they sent the spam out to thousands of users
at a time. Which of the following best describes what spammers use to hide the origin of these types of e-mails?

What mechanism in Windows prevents a user from accidentally executing a potentially malicious batch (.bat) or PowerShell (.ps1) script?

What is the code written for (199.jpg)?

Jesse receives an email with an attachment labeled "Court_Notice_21206.zip". Inside the zip file named "Court_Notice_21206.docx.exe" disguised as a word
document. Upon execution, a window appears stating, "This word document is corrupt". In the background, the file copies itself to Jesse APPDATA\local directory
and begins to beacon to a C2 server to download additional malicious binaries.
What type of malware has Jesse encountered?

Rebecca commonly sees an error on her Windows system that states that a Data Execution Prevention (DEP) error has taken place. Which of the following is
most likely taking place?

When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's Computer to
update the router configuration. What type of an alert is this?

You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist's email, and you send her an email changing the source email to her boss's email (boss@company). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your machine gets infected. You now have access to the company network. opens the links, and her malicious links (these links contain malware) and send back the modified pdf, saying that the links don't work. She reads your email, What testing method did you use?

Which of the following describes the characteristics of a Boot Sector Virus?

Which of the following is the least-likely physical characteristic to be used in biometric control that supports a large company?

Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp's lobby. He checks his current SID, which is S-1-521-
1223352397-1872883824-861252104-501. What needs to happen before Matthew has full administrator access?

Log monitoring tools performing behavioral analysis have alerted several suspicious logins on a Linux server occuring during non-business hours. After further examination of all login activities, it is notices that none of the logins have occurred during typical work hours. A Linux administrator who is investigating this problem realized the system time on the Linux server is wrong by more than twelve hours. What protocol used on Linux serves to synchronize the time has stopped working?

Which of the following statements is FALSE with respect to Intrusion Detection Systems?

You have several plain-text firewall logs that you must review to evaluate network traffic. You know that in order to do fast, efficient searches of the logs you
must use regular expressions. Which command-line utility are you most likely to use?

Tremp is an IT Security Manager, and he is planning to deploy an IDS in his small company. He is looking for an IDS with the following characteristics:

-Verifies success or failure of an attack

- Monitors system activities

- Detects attacks that a network-based IDS fails to detect.

- Near real-time detection and response

-Does not require additional hardware

- Lower entry cost. Which type of IDS is best suited for Tremp's requirements?

You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration?
alert tcp any any ->192.168.100.0/24 21 (msg:""FTP on the network!"";)

Which of the following DoS tools is used to attack target web applications by starvation of available sessions on the web server? The tool keeps sessions at halt using never-ending POST transmissions and sending an arbitrarily large content-length header value.

What kind of detection techniques is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it's made on the provider's environment.

You are monitoring the network of your organizations. You notice that: step 1-There are huge outbound connections from your Internal Network to External Ips step 2-On further investigation, you see that the external IPs are blacklisted step3 --Some connections are accepted, and some are dropped step 4-You find that it is a CnC communication Which of the following solution will you suggest?

A company's policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols because the employees do not like changes. You have positioned a network sniffer to capture traffic from the laptops used by employees in the data ingest department. Using Wireshark to examine the captured traffic, which command can be used as display filter to find unencrypted file transfers?

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?

An Intrusion Detection System (IDS) has alerted the network administrator to a possibly malicious sequence of packets sent to a Web server in the network's external DMZ. The packet traffic was captured by the IDS and saved to a PCAP file. What type of network tool can be used to determine if these packets are genuinely malicious or simply a false positive?

CompanyXYZ has asked you to assess the security of their perimeter email gateway. From your office in New York, you craft a specially formatted email message and send it across the Internet to an employee of CompanyXYZ. The employee of CompanyXYZ is aware of your test. Your email message looks like this:

From: jim_miller@companyxyz.com To: michelle_saunders@companyxyz.com

Subject: Test message
Date: 4/3/2017 14:37
The employee of CompanyXYZ receives your email message.
This proves that CompanyXYZ's email gateway doesn't prevent what?

You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What Wireshark filter will show the connections from the snort machine to kiwi syslog machine?

To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https. Which of the following firewall rules meets this requirement?

What is the minimum number of network connections in a multihomed firewall?

Which of the following is an extremely common IDS evasion technique in the web world?

Which of the following techniques is used by an attacker to mimic legitimate institutions such as banks and steal sensitive information such as login passwords and credit-card and bank-account data?

Which of the following techniques is used by an attacker to gain unauthorized access to a target network and remain undetected for a long period of time?

Which of the following port numbers is used by the Trojans Zeus, OceanSalt, and Shamoon?

What is the TCP/IP-based protocol used for exchanging management information between devices connected to a network?

Which of the following IOS Global commands is used to configure the number of DHCP packets per second (pps) that an interface can receive?