Free Ethical Hacker Security Questions and Answers

Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall.
From the following signature, what will Snort look for in the payload of the suspected packets?

alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG."BACKDOOR SIG - SubSseven 22";flags: A +; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids, 485;) alert

The payload of 485 is what this Snort signature will look for.

Snort will look for 0d0a5b52504c5d3030320d0a in the payload.

Packets that contain the payload of BACKDOOR SIG - SubSseven 22 will be flagged.

From this snort signature, packets with HOME_NET 27374 in the payload will be flagged.

Correct! Wrong!

How many bits encryption does SHA-1 use?

64 bits

128 bits

256 bits

160 bits

Correct! Wrong!

A penetration tester is hired to do a risk assessment of a company's DMZ.
The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems.
What kind of test is being performed?

white box

grey box

red box

black box

Correct! Wrong!

You work as a Security Analyst for a retail organization. In securing the company's network, you set up a firewall and an IDS. However, hackers are able to attack the network.
After investigating, you discover that your IDS is not configured properly and therefore is unable to trigger alarms when needed.
What type of alert is the IDS giving?

True Positive

True Negative

False Negative

False Positive

Correct! Wrong!

During a security audit of IT processes, an IS auditor found that there were no documented security procedures.
What should the IS auditor do?

Terminate the audit

Identify and evaluate existing practices

Create a procedures document

Conduct compliance testing

Correct! Wrong!

What is the least important information when you analyze a public IP address in a security alert?

ARP

Whois

DNS

Geolocation

Correct! Wrong!

How can telnet be used to fingerprint a web server?

telnet webserverAddress 80 HEAD / HTTP/1.0

telnet webserverAddress 80 PUT / HTTP/1.0

telnet webserverAddress 80 HEAD / HTTP/2.0

telnet webserverAddress 80 PUT / HTTP/2.0

Correct! Wrong!

What port number is used by LDAP protocol?

110

389

464

445

Correct! Wrong!

When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?

A bottom-up approach

A top-down approach

A senior creation approach

An IT assurance approach

Correct! Wrong!

Claire is surfing the Web and, after some time, a message pops up stating her system has been infected by malware and offering a button to click for removal of the virus. After she clicks the button, another message window appears stating the system has been quarantined due to the nature of the infection and provides a link with instructions to pay in order to regain control and to clear the virus. Which of the following best describes this infection?

Spyware

Ransomware

Trojan

Adware

Correct! Wrong!

A medium-sized healthcare IT business decides to implement a risk management strategy.
Which of the following is NOT one of the five basic responses to risk?

Avoid

Mitigate

Accept

Delegate

Correct! Wrong!

How many bits encryption does SHA-1 use?

A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems. What kind of test is being performed?

During a security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?

What is the least important information when you analyze a public IP address in a security alert?

How can telnet be used to fingerprint a web server?

What port number is used by LDAP protocol?

When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?

A medium-sized healthcare IT business decides to implement a risk management strategy. Which of the following is NOT one of the five basic responses to risk?

A penetration tester is hired to do a risk assessment of a company's DMZ.
The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems.
What kind of test is being performed?

During a security audit of IT processes, an IS auditor found that there were no documented security procedures.
What should the IS auditor do?

A medium-sized healthcare IT business decides to implement a risk management strategy.
Which of the following is NOT one of the five basic responses to risk?