100 Free GIAC GCIH Practice Questions and Answers
100 questions for the GIAC GCIH exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IP address spoofing operates at Layer 3 and forges source IP addresses but does not directly bypass MAC-based access control lists.
Not this one. Try another answer.
Why B is wrong
VLAN hopping exploits VLAN configuration weaknesses but is a different attack vector than MAC address manipulation.
Not this one. Try another answer.
Why C is wrong
ARP spoofing manipulates ARP tables for man-in-the-middle attacks but does not directly bypass access control lists through address masquerading.
Right, D is the answer.
Why D is right
MAC spoofing allows attackers to change their Media Access Control address to impersonate another computer on the network, thereby bypassing MAC-based access control lists and network restrictions. This attack operates at Layer 2 (data link layer) and is particularly effective against networks relying on MAC filtering for access control, allowing attackers to either hide their identity or assume another computer's identity.
Question 2 Play from 01:57
nc -v -z 192.168.40.90 1-1024
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This command scans the target host; it does not create a listener on the target.
Right, B is the answer.
Why B is right
The netcat command 'nc -v -z 192.168.40.90 1-1024' performs a port scan on the target host 192.168.40.90 for ports 1 through 1024. The -z flag enables zero I/O mode (scan without sending data), and -v enables verbose output to show which ports are open.
Not this one. Try another answer.
Why C is wrong
The -z flag prevents data transmission, so this cannot send files.
Not this one. Try another answer.
Why D is wrong
Netcat performs port scanning, not vulnerability assessment scanning.
Question 3 Play from 03:50
When you trace them down they come from multiple different IP addresses.
What kind of attack is this?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SYN flood attacks use TCP SYN packets, not ICMP packets.
Not this one. Try another answer.
Why B is wrong
Ping storm typically originates from a single source, not multiple different IP addresses.
Not this one. Try another answer.
Why C is wrong
While Smurf attacks do use ICMP, they typically amplify from a broadcast address rather than appearing as truly independent sources like a DDoS.
Right, D is the answer.
Why D is right
When ICMP packets flood a network from multiple different IP addresses, this is a Distributed Denial of Service (DDoS) attack, where numerous sources collectively overwhelm the target. A Smurf attack uses ICMP echo requests to intermediate networks, but the question specifies packets from multiple sources. A SYN flood uses TCP SYN packets, not ICMP. A ping storm typically comes from a single source using ICMP. The defining characteristic of DDoS is the involvement of multiple source addresses.
Question 4 Play from 05:38
What flaw on the news aggregator website allowed this attack to happen?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SQL Injection targets databases, not web page content rendered in browsers.
Right, B is the answer.
Why B is right
This describes a Reflected XSS attack where the attacker crafts a malicious link that causes the news aggregator to reflect attacker-controlled content (malicious links) back to the victim's browser. The browser trusts the content because it came from the legitimate domain, allowing the injected malicious content to execute.
Not this one. Try another answer.
Why C is wrong
CSRF tricks a user into making unwanted requests; this attack directly injects malicious content into the page.
Not this one. Try another answer.
Why D is wrong
Buffer Overflow attacks target memory vulnerabilities in applications, not web page rendering.
Question 5 Play from 07:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
RADIUS is the authentication protocol/service, not the wireless network security framework; it typically works with 802.1x.
Right, B is the answer.
Why B is right
IEEE 802.1x is the port-based network access control protocol that enables authentication when wireless devices connect to access points through a centralized authentication server (typically using RADIUS). It ensures all hosts are properly authenticated before network access is granted. RADIUS is the authentication protocol often used with 802.1x, WEP is an older encryption standard, and WPA2 is an encryption protocol without centralized server authentication requirement.
Not this one. Try another answer.
Why C is wrong
WEP is an outdated encryption standard that does not involve centralized server authentication.
Not this one. Try another answer.
Why D is wrong
WPA2 is an encryption protocol; while secure, it does not specifically define centralized authentication infrastructure.
Question 6 Play from 09:22
What is most likely occurring?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A ping sweep generates ICMP Echo Requests and Echo Replies, not Time Exceeded messages.
Right, B is the answer.
Why B is right
ICMP Time Exceeded packets are generated when traceroute tools probe the network path to a destination. Each hop in a traceroute sends back a Time Exceeded message when the TTL reaches zero, allowing the mapping of the network path. This is the characteristic traffic pattern of a traceroute scan.
Not this one. Try another answer.
Why C is wrong
DHCP address expiration is unrelated to ICMP Time Exceeded packets.
Not this one. Try another answer.
Why D is wrong
If ICMP were blocked by the firewall, these packets would not appear in outbound logs.
Question 7 Play from 10:54
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In a bcrypt string, $2b$ is the prefix that identifies the method and its revision, and the two-digit field that follows is the CPU time cost parameter. That scale is logarithmic and runs from 4 to 31, so each step up makes every hash computation, and therefore every guess, much slower. Because the cost is tunable, administrators can raise it to keep the hash slow as hardware improves, which keeps offline guessing expensive.
Not this one. Try another answer.
Why B is wrong
bcrypt uses a fixed 128-bit salt, which this field does not set.
Not this one. Try another answer.
Why C is wrong
bcrypt's maximum passphrase length is fixed at 72 characters and is not encoded in the hash.
Not this one. Try another answer.
Why D is wrong
The revision is carried by the 2b in the prefix, not by the field after it.
Question 8 Play from 12:44
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
When the ping command is executed on a Windows system, the first packet sent is an ICMP echo request. This request is sent to the target host, which then responds with an ICMP echo reply. The echo request initiates the ping process by asking the remote host to respond, making it the first packet type transmitted during a ping operation.
Not this one. Try another answer.
Why B is wrong
ICMP echo is not a standard packet type designation in this context; the correct term is echo request.
Not this one. Try another answer.
Why C is wrong
ICMP echo reply is the response packet sent back by the target, not the first packet sent by the ping command.
Not this one. Try another answer.
Why D is wrong
UDP packets are not used by ping; ping uses ICMP, which operates at the network layer, not the transport layer like UDP.
Question 9 Play from 14:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
enum is not a standard Linux command for this purpose.
Not this one. Try another answer.
Why B is wrong
smbstatus displays information about current Samba connections, not Windows user and SID enumeration.
Right, C is the answer.
Why C is right
rpcclient is a Linux tool that uses RPC (Remote Procedure Call) to query Windows systems remotely. It can enumerate users, groups, and their associated SIDs from a Windows system when proper credentials or null sessions are available, making it the correct answer for listing Windows users, groups, and SIDs from a Linux perspective.
Not this one. Try another answer.
Why D is wrong
smbclient is used for interactive SMB file sharing and printing; it doesn't enumerate users and SIDs.
Question 10 Play from 15:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ingress describes network traffic flowing inward, from outside the network perimeter toward the inside.
Not this one. Try another answer.
Why B is wrong
Inwards network is not standard networking terminology for traffic direction.
Right, C is the answer.
Why C is right
Egress network traffic refers to data flowing outbound from a network toward external networks or the internet. The term 'egress' literally means 'exit' and is the standard networking terminology for outbound traffic originating from inside the network perimeter.
Not this one. Try another answer.
Why D is wrong
Outwards network is not the correct technical term; the proper term is 'egress.'
Show all 100 questionsShow fewer questions
Question 11 Play from 17:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Living Off the Land (LotL) is a bypass technique where attackers use legitimate, pre-installed system utilities and tools (like PowerShell, cmd.exe, certutil, or wmic) instead of deploying malicious executables. This evades antivirus detection by leveraging trusted binaries.
Not this one. Try another answer.
Why B is wrong
Code signing is a security feature that digitally signs executables; it does not bypass endpoint security.
Not this one. Try another answer.
Why C is wrong
Compile After Delivery involves compiling code on the target system but does not specifically describe leveraging existing system tools.
Not this one. Try another answer.
Why D is wrong
Ghostwriting is not a recognized endpoint security bypass technique in established security terminology.
Question 12 Play from 18:46
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Reconnaissance is the initial phase of an attack where the attacker gathers information about the target through passive means such as public records, WHOIS lookups, DNS queries, website analysis, and social engineering research. This phase involves little to no direct interaction with target systems, no scanning, no exploitation, no system access. The attacker is collecting intelligence without triggering any alerts or defenses.
Not this one. Try another answer.
Why B is wrong
Scanning involves direct interaction with target systems to identify open ports and services.
Not this one. Try another answer.
Why C is wrong
Covering tracks occurs after access is achieved and involves active system manipulation.
Not this one. Try another answer.
Why D is wrong
Keeping access involves active maintenance of backdoors and persistence mechanisms.
Not this one. Try another answer.
Why E is wrong
Denial of Service is a direct attack with significant interaction with target systems.
Question 13 Play from 20:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
S/KEY is a one-time password system unrelated to RADIUS integration.
Not this one. Try another answer.
Why B is wrong
SYSKEY is a Windows security feature, not a Linux tool.
Right, C is the answer.
Why C is right
PAM (Pluggable Authentication Modules) is a flexible authentication framework for Linux that can integrate with RADIUS (Remote Authentication Dial In User Service) to provide centralized network authentication. PAM allows administrators to configure various authentication methods including RADIUS without modifying individual applications.
Not this one. Try another answer.
Why D is wrong
Shadow manages local password files and does not provide RADIUS integration.
Question 14 Play from 22:01
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Kernel keyloggers operate at the OS kernel level in software and can be detected by anti-virus and anti-spyware tools that scan kernel memory and processes.
Not this one. Try another answer.
Why B is wrong
Software keyloggers run as programs within the operating system and can be detected by anti-virus and anti-spyware products through signature and behavioral analysis.
Right, C is the answer.
Why C is right
Hardware keyloggers are physical devices placed between a keyboard and computer that cannot be detected by anti-virus or anti-spyware products because they operate entirely outside the software layer. Since they are physical hardware interception devices, they leave no software signatures for security tools to detect.
Not this one. Try another answer.
Why D is wrong
OS keyloggers are software-based components that operate at the operating system level and can be detected by security scanning tools.
Question 15 Play from 23:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Password hashes for rainbow table cracking are stored in /etc/shadow, not /etc/passwd
Not this one. Try another answer.
Why B is wrong
A dictionary approach targets passwords, not user enumeration; /etc/passwd enables account enumeration
Right, C is the answer.
Why C is right
An auditor obtains /etc/passwd to enumerate valid user accounts on the system. This provides a comprehensive list of usernames to target during password cracking efforts. By identifying all user accounts first, the auditor can focus password guessing and cracking attempts on known valid accounts, which is a prerequisite to any password security assessment.
Not this one. Try another answer.
Why D is wrong
Brute force approaches require knowledge of usernames first; /etc/passwd enables targeted enumeration
Question 16 Play from 25:31
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
ICMP (Internet Control Message Protocol) is a maintenance protocol used for network diagnostics and error reporting at the IP layer. However, it has been extensively used in denial-of-service attacks such as ping floods and smurf attacks.
Not this one. Try another answer.
Why B is wrong
L2TP (Layer 2 Tunneling Protocol) is a VPN protocol for secure communications, not a maintenance protocol at the IP layer.
Not this one. Try another answer.
Why C is wrong
TCP is a transport layer protocol, not specifically an IP layer maintenance protocol, though it can be exploited in attacks.
Not this one. Try another answer.
Why D is wrong
NNTP (Network News Transfer Protocol) is an application layer protocol for news distribution, not an IP layer maintenance protocol.
Question 17 Play from 27:11
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SRUM\Extensions
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The SRUM (System Resource Usage Monitor) registry key stores temporarily held system activity data collected by Windows for resource monitoring and diagnostic purposes. This includes CPU usage, memory consumption, disk I/O, and network activity over time, providing forensic analysts with insight into system behavior during specific periods.
Not this one. Try another answer.
Why B is wrong
File associations are stored in different registry locations, typically under HKEY_CLASSES_ROOT.
Not this one. Try another answer.
Why C is wrong
Recently searched files are stored in different locations like MRU lists and Search history, not in SRUM.
Not this one. Try another answer.
Why D is wrong
Web browser add-on policies are found under different registry paths related to browser-specific policies.
Question 18 Play from 29:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tcpview is a process and connection monitoring tool, not a packet crafting scanner.
Not this one. Try another answer.
Why B is wrong
Nessus is a vulnerability scanner that does not specifically send packets with nontraditional IP parameters.
Not this one. Try another answer.
Why C is wrong
Legion is an enumeration tool focused on network resource discovery, not packet manipulation.
Right, D is the answer.
Why D is right
HPing is a network analysis tool that sends packets with nontraditional or customizable IP stack parameters and analyzes responses, making it useful for both scanning and detailed network reconnaissance. Tcpview (A) is a process monitoring tool. Nessus (B) is a vulnerability scanner. Legion (C) is a network enumeration tool. Only HPing fits the description of sending crafted packets with non-standard IP parameters and gathering information from responses.
Question 19 Play from 30:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Samba restrict anonymous parameter controls whether the SAMR and LSA DCERPC services can be used anonymously and corresponds to the Windows RestrictAnonymous registry value. A value of 1 disables anonymous SAMR access, and a value of 2 does that and also disallows anonymous connections to the IPC$ share in general, which shuts down null-session enumeration. The default is 0, and setting guest ok = yes on any share removes the security advantage.
Not this one. Try another answer.
Why B is wrong
A value of 1 disables anonymous SAMR access but still allows anonymous connections to IPC$.
Not this one. Try another answer.
Why C is wrong
A value of 0 is the default and leaves anonymous access unrestricted.
Not this one. Try another answer.
Why D is wrong
Allowing guest access on a share removes the security advantage of restricting anonymous access.
Question 20 Play from 32:50
Each correct answer represents a complete solution. (Choose two.)
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
printf() can be vulnerable to format string attacks but is not a primary buffer overflow vector like strcat() and strcpy().
Right, B is one of the answers.
Why B is right
Both strcat() and strcpy() are vulnerable to buffer overflow attacks because they copy data without checking buffer boundaries. These functions do not perform length validation, allowing attackers to write beyond allocated memory and corrupt the stack or heap.
Right, C is one of the answers.
Why C is right
Both strcat() and strcpy() are vulnerable to buffer overflow attacks because they copy data without checking buffer boundaries. These functions do not perform length validation, allowing attackers to write beyond allocated memory and corrupt the stack or heap.
Not this one. Try another answer.
Why D is wrong
strlength() (or strlen()) only returns the length of a string and does not perform any copying or data manipulation that would cause buffer overflow.
Question 21 Play from 34:18
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The netscan plugin in Volatility displays information about network connections, including listening sockets and closed sockets. It scans the memory dump for TCP and UDP connection structures and provides detailed information about active and listening network connections on the system.
Not this one. Try another answer.
Why B is wrong
dlllist shows dynamically loaded libraries in memory, not network socket information.
Not this one. Try another answer.
Why C is wrong
pslist enumerates running processes, not network socket connections.
Not this one. Try another answer.
Why D is wrong
psscan scans for process structures in memory but does not provide network socket information.
Question 22 Play from 35:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Establishing a backdoor involves creating persistent remote access mechanisms, not accessing existing logs.
Not this one. Try another answer.
Why B is wrong
Using steganography is a data hiding technique unrelated to accessing system logs.
Not this one. Try another answer.
Why C is wrong
Initial reconnaissance involves information gathering before an attack, not post-intrusion log access.
Not this one. Try another answer.
Why D is wrong
Port scanning occurs during early attack phases for network discovery, before system access is gained.
Right, E is the answer.
Why E is right
Accessing and modifying logs in 'Documents and Settings\logs' represents the attacker attempting to cover their tracks by altering evidence of their intrusion. This is the final phase of the attack lifecycle where attackers remove or manipulate audit trails and logs to hide indicators of compromise.
Question 23 Play from 37:25
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Preparation phase occurs before incidents happen and involves implementing preventive measures and defensive strategies. Developing patch management and file encryption policies are proactive security measures designed to prevent successful attacks. These policies and processes are established during preparation, not in response to an active incident.
Not this one. Try another answer.
Why B is wrong
Containment focuses on stopping an ongoing attack, not developing long-term prevention policies.
Not this one. Try another answer.
Why C is wrong
Identification involves discovering and analyzing an active incident, not creating preventive policies.
Not this one. Try another answer.
Why D is wrong
Eradication removes the threat from affected systems but does not develop organizational policies.
Not this one. Try another answer.
Why E is wrong
Recovery restores systems to normal operation after incident resolution, not the phase for policy development.
Question 24 Play from 39:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While determining if an incident occurred is important, it should follow documentation and scene security to preserve evidence.
Not this one. Try another answer.
Why B is wrong
Removing network access is a containment action that should not occur before documenting and securing the scene.
Not this one. Try another answer.
Why C is wrong
Reviewing firewall rules is part of the response but comes after scene security to avoid losing critical evidence.
Right, D is the answer.
Why D is right
Before taking any containment action, the incident response team must first document and secure the incident scene. This preserves evidence integrity, establishes a baseline, and prevents contamination of the investigation. Determining if an incident occurred, removing access, or reviewing firewall rules are all important but should follow proper evidence preservation protocols. Jumping directly to containment actions without proper documentation can compromise forensic value and legal admissibility.
Question 25 Play from 41:05
Each correct answer represents a complete solution. (Choose all that apply.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
The primary goals of an incident handling team are to freeze the scene (preserve evidence and prevent tampering), repair damage caused by the incident (restore systems to normal operation), and prevent further damage (contain the incident and block attack vectors). These three objectives represent the core mission of incident response: preservation, recovery, and containment. Informing higher authorities is important for communication and reporting but is secondary to these primary operational goals.
Right, B is one of the answers.
Why B is right
The primary goals of an incident handling team are to freeze the scene (preserve evidence and prevent tampering), repair damage caused by the incident (restore systems to normal operation), and prevent further damage (contain the incident and block attack vectors). These three objectives represent the core mission of incident response: preservation, recovery, and containment. Informing higher authorities is important for communication and reporting but is secondary to these primary operational goals.
Right, C is one of the answers.
Why C is right
The primary goals of an incident handling team are to freeze the scene (preserve evidence and prevent tampering), repair damage caused by the incident (restore systems to normal operation), and prevent further damage (contain the incident and block attack vectors). These three objectives represent the core mission of incident response: preservation, recovery, and containment. Informing higher authorities is important for communication and reporting but is secondary to these primary operational goals.
Not this one. Try another answer.
Why D is wrong
While informing higher authorities is part of incident response procedures, it is a communication and escalation task rather than a primary operational goal of the incident handling team.
Question 26 Play from 42:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Database retrieval attack is not a standard classified attack type.
Not this one. Try another answer.
Why B is wrong
PHP injection attacks target PHP code execution but are not specifically designed for database information retrieval compared to SQL injection.
Right, C is the answer.
Why C is right
SQL injection is the attack technique that allows attackers to insert malicious SQL code into input fields to retrieve, modify, or delete database information from a Web server's database. It exploits improper input validation in web applications that construct SQL queries.
Not this one. Try another answer.
Why D is wrong
Server data attack is a generic term that does not represent a specific, well-known attack methodology.
Question 27 Play from 44:21
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Using known good hashes (like those from NIST databases or OS baseline hashes) allows investigators to filter out files that are definitely legitimate, significantly reducing the dataset that requires detailed analysis. This technique is called 'hash set filtering' and is a standard forensic practice to focus investigation efforts on truly suspicious files.
Not this one. Try another answer.
Why B is wrong
Ignoring malicious file hashes would actually increase the data to examine and defeat the purpose of reducing investigation scope.
Not this one. Try another answer.
Why C is wrong
Creating hashes for all directories adds more data to manage rather than reducing what needs examination.
Not this one. Try another answer.
Why D is wrong
Requesting management recommendations is a decision-making process, not a data reduction technique.
Question 28 Play from 46:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Excessive functionality means the extension exposes functions the task does not need, such as delete or send, rather than an overprivileged identity.
Not this one. Try another answer.
Why B is wrong
Excessive autonomy means high-impact actions run without independent verification or user approval, which is not the flaw described.
Right, C is the answer.
Why C is right
OWASP splits the root causes of Excessive Agency into excessive functionality, excessive permissions and excessive autonomy. When an extension built to act for one user reaches downstream systems with a generic high-privileged identity, the problem is excessive permissions, because the extension can touch far more data than its task requires. The remedy is to execute extensions in the user's own context, for example through OAuth with the minimum scope, so actions on the user's behalf carry only that user's privileges.
Not this one. Try another answer.
Why D is wrong
Improper output handling concerns unvalidated model output passed to downstream components, not the identity an extension uses.
Question 29 Play from 48:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Brute force is exhaustive but extremely slow because it must try all possible character combinations before finding the password.
Right, B is the answer.
Why B is right
Dictionary attacks are generally the fastest password cracking method in practice because they exploit the reality that most users choose passwords from common words, phrases, and patterns found in dictionaries. They require far fewer attempts than brute force attacks, which must try all possible character combinations, making dictionary attacks significantly faster for real-world passwords.
Not this one. Try another answer.
Why C is wrong
Manual guessing is impractical and unreliable, depending entirely on the attacker's intuition rather than systematic methods.
Not this one. Try another answer.
Why D is wrong
Hybrid attacks combine dictionary and brute force but are slower than pure dictionary attacks since they require additional computation.
Question 30 Play from 49:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Netcat does not require or use FTP to relay data between machines.
Not this one. Try another answer.
Why B is wrong
ARP poisoning is an attack method unrelated to how Netcat relays data.
Right, C is the answer.
Why C is right
Netcat implements relay functionality using standard input/output (I/O) redirection, which allows it to pipe data between connections without relying on external protocols. This is one of Netcat's core features that makes it flexible for network communication tasks. FTP and Telnet are separate protocols, not mechanisms Netcat uses. ARP poisoning is an unrelated attack technique.
Not this one. Try another answer.
Why D is wrong
While Netcat can replace Telnet for connections, it does not use Telnet protocol to relay data.
Question 31 Play from 51:26
C:\Users\JaneD\funnyjokes.doc:file1
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
cp is a Unix/Linux command and not a native Windows tool for this purpose.
Not this one. Try another answer.
Why B is wrong
dir lists directory contents but does not display the contents of alternate data streams.
Right, C is the answer.
Why C is right
The file path C:\Users\JaneD\funnyjokes.doc:file1 references an alternate data stream (ADS) on an NTFS file system. The colon syntax indicates that 'file1' is a hidden data stream attached to the funnyjokes.doc file. The 'more' command in Windows can be used to read and display the contents of alternate data streams directly from the command line, making it the appropriate tool for viewing this hidden data.
Not this one. Try another answer.
Why D is wrong
notepad is a graphical text editor that cannot directly access or display alternate data stream contents from the command line.
Question 32 Play from 53:04
# last -f /var/log/btmp
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Successful logins are recorded in wtmp, not btmp.
Not this one. Try another answer.
Why B is wrong
The 'last' command does not erase bash history; it reads log files.
Not this one. Try another answer.
Why C is wrong
The 'last' command does not delete logs; it only displays them for review.
Right, D is the answer.
Why D is right
The command 'last -f /var/log/btmp' displays records from the btmp file, which contains failed login attempts on Unix/Linux systems. The 'last' command with the btmp file specifically shows a history of unsuccessful authentication attempts.
Question 33 Play from 54:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Disabling Internet Explorer scripts does not address protocol parser vulnerabilities in network tools.
Not this one. Try another answer.
Why B is wrong
Disabling Outlook preview pane helps with email-based exploits but not protocol parser vulnerabilities.
Not this one. Try another answer.
Why C is wrong
Keeping Nmap patched is important, but Nmap is a port scanner, not primarily a protocol parser for receiving traffic.
Right, D is the answer.
Why D is right
Tcpdump is a packet capture tool that parses network protocols. Keeping tcpdump fully patched directly defends against protocol parser vulnerabilities that could be exploited through malformed packets. Vulnerabilities in packet parsing libraries can be triggered by specially crafted network traffic.
Question 34 Play from 56:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Govern, Identify and Protect are the preparation layer, which supports incident response but is not part of the response itself.
Not this one. Try another answer.
Why B is wrong
Identify and Protect sit in the preparation layer, so this set mixes preparation with only one response Function.
Right, C is the answer.
Why C is right
Revision 3, published in April 2025, supersedes the 2012 Revision 2 and organizes its recommendations around the CSF 2.0 Functions. Detect, Respond and Recover form incident response itself, while Govern, Identify and Protect are broader risk management activities that prepare for incidents but are not part of the response. Lessons learned from every Function feed the Improvement Category under Identify continuously, because modern incidents can take weeks or months to recover from.
Not this one. Try another answer.
Why D is wrong
Protect and Govern are preparation Functions, and Recover, which restores affected assets, is missing from this set.
Question 35 Play from 58:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
-sF performs a TCP FIN scan, not TCP SYN scanning.
Not this one. Try another answer.
Why B is wrong
-sU performs UDP port scanning, not TCP scanning.
Not this one. Try another answer.
Why C is wrong
-sX performs a TCP Xmas scan with FIN, PSH, and URG flags set, not TCP SYN scanning.
Right, D is the answer.
Why D is right
The -sS parameter in nmap initiates a TCP SYN scan, also known as a half-open scan. It sends SYN packets to target ports and analyzes responses to determine port states without completing full TCP connections, making it a standard and efficient port scanning technique.
Question 36 Play from 59:35
Which of the following tools will you use to accomplish the task?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
PSExec is a legitimate Microsoft Sysinternals tool that allows execution of processes on remote systems over a network. Attackers can abuse PSExec to deploy malware like Trojans on target computers. While it has legitimate administrative uses, it is commonly exploited for malicious purposes. The other options are either non-existent tools or not designed for this primary purpose.
Not this one. Try another answer.
Why B is wrong
Remoxec is not a recognized or standard tool used for remote code execution.
Not this one. Try another answer.
Why C is wrong
Hk.exe is not a standard tool designed for remote code execution and deployment.
Not this one. Try another answer.
Why D is wrong
GetAdmin.exe was a privilege escalation tool from older Windows versions, not a remote execution tool.
Question 37 Play from 1:01:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Sneakin is not a known ICMP tunneling tool for shell access.
Not this one. Try another answer.
Why B is wrong
Telnet is a traditional network protocol that uses TCP port 23, not ICMP.
Right, C is the answer.
Why C is right
Loki is a covert tunneling tool specifically designed to provide shell access and command execution over ICMP (ping) traffic. It tunnels data through ICMP echo requests and replies, allowing attackers to bypass firwall rules that allow ICMP but block other protocols. This makes it particularly stealthy for maintaining backdoor access. Sneakin, Telnet, and WWW shell are not ICMP-based tools.
Not this one. Try another answer.
Why D is wrong
Reverse WWW Shell operates over HTTP/HTTPS, not ICMP.
Question 38 Play from 1:02:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Acts refer to legislation and legal statutes passed by government, not internal organizational operating rules.
Right, B is the answer.
Why B is right
Policies are the formal rules and guidelines that define how an organization operates, including security practices, acceptable use, and operational procedures. They are established by management and provide the framework for all organizational activities. Acts refer to legal statutes, Rules are more specific implementations of policies, and Manuals are documentation tools, but Policies are the foundational governing principles of an organization.
Not this one. Try another answer.
Why C is wrong
Rules are typically more specific, tactical implementations derived from policies rather than the overarching governing framework.
Not this one. Try another answer.
Why D is wrong
Manuals are documentation and reference materials, not the governing rules themselves.
Question 39 Play from 1:04:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Disaster management policies address business continuity and recovery, not incident response roles.
Not this one. Try another answer.
Why B is wrong
Incident response manuals provide procedural guidance but policies are the authoritative documents establishing responsibility.
Not this one. Try another answer.
Why C is wrong
Disaster management manuals focus on recovery procedures rather than incident response role assignment.
Right, D is the answer.
Why D is right
Incident response policies specifically define roles, responsibilities, and procedures for responding to security incidents, including who is responsible for each aspect of the response. These policies establish the organizational structure and accountability framework for incident handling.
Question 40 Play from 1:05:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Nessus is a detailed vulnerability scanner, not optimized for scanning speed across thousands of hosts.
Not this one. Try another answer.
Why B is wrong
Nmap is a comprehensive scanning tool but significantly slower than Masscan for large-scale rapid scans.
Right, C is the answer.
Why C is right
Masscan is specifically designed for extremely fast scanning of very large networks and can scan the entire Internet in under 6 minutes. It uses an asynchronous transmission model and was built to handle massive scale. Nessus is a vulnerability scanner (slower, more thorough). Nmap is general-purpose but not optimized for speed on thousands of hosts. Hping3 is a packet crafting tool, not a comprehensive scanner. For pure speed on large networks, Masscan is the clear choice.
Not this one. Try another answer.
Why D is wrong
Hping3 is a packet crafting and analysis tool, not designed for rapid large-scale network scanning.
Question 41 Play from 1:07:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Using the organization's service account compromises the separation between operational and forensic activities and creates audit trail ambiguity.
Not this one. Try another answer.
Why B is wrong
Limited network connectivity impedes the ability to access and analyze cloud resources effectively.
Not this one. Try another answer.
Why C is wrong
On-premise systems have latency issues and may not have the proper cloud-native tools needed for cloud investigations.
Right, D is the answer.
Why D is right
A cloud-based forensics system using an independent service account is ideal for cloud investigations because it maintains proper access controls and audit trails specific to the investigation. Using an independent account prevents confusion with organizational service accounts, ensures accountability, and creates a clear separation between operational access and forensic analysis access, which is critical for maintaining evidence integrity and compliance.
Question 42 Play from 1:09:35
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An egress anti-spoof filter operates on outbound traffic leaving the network and drops packets where the source address does not originate from internal networks. This prevents attackers on internal systems from spoofing their source addresses to appear as if they come from external or unauthorized networks. Egress filtering protects the perimeter by ensuring only legitimate internal traffic originates from the organization.
Not this one. Try another answer.
Why B is wrong
This describes incoming traffic filtering based on destination, not egress anti-spoofing.
Not this one. Try another answer.
Why C is wrong
This describes ingress anti-spoofing, not egress anti-spoofing; egress is outbound.
Not this one. Try another answer.
Why D is wrong
This describes filtering based on destination address in outgoing traffic, not source address spoofing.
Question 43 Play from 1:11:25
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Information Security representative is responsible for ensuring that the organization's security policies and information security requirements are enforced and followed during incident response activities. This role ensures that response actions align with security standards and policies. While Legal may handle compliance and liability, Human Resources handles personnel issues, and Technical representatives handle technical implementation, the Information Security representative specifically oversees policy enforcement during incidents.
Not this one. Try another answer.
Why B is wrong
Legal representative focuses on compliance, liability, and legal implications rather than enforcing organizational security policies.
Not this one. Try another answer.
Why C is wrong
Human Resources handles personnel-related matters and employment policies, not information security policy enforcement.
Not this one. Try another answer.
Why D is wrong
Technical representative implements the response actions but does not ensure organizational policies are being followed.
Question 44 Play from 1:13:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Kernel level rootkits operate within the kernel but do not create a virtualization layer to run the OS as a virtual machine.
Not this one. Try another answer.
Why B is wrong
Boot loader rootkits compromise the boot process but don't implement hypervisor functionality to virtualize the OS.
Right, C is the answer.
Why C is right
A hypervisor rootkit operates at a level above the operating system by creating a virtual machine layer that loads the original OS as a guest, allowing it to intercept all hardware calls and system operations. This gives it exceptional control and stealth compared to other rootkit types, as it sits between the OS and hardware.
Not this one. Try another answer.
Why D is wrong
Library rootkits operate at the user space level by compromising system libraries, not by virtualizing the operating system.
Question 45 Play from 1:15:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Dashes are used in SQL comments but are not the primary probe character for injection detection.
Not this one. Try another answer.
Why B is wrong
Double quotes are less commonly used as a test vector since many SQL implementations use single quotes for string literals.
Right, C is the answer.
Why C is right
The single quote (') character is the standard test vector for SQL injection vulnerabilities because it terminates SQL string literals and allows an attacker to inject arbitrary SQL commands. When a single quote is inserted into a vulnerable parameter and causes an error or unexpected behavior, it indicates the application does not properly sanitize input. This is the most commonly used and reliable test character for identifying SQL injection flaws.
Not this one. Try another answer.
Why D is wrong
Semicolons terminate SQL statements but are not the initial probe character and are often filtered.
Question 46 Play from 1:16:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Mass mailer malware replicates by sending copies of itself via email.
Not this one. Try another answer.
Why B is wrong
Worms are specifically designed to self-replicate and spread automatically without user intervention.
Not this one. Try another answer.
Why C is wrong
Blended threats combine characteristics of multiple malware types, many of which do self-replicate.
Right, D is the answer.
Why D is right
A Trojan horse is malware that does not replicate itself but instead spreads through user action or distribution. It requires favorable circumstances (such as a user downloading and executing it) to propagate, unlike worms which self-replicate automatically.
Question 47 Play from 1:18:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
MAC spoofing only changes the MAC address; it doesn't enable sniffing and modifying traffic on a LAN.
Not this one. Try another answer.
Why B is wrong
IP address spoofing operates at Layer 3 and is not the primary technique for sniffing and modifying LAN frames.
Not this one. Try another answer.
Why C is wrong
Email spoofing is used to forge email headers and is not related to LAN frame manipulation.
Right, D is the answer.
Why D is right
ARP spoofing allows an attacker to intercept and modify traffic on a local area network by mapping their MAC address to another IP address, enabling man-in-the-middle attacks where frames can be sniffed and altered. MAC spoofing only changes the source MAC address but doesn't enable traffic modification. IP and email spoofing operate at different layers and don't facilitate frame-level sniffing on LANs.
Question 48 Play from 1:19:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Attack surface reduction helps prevent code execution but does not address password hash reuse.
Right, B is the answer.
Why B is right
LAPS (Local Administrator Password Solution) is a Microsoft tool designed specifically to mitigate the risk of compromised local administrator passwords. It automatically manages and rotates local administrator account passwords on domain-joined computers, storing them securely in Active Directory. This prevents attackers from reusing stolen password hashes across multiple systems.
Not this one. Try another answer.
Why C is wrong
ASLR (Address Space Layout Randomization) is a memory protection technique unrelated to password management.
Not this one. Try another answer.
Why D is wrong
Heap spray protection is a memory exploitation defense mechanism, not related to administrator credential protection.
Question 49 Play from 1:21:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Information Request is not a standard ICMP message type for hop limit expiration.
Not this one. Try another answer.
Why B is wrong
Redirect messages are sent when a router suggests a better route, not for hop limit issues.
Not this one. Try another answer.
Why C is wrong
Host Unreachable is sent when a specific destination host cannot be reached, not for hop limit expiration.
Right, D is the answer.
Why D is right
When a router receives an IPv6 packet with a Hop Limit of 1 and the packet is not destined for the router itself, the router must decrement the Hop Limit. Since it reaches 0, the router sends back an ICMPv6 Time Exceeded message to the originating host, informing it that the packet could not be forwarded due to the hop limit being exceeded.
Not this one. Try another answer.
Why E is wrong
Timestamp is used for time synchronization, not for hop limit expiration events.
Question 50 Play from 1:23:02
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A DNS zone transfer is the bulk transfer of all DNS records (the zone file) from a primary DNS server to a secondary or requesting host, typically using AXFR requests. This is a legitimate administrative function but can be a security risk if unrestricted, as it reveals the entire domain structure. Changing registered regions, switching zone preferences, and converting between internal/external servers are not standard DNS terminology or operations.
Not this one. Try another answer.
Why B is wrong
DNS servers don't have registered regions that change; this is not a valid DNS concept.
Not this one. Try another answer.
Why C is wrong
Zone preferences between DNS servers are not switched in standard DNS operations.
Not this one. Try another answer.
Why D is wrong
Converting servers between internal and external roles is not called a zone transfer.
Question 51 Play from 1:25:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Activity log records control plane operations on Azure resources, such as creating a virtual machine, not user sign-in attempts.
Right, B is the answer.
Why B is right
The Microsoft Entra sign-in logs record each authentication attempt, including failures, and describe who signed in (the user), how (the client application) and what was accessed (the target resource). Those fields let a handler spot one source trying a few passwords across many accounts, which is the signature of a spray. Entries in the sign-in logs are system generated and cannot be changed or deleted, which also makes them dependable evidence.
Not this one. Try another answer.
Why C is wrong
Storage logs record requests made to a storage account's data and do not record tenant sign-ins.
Not this one. Try another answer.
Why D is wrong
CloudTrail records API activity in AWS accounts and has no visibility into Microsoft Entra authentication.
Question 52 Play from 1:27:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IP addresses operate at Layer 3; switches do not examine Layer 3 headers for basic switching decisions.
Right, B is the answer.
Why B is right
Switches operate at Layer 2 (Data Link Layer) and make forwarding decisions based on the destination MAC address contained in the Ethernet frame header. This MAC address determines which physical port the frame is forwarded to within the switched network.
Not this one. Try another answer.
Why C is wrong
ARP responses are used for address resolution, not frame forwarding decisions by switches.
Not this one. Try another answer.
Why D is wrong
DHCP packets are not used for switch frame forwarding; they operate at a higher layer for IP address assignment.
Question 53 Play from 1:28:33
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
When conducting SQL injection attacks, attackers typically begin experimenting with quote characters (single quotes, double quotes, etc.) because these are the primary delimiters used in SQL syntax to define string boundaries. By inserting quotes, attackers can break out of the intended SQL query structure and inject their own commands. This is the most fundamental and obvious starting point for SQL injection testing.
Not this one. Try another answer.
Why B is wrong
Alphabetic characters alone do not have special meaning in SQL syntax and would not reveal SQL injection vulnerabilities.
Not this one. Try another answer.
Why C is wrong
Numeric characters alone cannot break SQL syntax or demonstrate injection capability.
Not this one. Try another answer.
Why D is wrong
Percent signs (%) are SQL wildcards used in LIKE clauses but are not the primary starting point for discovering SQL injection vulnerabilities.
Question 54 Play from 1:30:14
Each correct answer represents a complete solution. (Choose all that apply.)
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Netbus is a Windows remote access/backdoor tool, not a Linux network traffic monitoring tool.
Right, B is one of the answers.
Why B is right
IPTraf (B) is a real-time IP LAN traffic monitoring tool for Linux. MRTG (C) is a traffic monitoring tool that generates graphs of network traffic. Ntop (D) is a network traffic probe that shows network usage in a manner similar to top. All three are legitimate Linux network monitoring tools. Netbus is a Windows-based backdoor/remote access tool, not a network traffic monitoring tool for Linux.
Right, C is one of the answers.
Why C is right
IPTraf (B) is a real-time IP LAN traffic monitoring tool for Linux. MRTG (C) is a traffic monitoring tool that generates graphs of network traffic. Ntop (D) is a network traffic probe that shows network usage in a manner similar to top. All three are legitimate Linux network monitoring tools. Netbus is a Windows-based backdoor/remote access tool, not a network traffic monitoring tool for Linux.
Right, D is one of the answers.
Why D is right
IPTraf (B) is a real-time IP LAN traffic monitoring tool for Linux. MRTG (C) is a traffic monitoring tool that generates graphs of network traffic. Ntop (D) is a network traffic probe that shows network usage in a manner similar to top. All three are legitimate Linux network monitoring tools. Netbus is a Windows-based backdoor/remote access tool, not a network traffic monitoring tool for Linux.
Question 55 Play from 1:31:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Warchalking is the practice of marking locations of wireless networks with chalk, not for gathering firewall information.
Not this one. Try another answer.
Why B is wrong
Wardialing involves calling multiple phone numbers to find modems, not related to firewall information gathering.
Not this one. Try another answer.
Why C is wrong
Firechalking is not an established or recognized technique for firewall reconnaissance.
Right, D is the answer.
Why D is right
Firewalking is a technique used to determine which ports and protocols are allowed through a firewall by analyzing the responses to specially crafted packets. It allows attackers to map firewall rules and identify open or filtered ports on networks protected by firewalls.
Question 56 Play from 1:33:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While IP Options can technically carry data, they are more easily detected and monitored than the IP ID field.
Not this one. Try another answer.
Why B is wrong
The Urgent Pointer is a TCP field for priority indication, not a primary covert channel in this technique.
Right, C is the answer.
Why C is right
Covert TCP is a technique that uses the IP Identification field to transmit hidden data within legitimate-looking packets. By manipulating this field, data can be encoded and transmitted without appearing suspicious. IP Options can carry data but are more obviously suspicious; the Urgent Pointer is part of TCP headers for priority data; Code Bits (TCP flags) are structural elements not typically used for data encoding in this technique.
Not this one. Try another answer.
Why D is wrong
Code Bits (TCP flags like SYN, ACK, FIN) are structural control elements, not data carrier fields.
Question 57 Play from 1:34:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Both Netcat and Telnet can send and receive clear text data, so this is not a distinguishing feature.
Not this one. Try another answer.
Why B is wrong
Both Netcat and Telnet are capable of connecting to ports numbered above 1024.
Right, C is the answer.
Why C is right
Netcat can connect to both TCP and UDP ports, while Telnet is restricted to TCP only. This flexibility is a key distinguishing feature of Netcat. Both tools can send and receive clear text data (A), both can connect to ports above 1024 (B), and neither requires authentication by design (D).
Not this one. Try another answer.
Why D is wrong
Neither Netcat nor Telnet requires authentication as a built-in feature; this does not distinguish them.
Question 58 Play from 1:36:33
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
When a host receives a packet with an invalid TCP checksum, it drops the packet because the checksum validation fails. This is a fundamental network reliability mechanism, a bad checksum indicates the packet was corrupted in transit and cannot be trusted. The packet is silently discarded without acknowledgment or further action. Options B, C, and D describe active responses that are not triggered by checksum failures.
Not this one. Try another answer.
Why B is wrong
Hosts do not wait for rebroadcasts on invalid checksums; the packet is simply dropped.
Not this one. Try another answer.
Why C is wrong
An ICMP redirect is not sent in response to checksum validation failures.
Not this one. Try another answer.
Why D is wrong
A TCP reset is not automatically sent for packets with invalid checksums; they are simply discarded.
Question 59 Play from 1:38:13
Which tool could generate this report?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
DPAT (Dictionary Password Audit Tool) is specifically designed to audit passwords within an organization by analyzing password policies, identifying weak passwords, and generating reports on password metrics such as popularity, sharing patterns, and length distributions by department. The report described, containing users' most popular passwords, data on password sharing, and password length breakdown by department, is exactly the type of output DPAT produces for security auditing purposes.
Not this one. Try another answer.
Why B is wrong
Hashcat is a password cracking tool used to recover lost passwords through brute-force or dictionary attacks, not for generating organizational password audit reports.
Not this one. Try another answer.
Why C is wrong
Yescrypt is a key derivation function and password hashing algorithm used for secure password storage, not for auditing or analyzing existing organizational passwords.
Not this one. Try another answer.
Why D is wrong
LANMAN is a legacy password hashing method used in older Windows systems, not a tool for generating password audit reports.
Question 60 Play from 1:40:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
wordlist.txt is a common dictionary file used in cracking but is not as critical as the potfile containing actual cracked credentials.
Right, B is the answer.
Why B is right
john.pot is the potfile (password hash file) used by John the Ripper password cracker. After a password audit on a domain controller, this file should be removed as it contains all cracked passwords in plaintext or recoverable form, representing a significant security risk if left behind on the system.
Not this one. Try another answer.
Why C is wrong
The shadow file is a Linux/Unix file and not relevant to Windows domain controllers.
Not this one. Try another answer.
Why D is wrong
ntds.dit is the Active Directory database itself and should never be removed from a domain controller as it's essential for DC operation; it should be secured, not deleted.
Question 61 Play from 1:41:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A Trojan horse typically requires user interaction to execute or spread; it is not automatically triggered by events.
Right, B is the answer.
Why B is right
A logic bomb is a malicious code segment that executes automatically when a predetermined condition or event occurs. Unlike other malware types, logic bombs remain dormant until their trigger condition is met, such as a specific date, time, system event, or user action. Once the triggering event happens, the malicious payload activates and executes its payload.
Not this one. Try another answer.
Why C is wrong
MAC (Mandatory Access Control) is a security model for controlling access to resources, not executable malware.
Not this one. Try another answer.
Why D is wrong
Worms autonomously replicate and spread continuously, not based on predetermined events.
Question 62 Play from 1:43:21
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An alternate data stream is a feature of the NTFS file system that allows multiple data streams to be associated with a single file. While a file normally has one main data stream containing its content, NTFS permits additional named streams to be attached, which are not visible through standard file browsing tools.
Not this one. Try another answer.
Why B is wrong
Encoded text within an image file is steganography, not an alternate data stream.
Not this one. Try another answer.
Why C is wrong
Volume Shadow Copy creates versioned copies of files but is not itself an alternate data stream.
Not this one. Try another answer.
Why D is wrong
FAT partitions do not support alternate data streams; this feature is exclusive to NTFS.
Question 63 Play from 1:44:57
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The search term 'inurl:ViewerFrame?Mode=' is a Google dork query designed to locate web accessible devices like IP cameras, DVRs, and network appliances that expose their management interfaces through this specific URL parameter pattern. This search targets internet-exposed device control panels.
Not this one. Try another answer.
Why B is wrong
SMB shares are Windows network file shares; the URL pattern targets web interfaces, not SMB protocols.
Not this one. Try another answer.
Why C is wrong
While some results may be default HTTP servers, the specific URL pattern targets device control interfaces, not generic web servers.
Not this one. Try another answer.
Why D is wrong
SQL databases are typically not directly accessible through this web interface URL pattern; this targets device management interfaces.
Question 64 Play from 1:46:36
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In incident handling terminology, an event is broadly defined as any observable occurrence in a system and/or network. This encompasses all activities, both normal and suspicious, that can be detected or logged. Events become security incidents only when they are determined to have adverse impact or indicate a threat.
Not this one. Try another answer.
Why B is wrong
While malicious code introduction is a type of incident, this definition is too narrow for the general definition of an event.
Not this one. Try another answer.
Why C is wrong
An IDS alert is a triggered event, but not all events trigger alerts; this is too restrictive.
Not this one. Try another answer.
Why D is wrong
This definition describes an incident or security incident specifically, not an event in general.
Question 65 Play from 1:48:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Metamorphic worms change their code structure and appearance with each infection to avoid detection, not based on exploiting multiple vulnerabilities.
Not this one. Try another answer.
Why B is wrong
Zero-Day worms exploit previously unknown vulnerabilities, not multiple known or unknown vulnerabilities across different applications.
Right, C is the answer.
Why C is right
A Multi-Exploit Worm is the correct term for a worm that can infect hosts by exploiting many different application or operating system vulnerabilities. This classification specifically describes the capability to leverage multiple different exploits rather than just one vulnerability or class of vulnerabilities.
Not this one. Try another answer.
Why D is wrong
Polymorphic worms use encryption and vary their code to evade detection, not to exploit multiple different vulnerabilities.
Question 66 Play from 1:50:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Windows 8 was the first consumer version of Windows to natively support SMB 3.0 encryption. SMB 3.0 introduced transparent encryption for SMB protocol traffic. While Server 2012 also added this support, Windows 8 is the earliest native support among the options given. Windows 7 and Server 2003 required third-party solutions for SMB encryption.
Not this one. Try another answer.
Why B is wrong
Windows Server 2008 predates SMB 3.0 and lacked native SMB encryption support.
Not this one. Try another answer.
Why C is wrong
Windows 7 did not support SMB 3.0 encryption natively; it required third-party tools.
Not this one. Try another answer.
Why D is wrong
Windows Server 2003 significantly predates SMB 3.0 and has no native encryption support.
Question 67 Play from 1:51:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Back Orifice is a RAT but does not typically use port 5900.
Right, B is the answer.
Why B is right
VNC (Virtual Network Computing) is a legitimate remote control application that can be exploited as an application-level backdoor and typically listens on port 5900. It provides remote desktop access, making it useful for attackers who can compromise credentials or leave it installed. While Back Orifice, Sub7, and Netbus are also RATs, VNC is the specific tool known for port 5900 operations.
Not this one. Try another answer.
Why C is wrong
Sub7 is a RAT but does not typically use port 5900.
Not this one. Try another answer.
Why D is wrong
Netbus is a RAT but does not typically use port 5900.
Not this one. Try another answer.
Why E is wrong
Hack-a-tack is not a recognized remote control tool.
Question 68 Play from 1:53:20
Which of the following steps is NOT a part of manual network mapping?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Gathering private and public IP addresses is a core part of manual network mapping.
Not this one. Try another answer.
Why B is wrong
Collecting information about employees is part of the manual mapping of an organization.
Not this one. Try another answer.
Why C is wrong
Banner grabbing identifies running services and their versions and is a manual mapping step.
Right, D is the answer.
Why D is right
Manual network mapping is done by hand: gathering the organization's private and public IP addresses, collecting information about employees, and banner grabbing to identify services and versions. Tracing routes with a tool such as NeoTrace is automated mapping, so it is the step that does not belong to the manual process.
Question 69 Play from 1:54:54
Each correct answer represents a complete solution. (Choose all that apply.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
escapeshellarg() (A) and escapeshellcmd() (D) are both PHP functions specifically designed to prevent shell injection attacks. escapeshellarg() escapes arguments to shell commands, and escapeshellcmd() escapes shell metacharacters in command strings. Both functions neutralize attacker-supplied input by treating it as literal data rather than executable code. mysql_real_escape_string() is designed for SQL injection prevention, not shell injection, making it inappropriate for this threat. regenerateid() is a session management function unrelated to shell injection prevention.
Not this one. Try another answer.
Why B is wrong
mysql_real_escape_string() prevents SQL injection attacks, not shell injection attacks.
Not this one. Try another answer.
Why C is wrong
regenerateid() is used for session management and session fixation prevention, not shell injection defense.
Right, D is one of the answers.
Why D is right
escapeshellarg() (A) and escapeshellcmd() (D) are both PHP functions specifically designed to prevent shell injection attacks. escapeshellarg() escapes arguments to shell commands, and escapeshellcmd() escapes shell metacharacters in command strings. Both functions neutralize attacker-supplied input by treating it as literal data rather than executable code. mysql_real_escape_string() is designed for SQL injection prevention, not shell injection, making it inappropriate for this threat. regenerateid() is a session management function unrelated to shell injection prevention.
Question 70 Play from 1:56:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
DoS attacks flood a target with traffic but are not specifically characterized by source address spoofing and the resulting backscatter response.
Not this one. Try another answer.
Why B is wrong
DDoS involves multiple sources attacking simultaneously and, while may use spoofing, is not defined by backscatter specifically.
Right, C is the answer.
Why C is right
Backscatter refers to the unwanted replies sent back to the spoofed source IP address when an attacker sends packets with forged source addresses. The victim's systems respond to the false source address, creating a backscatter effect that reveals the attack pattern and can be used for detection and analysis.
Not this one. Try another answer.
Why D is wrong
SQL injection is a web application attack that injects malicious SQL code, unrelated to IP spoofing or backscatter.
Question 71 Play from 1:58:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port scanning discovers open ports directly, but firewalking specifically uses TTL values to map firewall rules.
Not this one. Try another answer.
Why B is wrong
Cloaking refers to hiding malicious content or activity, not using TTL values to probe firewalls.
Right, C is the answer.
Why C is right
Firewalking is a technique that uses TTL (Time To Live) values in packets to map out firewall rules and identify open ports. By sending SYN packets with the target system's TTL starting at port 1 and incrementing to port 1024, an attacker can determine which ports are allowed through the firewall based on which packets reach the destination. Port scanning discovers open ports, cloaking hides malicious activity, and spoofing falsifies source addresses.
Not this one. Try another answer.
Why D is wrong
Spoofing involves falsifying source addresses, not using TTL values for firewall reconnaissance.
Question 72 Play from 2:00:08
Which type of attack is this?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Vulnerability attacks exploit specific security weaknesses in software or systems, not resource saturation.
Not this one. Try another answer.
Why B is wrong
Impersonation attacks involve forging identity or credentials, not flooding networks with packets.
Not this one. Try another answer.
Why C is wrong
Social Engineering attacks manipulate people through deception, not network packet flooding.
Right, D is the answer.
Why D is right
This describes a Denial-of-Service (DoS) attack where an attacker sends large volumes of protocol packets to saturate network resources and disrupt communications. The goal is to deny legitimate users access to services by overwhelming the target with traffic. Vulnerability attacks exploit specific weaknesses, impersonation attacks forge identity, and social engineering manipulates people, none of which fit this network saturation scenario.
Question 73 Play from 2:01:58
Which attack will have a 100% success rate at recovering the original password, given enough time and computing power?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A brute force attack will have a 100% success rate given enough time and computing power because it systematically tries every possible password combination until the correct one is found. Even with salt added to the MD5 hash, brute force will eventually find the original password by hashing every possibility and comparing it to the target hash. Rainbow tables are ineffective against salted hashes, and dictionary/hybrid attacks depend on password patterns and may miss complex passwords.
Not this one. Try another answer.
Why B is wrong
Hybrid attacks combine dictionary words with patterns but will not guarantee success if the password doesn't follow common patterns.
Not this one. Try another answer.
Why C is wrong
MD5 rainbow tables are ineffective against salted hashes because the salt changes the hash value for each password, making precomputed tables useless.
Not this one. Try another answer.
Why D is wrong
Dictionary attacks only try common words and variations, which will not guarantee success against arbitrary passwords with sufficient complexity.
Question 74 Play from 2:03:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Supply chain risk concerns third-party models, packages and data, and nothing here involves a compromised component.
Not this one. Try another answer.
Why B is wrong
Excessive agency involves an LLM taking damaging actions through tools, not a caller flooding the API.
Right, C is the answer.
Why C is right
Unbounded Consumption occurs when an LLM application allows excessive and uncontrolled inferences, leading to denial of service, economic losses, model theft or service degradation. Denial of Wallet is one of its listed examples: a high volume of operations exploits the cost-per-use model of cloud AI services. Mitigations include input size limits, rate limiting and per-user quotas, timeouts and throttling, and monitoring resource use for unusual patterns. MITRE ATLAS tracks the adversary's aim of driving up costs as Cost Harvesting.
Not this one. Try another answer.
Why D is wrong
No sensitive data was exposed; the harm is the financial cost of uncontrolled usage.
Question 75 Play from 2:06:04
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Credential stuffing is an attack that uses lists of stolen username-password pairs from previous breaches to attempt unauthorized access to accounts. The attacker leverages the fact that users often reuse credentials across multiple services.
Not this one. Try another answer.
Why B is wrong
Pass-the-Hash uses captured password hashes to authenticate without knowing the plaintext password.
Not this one. Try another answer.
Why C is wrong
Dictionary attacks use a predefined list of common words, not stolen breach lists.
Not this one. Try another answer.
Why D is wrong
Man-in-the-Middle attacks intercept communications, not using password breach lists.
Question 76 Play from 2:07:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Vulnerability attacks aim to exploit weaknesses for unauthorized access, not to degrade performance.
Not this one. Try another answer.
Why B is wrong
Man-in-the-middle attacks focus on intercepting and eavesdropping on communications, not degrading performance.
Right, C is the answer.
Why C is right
A Denial-of-Service (DoS) attack is specifically designed to degrade or eliminate the performance and availability of a computer or network by overwhelming it with requests or traffic. Vulnerability attacks target weaknesses to gain access, man-in-the-middle attacks intercept communications, and impersonation attacks involve pretending to be someone else, none of these have the primary objective of degrading performance.
Not this one. Try another answer.
Why D is wrong
Impersonation attacks involve assuming a false identity to gain access, not attacking performance.
Question 77 Play from 2:09:11
Which attack can an adversary use to leverage this situation to attack this particular industry?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Password-salting is a cryptographic technique for securing stored passwords, not a web-based attack method.
Not this one. Try another answer.
Why B is wrong
Defacing changes website appearance but doesn't leverage the external script/ad loading mechanism to target a specific industry.
Right, C is the answer.
Why C is right
A watering hole attack involves compromising legitimate websites frequented by a target industry to distribute malware or conduct attacks. Since this popular ICS forum loads external scripts and ads, an attacker could compromise one of those external sources to inject malicious content that targets forum visitors from the industrial control systems sector.
Not this one. Try another answer.
Why D is wrong
DDoS attacks flood targets with traffic but don't specifically leverage the forum's external resource loading or target the ICS industry through this vector.
Question 78 Play from 2:10:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Mutt is an email client for Linux, not a tool for accessing Windows network resources.
Not this one. Try another answer.
Why B is wrong
Scp is a secure copy utility for transferring files between systems over SSH, not specifically for accessing Windows network shares.
Not this one. Try another answer.
Why C is wrong
Rsync is a file synchronization utility that can work across platforms but is not the standard tool for accessing Windows shares.
Right, D is the answer.
Why D is right
Smbclient is the command-line tool used to access Windows resources (shares, printers, files) from a Linux workstation. It implements the SMB/CIFS protocol, which is the native file sharing protocol used by Windows systems. This tool allows Linux users to browse and interact with Windows network resources directly from the command line.
Question 79 Play from 2:12:35
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
RITA (Rapid Threat Intelligence Analysis) identifies command and control (C2) activity by detecting long-lived TCP connections, which is a characteristic behavior of Meterpreter and other C2 frameworks. Meterpreter maintains persistent TCP connections to its command server, making connection duration analysis an effective detection method.
Not this one. Try another answer.
Why B is wrong
Reviewing visited DNS subdomains helps identify domains contacted but is not specific to Meterpreter C2 activity.
Not this one. Try another answer.
Why C is wrong
Gratuitous ARP packet analysis is used for local network reconnaissance and ARP spoofing detection, not C2 identification.
Not this one. Try another answer.
Why D is wrong
IOC matching is a general detection method that requires known indicators, whereas long-lived connections provide behavioral detection specific to Meterpreter's connection patterns.
Question 80 Play from 2:14:30
Adam always makes use of a basic Web Browser to perform such testing.
Which of the following web browsers can adequately fill this purpose?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Mozilla Firefox supports JavaScript and applets, which would execute malicious code on the website.
Not this one. Try another answer.
Why B is wrong
Internet Explorer supports JavaScript and applets, creating risk when visiting malicious websites.
Right, C is the answer.
Why C is right
Lynx is a text-based web browser that does not execute JavaScript, Java applets, or other executable code. This makes it ideal for safely testing websites known to contain malicious applets and code, as the malicious content cannot execute. Mozilla Firefox, Internet Explorer, and Safari are graphical browsers that support JavaScript and applets, making them vulnerable to the malicious content Adam wishes to test safely.
Not this one. Try another answer.
Why D is wrong
Safari supports JavaScript and applets, exposing the user to execution of malicious content.
Question 81 Play from 2:16:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Macro viruses are limited to spreading through macro-enabled documents with a single replication method.
Right, B is the answer.
Why B is right
A blended threat is defined as malware that combines multiple attack vectors and capabilities, including multiple trigger mechanisms and replication methods. It typically combines characteristics of viruses, worms, and trojans. Macro viruses, boot sector viruses, and trojans are individual malware types with specific characteristics, not the comprehensive multi-vector threat that blended threats represent.
Not this one. Try another answer.
Why C is wrong
Trojans do not typically replicate themselves; they rely on user action or other means for distribution.
Not this one. Try another answer.
Why D is wrong
Boot sector viruses infect the boot sector specifically and have limited trigger and task capabilities compared to blended threats.
Question 82 Play from 2:17:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
rkhunter is a separate rootkit scanner that mainly compares file hashes and checks for known rootkit files, settings and backdoors.
Not this one. Try another answer.
Why B is wrong
OSSEC is a host-based intrusion detection system built around log analysis and file integrity monitoring, not a signature search with strings and grep.
Right, C is the answer.
Why C is right
Chkrootkit is specifically designed to search for rootkit signatures by leveraging common UNIX/Linux tools like strings and grep to scan system binaries for rootkit modification, and its helper programs such as chkproc and chkdirs check for signs of LKM trojans that hide processes and directories. rkhunter is a rootkit detection tool but uses a different approach based on hash comparisons and vulnerability scanning; OSSEC is a host-based intrusion detection system focused on log analysis; Blue Pill is a hypervisor rootkit, not a detection tool.
Not this one. Try another answer.
Why D is wrong
Blue Pill is a proof-of-concept hypervisor rootkit, not a tool for detecting rootkits.
Question 83 Play from 2:19:56
Each correct answer represents a complete solution. (Choose all that apply.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Cross-site scripting (XSS) can steal session cookies, session fixation forces a user into a known session ID controlled by the attacker, and session sidejacking captures unencrypted session tokens in transit. All three are valid methods for performing session hijacking attacks.
Right, B is one of the answers.
Why B is right
Cross-site scripting (XSS) can steal session cookies, session fixation forces a user into a known session ID controlled by the attacker, and session sidejacking captures unencrypted session tokens in transit. All three are valid methods for performing session hijacking attacks.
Not this one. Try another answer.
Why C is wrong
ARP spoofing is used for man-in-the-middle attacks and network-level poisoning, not specifically for session hijacking operations.
Right, D is one of the answers.
Why D is right
Cross-site scripting (XSS) can steal session cookies, session fixation forces a user into a known session ID controlled by the attacker, and session sidejacking captures unencrypted session tokens in transit. All three are valid methods for performing session hijacking attacks.
Question 84 Play from 2:21:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Evasion attacks are techniques used to circumvent security mechanisms, not inherently rooted in programming vulnerabilities.
Not this one. Try another answer.
Why B is wrong
Denial-of-Service attacks flood resources but are not specifically a result of poor programming techniques.
Not this one. Try another answer.
Why C is wrong
Ping of Death exploits a specific network layer limitation rather than being caused by poor programming practices.
Right, D is the answer.
Why D is right
Buffer overflow attacks result directly from poor programming techniques where developers fail to implement proper bounds checking on input data. This allows attackers to write beyond allocated memory boundaries, corrupting the stack and potentially executing arbitrary code. Evasion attacks are techniques to bypass security controls, DoS attacks aim to make services unavailable through resource exhaustion, and Ping of Death is a specific attack using malformed ICMP packets, none of these are inherently caused by poor programming practices in the fundamental sense that buffer overflows are.
Question 85 Play from 2:23:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
John the Ripper is a password cracking and hash analysis tool, not a shell access mechanism.
Not this one. Try another answer.
Why B is wrong
Nmap is a network discovery and port scanning tool, not designed for shell access.
Not this one. Try another answer.
Why C is wrong
Nessus is a vulnerability assessment scanner, not a tool for establishing shell connections.
Right, D is the answer.
Why D is right
Loki is a specific hacking tool designed to provide shell access and covert communication over ICMP (Internet Control Message Protocol) packets, which are typically used for ping and network diagnostics. By tunneling shell commands through ICMP, Loki can bypass standard firewall rules that may block TCP/UDP traffic. John the Ripper is a password cracking tool, Nmap is a port scanner, and Nessus is a vulnerability scanner, none of which provide shell access over ICMP.
Question 86 Play from 2:24:46
Which investigative technique does this describe?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Pivoting involves moving laterally through a network after compromising one system.
Not this one. Try another answer.
Why B is wrong
Enumeration involves discovering and cataloging systems and services, not prioritizing them.
Not this one. Try another answer.
Why C is wrong
Attribution involves determining who conducted the attack, not prioritizing systems for investigation.
Right, D is the answer.
Why D is right
Triaging is the process of prioritizing compromised systems based on factors such as criticality, service type, data sensitivity, and organizational impact. By listing priorities for each machine based on executive input and the services/data each provides, the investigator is performing triaging to determine which systems require immediate attention.
Question 87 Play from 2:26:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ethercap is primarily a network sniffer and man-in-the-middle tool, but Hunt is more specifically associated with session hijacking capabilities.
Not this one. Try another answer.
Why B is wrong
Tripwire is a file integrity monitoring and intrusion detection tool, not a network sniffing or session hijacking tool.
Not this one. Try another answer.
Why C is wrong
IPChains is a Linux firewall tool used for packet filtering and network access control, not for sniffing or session hijacking.
Right, D is the answer.
Why D is right
Hunt is a network tool specifically designed for network sniffing and session hijacking, allowing attackers to intercept and take over active network conversations and sessions on a LAN.
Question 88 Play from 2:27:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Union, column, and value are not the required components; UNION is a SELECT operation, not part of UPDATE syntax.
Not this one. Try another answer.
Why B is wrong
Database, row, and table are not the correct components; you specify columns and values, not rows directly.
Right, C is the answer.
Why C is right
A SQL UPDATE statement requires three essential components: the TABLE (which table to update), the COLUMN (which field to modify), and the VALUE (what to set the field to). The basic syntax is UPDATE table SET column = value WHERE conditions. These three elements are the minimum required to specify what data to change and how to change it.
Not this one. Try another answer.
Why D is wrong
Select, row, and table are incorrect; SELECT is separate from UPDATE, and UPDATE operates on columns, not rows.
Question 89 Play from 2:29:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encryption protects data confidentiality but does not prevent worm installation or execution.
Not this one. Try another answer.
Why B is wrong
Awareness training reduces user-initiated attacks like phishing but does not prevent self-propagating worms from exploiting software vulnerabilities.
Not this one. Try another answer.
Why C is wrong
Administrative privilege controls limit damage but do not prevent worms from exploiting unpatched vulnerabilities.
Not this one. Try another answer.
Why D is wrong
Device inventory is useful for management but does not prevent worm infections directly.
Right, E is the answer.
Why E is right
Patching is the most direct and effective defense against worm infections. Worms exploit known vulnerabilities in operating systems and applications, and security patches close these vulnerabilities before worms can spread through them. While awareness training and privilege controls help, they don't address the root cause of worm propagation, which is unpatched software flaws.
Question 90 Play from 2:31:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
HTTP Proxies are network infrastructure used for legitimate purposes, not a primary infection vector for bot software.
Not this one. Try another answer.
Why B is wrong
Open Relays are SMTP servers that can be abused for spam but are not a common method for bot infection.
Not this one. Try another answer.
Why C is wrong
Rootkits are post-compromise persistence tools, not an initial infection vector for delivering bots.
Right, D is the answer.
Why D is right
Worms are self-replicating malware that spread across networks by exploiting vulnerabilities and creating copies of themselves on other hosts. They are a common delivery mechanism for bot software, as they can automatically propagate and install botnet clients on compromised machines without requiring user interaction.
Question 91 Play from 2:32:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Rainbow attack refers to precomputed hash table attacks used for password cracking, not IP packet forgery.
Right, B is the answer.
Why B is right
IP address spoofing is the technique where an attacker creates IP packets with a forged source IP address to conceal identity or impersonate another system. This is the textbook definition that matches the question's description perfectly.
Not this one. Try another answer.
Why C is wrong
Cross-site request forgery is a web-based attack where unauthorized commands are transmitted through a trusted user's browser, not an IP-level attack.
Not this one. Try another answer.
Why D is wrong
Polymorphic shell code attack uses code that mutates to evade detection, not IP address forgery.
Question 92 Play from 2:34:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Server upload policies are not typical vectors for drive-by attacks.
Right, B is the answer.
Why B is right
Drive-by attacks typically exploit vulnerabilities in a user's browser or browser plugins (such as outdated Flash, Java, or other add-ons) to deliver malware. When a user visits a compromised or malicious website, the exploit code is executed in the browser context without additional user interaction beyond visiting the page. The vulnerability is in the browser software itself, making it an ideal delivery mechanism.
Not this one. Try another answer.
Why C is wrong
While SSL version vulnerabilities exist, drive-by attacks primarily target browser vulnerabilities, not SSL.
Not this one. Try another answer.
Why D is wrong
Weak passwords are not leveraged in drive-by attacks; these attacks do not require authentication.
Question 93 Play from 2:35:57
Which of the following control bits initiates a graceful end to a connection?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The FIN (Finish) control bit is used to initiate a graceful termination of a TCP connection, signaling that the sender has finished sending data. This allows for an orderly shutdown where both sides acknowledge the connection closure. PSH pushes data immediately, SYN initiates connections, RST forcefully resets connections, and URG indicates urgent data, none of these initiate graceful termination.
Not this one. Try another answer.
Why B is wrong
PSH (Push) forces immediate transmission of buffered data, not connection termination.
Not this one. Try another answer.
Why C is wrong
SYN (Synchronize) initiates new TCP connections, not termination.
Not this one. Try another answer.
Why D is wrong
RST (Reset) forcefully aborts a connection abnormally, not gracefully.
Not this one. Try another answer.
Why E is wrong
URG (Urgent) indicates that urgent data follows, not connection termination.
Question 94 Play from 2:37:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Winmap is not a recognized Nmap GUI tool.
Right, B is the answer.
Why B is right
Zenmap is the official GUI-based graphical front end for Nmap, providing a user-friendly interface to the powerful Nmap command-line port scanner. It allows users to run scans, save results, and compare scans through a visual interface rather than using the command line.
Not this one. Try another answer.
Why C is wrong
Nmap-GUI is not the official name of Nmap's graphical interface.
Not this one. Try another answer.
Why D is wrong
Windump is a Windows version of tcpdump for packet capturing, not related to Nmap.
Question 95 Play from 2:39:11
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Ping of Death is a classic DoS attack in which an attacker sends an ICMP echo request (ping) packet larger than the maximum allowed size of 65,536 bytes. When the target system attempts to process this oversized packet, it can cause a buffer overflow, crash, or system hang. This attack exploits a limitation in older TCP/IP implementations.
Not this one. Try another answer.
Why B is wrong
Jolt is a DoS attack that sends fragmented ICMP echo requests, not oversized single packets.
Not this one. Try another answer.
Why C is wrong
Fraggle is a DoS attack that exploits the UDP echo and chargen services by sending spoofed broadcast traffic, not ICMP oversized packets.
Not this one. Try another answer.
Why D is wrong
Teardrop sends overlapping IP fragments that cause processing errors, but is not specifically characterized by a single packet larger than 65,536 bytes.
Question 96 Play from 2:40:57
Each correct answer represents a complete solution. (Choose two.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Internet bots and scripts are both legitimate tools used for stress testing web servers. Bots can generate automated traffic loads, while custom scripts can simulate various request patterns and user behaviors to test server capacity and performance under load. Anti-virus software and spyware are security tools unrelated to stress testing.
Right, B is one of the answers.
Why B is right
Internet bots and scripts are both legitimate tools used for stress testing web servers. Bots can generate automated traffic loads, while custom scripts can simulate various request patterns and user behaviors to test server capacity and performance under load. Anti-virus software and spyware are security tools unrelated to stress testing.
Not this one. Try another answer.
Why C is wrong
Anti-virus software is designed for malware detection and removal, not performance or stress testing.
Not this one. Try another answer.
Why D is wrong
Spyware is malicious software used for unauthorized surveillance, not legitimate stress testing.
Question 97 Play from 2:42:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Eradication removes the threat but does not focus on restoring normal operations and ongoing monitoring.
Not this one. Try another answer.
Why B is wrong
Lessons Learned occurs after recovery to analyze what happened and improve future response procedures.
Right, C is the answer.
Why C is right
Recovery is the phase where systems and business processes are restored to normal operations after an incident. During recovery, the incident handler verifies that all affected systems are functioning properly and implements monitoring to detect any signs of compromise or re-infection. This occurs after eradication (removing the threat) and before lessons learned.
Not this one. Try another answer.
Why D is wrong
Containment stops the spread of an incident but does not restore systems to normal operation.
Question 98 Play from 2:44:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SSH uses different authentication mechanisms (keys or passwords) and does not accept Windows NTLM hashes.
Not this one. Try another answer.
Why B is wrong
Direct login to a Linux server requires credentials compatible with Linux authentication, not Windows hashes.
Not this one. Try another answer.
Why C is wrong
Being a man-in-the-middle requires network positioning and does not directly use stolen hashes for authentication.
Right, D is the answer.
Why D is right
An adversary with a stolen Windows NTLM hash can use pass-the-hash techniques against SAMBA shares on a Linux server. SAMBA implements the SMB protocol and can be configured to authenticate using NTLM hashes, allowing an attacker to authenticate without knowing the plaintext password. This leverages the fact that SAMBA shares use the same hash-based authentication that Windows does.
Question 99 Play from 2:46:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encat is not a recognized standard netcat variant with encryption capabilities.
Not this one. Try another answer.
Why B is wrong
Nikto is a web server vulnerability scanner, not an encryption-enhanced version of netcat.
Not this one. Try another answer.
Why C is wrong
Socat is a utility for relaying connections but is not specifically netcat with integrated encryption.
Right, D is the answer.
Why D is right
Cryptcat is a variant of netcat that adds transport layer encryption capabilities to netcat's functionality, allowing encrypted communication over network connections while maintaining netcat's core features.
Question 100 Play from 2:47:19
Each correct answer represents a part of the solution. (Choose all that apply.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
escapeshellarg() (A) escapes shell argument strings to prevent injection by adding quotes and escaping special characters. escapeshellcmd() (B) escapes shell metacharacters to prevent command injection by neutralizing dangerous characters. Both functions are specifically designed to sanitize user input for shell command contexts. htmlentities() encodes HTML entities for display context, not shell safety. strip_tags() removes HTML tags but does not prevent shell command injection.
Right, B is one of the answers.
Why B is right
escapeshellarg() (A) escapes shell argument strings to prevent injection by adding quotes and escaping special characters. escapeshellcmd() (B) escapes shell metacharacters to prevent command injection by neutralizing dangerous characters. Both functions are specifically designed to sanitize user input for shell command contexts. htmlentities() encodes HTML entities for display context, not shell safety. strip_tags() removes HTML tags but does not prevent shell command injection.
Not this one. Try another answer.
Why C is wrong
htmlentities() is used to prevent cross-site scripting in HTML output, not command injection attacks.
Not this one. Try another answer.
Why D is wrong
strip_tags() removes HTML and PHP tags but does not prevent shell metacharacters from being executed in command contexts.
Transcript
Play from 00:00 Question 1. Which of the following attacking methods allows the bypassing of access control lists on servers or routers, either hiding a computer on a network or allowing it to impersonate another computer by changing the Media Access Control address? Here are the options. Option A. IP address spoofing. Option B. VLAN hoping. Option C. ARP spoofing. Option D. MAC spoofing. Pause the video now if you want time to think about the answer.
The correct answer is D. MAC spoofing. MAC spoofing allows attackers to change their Media Access Control address to impersonate another computer on the network, thereby bypassing MAC-based access control lists and network restrictions. This attack operates at Layer 2 (data link layer) and is particularly effective against networks relying on MAC filtering for access control, allowing attackers to either hide their identity or assume another computer's identity. Now, why are the other options incorrect? Option A is incorrect. IP address spoofing operates at Layer 3 and forges source IP addresses but does not directly bypass MAC-based access control lists. Option B is incorrect. VLAN hopping exploits VLAN configuration weaknesses but is a different attack vector than MAC address manipulation. Option C is incorrect. ARP spoofing manipulates ARP tables for man-in-the-middle attacks but does not directly bypass access control lists through address masquerading. Therefore, D, MAC spoofing, is the correct answer.
Play from 01:57 Question 2. What does the following command do? nc -v -z 192.168.40.90 1-1024 Here are the options. Option A. Creates a listener on all well-known ports on 192.168.40.90. Option B. Port scan on all well-known ports for host 192.168.40.90. Option C. Sends files from to the host 192.168.40.90. Option D. Conduct a vulnerability scan on all well-known ports. Pause the video now if you want time to think about the answer.
The correct answer is B. Port scan on all well-known ports for host 192.168.40.90. The netcat command 'nc -v -z 192.168.40.90 1-1024' performs a port scan on the target host 192.168.40.90 for ports 1 through 1024. The -z flag enables zero I/O mode (scan without sending data), and -v enables verbose output to show which ports are open. Now, why are the other options incorrect? Option A is incorrect. This command scans the target host; it does not create a listener on the target. Option C is incorrect. The -z flag prevents data transmission, so this cannot send files. Option D is incorrect. Netcat performs port scanning, not vulnerability assessment scanning. Therefore, B, Port scan on all well-known ports for host 192.168.40.90, is the correct answer.
Play from 03:50 Question 3. Your network is being flooded by ICMP packets. When you trace them down they come from multiple different IP addresses. What kind of attack is this? Here are the options. Option A. Syn flood. Option B. Ping storm. Option C. Smurf attack. Option D. DDOS. Pause the video now if you want time to think about the answer.
The correct answer is D. DDOS. When ICMP packets flood a network from multiple different IP addresses, this is a Distributed Denial of Service (DDoS) attack, where numerous sources collectively overwhelm the target. A Smurf attack uses ICMP echo requests to intermediate networks, but the question specifies packets from multiple sources. A SYN flood uses TCP SYN packets, not ICMP. A ping storm typically comes from a single source using ICMP. The defining characteristic of DDoS is the involvement of multiple source addresses. Now, why are the other options incorrect? Option A is incorrect. SYN flood attacks use TCP SYN packets, not ICMP packets. Option B is incorrect. Ping storm typically originates from a single source, not multiple different IP addresses. Option C is incorrect. While Smurf attacks do use ICMP, they typically amplify from a broadcast address rather than appearing as truly independent sources like a DDoS. Therefore, D, DDOS, is the correct answer.
Show full transcriptShow less
Play from 05:38 Question 4. A victim browses to a news aggregator website through a link sent to them by an attacker. The attacker then alters the page delivered to the victim's browser and includes malicious links. What flaw on the news aggregator website allowed this attack to happen? Here are the options. Option A. SQL Injection. Option B. Reflected XSS. Option C. Cross-Site Request Forgery. Option D. Buffer Overflow. Pause the video now if you want time to think about the answer.
The correct answer is B. Reflected XSS. This describes a Reflected XSS attack where the attacker crafts a malicious link that causes the news aggregator to reflect attacker-controlled content (malicious links) back to the victim's browser. The browser trusts the content because it came from the legitimate domain, allowing the injected malicious content to execute. Now, why are the other options incorrect? Option A is incorrect. SQL Injection targets databases, not web page content rendered in browsers. Option C is incorrect. CSRF tricks a user into making unwanted requests; this attack directly injects malicious content into the page. Option D is incorrect. Buffer Overflow attacks target memory vulnerabilities in applications, not web page rendering. Therefore, B, Reflected XSS, is the correct answer.
Play from 07:18 Question 5. Which of the following wireless network security solutions refers to an authentication process in which a user can connect wireless access points to a centralized server to ensure that all hosts are properly authenticated? Here are the options. Option A. Remote Authentication Dial-In User Service (RADIUS). Option B. IEEE 802.1x. Option C. Wired Equivalent Privacy (WEP). Option D. Wi-Fi Protected Access 2 (WPA2). Pause the video now if you want time to think about the answer.
The correct answer is B. IEEE 802.1x. IEEE 802.1x is the port-based network access control protocol that enables authentication when wireless devices connect to access points through a centralized authentication server (typically using RADIUS). It ensures all hosts are properly authenticated before network access is granted. RADIUS is the authentication protocol often used with 802.1x, WEP is an older encryption standard, and WPA2 is an encryption protocol without centralized server authentication requirement. Now, why are the other options incorrect? Option A is incorrect. RADIUS is the authentication protocol/service, not the wireless network security framework; it typically works with 802.1x. Option C is incorrect. WEP is an outdated encryption standard that does not involve centralized server authentication. Option D is incorrect. WPA2 is an encryption protocol; while secure, it does not specifically define centralized authentication infrastructure. Therefore, B, IEEE 802.1x, is the correct answer.
Play from 09:22 Question 6. An analyst notices a large amount of ICMP Time Exceeded packets logged on an outbound firewall interface. What is most likely occurring? Here are the options. Option A. A ping sweep is being run. Option B. Traceroute is being run. Option C. DHCP addresses are expiring. Option D. ICMP is blocked by the firewall. Pause the video now if you want time to think about the answer.
The correct answer is B. Traceroute is being run. ICMP Time Exceeded packets are generated when traceroute tools probe the network path to a destination. Each hop in a traceroute sends back a Time Exceeded message when the TTL reaches zero, allowing the mapping of the network path. This is the characteristic traffic pattern of a traceroute scan. Now, why are the other options incorrect? Option A is incorrect. A ping sweep generates ICMP Echo Requests and Echo Replies, not Time Exceeded messages. Option C is incorrect. DHCP address expiration is unrelated to ICMP Time Exceeded packets. Option D is incorrect. If ICMP were blocked by the firewall, these packets would not appear in outbound logs. Therefore, B, Traceroute is being run, is the correct answer.
Play from 10:54 Question 7. A web application stores password hashes in the form $2b$12$ followed by 53 characters. What does the value 12 represent? Here are the options. Option A. The logarithmic CPU time cost parameter. Option B. The salt length in bytes. Option C. The maximum accepted password length. Option D. The bcrypt revision in use. Pause the video now if you want time to think about the answer.
The correct answer is A. The logarithmic CPU time cost parameter. In a bcrypt string, $2b$ is the prefix that identifies the method and its revision, and the two-digit field that follows is the CPU time cost parameter. That scale is logarithmic and runs from 4 to 31, so each step up makes every hash computation, and therefore every guess, much slower. Because the cost is tunable, administrators can raise it to keep the hash slow as hardware improves, which keeps offline guessing expensive. Now, why are the other options incorrect? Option B is incorrect. bcrypt uses a fixed 128-bit salt, which this field does not set. Option C is incorrect. bcrypt's maximum passphrase length is fixed at 72 characters and is not encoded in the hash. Option D is incorrect. The revision is carried by the 2b in the prefix, not by the field after it. Therefore, A, The logarithmic CPU time cost parameter, is the correct answer.
Play from 12:44 Question 8. What is the first type of packet sent when the ping command is executed on a Windows system? Here are the options. Option A. ICMP echo request. Option B. ICMP echo. Option C. ICMP echo reply. Option D. UDP packet. Pause the video now if you want time to think about the answer.
The correct answer is A. ICMP echo request. When the ping command is executed on a Windows system, the first packet sent is an ICMP echo request. This request is sent to the target host, which then responds with an ICMP echo reply. The echo request initiates the ping process by asking the remote host to respond, making it the first packet type transmitted during a ping operation. Now, why are the other options incorrect? Option B is incorrect. ICMP echo is not a standard packet type designation in this context; the correct term is echo request. Option C is incorrect. ICMP echo reply is the response packet sent back by the target, not the first packet sent by the ping command. Option D is incorrect. UDP packets are not used by ping; ping uses ICMP, which operates at the network layer, not the transport layer like UDP. Therefore, A, ICMP echo request, is the correct answer.
Play from 14:22 Question 9. Which Linus command will list locally defined Windows users, groups, and SID's? Here are the options. Option A. enum. Option B. smbstatus. Option C. rpcclient. Option D. smbclient. Pause the video now if you want time to think about the answer.
The correct answer is C. rpcclient. rpcclient is a Linux tool that uses RPC (Remote Procedure Call) to query Windows systems remotely. It can enumerate users, groups, and their associated SIDs from a Windows system when proper credentials or null sessions are available, making it the correct answer for listing Windows users, groups, and SIDs from a Linux perspective. Now, why are the other options incorrect? Option A is incorrect. enum is not a standard Linux command for this purpose. Option B is incorrect. smbstatus displays information about current Samba connections, not Windows user and SID enumeration. Option D is incorrect. smbclient is used for interactive SMB file sharing and printing; it doesn't enumerate users and SIDs. Therefore, C, rpcclient, is the correct answer.
Play from 15:51 Question 10. Which of the following describes network traffic that originates from the inside of a network perimeter and progresses towards the outside? Here are the options. Option A. Ingress network. Option B. Inwards network. Option C. Egress network. Option D. Outwards network. Pause the video now if you want time to think about the answer.
The correct answer is C. Egress network. Egress network traffic refers to data flowing outbound from a network toward external networks or the internet. The term 'egress' literally means 'exit' and is the standard networking terminology for outbound traffic originating from inside the network perimeter. Now, why are the other options incorrect? Option A is incorrect. Ingress describes network traffic flowing inward, from outside the network perimeter toward the inside. Option B is incorrect. Inwards network is not standard networking terminology for traffic direction. Option D is incorrect. Outwards network is not the correct technical term; the proper term is 'egress.' Therefore, C, Egress network, is the correct answer.
Play from 17:14 Question 11. Which endpoint security bypass technique leverages existing system tools instead of adding executable? Here are the options. Option A. Living Off the Land. Option B. Code signing. Option C. Compile After Delivery. Option D. Ghostwriting. Pause the video now if you want time to think about the answer.
The correct answer is A. Living Off the Land. Living Off the Land (LotL) is a bypass technique where attackers use legitimate, pre-installed system utilities and tools (like PowerShell, cmd.exe, certutil, or wmic) instead of deploying malicious executables. This evades antivirus detection by leveraging trusted binaries. Now, why are the other options incorrect? Option B is incorrect. Code signing is a security feature that digitally signs executables; it does not bypass endpoint security. Option C is incorrect. Compile After Delivery involves compiling code on the target system but does not specifically describe leveraging existing system tools. Option D is incorrect. Ghostwriting is not a recognized endpoint security bypass technique in established security terminology. Therefore, A, Living Off the Land, is the correct answer.
Play from 18:46 Question 12. Which stage of an attack typically involves little or no direct interaction with the attack target(s)? Here are the options. Option A. Reconnaissance. Option B. Scanning. Option C. Covering the Tracks. Option D. Keeping Access. Option E. Denial of Service. Pause the video now if you want time to think about the answer.
The correct answer is A. Reconnaissance. Reconnaissance is the initial phase of an attack where the attacker gathers information about the target through passive means such as public records, WHOIS lookups, DNS queries, website analysis, and social engineering research. This phase involves little to no direct interaction with target systems, no scanning, no exploitation, no system access. The attacker is collecting intelligence without triggering any alerts or defenses. Now, why are the other options incorrect? Option B is incorrect. Scanning involves direct interaction with target systems to identify open ports and services. Option C is incorrect. Covering tracks occurs after access is achieved and involves active system manipulation. Option D is incorrect. Keeping access involves active maintenance of backdoors and persistence mechanisms. Option E is incorrect. Denial of Service is a direct attack with significant interaction with target systems. Therefore, A, Reconnaissance, is the correct answer.
Play from 20:32 Question 13. What can a Linux administrator use to take advantage of RADIUS? Here are the options. Option A. S/KEY. Option B. SYSKEY. Option C. PAM. Option D. Shadow. Pause the video now if you want time to think about the answer.
The correct answer is C. PAM. PAM (Pluggable Authentication Modules) is a flexible authentication framework for Linux that can integrate with RADIUS (Remote Authentication Dial In User Service) to provide centralized network authentication. PAM allows administrators to configure various authentication methods including RADIUS without modifying individual applications. Now, why are the other options incorrect? Option A is incorrect. S/KEY is a one-time password system unrelated to RADIUS integration. Option B is incorrect. SYSKEY is a Windows security feature, not a Linux tool. Option D is incorrect. Shadow manages local password files and does not provide RADIUS integration. Therefore, C, PAM, is the correct answer.
Play from 22:01 Question 14. Which of the following keyloggers cannot be detected by anti-virus or anti-spyware products? Here are the options. Option A. Kernel keylogger. Option B. Software keylogger. Option C. Hardware keylogger. Option D. OS keylogger. Pause the video now if you want time to think about the answer.
The correct answer is C. Hardware keylogger. Hardware keyloggers are physical devices placed between a keyboard and computer that cannot be detected by anti-virus or anti-spyware products because they operate entirely outside the software layer. Since they are physical hardware interception devices, they leave no software signatures for security tools to detect. Now, why are the other options incorrect? Option A is incorrect. Kernel keyloggers operate at the OS kernel level in software and can be detected by anti-virus and anti-spyware tools that scan kernel memory and processes. Option B is incorrect. Software keyloggers run as programs within the operating system and can be detected by anti-virus and anti-spyware products through signature and behavioral analysis. Option D is incorrect. OS keyloggers are software-based components that operate at the operating system level and can be detected by security scanning tools. Therefore, C, Hardware keylogger, is the correct answer.
Play from 23:41 Question 15. For what purpose would an auditor obtain a copy of the /etc/passwd file for a password audit of a linux machine? Here are the options. Option A. The file contains hashes for rainbow tables cracking. Option B. The file is required for a dictionary guessing approach. Option C. The file allows for user enumeration prior to password cracking. Option D. The file allows for a brute force audit approach. Pause the video now if you want time to think about the answer.
The correct answer is C. The file allows for user enumeration prior to password cracking. An auditor obtains /etc/passwd to enumerate valid user accounts on the system. This provides a comprehensive list of usernames to target during password cracking efforts. By identifying all user accounts first, the auditor can focus password guessing and cracking attempts on known valid accounts, which is a prerequisite to any password security assessment. Now, why are the other options incorrect? Option A is incorrect. Password hashes for rainbow table cracking are stored in /etc/shadow, not /etc/passwd Option B is incorrect. A dictionary approach targets passwords, not user enumeration; /etc/passwd enables account enumeration Option D is incorrect. Brute force approaches require knowledge of usernames first; /etc/passwd enables targeted enumeration Therefore, C, The file allows for user enumeration prior to password cracking, is the correct answer.
Play from 25:31 Question 16. Which of the following protocols is a maintenance protocol and is normally considered a part of the IP layer, but has also been used to conduct denial-of-service attacks? Here are the options. Option A. ICMP. Option B. L2TP. Option C. TCP. Option D. NNTP. Pause the video now if you want time to think about the answer.
The correct answer is A. ICMP. ICMP (Internet Control Message Protocol) is a maintenance protocol used for network diagnostics and error reporting at the IP layer. However, it has been extensively used in denial-of-service attacks such as ping floods and smurf attacks. Now, why are the other options incorrect? Option B is incorrect. L2TP (Layer 2 Tunneling Protocol) is a VPN protocol for secure communications, not a maintenance protocol at the IP layer. Option C is incorrect. TCP is a transport layer protocol, not specifically an IP layer maintenance protocol, though it can be exploited in attacks. Option D is incorrect. NNTP (Network News Transfer Protocol) is an application layer protocol for news distribution, not an IP layer maintenance protocol. Therefore, A, ICMP, is the correct answer.
Play from 27:11 Question 17. What would a forensic analyst extract from the following registry key? HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SRUM\Extensions Here are the options. Option A. Temporarily stored system activity data. Option B. File associations for installed programs. Option C. Recently searched files and directories. Option D. System policies for web browser add-ons. Pause the video now if you want time to think about the answer.
The correct answer is A. Temporarily stored system activity data. The SRUM (System Resource Usage Monitor) registry key stores temporarily held system activity data collected by Windows for resource monitoring and diagnostic purposes. This includes CPU usage, memory consumption, disk I/O, and network activity over time, providing forensic analysts with insight into system behavior during specific periods. Now, why are the other options incorrect? Option B is incorrect. File associations are stored in different registry locations, typically under HKEY_CLASSES_ROOT. Option C is incorrect. Recently searched files are stored in different locations like MRU lists and Search history, not in SRUM. Option D is incorrect. Web browser add-on policies are found under different registry paths related to browser-specific policies. Therefore, A, Temporarily stored system activity data, is the correct answer.
Play from 29:07 Question 18. Which of the following scanning tools is also a network analysis tool that sends packets with nontraditional IP stack parameters and allows the scanner to gather information from the response packets generated? Here are the options. Option A. Tcpview. Option B. Nessus. Option C. Legion. Option D. HPing. Pause the video now if you want time to think about the answer.
The correct answer is D. HPing. HPing is a network analysis tool that sends packets with nontraditional or customizable IP stack parameters and analyzes responses, making it useful for both scanning and detailed network reconnaissance. Tcpview (A) is a process monitoring tool. Nessus (B) is a vulnerability scanner. Legion (C) is a network enumeration tool. Only HPing fits the description of sending crafted packets with non-standard IP parameters and gathering information from responses. Now, why are the other options incorrect? Option A is incorrect. Tcpview is a process and connection monitoring tool, not a packet crafting scanner. Option B is incorrect. Nessus is a vulnerability scanner that does not specifically send packets with nontraditional IP parameters. Option C is incorrect. Legion is an enumeration tool focused on network resource discovery, not packet manipulation. Therefore, D, HPing, is the correct answer.
Play from 30:52 Question 19. A handler finds that anyone on the network can open a null session to a Linux Samba server's IPC$ share and enumerate accounts through SAMR. Which global smb.conf setting blocks anonymous SAMR access and also disallows anonymous connections to IPC$? Here are the options. Option A. restrict anonymous = 2. Option B. restrict anonymous = 1. Option C. restrict anonymous = 0. Option D. guest ok = yes. Pause the video now if you want time to think about the answer.
The correct answer is A. restrict anonymous = 2. The Samba restrict anonymous parameter controls whether the SAMR and LSA DCERPC services can be used anonymously and corresponds to the Windows RestrictAnonymous registry value. A value of 1 disables anonymous SAMR access, and a value of 2 does that and also disallows anonymous connections to the IPC$ share in general, which shuts down null-session enumeration. The default is 0, and setting guest ok = yes on any share removes the security advantage. Now, why are the other options incorrect? Option B is incorrect. A value of 1 disables anonymous SAMR access but still allows anonymous connections to IPC$. Option C is incorrect. A value of 0 is the default and leaves anonymous access unrestricted. Option D is incorrect. Allowing guest access on a share removes the security advantage of restricting anonymous access. Therefore, A, restrict anonymous = 2, is the correct answer.
Play from 32:50 Question 20. Which of the following functions in c/c++ can be the cause of buffer overflow? Each correct answer represents a complete solution. (Choose two.) Here are the options. Option A. printf(). Option B. strcat(). Option C. strcpy(). Option D. strlength(). Pause the video now if you want time to think about the answer.
The correct answers are B. strcat(), and C. strcpy(). Both strcat() and strcpy() are vulnerable to buffer overflow attacks because they copy data without checking buffer boundaries. These functions do not perform length validation, allowing attackers to write beyond allocated memory and corrupt the stack or heap. Now, why are the other options incorrect? Option A is incorrect. printf() can be vulnerable to format string attacks but is not a primary buffer overflow vector like strcat() and strcpy(). Option D is incorrect. strlength() (or strlen()) only returns the length of a string and does not perform any copying or data manipulation that would cause buffer overflow. Therefore, B and C are the correct answers.
Play from 34:18 Question 21. Which volatility plugin shows information about listening and closed sockets? Here are the options. Option A. netscan. Option B. dlllist. Option C. pslist. Option D. psscan. Pause the video now if you want time to think about the answer.
The correct answer is A. netscan. The netscan plugin in Volatility displays information about network connections, including listening sockets and closed sockets. It scans the memory dump for TCP and UDP connection structures and provides detailed information about active and listening network connections on the system. Now, why are the other options incorrect? Option B is incorrect. dlllist shows dynamically loaded libraries in memory, not network socket information. Option C is incorrect. pslist enumerates running processes, not network socket connections. Option D is incorrect. psscan scans for process structures in memory but does not provide network socket information. Therefore, A, netscan, is the correct answer.
Play from 35:42 Question 22. Logs show that a malicious host has remotely accessed the file `Documents and Settings:logs`. At what step of the attack process is the attacker most likely operating in? Here are the options. Option A. Establishing a backdoor. Option B. Using steganography. Option C. Initial reconnaissance. Option D. Port scanning. Option E. Covering tracks. Pause the video now if you want time to think about the answer.
The correct answer is E. Covering tracks. Accessing and modifying logs in 'Documents and Settings\logs' represents the attacker attempting to cover their tracks by altering evidence of their intrusion. This is the final phase of the attack lifecycle where attackers remove or manipulate audit trails and logs to hide indicators of compromise. Now, why are the other options incorrect? Option A is incorrect. Establishing a backdoor involves creating persistent remote access mechanisms, not accessing existing logs. Option B is incorrect. Using steganography is a data hiding technique unrelated to accessing system logs. Option C is incorrect. Initial reconnaissance involves information gathering before an attack, not post-intrusion log access. Option D is incorrect. Port scanning occurs during early attack phases for network discovery, before system access is gained. Therefore, E, Covering tracks, is the correct answer.
Play from 37:25 Question 23. During which Incident Handling phase would steps for preventing successful worm attacks occur, such as developing patch management and file encryption policies and processes? Here are the options. Option A. Preparation. Option B. Containment. Option C. Identification. Option D. Eradication. Option E. Recovery. Pause the video now if you want time to think about the answer.
The correct answer is A. Preparation. The Preparation phase occurs before incidents happen and involves implementing preventive measures and defensive strategies. Developing patch management and file encryption policies are proactive security measures designed to prevent successful attacks. These policies and processes are established during preparation, not in response to an active incident. Now, why are the other options incorrect? Option B is incorrect. Containment focuses on stopping an ongoing attack, not developing long-term prevention policies. Option C is incorrect. Identification involves discovering and analyzing an active incident, not creating preventive policies. Option D is incorrect. Eradication removes the threat from affected systems but does not develop organizational policies. Option E is incorrect. Recovery restores systems to normal operation after incident resolution, not the phase for policy development. Therefore, A, Preparation, is the correct answer.
Play from 39:12 Question 24. What is the first step that a containment team should take? Here are the options. Option A. Determine if the events indicate an incident. Option B. Remove network and Internet access for affected systems. Option C. Review firewall rules for preventing attacker access. Option D. Document and secure the incident scene. Pause the video now if you want time to think about the answer.
The correct answer is D. Document and secure the incident scene. Before taking any containment action, the incident response team must first document and secure the incident scene. This preserves evidence integrity, establishes a baseline, and prevents contamination of the investigation. Determining if an incident occurred, removing access, or reviewing firewall rules are all important but should follow proper evidence preservation protocols. Jumping directly to containment actions without proper documentation can compromise forensic value and legal admissibility. Now, why are the other options incorrect? Option A is incorrect. While determining if an incident occurred is important, it should follow documentation and scene security to preserve evidence. Option B is incorrect. Removing network access is a containment action that should not occur before documenting and securing the scene. Option C is incorrect. Reviewing firewall rules is part of the response but comes after scene security to avoid losing critical evidence. Therefore, D, Document and secure the incident scene, is the correct answer.
Play from 41:05 Question 25. Which of the following are the primary goals of the incident handling team? Each correct answer represents a complete solution. (Choose all that apply.) Here are the options. Option A. Freeze the scene. Option B. Repair any damage caused by an incident. Option C. Prevent any further damage. Option D. Inform higher authorities. Pause the video now if you want time to think about the answer.
The correct answers are A. Freeze the scene, and B. Repair any damage caused by an incident, and C. Prevent any further damage. The primary goals of an incident handling team are to freeze the scene (preserve evidence and prevent tampering), repair damage caused by the incident (restore systems to normal operation), and prevent further damage (contain the incident and block attack vectors). These three objectives represent the core mission of incident response: preservation, recovery, and containment. Informing higher authorities is important for communication and reporting but is secondary to these primary operational goals. Now, why are the other options incorrect? Option D is incorrect. While informing higher authorities is part of incident response procedures, it is a communication and escalation task rather than a primary operational goal of the incident handling team. Therefore, A and B and C are the correct answers.
Play from 42:48 Question 26. Which of the following attacks allows an attacker to retrieve crucial information from a Web server's database? Here are the options. Option A. Database retrieval attack. Option B. PHP injection attack. Option C. SQL injection attack. Option D. Server data attack. Pause the video now if you want time to think about the answer.
The correct answer is C. SQL injection attack. SQL injection is the attack technique that allows attackers to insert malicious SQL code into input fields to retrieve, modify, or delete database information from a Web server's database. It exploits improper input validation in web applications that construct SQL queries. Now, why are the other options incorrect? Option A is incorrect. Database retrieval attack is not a standard classified attack type. Option B is incorrect. PHP injection attacks target PHP code execution but are not specifically designed for database information retrieval compared to SQL injection. Option D is incorrect. Server data attack is a generic term that does not represent a specific, well-known attack methodology. Therefore, C, SQL injection attack, is the correct answer.
Play from 44:21 Question 27. Which of the following is a technique that can be used to reduce the amount of data to examine during an investigation? Here are the options. Option A. Ignore files with known good hashes. Option B. Ignore malicious file hashes. Option C. Create file hashes for all directories on the system. Option D. Request management recommendation for file hashes of interest. Pause the video now if you want time to think about the answer.
The correct answer is A. Ignore files with known good hashes. Using known good hashes (like those from NIST databases or OS baseline hashes) allows investigators to filter out files that are definitely legitimate, significantly reducing the dataset that requires detailed analysis. This technique is called 'hash set filtering' and is a standard forensic practice to focus investigation efforts on truly suspicious files. Now, why are the other options incorrect? Option B is incorrect. Ignoring malicious file hashes would actually increase the data to examine and defeat the purpose of reducing investigation scope. Option C is incorrect. Creating hashes for all directories adds more data to manage rather than reducing what needs examination. Option D is incorrect. Requesting management recommendations is a decision-making process, not a data reduction technique. Therefore, A, Ignore files with known good hashes, is the correct answer.
Play from 46:09 Question 28. An LLM extension that should read only the current user's documents connects to the document repository with a privileged service account that can open every user's files. Which root cause of Excessive Agency does this represent? Here are the options. Option A. Excessive functionality. Option B. Excessive autonomy. Option C. Excessive permissions. Option D. Improper output handling. Pause the video now if you want time to think about the answer.
The correct answer is C. Excessive permissions. OWASP splits the root causes of Excessive Agency into excessive functionality, excessive permissions and excessive autonomy. When an extension built to act for one user reaches downstream systems with a generic high-privileged identity, the problem is excessive permissions, because the extension can touch far more data than its task requires. The remedy is to execute extensions in the user's own context, for example through OAuth with the minimum scope, so actions on the user's behalf carry only that user's privileges. Now, why are the other options incorrect? Option A is incorrect. Excessive functionality means the extension exposes functions the task does not need, such as delete or send, rather than an overprivileged identity. Option B is incorrect. Excessive autonomy means high-impact actions run without independent verification or user approval, which is not the flaw described. Option D is incorrect. Improper output handling concerns unvalidated model output passed to downstream components, not the identity an extension uses. Therefore, C, Excessive permissions, is the correct answer.
Play from 48:13 Question 29. In general, which method is the fastest for cracking a password? Here are the options. Option A. Brute Force. Option B. Dictionary. Option C. Manual guessing. Option D. Hybrid. Pause the video now if you want time to think about the answer.
The correct answer is B. Dictionary. Dictionary attacks are generally the fastest password cracking method in practice because they exploit the reality that most users choose passwords from common words, phrases, and patterns found in dictionaries. They require far fewer attempts than brute force attacks, which must try all possible character combinations, making dictionary attacks significantly faster for real-world passwords. Now, why are the other options incorrect? Option A is incorrect. Brute force is exhaustive but extremely slow because it must try all possible character combinations before finding the password. Option C is incorrect. Manual guessing is impractical and unreliable, depending entirely on the attacker's intuition rather than systematic methods. Option D is incorrect. Hybrid attacks combine dictionary and brute force but are slower than pure dictionary attacks since they require additional computation. Therefore, B, Dictionary, is the correct answer.
Play from 49:50 Question 30. Which of the following methods does Netcat use to act as a relay (transferring data from machine to machine)? Here are the options. Option A. By using FTP. Option B. By poisoning the ARP cache. Option C. By standard I/O redirection. Option D. By using telnet. Pause the video now if you want time to think about the answer.
The correct answer is C. By standard I/O redirection. Netcat implements relay functionality using standard input/output (I/O) redirection, which allows it to pipe data between connections without relying on external protocols. This is one of Netcat's core features that makes it flexible for network communication tasks. FTP and Telnet are separate protocols, not mechanisms Netcat uses. ARP poisoning is an unrelated attack technique. Now, why are the other options incorrect? Option A is incorrect. Netcat does not require or use FTP to relay data between machines. Option B is incorrect. ARP poisoning is an attack method unrelated to how Netcat relays data. Option D is incorrect. While Netcat can replace Telnet for connections, it does not use Telnet protocol to relay data. Therefore, C, By standard I/O redirection, is the correct answer.
Play from 51:26 Question 31. Which Windows tool can be used to view the contents of the following file directly in the command shell? C:\Users\JaneD\funnyjokes.doc:file1 Here are the options. Option A. cp. Option B. dir. Option C. more. Option D. notepad. Pause the video now if you want time to think about the answer.
The correct answer is C. more. The file path C:\Users\JaneD\funnyjokes.doc:file1 references an alternate data stream (ADS) on an NTFS file system. The colon syntax indicates that 'file1' is a hidden data stream attached to the funnyjokes.doc file. The 'more' command in Windows can be used to read and display the contents of alternate data streams directly from the command line, making it the appropriate tool for viewing this hidden data. Now, why are the other options incorrect? Option A is incorrect. cp is a Unix/Linux command and not a native Windows tool for this purpose. Option B is incorrect. dir lists directory contents but does not display the contents of alternate data streams. Option D is incorrect. notepad is a graphical text editor that cannot directly access or display alternate data stream contents from the command line. Therefore, C, more, is the correct answer.
Play from 53:04 Question 32. What information will be returned when an administrator executes the command below? # last -f /var/log/btmp Here are the options. Option A. See successful logins. Option B. Erase bash history. Option C. Delete failed login logs. Option D. See failed logins. Pause the video now if you want time to think about the answer.
The correct answer is D. See failed logins. The command 'last -f /var/log/btmp' displays records from the btmp file, which contains failed login attempts on Unix/Linux systems. The 'last' command with the btmp file specifically shows a history of unsuccessful authentication attempts. Now, why are the other options incorrect? Option A is incorrect. Successful logins are recorded in wtmp, not btmp. Option B is incorrect. The 'last' command does not erase bash history; it reads log files. Option C is incorrect. The 'last' command does not delete logs; it only displays them for review. Therefore, D, See failed logins, is the correct answer.
Play from 54:29 Question 33. Assuming you use each program listed, of the choices listed below, which represents the BEST defense against protocol parser vulnerabilities? Here are the options. Option A. Disable scripts in Internet Explorer. Option B. Disable the Outlook preview pane. Option C. Keep Nmap fully patched. Option D. Keep tcpdump fully patched. Pause the video now if you want time to think about the answer.
The correct answer is D. Keep tcpdump fully patched. Tcpdump is a packet capture tool that parses network protocols. Keeping tcpdump fully patched directly defends against protocol parser vulnerabilities that could be exploited through malformed packets. Vulnerabilities in packet parsing libraries can be triggered by specially crafted network traffic. Now, why are the other options incorrect? Option A is incorrect. Disabling Internet Explorer scripts does not address protocol parser vulnerabilities in network tools. Option B is incorrect. Disabling Outlook preview pane helps with email-based exploits but not protocol parser vulnerabilities. Option C is incorrect. Keeping Nmap patched is important, but Nmap is a port scanner, not primarily a protocol parser for receiving traffic. Therefore, D, Keep tcpdump fully patched, is the correct answer.
Play from 56:10 Question 34. NIST SP 800-61 Revision 3 replaced the earlier incident response life cycle with a model built on the six NIST CSF 2.0 Functions. Which Functions does it place in the top level of the model as incident response itself? Here are the options. Option A. Govern, Identify and Protect. Option B. Identify, Protect and Detect. Option C. Detect, Respond and Recover. Option D. Protect, Respond and Govern. Pause the video now if you want time to think about the answer.
The correct answer is C. Detect, Respond and Recover. Revision 3, published in April 2025, supersedes the 2012 Revision 2 and organizes its recommendations around the CSF 2.0 Functions. Detect, Respond and Recover form incident response itself, while Govern, Identify and Protect are broader risk management activities that prepare for incidents but are not part of the response. Lessons learned from every Function feed the Improvement Category under Identify continuously, because modern incidents can take weeks or months to recover from. Now, why are the other options incorrect? Option A is incorrect. Govern, Identify and Protect are the preparation layer, which supports incident response but is not part of the response itself. Option B is incorrect. Identify and Protect sit in the preparation layer, so this set mixes preparation with only one response Function. Option D is incorrect. Protect and Govern are preparation Functions, and Recover, which restores affected assets, is missing from this set. Therefore, C, Detect, Respond and Recover, is the correct answer.
Play from 58:14 Question 35. Which of the following nmap command parameters is used for TCP SYN port scanning? Here are the options. Option A. -sF. Option B. -sU. Option C. -sX. Option D. -sS. Pause the video now if you want time to think about the answer.
The correct answer is D. -sS. The -sS parameter in nmap initiates a TCP SYN scan, also known as a half-open scan. It sends SYN packets to target ports and analyzes responses to determine port states without completing full TCP connections, making it a standard and efficient port scanning technique. Now, why are the other options incorrect? Option A is incorrect. -sF performs a TCP FIN scan, not TCP SYN scanning. Option B is incorrect. -sU performs UDP port scanning, not TCP scanning. Option C is incorrect. -sX performs a TCP Xmas scan with FIN, PSH, and URG flags set, not TCP SYN scanning. Therefore, D, -sS, is the correct answer.
Play from 59:35 Question 36. You want to connect to your friend's computer and run a Trojan on it. Which of the following tools will you use to accomplish the task? Here are the options. Option A. PSExec. Option B. Remoxec. Option C. Hk.exe. Option D. GetAdmin.exe. Pause the video now if you want time to think about the answer.
The correct answer is A. PSExec. PSExec is a legitimate Microsoft Sysinternals tool that allows execution of processes on remote systems over a network. Attackers can abuse PSExec to deploy malware like Trojans on target computers. While it has legitimate administrative uses, it is commonly exploited for malicious purposes. The other options are either non-existent tools or not designed for this primary purpose. Now, why are the other options incorrect? Option B is incorrect. Remoxec is not a recognized or standard tool used for remote code execution. Option C is incorrect. Hk.exe is not a standard tool designed for remote code execution and deployment. Option D is incorrect. GetAdmin.exe was a privilege escalation tool from older Windows versions, not a remote execution tool. Therefore, A, PSExec, is the correct answer.
Play from 1:01:08 Question 37. Which tool is designed to provide shell access over ICMP? Here are the options. Option A. Sneakin. Option B. Telnet. Option C. Loki. Option D. Reverse World Wide Web (WWW) Shell. Pause the video now if you want time to think about the answer.
The correct answer is C. Loki. Loki is a covert tunneling tool specifically designed to provide shell access and command execution over ICMP (ping) traffic. It tunnels data through ICMP echo requests and replies, allowing attackers to bypass firwall rules that allow ICMP but block other protocols. This makes it particularly stealthy for maintaining backdoor access. Sneakin, Telnet, and WWW shell are not ICMP-based tools. Now, why are the other options incorrect? Option A is incorrect. Sneakin is not a known ICMP tunneling tool for shell access. Option B is incorrect. Telnet is a traditional network protocol that uses TCP port 23, not ICMP. Option D is incorrect. Reverse WWW Shell operates over HTTP/HTTPS, not ICMP. Therefore, C, Loki, is the correct answer.
Play from 1:02:43 Question 38. Which of the following are the rules by which an organization operates? Here are the options. Option A. Acts. Option B. Policies. Option C. Rules. Option D. Manuals. Pause the video now if you want time to think about the answer.
The correct answer is B. Policies. Policies are the formal rules and guidelines that define how an organization operates, including security practices, acceptable use, and operational procedures. They are established by management and provide the framework for all organizational activities. Acts refer to legal statutes, Rules are more specific implementations of policies, and Manuals are documentation tools, but Policies are the foundational governing principles of an organization. Now, why are the other options incorrect? Option A is incorrect. Acts refer to legislation and legal statutes passed by government, not internal organizational operating rules. Option C is incorrect. Rules are typically more specific, tactical implementations derived from policies rather than the overarching governing framework. Option D is incorrect. Manuals are documentation and reference materials, not the governing rules themselves. Therefore, B, Policies, is the correct answer.
Play from 1:04:18 Question 39. Which of the following are used to identify who is responsible for responding to an incident? Here are the options. Option A. Disaster management policies. Option B. Incident response manuals. Option C. Disaster management manuals. Option D. Incident response policies. Pause the video now if you want time to think about the answer.
The correct answer is D. Incident response policies. Incident response policies specifically define roles, responsibilities, and procedures for responding to security incidents, including who is responsible for each aspect of the response. These policies establish the organizational structure and accountability framework for incident handling. Now, why are the other options incorrect? Option A is incorrect. Disaster management policies address business continuity and recovery, not incident response roles. Option B is incorrect. Incident response manuals provide procedural guidance but policies are the authoritative documents establishing responsibility. Option C is incorrect. Disaster management manuals focus on recovery procedures rather than incident response role assignment. Therefore, D, Incident response policies, is the correct answer.
Play from 1:05:56 Question 40. An administrator needs to repeatedly scan a very large network with thousands of hosts, what is the best way of accomplishing this very quickly? Here are the options. Option A. Nessus. Option B. Nmap. Option C. Masscan. Option D. Hping3. Pause the video now if you want time to think about the answer.
The correct answer is C. Masscan. Masscan is specifically designed for extremely fast scanning of very large networks and can scan the entire Internet in under 6 minutes. It uses an asynchronous transmission model and was built to handle massive scale. Nessus is a vulnerability scanner (slower, more thorough). Nmap is general-purpose but not optimized for speed on thousands of hosts. Hping3 is a packet crafting tool, not a comprehensive scanner. For pure speed on large networks, Masscan is the clear choice. Now, why are the other options incorrect? Option A is incorrect. Nessus is a detailed vulnerability scanner, not optimized for scanning speed across thousands of hosts. Option B is incorrect. Nmap is a comprehensive scanning tool but significantly slower than Masscan for large-scale rapid scans. Option D is incorrect. Hping3 is a packet crafting and analysis tool, not designed for rapid large-scale network scanning. Therefore, C, Masscan, is the correct answer.
Play from 1:07:37 Question 41. Which would be the ideal system for conducting analysis during cloud investigations? Here are the options. Option A. Cloud-based forensics system using the organization's service account. Option B. On-premise forensics system with limited network connectivity. Option C. On-premise forensics system with connectivity to the cloud service. Option D. Cloud-based forensics system using an independent service account. Pause the video now if you want time to think about the answer.
The correct answer is D. Cloud-based forensics system using an independent service account. A cloud-based forensics system using an independent service account is ideal for cloud investigations because it maintains proper access controls and audit trails specific to the investigation. Using an independent account prevents confusion with organizational service accounts, ensures accountability, and creates a clear separation between operational access and forensic analysis access, which is critical for maintaining evidence integrity and compliance. Now, why are the other options incorrect? Option A is incorrect. Using the organization's service account compromises the separation between operational and forensic activities and creates audit trail ambiguity. Option B is incorrect. Limited network connectivity impedes the ability to access and analyze cloud resources effectively. Option C is incorrect. On-premise systems have latency issues and may not have the proper cloud-native tools needed for cloud investigations. Therefore, D, Cloud-based forensics system using an independent service account, is the correct answer.
Play from 1:09:35 Question 42. What kind of traffic does an egress anti-spoof filter drop? Here are the options. Option A. Outgoing packets with a source address not from internal networks. Option B. Incoming packets with a destination address from internal networks. Option C. Incoming packets with a source address not from internal networks. Option D. Outgoing packets with a destination address from internal networks. Pause the video now if you want time to think about the answer.
The correct answer is A. Outgoing packets with a source address not from internal networks. An egress anti-spoof filter operates on outbound traffic leaving the network and drops packets where the source address does not originate from internal networks. This prevents attackers on internal systems from spoofing their source addresses to appear as if they come from external or unauthorized networks. Egress filtering protects the perimeter by ensuring only legitimate internal traffic originates from the organization. Now, why are the other options incorrect? Option B is incorrect. This describes incoming traffic filtering based on destination, not egress anti-spoofing. Option C is incorrect. This describes ingress anti-spoofing, not egress anti-spoofing; egress is outbound. Option D is incorrect. This describes filtering based on destination address in outgoing traffic, not source address spoofing. Therefore, A, Outgoing packets with a source address not from internal networks, is the correct answer.
Play from 1:11:25 Question 43. Which of the following incident response team members ensures that the policies of the organization are enforced during the incident response? Here are the options. Option A. Information Security representative. Option B. Legal representative. Option C. Human Resource. Option D. Technical representative. Pause the video now if you want time to think about the answer.
The correct answer is A. Information Security representative. The Information Security representative is responsible for ensuring that the organization's security policies and information security requirements are enforced and followed during incident response activities. This role ensures that response actions align with security standards and policies. While Legal may handle compliance and liability, Human Resources handles personnel issues, and Technical representatives handle technical implementation, the Information Security representative specifically oversees policy enforcement during incidents. Now, why are the other options incorrect? Option B is incorrect. Legal representative focuses on compliance, liability, and legal implications rather than enforcing organizational security policies. Option C is incorrect. Human Resources handles personnel-related matters and employment policies, not information security policy enforcement. Option D is incorrect. Technical representative implements the response actions but does not ensure organizational policies are being followed. Therefore, A, Information Security representative, is the correct answer.
Play from 1:13:20 Question 44. Which of the following rootkits is able to load the original operating system as a virtual machine, thereby enabling it to intercept all hardware calls made by the original operating system? Here are the options. Option A. Kernel level rootkit. Option B. Boot loader rootkit. Option C. Hypervisor rootkit. Option D. Library rootkit. Pause the video now if you want time to think about the answer.
The correct answer is C. Hypervisor rootkit. A hypervisor rootkit operates at a level above the operating system by creating a virtual machine layer that loads the original OS as a guest, allowing it to intercept all hardware calls and system operations. This gives it exceptional control and stealth compared to other rootkit types, as it sits between the OS and hardware. Now, why are the other options incorrect? Option A is incorrect. Kernel level rootkits operate within the kernel but do not create a virtualization layer to run the OS as a virtual machine. Option B is incorrect. Boot loader rootkits compromise the boot process but don't implement hypervisor functionality to virtualize the OS. Option D is incorrect. Library rootkits operate at the user space level by compromising system libraries, not by virtualizing the operating system. Therefore, C, Hypervisor rootkit, is the correct answer.
Play from 1:15:04 Question 45. Which of the following characters will you use to check whether an application is vulnerable to an SQL injection attack? Here are the options. Option A. Dash (-). Option B. Double quote ("). Option C. Single quote ('). Option D. Semi colon (;). Pause the video now if you want time to think about the answer.
The correct answer is C. Single quote ('). The single quote (') character is the standard test vector for SQL injection vulnerabilities because it terminates SQL string literals and allows an attacker to inject arbitrary SQL commands. When a single quote is inserted into a vulnerable parameter and causes an error or unexpected behavior, it indicates the application does not properly sanitize input. This is the most commonly used and reliable test character for identifying SQL injection flaws. Now, why are the other options incorrect? Option A is incorrect. Dashes are used in SQL comments but are not the primary probe character for injection detection. Option B is incorrect. Double quotes are less commonly used as a test vector since many SQL implementations use single quotes for string literals. Option D is incorrect. Semicolons terminate SQL statements but are not the initial probe character and are often filtered. Therefore, C, Single quote ('), is the correct answer.
Play from 1:16:41 Question 46. Which of the following types of malware does not replicate itself but can spread only when the circumstances are beneficial? Here are the options. Option A. Mass mailer. Option B. Worm. Option C. Blended threat. Option D. Trojan horse. Pause the video now if you want time to think about the answer.
The correct answer is D. Trojan horse. A Trojan horse is malware that does not replicate itself but instead spreads through user action or distribution. It requires favorable circumstances (such as a user downloading and executing it) to propagate, unlike worms which self-replicate automatically. Now, why are the other options incorrect? Option A is incorrect. Mass mailer malware replicates by sending copies of itself via email. Option B is incorrect. Worms are specifically designed to self-replicate and spread automatically without user intervention. Option C is incorrect. Blended threats combine characteristics of multiple malware types, many of which do self-replicate. Therefore, D, Trojan horse, is the correct answer.
Play from 1:18:05 Question 47. Which of the following techniques does an attacker use to sniff data frames on a local area network and modify the traffic? Here are the options. Option A. MAC spoofing. Option B. IP address spoofing. Option C. Email spoofing. Option D. ARP spoofing. Pause the video now if you want time to think about the answer.
The correct answer is D. ARP spoofing. ARP spoofing allows an attacker to intercept and modify traffic on a local area network by mapping their MAC address to another IP address, enabling man-in-the-middle attacks where frames can be sniffed and altered. MAC spoofing only changes the source MAC address but doesn't enable traffic modification. IP and email spoofing operate at different layers and don't facilitate frame-level sniffing on LANs. Now, why are the other options incorrect? Option A is incorrect. MAC spoofing only changes the MAC address; it doesn't enable sniffing and modifying traffic on a LAN. Option B is incorrect. IP address spoofing operates at Layer 3 and is not the primary technique for sniffing and modifying LAN frames. Option C is incorrect. Email spoofing is used to forge email headers and is not related to LAN frame manipulation. Therefore, D, ARP spoofing, is the correct answer.
Play from 1:19:44 Question 48. Which Microsoft tool can be used to mitigate the risk of an adversary reusing a stolen local administrator password hash? Here are the options. Option A. Attack surface reduction. Option B. LAPS. Option C. ASLR. Option D. Heap spray protection. Pause the video now if you want time to think about the answer.
The correct answer is B. LAPS. LAPS (Local Administrator Password Solution) is a Microsoft tool designed specifically to mitigate the risk of compromised local administrator passwords. It automatically manages and rotates local administrator account passwords on domain-joined computers, storing them securely in Active Directory. This prevents attackers from reusing stolen password hashes across multiple systems. Now, why are the other options incorrect? Option A is incorrect. Attack surface reduction helps prevent code execution but does not address password hash reuse. Option C is incorrect. ASLR (Address Space Layout Randomization) is a memory protection technique unrelated to password management. Option D is incorrect. Heap spray protection is a memory exploitation defense mechanism, not related to administrator credential protection. Therefore, B, LAPS, is the correct answer.
Play from 1:21:20 Question 49. If a router received an IPv6 packet with a Hop Limit of 1, which of the following ICMP messages would it send back to the originating host? Here are the options. Option A. Information Request. Option B. Redirect. Option C. Host Unreachable. Option D. Time Exceeded. Option E. Timestamp. Pause the video now if you want time to think about the answer.
The correct answer is D. Time Exceeded. When a router receives an IPv6 packet with a Hop Limit of 1 and the packet is not destined for the router itself, the router must decrement the Hop Limit. Since it reaches 0, the router sends back an ICMPv6 Time Exceeded message to the originating host, informing it that the packet could not be forwarded due to the hop limit being exceeded. Now, why are the other options incorrect? Option A is incorrect. Information Request is not a standard ICMP message type for hop limit expiration. Option B is incorrect. Redirect messages are sent when a router suggests a better route, not for hop limit issues. Option C is incorrect. Host Unreachable is sent when a specific destination host cannot be reached, not for hop limit expiration. Option E is incorrect. Timestamp is used for time synchronization, not for hop limit expiration events. Therefore, D, Time Exceeded, is the correct answer.
Play from 1:23:02 Question 50. What is a DNS zone transfer? Here are the options. Option A. Bulk transfer of DNS records for a domain from your DNS server to another host upon request. Option B. Changing the registered region in which your DNS server is allowed to operate. Option C. Switching zone preferences between two DNS servers. Option D. Turning a DNS server from an internal server to an external server, or the other way around. Pause the video now if you want time to think about the answer.
The correct answer is A. Bulk transfer of DNS records for a domain from your DNS server to another host upon request. A DNS zone transfer is the bulk transfer of all DNS records (the zone file) from a primary DNS server to a secondary or requesting host, typically using AXFR requests. This is a legitimate administrative function but can be a security risk if unrestricted, as it reveals the entire domain structure. Changing registered regions, switching zone preferences, and converting between internal/external servers are not standard DNS terminology or operations. Now, why are the other options incorrect? Option B is incorrect. DNS servers don't have registered regions that change; this is not a valid DNS concept. Option C is incorrect. Zone preferences between DNS servers are not switched in standard DNS operations. Option D is incorrect. Converting servers between internal and external roles is not called a zone transfer. Therefore, A, Bulk transfer of DNS records for a domain from your DNS server to another host upon request, is the correct answer.
Play from 1:25:06 Question 51. A handler investigating a suspected password spray against a Microsoft Entra tenant needs every failed authentication attempt, with the user, client application and target resource for each one. Which log source should be queried first? Here are the options. Option A. Azure Activity log. Option B. Microsoft Entra sign-in logs. Option C. Azure Storage account logs. Option D. AWS CloudTrail management events. Pause the video now if you want time to think about the answer.
The correct answer is B. Microsoft Entra sign-in logs. The Microsoft Entra sign-in logs record each authentication attempt, including failures, and describe who signed in (the user), how (the client application) and what was accessed (the target resource). Those fields let a handler spot one source trying a few passwords across many accounts, which is the signature of a spray. Entries in the sign-in logs are system generated and cannot be changed or deleted, which also makes them dependable evidence. Now, why are the other options incorrect? Option A is incorrect. The Activity log records control plane operations on Azure resources, such as creating a virtual machine, not user sign-in attempts. Option C is incorrect. Storage logs record requests made to a storage account's data and do not record tenant sign-ins. Option D is incorrect. CloudTrail records API activity in AWS accounts and has no visibility into Microsoft Entra authentication. Therefore, B, Microsoft Entra sign-in logs, is the correct answer.
Play from 1:27:04 Question 52. When switching traffic on a LAN, what element of the Ethernet frame does a switch use to make its decision on where to send the data? Here are the options. Option A. Destination IP address. Option B. Destination MAC address. Option C. Destination ARP response. Option D. Source DHCP packet. Pause the video now if you want time to think about the answer.
The correct answer is B. Destination MAC address. Switches operate at Layer 2 (Data Link Layer) and make forwarding decisions based on the destination MAC address contained in the Ethernet frame header. This MAC address determines which physical port the frame is forwarded to within the switched network. Now, why are the other options incorrect? Option A is incorrect. IP addresses operate at Layer 3; switches do not examine Layer 3 headers for basic switching decisions. Option C is incorrect. ARP responses are used for address resolution, not frame forwarding decisions by switches. Option D is incorrect. DHCP packets are not used for switch frame forwarding; they operate at a higher layer for IP address assignment. Therefore, B, Destination MAC address, is the correct answer.
Play from 1:28:33 Question 53. When launching a SQL Injection attack, what characters might an attacker start experimenting with first? Here are the options. Option A. Quotes (', ", etc.). Option B. Alphabetic characters. Option C. Numeric characters. Option D. Percents (%). Pause the video now if you want time to think about the answer.
The correct answer is A. Quotes (', ", etc.). When conducting SQL injection attacks, attackers typically begin experimenting with quote characters (single quotes, double quotes, etc.) because these are the primary delimiters used in SQL syntax to define string boundaries. By inserting quotes, attackers can break out of the intended SQL query structure and inject their own commands. This is the most fundamental and obvious starting point for SQL injection testing. Now, why are the other options incorrect? Option B is incorrect. Alphabetic characters alone do not have special meaning in SQL syntax and would not reveal SQL injection vulnerabilities. Option C is incorrect. Numeric characters alone cannot break SQL syntax or demonstrate injection capability. Option D is incorrect. Percent signs (%) are SQL wildcards used in LIKE clauses but are not the primary starting point for discovering SQL injection vulnerabilities. Therefore, A, Quotes (', ", etc.), is the correct answer.
Play from 1:30:14 Question 54. Which of the following tools are used as a network traffic monitoring tool in the Linux operating system? Each correct answer represents a complete solution. (Choose all that apply.) Here are the options. Option A. Netbus. Option B. IPTraf. Option C. MRTG. Option D. Ntop. Pause the video now if you want time to think about the answer.
The correct answers are B. IPTraf, and C. MRTG, and D. Ntop. IPTraf (B) is a real-time IP LAN traffic monitoring tool for Linux. MRTG (C) is a traffic monitoring tool that generates graphs of network traffic. Ntop (D) is a network traffic probe that shows network usage in a manner similar to top. All three are legitimate Linux network monitoring tools. Netbus is a Windows-based backdoor/remote access tool, not a network traffic monitoring tool for Linux. Now, why are the other options incorrect? Option A is incorrect. Netbus is a Windows remote access/backdoor tool, not a Linux network traffic monitoring tool. Therefore, B and C and D are the correct answers.
Play from 1:31:39 Question 55. Which of the following is used to gather information about a remote network protected by a firewall? Here are the options. Option A. Warchalking. Option B. Wardialing. Option C. Firechalking. Option D. Firewalking. Pause the video now if you want time to think about the answer.
The correct answer is D. Firewalking. Firewalking is a technique used to determine which ports and protocols are allowed through a firewall by analyzing the responses to specially crafted packets. It allows attackers to map firewall rules and identify open or filtered ports on networks protected by firewalls. Now, why are the other options incorrect? Option A is incorrect. Warchalking is the practice of marking locations of wireless networks with chalk, not for gathering firewall information. Option B is incorrect. Wardialing involves calling multiple phone numbers to find modems, not related to firewall information gathering. Option C is incorrect. Firechalking is not an established or recognized technique for firewall reconnaissance. Therefore, D, Firewalking, is the correct answer.
Play from 1:33:06 Question 56. Which of the following is one of the fields that Covert TCP uses to transmit data? Here are the options. Option A. IP Options. Option B. Urgent Pointer. Option C. IP Identification. Option D. Code Bits. Pause the video now if you want time to think about the answer.
The correct answer is C. IP Identification. Covert TCP is a technique that uses the IP Identification field to transmit hidden data within legitimate-looking packets. By manipulating this field, data can be encoded and transmitted without appearing suspicious. IP Options can carry data but are more obviously suspicious; the Urgent Pointer is part of TCP headers for priority data; Code Bits (TCP flags) are structural elements not typically used for data encoding in this technique. Now, why are the other options incorrect? Option A is incorrect. While IP Options can technically carry data, they are more easily detected and monitored than the IP ID field. Option B is incorrect. The Urgent Pointer is a TCP field for priority indication, not a primary covert channel in this technique. Option D is incorrect. Code Bits (TCP flags like SYN, ACK, FIN) are structural control elements, not data carrier fields. Therefore, C, IP Identification, is the correct answer.
Play from 1:34:50 Question 57. Which of the following is a feature of Netcat that is not present in telnet? Here are the options. Option A. The ability to send and receive clear text data. Option B. The ability to connect to ports above 1024. Option C. The ability to connect to TCP and UDP ports. Option D. The ability to require authentication. Pause the video now if you want time to think about the answer.
The correct answer is C. The ability to connect to TCP and UDP ports. Netcat can connect to both TCP and UDP ports, while Telnet is restricted to TCP only. This flexibility is a key distinguishing feature of Netcat. Both tools can send and receive clear text data (A), both can connect to ports above 1024 (B), and neither requires authentication by design (D). Now, why are the other options incorrect? Option A is incorrect. Both Netcat and Telnet can send and receive clear text data, so this is not a distinguishing feature. Option B is incorrect. Both Netcat and Telnet are capable of connecting to ports numbered above 1024. Option D is incorrect. Neither Netcat nor Telnet requires authentication as a built-in feature; this does not distinguish them. Therefore, C, The ability to connect to TCP and UDP ports, is the correct answer.
Play from 1:36:33 Question 58. What will a host do when it receives a packet with an invalid TCP checksum? Here are the options. Option A. Drop the packet. Option B. Hold the packet and wait for a rebroadcast. Option C. Send an ICMP redirect. Option D. Reply with a TCP reset. Pause the video now if you want time to think about the answer.
The correct answer is A. Drop the packet. When a host receives a packet with an invalid TCP checksum, it drops the packet because the checksum validation fails. This is a fundamental network reliability mechanism, a bad checksum indicates the packet was corrupted in transit and cannot be trusted. The packet is silently discarded without acknowledgment or further action. Options B, C, and D describe active responses that are not triggered by checksum failures. Now, why are the other options incorrect? Option B is incorrect. Hosts do not wait for rebroadcasts on invalid checksums; the packet is simply dropped. Option C is incorrect. An ICMP redirect is not sent in response to checksum validation failures. Option D is incorrect. A TCP reset is not automatically sent for packets with invalid checksums; they are simply discarded. Therefore, A, Drop the packet, is the correct answer.
Play from 1:38:13 Question 59. A consultant provides an organization with a report that contains their users' most popular passwords, data on password sharing, and a breakdown of password length by department. Which tool could generate this report? Here are the options. Option A. DPAT. Option B. Hashcat. Option C. Yescrypt. Option D. LANMAN. Pause the video now if you want time to think about the answer.
The correct answer is A. DPAT. DPAT (Dictionary Password Audit Tool) is specifically designed to audit passwords within an organization by analyzing password policies, identifying weak passwords, and generating reports on password metrics such as popularity, sharing patterns, and length distributions by department. The report described, containing users' most popular passwords, data on password sharing, and password length breakdown by department, is exactly the type of output DPAT produces for security auditing purposes. Now, why are the other options incorrect? Option B is incorrect. Hashcat is a password cracking tool used to recover lost passwords through brute-force or dictionary attacks, not for generating organizational password audit reports. Option C is incorrect. Yescrypt is a key derivation function and password hashing algorithm used for secure password storage, not for auditing or analyzing existing organizational passwords. Option D is incorrect. LANMAN is a legacy password hashing method used in older Windows systems, not a tool for generating password audit reports. Therefore, A, DPAT, is the correct answer.
Play from 1:40:15 Question 60. Which file is critical to remove from a domain controller after a password audit? Here are the options. Option A. wordlist.txt. Option B. john.pot. Option C. shadow. Option D. ntds.dit. Pause the video now if you want time to think about the answer.
The correct answer is B. john.pot. john.pot is the potfile (password hash file) used by John the Ripper password cracker. After a password audit on a domain controller, this file should be removed as it contains all cracked passwords in plaintext or recoverable form, representing a significant security risk if left behind on the system. Now, why are the other options incorrect? Option A is incorrect. wordlist.txt is a common dictionary file used in cracking but is not as critical as the potfile containing actual cracked credentials. Option C is incorrect. The shadow file is a Linux/Unix file and not relevant to Windows domain controllers. Option D is incorrect. ntds.dit is the Active Directory database itself and should never be removed from a domain controller as it's essential for DC operation; it should be secured, not deleted. Therefore, B, john.pot, is the correct answer.
Play from 1:41:48 Question 61. Which of the following is executed when a predetermined event occurs? Here are the options. Option A. Trojan horse. Option B. Logic bomb. Option C. MAC. Option D. Worm. Pause the video now if you want time to think about the answer.
The correct answer is B. Logic bomb. A logic bomb is a malicious code segment that executes automatically when a predetermined condition or event occurs. Unlike other malware types, logic bombs remain dormant until their trigger condition is met, such as a specific date, time, system event, or user action. Once the triggering event happens, the malicious payload activates and executes its payload. Now, why are the other options incorrect? Option A is incorrect. A Trojan horse typically requires user interaction to execute or spread; it is not automatically triggered by events. Option C is incorrect. MAC (Mandatory Access Control) is a security model for controlling access to resources, not executable malware. Option D is incorrect. Worms autonomously replicate and spread continuously, not based on predetermined events. Therefore, B, Logic bomb, is the correct answer.
Play from 1:43:21 Question 62. What is an alternate data stream? Here are the options. Option A. A file stream on an NTFS partition. Option B. Encoded text within an image file. Option C. The Volume Shadow Copy version of a file. Option D. A secondary file stream on a FAT partition. Pause the video now if you want time to think about the answer.
The correct answer is A. A file stream on an NTFS partition. An alternate data stream is a feature of the NTFS file system that allows multiple data streams to be associated with a single file. While a file normally has one main data stream containing its content, NTFS permits additional named streams to be attached, which are not visible through standard file browsing tools. Now, why are the other options incorrect? Option B is incorrect. Encoded text within an image file is steganography, not an alternate data stream. Option C is incorrect. Volume Shadow Copy creates versioned copies of files but is not itself an alternate data stream. Option D is incorrect. FAT partitions do not support alternate data streams; this feature is exclusive to NTFS. Therefore, A, A file stream on an NTFS partition, is the correct answer.
Play from 1:44:57 Question 63. A search using the term inurl: `ViewerFrame?Mode=` is looking for what? Here are the options. Option A. Web accessible devices. Option B. Searchable SMB shares. Option C. Default configured HTTP servers. Option D. Accessible SQL databases. Pause the video now if you want time to think about the answer.
The correct answer is A. Web accessible devices. The search term 'inurl:ViewerFrame?Mode=' is a Google dork query designed to locate web accessible devices like IP cameras, DVRs, and network appliances that expose their management interfaces through this specific URL parameter pattern. This search targets internet-exposed device control panels. Now, why are the other options incorrect? Option B is incorrect. SMB shares are Windows network file shares; the URL pattern targets web interfaces, not SMB protocols. Option C is incorrect. While some results may be default HTTP servers, the specific URL pattern targets device control interfaces, not generic web servers. Option D is incorrect. SQL databases are typically not directly accessible through this web interface URL pattern; this targets device management interfaces. Therefore, A, Web accessible devices, is the correct answer.
Play from 1:46:36 Question 64. What is the definition of an event as it applies to incident handling? Here are the options. Option A. Any observable occurrence in a system and/or network. Option B. The introduction of malicious code into your network. Option C. Something that triggers an alert from your Intrusion Detection System. Option D. An adverse occurrence in an information system and/or network or the threat of such an occurrence. Pause the video now if you want time to think about the answer.
The correct answer is A. Any observable occurrence in a system and/or network. In incident handling terminology, an event is broadly defined as any observable occurrence in a system and/or network. This encompasses all activities, both normal and suspicious, that can be detected or logged. Events become security incidents only when they are determined to have adverse impact or indicate a threat. Now, why are the other options incorrect? Option B is incorrect. While malicious code introduction is a type of incident, this definition is too narrow for the general definition of an event. Option C is incorrect. An IDS alert is a triggered event, but not all events trigger alerts; this is too restrictive. Option D is incorrect. This definition describes an incident or security incident specifically, not an event in general. Therefore, A, Any observable occurrence in a system and/or network, is the correct answer.
Play from 1:48:22 Question 65. What is the term used to describe a Worm that is able to infect a host by exploiting many different application or operating system vulnerabilities? Here are the options. Option A. Metamorphic Worm. Option B. Zero-Day Worm. Option C. Multi-Exploit Worm. Option D. Polymorphic Worm. Pause the video now if you want time to think about the answer.
The correct answer is C. Multi-Exploit Worm. A Multi-Exploit Worm is the correct term for a worm that can infect hosts by exploiting many different application or operating system vulnerabilities. This classification specifically describes the capability to leverage multiple different exploits rather than just one vulnerability or class of vulnerabilities. Now, why are the other options incorrect? Option A is incorrect. Metamorphic worms change their code structure and appearance with each infection to avoid detection, not based on exploiting multiple vulnerabilities. Option B is incorrect. Zero-Day worms exploit previously unknown vulnerabilities, not multiple known or unknown vulnerabilities across different applications. Option D is incorrect. Polymorphic worms use encryption and vary their code to evade detection, not to exploit multiple different vulnerabilities. Therefore, C, Multi-Exploit Worm, is the correct answer.
Play from 1:50:01 Question 66. What version of Windows natively supports SMB encryption? Here are the options. Option A. Windows 8. Option B. Windows Server 2008. Option C. Windows 7. Option D. Windows Server 2003. Pause the video now if you want time to think about the answer.
The correct answer is A. Windows 8. Windows 8 was the first consumer version of Windows to natively support SMB 3.0 encryption. SMB 3.0 introduced transparent encryption for SMB protocol traffic. While Server 2012 also added this support, Windows 8 is the earliest native support among the options given. Windows 7 and Server 2003 required third-party solutions for SMB encryption. Now, why are the other options incorrect? Option B is incorrect. Windows Server 2008 predates SMB 3.0 and lacked native SMB encryption support. Option C is incorrect. Windows 7 did not support SMB 3.0 encryption natively; it required third-party tools. Option D is incorrect. Windows Server 2003 significantly predates SMB 3.0 and has no native encryption support. Therefore, A, Windows 8, is the correct answer.
Play from 1:51:36 Question 67. Which remote control program can be used as an application-level backdoor and typically listens for connections on port 5900? Here are the options. Option A. Back Orifice. Option B. VNC. Option C. Sub7. Option D. Netbus. Option E. Hack-a-tack. Pause the video now if you want time to think about the answer.
The correct answer is B. VNC. VNC (Virtual Network Computing) is a legitimate remote control application that can be exploited as an application-level backdoor and typically listens on port 5900. It provides remote desktop access, making it useful for attackers who can compromise credentials or leave it installed. While Back Orifice, Sub7, and Netbus are also RATs, VNC is the specific tool known for port 5900 operations. Now, why are the other options incorrect? Option A is incorrect. Back Orifice is a RAT but does not typically use port 5900. Option C is incorrect. Sub7 is a RAT but does not typically use port 5900. Option D is incorrect. Netbus is a RAT but does not typically use port 5900. Option E is incorrect. Hack-a-tack is not a recognized remote control tool. Therefore, B, VNC, is the correct answer.
Play from 1:53:20 Question 68. Network mapping provides a security testing team with a blueprint of the organization. Which of the following steps is NOT a part of manual network mapping? Here are the options. Option A. Gathering private and public IP addresses. Option B. Collecting employees information. Option C. Banner grabbing. Option D. Performing Neotracerouting. Pause the video now if you want time to think about the answer.
The correct answer is D. Performing Neotracerouting. Manual network mapping is done by hand: gathering the organization's private and public IP addresses, collecting information about employees, and banner grabbing to identify services and versions. Tracing routes with a tool such as NeoTrace is automated mapping, so it is the step that does not belong to the manual process. Now, why are the other options incorrect? Option A is incorrect. Gathering private and public IP addresses is a core part of manual network mapping. Option B is incorrect. Collecting information about employees is part of the manual mapping of an organization. Option C is incorrect. Banner grabbing identifies running services and their versions and is a manual mapping step. Therefore, D, Performing Neotracerouting, is the correct answer.
Play from 1:54:54 Question 69. Which of the following functions can be used as a countermeasure to a Shell Injection attack? Each correct answer represents a complete solution. (Choose all that apply.) Here are the options. Option A. escapeshellarg(). Option B. mysql_real_escape_string(). Option C. regenerateid(). Option D. escapeshellcmd(). Pause the video now if you want time to think about the answer.
The correct answers are A. escapeshellarg(), and D. escapeshellcmd(). escapeshellarg() (A) and escapeshellcmd() (D) are both PHP functions specifically designed to prevent shell injection attacks. escapeshellarg() escapes arguments to shell commands, and escapeshellcmd() escapes shell metacharacters in command strings. Both functions neutralize attacker-supplied input by treating it as literal data rather than executable code. mysql_real_escape_string() is designed for SQL injection prevention, not shell injection, making it inappropriate for this threat. regenerateid() is a session management function unrelated to shell injection prevention. Now, why are the other options incorrect? Option B is incorrect. mysql_real_escape_string() prevents SQL injection attacks, not shell injection attacks. Option C is incorrect. regenerateid() is used for session management and session fixation prevention, not shell injection defense. Therefore, A and D are the correct answers.
Play from 1:56:40 Question 70. In which of the following attacks does an attacker spoof the source address in IP packets that are sent to the victim? Here are the options. Option A. Dos. Option B. DDoS. Option C. Backscatter. Option D. SQL injection. Pause the video now if you want time to think about the answer.
The correct answer is C. Backscatter. Backscatter refers to the unwanted replies sent back to the spoofed source IP address when an attacker sends packets with forged source addresses. The victim's systems respond to the false source address, creating a backscatter effect that reveals the attack pattern and can be used for detection and analysis. Now, why are the other options incorrect? Option A is incorrect. DoS attacks flood a target with traffic but are not specifically characterized by source address spoofing and the resulting backscatter response. Option B is incorrect. DDoS involves multiple sources attacking simultaneously and, while may use spoofing, is not defined by backscatter specifically. Option D is incorrect. SQL injection is a web application attack that injects malicious SQL code, unrelated to IP spoofing or backscatter. Therefore, C, Backscatter, is the correct answer.
Play from 1:58:15 Question 71. You send SYN packets with the exact TTL of the target system starting at port 1 and going up to port 1024 using hping2 utility. This attack is known as __________. Here are the options. Option A. Port scanning. Option B. Cloaking. Option C. Firewalking. Option D. Spoofing. Pause the video now if you want time to think about the answer.
The correct answer is C. Firewalking. Firewalking is a technique that uses TTL (Time To Live) values in packets to map out firewall rules and identify open ports. By sending SYN packets with the target system's TTL starting at port 1 and incrementing to port 1024, an attacker can determine which ports are allowed through the firewall based on which packets reach the destination. Port scanning discovers open ports, cloaking hides malicious activity, and spoofing falsifies source addresses. Now, why are the other options incorrect? Option A is incorrect. Port scanning discovers open ports directly, but firewalking specifically uses TTL values to map firewall rules. Option B is incorrect. Cloaking refers to hiding malicious content or activity, not using TTL values to probe firewalls. Option D is incorrect. Spoofing involves falsifying source addresses, not using TTL values for firewall reconnaissance. Therefore, C, Firewalking, is the correct answer.
Play from 2:00:08 Question 72. A user is sending a large number of protocol packets to a network in order to saturate its resources and to disrupt connections to prevent communications between services. Which type of attack is this? Here are the options. Option A. Vulnerability attack. Option B. Impersonation attack. Option C. Social Engineering attack. Option D. Denial-of-Service attack. Pause the video now if you want time to think about the answer.
The correct answer is D. Denial-of-Service attack. This describes a Denial-of-Service (DoS) attack where an attacker sends large volumes of protocol packets to saturate network resources and disrupt communications. The goal is to deny legitimate users access to services by overwhelming the target with traffic. Vulnerability attacks exploit specific weaknesses, impersonation attacks forge identity, and social engineering manipulates people, none of which fit this network saturation scenario. Now, why are the other options incorrect? Option A is incorrect. Vulnerability attacks exploit specific security weaknesses in software or systems, not resource saturation. Option B is incorrect. Impersonation attacks involve forging identity or credentials, not flooding networks with packets. Option C is incorrect. Social Engineering attacks manipulate people through deception, not network packet flooding. Therefore, D, Denial-of-Service attack, is the correct answer.
Play from 2:01:58 Question 73. You are recovering a password. The password is encoded as an MD5 hash with salt. Which attack will have a 100% success rate at recovering the original password, given enough time and computing power? Here are the options. Option A. Brute force. Option B. Hybrid. Option C. MD5 Rainbow table. Option D. Dictionary. Pause the video now if you want time to think about the answer.
The correct answer is A. Brute force. A brute force attack will have a 100% success rate given enough time and computing power because it systematically tries every possible password combination until the correct one is found. Even with salt added to the MD5 hash, brute force will eventually find the original password by hashing every possibility and comparing it to the target hash. Rainbow tables are ineffective against salted hashes, and dictionary/hybrid attacks depend on password patterns and may miss complex passwords. Now, why are the other options incorrect? Option B is incorrect. Hybrid attacks combine dictionary words with patterns but will not guarantee success if the password doesn't follow common patterns. Option C is incorrect. MD5 rainbow tables are ineffective against salted hashes because the salt changes the hash value for each password, making precomputed tables useless. Option D is incorrect. Dictionary attacks only try common words and variations, which will not guarantee success against arbitrary passwords with sufficient complexity. Therefore, A, Brute force, is the correct answer.
Play from 2:03:55 Question 74. A company's monthly bill for a pay-per-use LLM API rises tenfold. Logs show a single API key sending a continuous stream of large, low-value requests at all hours. Which OWASP LLM risk does this Denial of Wallet activity fall under? Here are the options. Option A. LLM03 Supply Chain. Option B. LLM06 Excessive Agency. Option C. LLM10 Unbounded Consumption. Option D. LLM02 Sensitive Information Disclosure. Pause the video now if you want time to think about the answer.
The correct answer is C. LLM10 Unbounded Consumption. Unbounded Consumption occurs when an LLM application allows excessive and uncontrolled inferences, leading to denial of service, economic losses, model theft or service degradation. Denial of Wallet is one of its listed examples: a high volume of operations exploits the cost-per-use model of cloud AI services. Mitigations include input size limits, rate limiting and per-user quotas, timeouts and throttling, and monitoring resource use for unusual patterns. MITRE ATLAS tracks the adversary's aim of driving up costs as Cost Harvesting. Now, why are the other options incorrect? Option A is incorrect. Supply chain risk concerns third-party models, packages and data, and nothing here involves a compromised component. Option B is incorrect. Excessive agency involves an LLM taking damaging actions through tools, not a caller flooding the API. Option D is incorrect. No sensitive data was exposed; the harm is the financial cost of uncontrolled usage. Therefore, C, LLM10 Unbounded Consumption, is the correct answer.
Play from 2:06:04 Question 75. What password attack uses a stolen password breach list? Here are the options. Option A. Credential Stuffing. Option B. Pass-the-Hash. Option C. Dictionary Attack. Option D. Man-in-the-Middle. Pause the video now if you want time to think about the answer.
The correct answer is A. Credential Stuffing. Credential stuffing is an attack that uses lists of stolen username-password pairs from previous breaches to attempt unauthorized access to accounts. The attacker leverages the fact that users often reuse credentials across multiple services. Now, why are the other options incorrect? Option B is incorrect. Pass-the-Hash uses captured password hashes to authenticate without knowing the plaintext password. Option C is incorrect. Dictionary attacks use a predefined list of common words, not stolen breach lists. Option D is incorrect. Man-in-the-Middle attacks intercept communications, not using password breach lists. Therefore, A, Credential Stuffing, is the correct answer.
Play from 2:07:26 Question 76. Which of the following types of attacks is mounted with the objective of causing a negative impact on the performance of a computer or network? Here are the options. Option A. Vulnerability attack. Option B. Man-in-the-middle attack. Option C. Denial-of-Service (DoS) attack. Option D. Impersonation attack. Pause the video now if you want time to think about the answer.
The correct answer is C. Denial-of-Service (DoS) attack. A Denial-of-Service (DoS) attack is specifically designed to degrade or eliminate the performance and availability of a computer or network by overwhelming it with requests or traffic. Vulnerability attacks target weaknesses to gain access, man-in-the-middle attacks intercept communications, and impersonation attacks involve pretending to be someone else, none of these have the primary objective of degrading performance. Now, why are the other options incorrect? Option A is incorrect. Vulnerability attacks aim to exploit weaknesses for unauthorized access, not to degrade performance. Option B is incorrect. Man-in-the-middle attacks focus on intercepting and eavesdropping on communications, not degrading performance. Option D is incorrect. Impersonation attacks involve assuming a false identity to gain access, not attacking performance. Therefore, C, Denial-of-Service (DoS) attack, is the correct answer.
Play from 2:09:11 Question 77. A popular forum, where ICS techniques are discussed, loads scripts and ads from multiple external sites. Which attack can an adversary use to leverage this situation to attack this particular industry? Here are the options. Option A. Password-salting. Option B. Defacing. Option C. Watering-hole. Option D. DDoS. Pause the video now if you want time to think about the answer.
The correct answer is C. Watering-hole. A watering hole attack involves compromising legitimate websites frequented by a target industry to distribute malware or conduct attacks. Since this popular ICS forum loads external scripts and ads, an attacker could compromise one of those external sources to inject malicious content that targets forum visitors from the industrial control systems sector. Now, why are the other options incorrect? Option A is incorrect. Password-salting is a cryptographic technique for securing stored passwords, not a web-based attack method. Option B is incorrect. Defacing changes website appearance but doesn't leverage the external script/ad loading mechanism to target a specific industry. Option D is incorrect. DDoS attacks flood targets with traffic but don't specifically leverage the forum's external resource loading or target the ICS industry through this vector. Therefore, C, Watering-hole, is the correct answer.
Play from 2:10:59 Question 78. Which of the following commands is used to access Windows resources from Linux workstation? Here are the options. Option A. mutt. Option B. scp. Option C. rsync. Option D. smbclient. Pause the video now if you want time to think about the answer.
The correct answer is D. smbclient. Smbclient is the command-line tool used to access Windows resources (shares, printers, files) from a Linux workstation. It implements the SMB/CIFS protocol, which is the native file sharing protocol used by Windows systems. This tool allows Linux users to browse and interact with Windows network resources directly from the command line. Now, why are the other options incorrect? Option A is incorrect. Mutt is an email client for Linux, not a tool for accessing Windows network resources. Option B is incorrect. Scp is a secure copy utility for transferring files between systems over SSH, not specifically for accessing Windows network shares. Option C is incorrect. Rsync is a file synchronization utility that can work across platforms but is not the standard tool for accessing Windows shares. Therefore, D, smbclient, is the correct answer.
Play from 2:12:35 Question 79. Which RITA threat hunting functionality is used to identify C2 activity specific to Meterpreter? Here are the options. Option A. Identify long lived TCP connections. Option B. Review visited DNS subdomains. Option C. Analyze gratuitous ARP packets. Option D. Alert on IOC matching behavior. Pause the video now if you want time to think about the answer.
The correct answer is A. Identify long lived TCP connections. RITA (Rapid Threat Intelligence Analysis) identifies command and control (C2) activity by detecting long-lived TCP connections, which is a characteristic behavior of Meterpreter and other C2 frameworks. Meterpreter maintains persistent TCP connections to its command server, making connection duration analysis an effective detection method. Now, why are the other options incorrect? Option B is incorrect. Reviewing visited DNS subdomains helps identify domains contacted but is not specific to Meterpreter C2 activity. Option C is incorrect. Gratuitous ARP packet analysis is used for local network reconnaissance and ARP spoofing detection, not C2 identification. Option D is incorrect. IOC matching is a general detection method that requires known indicators, whereas long-lived connections provide behavioral detection specific to Meterpreter's connection patterns. Therefore, A, Identify long lived TCP connections, is the correct answer.
Play from 2:14:30 Question 80. Adam, a novice web user, is very conscious about the security. He wants to visit the Web site that is known to have malicious applets and code. Adam always makes use of a basic Web Browser to perform such testing. Which of the following web browsers can adequately fill this purpose? Here are the options. Option A. Mozilla Firefox. Option B. Internet explorer. Option C. Lynx. Option D. Safari. Pause the video now if you want time to think about the answer.
The correct answer is C. Lynx. Lynx is a text-based web browser that does not execute JavaScript, Java applets, or other executable code. This makes it ideal for safely testing websites known to contain malicious applets and code, as the malicious content cannot execute. Mozilla Firefox, Internet Explorer, and Safari are graphical browsers that support JavaScript and applets, making them vulnerable to the malicious content Adam wishes to test safely. Now, why are the other options incorrect? Option A is incorrect. Mozilla Firefox supports JavaScript and applets, which would execute malicious code on the website. Option B is incorrect. Internet Explorer supports JavaScript and applets, creating risk when visiting malicious websites. Option D is incorrect. Safari supports JavaScript and applets, exposing the user to execution of malicious content. Therefore, C, Lynx, is the correct answer.
Play from 2:16:17 Question 81. Which of the following malicious code can have more than one type of trigger, multiple task capabilities, and can replicate itself in more than one manner? Here are the options. Option A. Macro virus. Option B. Blended threat. Option C. Trojan. Option D. Boot sector virus. Pause the video now if you want time to think about the answer.
The correct answer is B. Blended threat. A blended threat is defined as malware that combines multiple attack vectors and capabilities, including multiple trigger mechanisms and replication methods. It typically combines characteristics of viruses, worms, and trojans. Macro viruses, boot sector viruses, and trojans are individual malware types with specific characteristics, not the comprehensive multi-vector threat that blended threats represent. Now, why are the other options incorrect? Option A is incorrect. Macro viruses are limited to spreading through macro-enabled documents with a single replication method. Option C is incorrect. Trojans do not typically replicate themselves; they rely on user action or other means for distribution. Option D is incorrect. Boot sector viruses infect the boot sector specifically and have limited trigger and task capabilities compared to blended threats. Therefore, B, Blended threat, is the correct answer.
Play from 2:17:58 Question 82. Which of the following tools uses common UNIX/Linux tools like the strings and grep commands to search core system programs for signatures of the rootkits? Here are the options. Option A. rkhunter. Option B. OSSEC. Option C. chkrootkit. Option D. Blue Pill. Pause the video now if you want time to think about the answer.
The correct answer is C. chkrootkit. Chkrootkit is specifically designed to search for rootkit signatures by leveraging common UNIX/Linux tools like strings and grep to scan system binaries for rootkit modification, and its helper programs such as chkproc and chkdirs check for signs of LKM trojans that hide processes and directories. rkhunter is a rootkit detection tool but uses a different approach based on hash comparisons and vulnerability scanning; OSSEC is a host-based intrusion detection system focused on log analysis; Blue Pill is a hypervisor rootkit, not a detection tool. Now, why are the other options incorrect? Option A is incorrect. rkhunter is a separate rootkit scanner that mainly compares file hashes and checks for known rootkit files, settings and backdoors. Option B is incorrect. OSSEC is a host-based intrusion detection system built around log analysis and file integrity monitoring, not a signature search with strings and grep. Option D is incorrect. Blue Pill is a proof-of-concept hypervisor rootkit, not a tool for detecting rootkits. Therefore, C, chkrootkit, is the correct answer.
Play from 2:19:56 Question 83. Which of the following can be used to perform session hijacking? Each correct answer represents a complete solution. (Choose all that apply.) Here are the options. Option A. Cross-site scripting. Option B. Session fixation. Option C. ARP spoofing. Option D. Session sidejacking. Pause the video now if you want time to think about the answer.
The correct answers are A. Cross-site scripting, and B. Session fixation, and D. Session sidejacking. Cross-site scripting (XSS) can steal session cookies, session fixation forces a user into a known session ID controlled by the attacker, and session sidejacking captures unencrypted session tokens in transit. All three are valid methods for performing session hijacking attacks. Now, why are the other options incorrect? Option C is incorrect. ARP spoofing is used for man-in-the-middle attacks and network-level poisoning, not specifically for session hijacking operations. Therefore, A and B and D are the correct answers.
Play from 2:21:16 Question 84. Which of the following types of attacks is the result of vulnerabilities in a program due to poor programming techniques? Here are the options. Option A. Evasion attack. Option B. Denial-of-Service (DoS) attack. Option C. Ping of death attack. Option D. Buffer overflow attack. Pause the video now if you want time to think about the answer.
The correct answer is D. Buffer overflow attack. Buffer overflow attacks result directly from poor programming techniques where developers fail to implement proper bounds checking on input data. This allows attackers to write beyond allocated memory boundaries, corrupting the stack and potentially executing arbitrary code. Evasion attacks are techniques to bypass security controls, DoS attacks aim to make services unavailable through resource exhaustion, and Ping of Death is a specific attack using malformed ICMP packets, none of these are inherently caused by poor programming practices in the fundamental sense that buffer overflows are. Now, why are the other options incorrect? Option A is incorrect. Evasion attacks are techniques used to circumvent security mechanisms, not inherently rooted in programming vulnerabilities. Option B is incorrect. Denial-of-Service attacks flood resources but are not specifically a result of poor programming techniques. Option C is incorrect. Ping of Death exploits a specific network layer limitation rather than being caused by poor programming practices. Therefore, D, Buffer overflow attack, is the correct answer.
Play from 2:23:06 Question 85. Which of the following hacking tools provides shell access over ICMP? Here are the options. Option A. John the Ripper. Option B. Nmap. Option C. Nessus. Option D. Loki. Pause the video now if you want time to think about the answer.
The correct answer is D. Loki. Loki is a specific hacking tool designed to provide shell access and covert communication over ICMP (Internet Control Message Protocol) packets, which are typically used for ping and network diagnostics. By tunneling shell commands through ICMP, Loki can bypass standard firewall rules that may block TCP/UDP traffic. John the Ripper is a password cracking tool, Nmap is a port scanner, and Nessus is a vulnerability scanner, none of which provide shell access over ICMP. Now, why are the other options incorrect? Option A is incorrect. John the Ripper is a password cracking and hash analysis tool, not a shell access mechanism. Option B is incorrect. Nmap is a network discovery and port scanning tool, not designed for shell access. Option C is incorrect. Nessus is a vulnerability assessment scanner, not a tool for establishing shell connections. Therefore, D, Loki, is the correct answer.
Play from 2:24:46 Question 86. While examining multiple compromised systems, an investigator lists a priority for each machine based on executive input and the type of service and data each machine provides the organization. Which investigative technique does this describe? Here are the options. Option A. Pivoting. Option B. Enumeration. Option C. Attribution. Option D. Triaging. Pause the video now if you want time to think about the answer.
The correct answer is D. Triaging. Triaging is the process of prioritizing compromised systems based on factors such as criticality, service type, data sensitivity, and organizational impact. By listing priorities for each machine based on executive input and the services/data each provides, the investigator is performing triaging to determine which systems require immediate attention. Now, why are the other options incorrect? Option A is incorrect. Pivoting involves moving laterally through a network after compromising one system. Option B is incorrect. Enumeration involves discovering and cataloging systems and services, not prioritizing them. Option C is incorrect. Attribution involves determining who conducted the attack, not prioritizing systems for investigation. Therefore, D, Triaging, is the correct answer.
Play from 2:26:27 Question 87. Which of the following tools can be used for network sniffing as well as for intercepting conversations through session hijacking? Here are the options. Option A. Ethercap. Option B. Tripwire. Option C. IPChains. Option D. Hunt. Pause the video now if you want time to think about the answer.
The correct answer is D. Hunt. Hunt is a network tool specifically designed for network sniffing and session hijacking, allowing attackers to intercept and take over active network conversations and sessions on a LAN. Now, why are the other options incorrect? Option A is incorrect. Ethercap is primarily a network sniffer and man-in-the-middle tool, but Hunt is more specifically associated with session hijacking capabilities. Option B is incorrect. Tripwire is a file integrity monitoring and intrusion detection tool, not a network sniffing or session hijacking tool. Option C is incorrect. IPChains is a Linux firewall tool used for packet filtering and network access control, not for sniffing or session hijacking. Therefore, D, Hunt, is the correct answer.
Play from 2:27:51 Question 88. Which three components must be included in a SQL update statement? Here are the options. Option A. Union, column, value. Option B. Database, row, table. Option C. Table, column, value. Option D. Select, row, table. Pause the video now if you want time to think about the answer.
The correct answer is C. Table, column, value. A SQL UPDATE statement requires three essential components: the TABLE (which table to update), the COLUMN (which field to modify), and the VALUE (what to set the field to). The basic syntax is UPDATE table SET column = value WHERE conditions. These three elements are the minimum required to specify what data to change and how to change it. Now, why are the other options incorrect? Option A is incorrect. Union, column, and value are not the required components; UNION is a SELECT operation, not part of UPDATE syntax. Option B is incorrect. Database, row, and table are not the correct components; you specify columns and values, not rows directly. Option D is incorrect. Select, row, and table are incorrect; SELECT is separate from UPDATE, and UPDATE operates on columns, not rows. Therefore, C, Table, column, value, is the correct answer.
Play from 2:29:31 Question 89. Which security practice is most likely to reduce worm infections? Here are the options. Option A. Encryption. Option B. Awareness training. Option C. Administrative privilege controls. Option D. Device inventory. Option E. Patching. Pause the video now if you want time to think about the answer.
The correct answer is E. Patching. Patching is the most direct and effective defense against worm infections. Worms exploit known vulnerabilities in operating systems and applications, and security patches close these vulnerabilities before worms can spread through them. While awareness training and privilege controls help, they don't address the root cause of worm propagation, which is unpatched software flaws. Now, why are the other options incorrect? Option A is incorrect. Encryption protects data confidentiality but does not prevent worm installation or execution. Option B is incorrect. Awareness training reduces user-initiated attacks like phishing but does not prevent self-propagating worms from exploiting software vulnerabilities. Option C is incorrect. Administrative privilege controls limit damage but do not prevent worms from exploiting unpatched vulnerabilities. Option D is incorrect. Device inventory is useful for management but does not prevent worm infections directly. Therefore, E, Patching, is the correct answer.
Play from 2:31:17 Question 90. Which of the following is a common method for hosts to be infected with bot software? Here are the options. Option A. HTTP Proxies. Option B. Open Relays. Option C. Rootkits. Option D. Worms. Pause the video now if you want time to think about the answer.
The correct answer is D. Worms. Worms are self-replicating malware that spread across networks by exploiting vulnerabilities and creating copies of themselves on other hosts. They are a common delivery mechanism for bot software, as they can automatically propagate and install botnet clients on compromised machines without requiring user interaction. Now, why are the other options incorrect? Option A is incorrect. HTTP Proxies are network infrastructure used for legitimate purposes, not a primary infection vector for bot software. Option B is incorrect. Open Relays are SMTP servers that can be abused for spam but are not a common method for bot infection. Option C is incorrect. Rootkits are post-compromise persistence tools, not an initial infection vector for delivering bots. Therefore, D, Worms, is the correct answer.
Play from 2:32:45 Question 91. In which of the following attacks does an attacker create the IP packets with a forged (spoofed) source IP address with the purpose of concealing the identity of the sender or impersonating another computing system? Here are the options. Option A. Rainbow attack. Option B. IP address spoofing. Option C. Cross-site request forgery. Option D. Polymorphic shell code attack. Pause the video now if you want time to think about the answer.
The correct answer is B. IP address spoofing. IP address spoofing is the technique where an attacker creates IP packets with a forged source IP address to conceal identity or impersonate another system. This is the textbook definition that matches the question's description perfectly. Now, why are the other options incorrect? Option A is incorrect. Rainbow attack refers to precomputed hash table attacks used for password cracking, not IP packet forgery. Option C is incorrect. Cross-site request forgery is a web-based attack where unauthorized commands are transmitted through a trusted user's browser, not an IP-level attack. Option D is incorrect. Polymorphic shell code attack uses code that mutates to evade detection, not IP address forgery. Therefore, B, IP address spoofing, is the correct answer.
Play from 2:34:23 Question 92. What do drive-by attacks typically take advantage of when delivering exploits? Here are the options. Option A. Server upload policy. Option B. User's browser. Option C. Old SSL version. Option D. Weak passwords. Pause the video now if you want time to think about the answer.
The correct answer is B. User's browser. Drive-by attacks typically exploit vulnerabilities in a user's browser or browser plugins (such as outdated Flash, Java, or other add-ons) to deliver malware. When a user visits a compromised or malicious website, the exploit code is executed in the browser context without additional user interaction beyond visiting the page. The vulnerability is in the browser software itself, making it an ideal delivery mechanism. Now, why are the other options incorrect? Option A is incorrect. Server upload policies are not typical vectors for drive-by attacks. Option C is incorrect. While SSL version vulnerabilities exist, drive-by attacks primarily target browser vulnerabilities, not SSL. Option D is incorrect. Weak passwords are not leveraged in drive-by attacks; these attacks do not require authentication. Therefore, B, User's browser, is the correct answer.
Play from 2:35:57 Question 93. There are six control bits to describe a packet's role in a Transmission Control Protocol (TCP) connection. Which of the following control bits initiates a graceful end to a connection? Here are the options. Option A. FIN. Option B. PSH. Option C. SYN. Option D. RST. Option E. URG. Pause the video now if you want time to think about the answer.
The correct answer is A. FIN. The FIN (Finish) control bit is used to initiate a graceful termination of a TCP connection, signaling that the sender has finished sending data. This allows for an orderly shutdown where both sides acknowledge the connection closure. PSH pushes data immediately, SYN initiates connections, RST forcefully resets connections, and URG indicates urgent data, none of these initiate graceful termination. Now, why are the other options incorrect? Option B is incorrect. PSH (Push) forces immediate transmission of buffered data, not connection termination. Option C is incorrect. SYN (Synchronize) initiates new TCP connections, not termination. Option D is incorrect. RST (Reset) forcefully aborts a connection abnormally, not gracefully. Option E is incorrect. URG (Urgent) indicates that urgent data follows, not connection termination. Therefore, A, FIN, is the correct answer.
Play from 2:37:51 Question 94. What is the name of the GUI-based front end for Nmap? Here are the options. Option A. Winmap. Option B. Zenmap. Option C. Nmap-GUI. Option D. Windump. Pause the video now if you want time to think about the answer.
The correct answer is B. Zenmap. Zenmap is the official GUI-based graphical front end for Nmap, providing a user-friendly interface to the powerful Nmap command-line port scanner. It allows users to run scans, save results, and compare scans through a visual interface rather than using the command line. Now, why are the other options incorrect? Option A is incorrect. Winmap is not a recognized Nmap GUI tool. Option C is incorrect. Nmap-GUI is not the official name of Nmap's graphical interface. Option D is incorrect. Windump is a Windows version of tcpdump for packet capturing, not related to Nmap. Therefore, B, Zenmap, is the correct answer.
Play from 2:39:11 Question 95. In which of the following DoS attacks does an attacker send an ICMP packet larger than 65,536 bytes to the target system? Here are the options. Option A. Ping of death. Option B. Jolt. Option C. Fraggle. Option D. Teardrop. Pause the video now if you want time to think about the answer.
The correct answer is A. Ping of death. The Ping of Death is a classic DoS attack in which an attacker sends an ICMP echo request (ping) packet larger than the maximum allowed size of 65,536 bytes. When the target system attempts to process this oversized packet, it can cause a buffer overflow, crash, or system hang. This attack exploits a limitation in older TCP/IP implementations. Now, why are the other options incorrect? Option B is incorrect. Jolt is a DoS attack that sends fragmented ICMP echo requests, not oversized single packets. Option C is incorrect. Fraggle is a DoS attack that exploits the UDP echo and chargen services by sending spoofed broadcast traffic, not ICMP oversized packets. Option D is incorrect. Teardrop sends overlapping IP fragments that cause processing errors, but is not specifically characterized by a single packet larger than 65,536 bytes. Therefore, A, Ping of death, is the correct answer.
Play from 2:40:57 Question 96. Which of the following tools can be used for stress testing of a Web server? Each correct answer represents a complete solution. (Choose two.) Here are the options. Option A. Internet bots. Option B. Scripts. Option C. Anti-virus software. Option D. Spyware. Pause the video now if you want time to think about the answer.
The correct answers are A. Internet bots, and B. Scripts. Internet bots and scripts are both legitimate tools used for stress testing web servers. Bots can generate automated traffic loads, while custom scripts can simulate various request patterns and user behaviors to test server capacity and performance under load. Anti-virus software and spyware are security tools unrelated to stress testing. Now, why are the other options incorrect? Option C is incorrect. Anti-virus software is designed for malware detection and removal, not performance or stress testing. Option D is incorrect. Spyware is malicious software used for unauthorized surveillance, not legitimate stress testing. Therefore, A and B are the correct answers.
Play from 2:42:23 Question 97. In which of the following steps of the incident handling processes does the Incident Handler make sure that all business processes and functions are back to normal and then also wants to monitor the system or processes to ensure that the system is not compromised again? Here are the options. Option A. Eradication. Option B. Lesson Learned. Option C. Recovery. Option D. Containment. Pause the video now if you want time to think about the answer.
The correct answer is C. Recovery. Recovery is the phase where systems and business processes are restored to normal operations after an incident. During recovery, the incident handler verifies that all affected systems are functioning properly and implements monitoring to detect any signs of compromise or re-infection. This occurs after eradication (removing the threat) and before lessons learned. Now, why are the other options incorrect? Option A is incorrect. Eradication removes the threat but does not focus on restoring normal operations and ongoing monitoring. Option B is incorrect. Lessons Learned occurs after recovery to analyze what happened and improve future response procedures. Option D is incorrect. Containment stops the spread of an incident but does not restore systems to normal operation. Therefore, C, Recovery, is the correct answer.
Play from 2:44:06 Question 98. How can an adversary use a hash that was stolen from a Windows account to compromise a Linux server? Here are the options. Option A. Access the server using SSH. Option B. Log in directly to the server. Option C. Become a man-in-the-middle between the Windows and Linux hosts. Option D. Access a SAMBA share on the server. Pause the video now if you want time to think about the answer.
The correct answer is D. Access a SAMBA share on the server. An adversary with a stolen Windows NTLM hash can use pass-the-hash techniques against SAMBA shares on a Linux server. SAMBA implements the SMB protocol and can be configured to authenticate using NTLM hashes, allowing an attacker to authenticate without knowing the plaintext password. This leverages the fact that SAMBA shares use the same hash-based authentication that Windows does. Now, why are the other options incorrect? Option A is incorrect. SSH uses different authentication mechanisms (keys or passwords) and does not accept Windows NTLM hashes. Option B is incorrect. Direct login to a Linux server requires credentials compatible with Linux authentication, not Windows hashes. Option C is incorrect. Being a man-in-the-middle requires network positioning and does not directly use stolen hashes for authentication. Therefore, D, Access a SAMBA share on the server, is the correct answer.
Play from 2:46:00 Question 99. Which of the following is a version of netcat with integrated transport encryption capabilities? Here are the options. Option A. Encat. Option B. Nikto. Option C. Socat. Option D. Cryptcat. Pause the video now if you want time to think about the answer.
The correct answer is D. Cryptcat. Cryptcat is a variant of netcat that adds transport layer encryption capabilities to netcat's functionality, allowing encrypted communication over network connections while maintaining netcat's core features. Now, why are the other options incorrect? Option A is incorrect. Encat is not a recognized standard netcat variant with encryption capabilities. Option B is incorrect. Nikto is a web server vulnerability scanner, not an encryption-enhanced version of netcat. Option C is incorrect. Socat is a utility for relaying connections but is not specifically netcat with integrated encryption. Therefore, D, Cryptcat, is the correct answer.
Play from 2:47:19 Question 100. Which of the following functions can you use to mitigate a command injection attack? Each correct answer represents a part of the solution. (Choose all that apply.) Here are the options. Option A. escapeshellarg(). Option B. escapeshellcmd(). Option C. htmlentities(). Option D. strip_tags(). Pause the video now if you want time to think about the answer.
The correct answers are A. escapeshellarg(), and B. escapeshellcmd(). escapeshellarg() (A) escapes shell argument strings to prevent injection by adding quotes and escaping special characters. escapeshellcmd() (B) escapes shell metacharacters to prevent command injection by neutralizing dangerous characters. Both functions are specifically designed to sanitize user input for shell command contexts. htmlentities() encodes HTML entities for display context, not shell safety. strip_tags() removes HTML tags but does not prevent shell command injection. Now, why are the other options incorrect? Option C is incorrect. htmlentities() is used to prevent cross-site scripting in HTML output, not command injection attacks. Option D is incorrect. strip_tags() removes HTML and PHP tags but does not prevent shell metacharacters from being executed in command contexts. Therefore, A and B are the correct answers.
