Ethical Hacker Security Flashcards
11 cards from real Certified Ethical Hacker practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 11 Ethical Hacker Security flashcards as text
What port number is used by LDAP protocol?
Answer: 389
The Lightweight Directory Access Protocol (LDAP) uses TCP port 389 for unencrypted communication. LDAP is a widely used application protocol for accessing and maintaining distributed directory information services, such as user accounts and network resources. For secure, encrypted communication, a variant known as LDAPS (LDAP Secure) typically operates over TCP port 636, using SSL/TLS encryption.
A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems. What kind of test is being performed?
Answer: black box
A black box penetration test is conducted with no prior knowledge of the target system's internal structure, architecture, or source code. The tester simulates an external attacker who has no insider information, relying solely on publicly available information and reconnaissance to identify vulnerabilities. This approach provides a realistic assessment of what an external, unauthorized attacker could achieve against the organization's systems.
How many bits encryption does SHA-1 use?
Answer: 160 bits
SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function that produces a fixed-size output of 160 bits (20 bytes), known as a message digest. This hash value is unique for each input and is commonly used for data integrity verification and digital signatures. While historically popular, SHA-1 is now considered cryptographically weak for certain applications due to the discovery of practical collision attacks.
What is the least important information when you analyze a public IP address in a security alert?
Answer: ARP
When analyzing a public IP address in a security alert, information like Whois (owner details), DNS (associated domain names), and Geolocation (physical location) are crucial for identifying the source and nature of a threat. ARP (Address Resolution Protocol), however, maps IP addresses to MAC addresses within a local network segment. It is largely irrelevant for analyzing a public IP address that is external to the local network, as it doesn't provide global routing or ownership information.
A medium-sized healthcare IT business decides to implement a risk management strategy. Which of the following is NOT one of the five basic responses to risk?
Answer: Delegate
The five basic responses to risk in risk management are typically: Avoid (eliminate the activity causing the risk), Mitigate (reduce the likelihood or impact of the risk), Accept (live with the risk), and Transfer (shift the risk to another party, often through insurance). 'Delegate' is not considered one of these fundamental risk responses. While tasks related to risk management can be delegated, the ultimate responsibility for the risk itself remains with the organization.
When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?
Answer: A top-down approach
A top-down approach to creating a security program means that security policies and initiatives are driven and actively supported by senior management. This ensures that security is integrated into the organization's overall strategy, receives adequate resources, and is enforced throughout all levels of the company. Senior management's endorsement is critical for the success, effectiveness, and widespread adoption of any security policy or program.
Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall. From the following signature, what will Snort look for in the payload of the suspected packets? alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG."BACKDOOR SIG - SubSseven 22";flags: A +; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids, 485;) alert
Answer: Snort will look for 0d0a5b52504c5d3030320d0a in the payload.
In a Snort signature, the `content` keyword specifies a literal byte sequence that Snort will search for within the packet payload. The value `|0d0a5b52504c5d3030320d0a|` is a hexadecimal representation of a specific string. Therefore, Snort will inspect the packet's payload for this exact hexadecimal sequence to identify potential malicious activity, in this case, related to the SubSseven 22 backdoor, and trigger an alert if found.
You work as a Security Analyst for a retail organization. In securing the company's network, you set up a firewall and an IDS. However, hackers are able to attack the network. After investigating, you discover that your IDS is not configured properly and therefore is unable to trigger alarms when needed. What type of alert is the IDS giving?
Answer: False Negative
A false negative occurs when a security system, such as an Intrusion Detection System (IDS), fails to detect an actual attack or malicious activity. In this scenario, hackers successfully attacked the network, but the misconfigured IDS did not trigger an alarm, allowing the breach to go unnoticed. This is a critical failure as it means a real threat was missed, compromising the network's security.
How can telnet be used to fingerprint a web server?
Answer: telnet webserverAddress 80 HEAD / HTTP/1.0
Fingerprinting a web server involves identifying its software and version for reconnaissance. The `HEAD / HTTP/1.0` command sent via telnet to port 80 (standard HTTP port) requests only the header information of the web page. The server's response headers often reveal crucial details like the server type (e.g., Apache, Nginx, IIS) and its version, which is vital for ethical hacking assessments.
During a security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?
Answer: Identify and evaluate existing practices
When documented procedures are absent during an audit, the IS auditor's primary responsibility is to understand the actual operational landscape. Identifying and evaluating existing, undocumented practices allows the auditor to assess the current state of security controls. This step is crucial for determining compliance, identifying gaps, and providing actionable recommendations for improvement and proper documentation.
Claire is surfing the Web and, after some time, a message pops up stating her system has been infected by malware and offering a button to click for removal of the virus. After she clicks the button, another message window appears stating the system has been quarantined due to the nature of the infection and provides a link with instructions to pay in order to regain control and to clear the virus. Which of the following best describes this infection?
Answer: Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks their computer system, then demands a payment (ransom) to restore access. The scenario explicitly describes the system being 'quarantined' and requiring payment 'to regain control and to clear the virus.' These actions are hallmark characteristics of a ransomware attack, where control is withheld until a payment is made.