ECSA Study Guide
--------------------------------

1. Simplifying risk includes identifying risk itself, asset value, vulnerability and: 
 
Cost of Impact    
Backup Solutions     
(X)Perceived Threat   
Managerial Functions    
  
2. The four typical network security policies can be classified as prudent, permissive, promiscuous and: 
 
Prominent     
Pervasive     
(X)Paranoid    
Pre-emptive     
 
3.What is the definition of a grey hat? 
 
Reformed Black Hat    
A former network administrator    
(X)A white hat who at certain time breaks ethics for his/her own agenda  *  
A person who is tries to exploit weaknesses in systems who is not technically sophisticated     

4. An attackers methods are designed to impact confidentiality, availability, integrity, and which of the following? 
 
file rights    
verification of data    
(X)use control   
privacy     
 
5. When performing a penetration test which of the following is the most important action to take as you gather data?  
 
inform system administrators as soon as a vulnerability is found     
make note of the amount of time spent on each action     
(X)create a log of all actions, results, and findings you have collected   
avoid interaction with any employees associated to the client you are testing    
 
6. When doing a penetration test what is the definition of a race condition?  
 
a deadline imposed for penetration testing to be completed by     
discovering, documenting, informing, and patching a vulnerability in the most efficient and quickest time possible to avoid exploitation    
(X)when an exploit has to beat a currently running process or soon to be running process to the creation or modification of a file   
discovering vulnerabilities before system administrators patch them     

 

7. What is created when a user passes multiple string specifiers ( such as %s%s%s%s or %n%n%n%n) to a program as the parameter, possibly resulting in arbitrary code execution? 
 
a buffer overflow     
(X)a format string vulnerability    
a memory dump    
a heap stack overflow    
 
8. Which of the following products cannot be used as a sniffer? 
 
Etherape     (EtherApe is a graphical network monitor for Unix )
TcpDump     (a tool for network monitoring, protocol debugging and data acquisition)
(X)EtherSnort     
ButtSniff     (actual packet sniffer by Dildog)
 
9. When working under SKA(shared key authentication, what is required for authentication? 
 
a MD5 Hash     
(X)a WEP Key     
a client/server connection specific gateway    
no buffer fragmentation    
 
10. Which one of the following tools cannot be using for OS fingerprinting? 
 
Pof (An advanced passive OS/network fingerprinting utility )    
Nmap     (Free Security Scanner For Network Exploration & Hacking)
(X)Sing     
Hping2    (A network scanner that uses spoofed source address packets) 
 
11. Which penetration technique uses a traceroute-like IP packet analysis to determine wheter or not a particular packet can pass from an attackers host to a destination host through a packet filtering device?  
 
p-trace    (process tracing tool)
route hopping (Hooks for inband signalling to enable communication with routers along a route)   
(X)firewalking    
ACL probing  (This is just a description of what firewalk does)   
 
12. Which of the following is an acceptable use for a vulnerability scanner? 
 
used as a adequate replacement for a full penetration test     
used to infer the true risk of a vulnerability in relation to your data    
(X)used as a DoS tester     
used to mitigate risks created by vulnerabilities     
 
13. Which of the following is not a type of rootkit?  
 
Binary rootkits    (Attaches to binary files)
Kernel rootkits     (Attaches to kernel, typically loadable module)
Library rootkits     (Attaches to DLL's)
(X)Mime rootkits    
 
14. Which of the following is defined by the following statement: a self-replicating program that spreads by inserting copies of itself into other executable code of documents.  
 
Trojan (a Trojan horse is a malicious program)
Malware  (Malicious Software is software designed to infiltrate or damage)   
(X)Virus    
Spyware     (Spyware is computer software that collects personal information about users without their informed consent. )

15. Which of the following is used to lure an attacker away from resources or sensitive areas?  
 
IPS systems    (Intrusion Prevention)
ACLs    (Access Control List on Routers)
(X)Honeypots    
NAT     (Network to Address Translation)

16. When launching a full penetration test on an organization what is the first step in the process?  
 
Using automated vulnerability scanners to catch obvious problems    
Interact with staff members to find what systems could be vulnerable    
Perform information gathering about the company, its functions, and who it might have dealings with    
(X)Get written consent from a executive officer for the penetration test    
 
17. What region of memory is used to dynamically store and manipulate most program function variables?  
 
pagefile     (swapping to the harddisk)
(X)stack     
frame pointer   (pointer to memory location)  
heap     (just program storage)
 
18. Which of the following is a delivery mechanism for a stack, heap, or static overflow to occur? 
 
logical memory allocation    (real memory allocation)
(X)integer overflows    
tcp flood    (doesn't overflow memory)
buffer allocation     (allocation good)
 
19. What important part of the Windows operating system is an integral part of the Windows Security Model and is responsible for enforcing access control? 
 
kernel security module    (framework of kernel hooks that would allow many security models to work as loadable kernel modules.)
(X)security reference monitor    
memory allocation model    (The part of the operating system which handles this responsibility is called the memory manager.)
security access kernel    
 
20. What type of code mutates and changes itself while keeping the original program algorithm intact?  
 
(X)Polymorphic     (mutates and changes itself)
Metamorphic     (rewrites itself)
Encrypted     (doesn't keep the original program)
Tainted     (if it's not good)
  
21. What is the process by which a user is granted privileges for access to resources that were not previously authorized? 
 
unauthorized entry    (not a process)
account locking     
(X)privilege escalation    
information leakage    

22. Which of the following are acceptable sources for information gathering and enumeration?  
 
newsgroups     
dns querying    
search engines     
(X)all of the above    
 
23. In unix operating systems, a penetration tester should be able to identify three valid file permissions including: read, write, and: 
 
locked     (not a file permission)
(X)execute     
empty     (not a file permission)
owner     
 
24. Which of the following is a weakness of modern day Intrusion Detection Systems? 
 
signature based detection    (is an IDS)
statistical profiling     ( some do this)
processing of UDP traffic    ( they do process UDP traffic)
(X)inspecting encrypted traffic    
 
25. Using netcat and connecting to port 80 on a webserver to issue the command GET / HTTP/1.0 is an example of what?  
 
passive reconnaissance   (  the question is not passive)
passive enumeration    ( the question is not passive)
script analysis     ( what script??? there is no code here)
(X)banner grabbing     
 
26. Which of the following protocols can traffic be tunneled through?  
 
SSH     
ICMP     
SSL     
(X)All of the above    
 
27. Which of the following is a technique with which an attacker modifies a user-defined URL string that he/she knows will be processed by a backend SQL server? 
 
SQL command overflow     
SQL record spoofing    
(X)SQL injection     
SQL formatting string     
 
28. Which of the following best describes a type of attack that involves the mass distribution of spoofed email messages with return addresses, links, and brandings that appear to come from legitimate companies or personnel? 
 
Phreaking     ( phone )
(X)Phishing     
Social Engineering  (a collection of techniques used to manipulate people )  
Passive Enumeration    ( the question is not passive)
 
29. The OSSTMM is best described as what? 
 
passive information gathering source    
a hacking guide    (doesn't really give instruction's)
(X)a methodology     
a reporting structure after penetration testing     
 
30. A shadow file is best described as what?  
 
a hidden file in the windows operating system that contains hashed passwords     
a executable file in linux that can be used to exploit a system     
(X)a type of password file    
a hidden Novell Netware password file     
 
31. The purpose of penetration testing can be defined as: 
 
Hacking to impress friends and others so they will acknowledge or hire you    (not)
Identify, correct and mitigate vunerabilities and or risk posed to targeted systems  (never correct)  
(X)Identify and correct underlying systems failed management processes    
Testing a network or host for valuable information in weaknesses    
 
32. Preparation, Detection, Containment, Eradication, Recovery and Followup are steps referred to in which incident response methology? 
 
FRECDP     
(X)PDCERF     
PCDERF     
FEDRESP     
 
33. Which is the most important step in evidence collection for computer forensic analysis?  
 
(X)Chain of Custody    
Image Acquistion    
Image aquisition and maintaining chain of custody    
obtaining a warrant    
 
34. Which of the following is the FOUNDATION for information security? 
 
Employee training and education    
Business ethics    
Balanced Information Security Operations    
(X)Security Policies    
 
35. Shoulder Surfing is a technique for which type of the following attacks? 
 
Covert Operations Attack   
(X)Social Engineering    
Fraudulent Interception Attack    
People Engineering    
  
36. Social Engineering is referred to as the art of 
 
Engaging in after hours parties with business partners    
Applied interaction with skilled engineers    
(X)Tricking people into revealing sensitive information    
Coordination of engineering personnel    

 

37. Which of the following can be implemented to isolate an active network attack? 
 
Spoofing countermeasures    
Firewall Defense Attack Routines    
Intrusion Detection Systems (IDS)    
(X)Honeypots and Honeynets    
 
38. Which of the following describe Denial of Service Attack (DoS) testing benefit? 
 
Baseline for normal use    
Single Points of Failure    
Identify DoS vunerable systems    
(X)All the Above    
 
39. Which of the following mechanisms is use to identify suspicious activities, intrusion attempts and potiential security breaches? 
 
Firewalls (Accept or deny)   
(X)Intrusion Detection Systems (IDS)    
Access Control Lists (ACLs)   (used for authentication) 
Security Audit Logging    (Identifies suspicious activity)
 
40. Which of the following is the most common attack? 
 
Heap Overflows  (most difficult)
String Formatting Flaws  (difficult) 
(X)Buffer Overflows    
Protocol Flaws    (who wants to take over TCP or UDP)
 
41. A set of tools used after cracking a computer system that hides processes, logins as well as ""sniffs"" keystrokes is known as _______? 
 
(X)Rootkit    
Trojan    
Malware    
Spyware    
 
42. You are a security analyst working for a private company out of France.  Your current assignment is to obtain credit card information from a Swiss bank owned by that company.  After initial reconnaissance, you discover that the bank’s security defenses are too strong and would take too long to penetrate.  You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London.  After monitoring some of the traffic, you notice a lot of FTP packets back and forth.  You want to sniff the traffic and extract user names and passwords.  What tool could you use to obtain this information?

Airsnort
(X)Ettercap
Snort 
Raid Sniff

43. Why is a static packet filter firewall not as secure as other types of firewalls?

They cannot look into the packet at all
They cannot restrict IP packets based on their destination
(X)They do not look into the packet past header information
They cannot restrict IP packets based on source

44. What will the following command produce on a website’s login page:
	SELECT email, psswd, login_id, full_name
	FROM members
	WHERE email= someone@somewhere.com’; DROP TABLE members; --’

Deletes the entire members table
(X)This command will not produce anything since the syntax is incorrect
Insert the someone@somewhere.com email address into the members table
Retrieves the password for the first member in the members table

45. After passing her CEH exam, Carol wants to ensure that her entire network is completely secure.  She implements a DMZ statefull firewall, NAT, IPSEC and packet filtering firewall.  Since all of the security measures were taken, none of the hosts on her network can reach the internet.  Why is that?

Statefull firewalls do not work with packet filtering firewalls
IPSEC does not work with packet filtering firewalls
NAT does not work with statefull firewalls
(X)NAT does not work with IPSEC

46. To test your website for vulnerabilities, you type a quotation mark (‘) into the username field.  After you click OK, you receive the following error message window:
	Microsoft OLE DB Provider for ODCB drivers
	Error ‘80040e14’ [Microsoft] [ODCB Microsoft Access Driver] extra
	(in query expression userid’=’3306’) or (‘a’=’a’ AND Password=””.)
	/_users/loginmain.asp, line 41

What can you infer from the error window?
(‘) is a valid username?
SQL injection is not possible
(X)SQL injection is possible
The user for line 3306 in the SQL database has a weak password

47. You are running through a series of tests on your network to test for vulnerabilities.  After normal working hours, you initiate a DoS attack on your external firewall.  The firewall quickly freezes up and becomes unusable.  You then initiate FTP connection from an external IP into your internal network.  The connection is successful even though you have blocked FTP at the external firewall.  What happened?

(X)The firewall failed-open
The firewall’s ACL has been purged
The firewall fail-closed
The firewall failed-bypass

48. You set up SNMP in multiple offices of your company.  Your SNMP manager is not receiving data from other offices like he is the main.  You suspect the firewall changes are to blame. What port should you open up for SNMP to work through firewalls?

170
162
(X)161
173    

49. Software firewalls work at which level of the OSI model?

Network
Transport
Data Link 
(X)Application

50. When setting up a wireless network with multiple access points, why is it important for each access point be on a different channel?

So that the access points will work on different frequencies
Multiple access points can be set up on the same channel without isues
(X)Avoid cross talk
Avoid over saturation of wireless signals

51. You are carrying out the last round of testing for your new website before it goes live.  The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database.  You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities:
	<script>alert(“This is a test.”)</script>

What is the result of this test?
Your website if vulnerable to CSS
Your website is not vulnerable
Your website is vulnerable to SQL injection
Your websire is vulnerable to web bugs

52.You are carrying out the last round of testing for your new website before it goes live.  The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database.  You come across a web security sity that recommends inputting the following code into a search field on web pages to check for vulnerabilities:
	<script>alert(This is a test.)</script>

When you type this and click on search, you receive a pop-up window that says:
“This is a test”
What is the result of this test?

(X)Your website is vulnerable to CSS
Your website is not vulnerable
Your website is vulnerable to SQL Injection
Your website is vulnerable to web bugs

53. Larry is an IT consultant who works for corporations and government agencies.  Larry plans on shuttling down the city’s network using BGP devices and “zombies”.  What type of Penetration Testing is Larry planning to carry out?

Internal Penetration Testing
Router Penetration Testing
Firewall Penetration Testing
(X)DoS Penetration Testing

54. When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

NIPS
(X)Active IDS
Progressive IDS
Passive IDS

55. You are the network administrator for a small bank in Dallas, Texas.  To ensure security, you enact a security policy that requires all users to have 14 character passwords.  After giving your users 2 weeks notice, you change the Group Policy fo force 14 character passwords.  A week later you dump the SAM database from the stand alone server and run a password-cracking tool against it.  Over 99% of the passwords are broken within an hour.
Why are these passwords cracked so easily?

The passwords that were cracked are local accounts on the Domain Controller
Networks using Active Directory never use SAM databases so the SAM database pulled was empty
A password Group Policy change takes at least 3 weeks to completely replicate throughout a network
(X)Passwords of 14 characters or less are broken up into two 7 character hashes

56. Michael works for Kimball Construction Company as a senior security analyst.  As part of yearly security audit, Michael scans his network for vulnerabilities.  Using, Nmap, Michael conduct XMAS scan and most of the ports scanned do not give a response.  In what state are these ports?

(X)Open
Stealth
Closed
Filtered

57. George is a senior security analyst working for a state agency in Florida.  His state’s congress just passed a bill mandating every state agency to undergo a security audit annually.  After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs.  The state bill requires that an IDS with a “time-based induction machine” be used.

What IDS feature must George implement to meet the requirement

Signature based anomaly detection
Pattern matching
Real-time Anomaly
(X)Statistical-based anomaly detection

58. Jonathan is a network administrator who is currently testing the internal security of his network.  He is attempting to hijack a session, using Ettercap, of a user connected to his Web server.  Why will Jonathan?

(X)HTTP protocol does not maintain session
Only DNS traffic can be hijacked
Only FTP traffic can be hijacked
Only HTTPS session can be hijacked

59. Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory.  He has placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button.  A week later, Jason finds in his network logs how an intruder accessed the honey pot and downloaded sensitive information.  Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information.
Why is this not viable?

Entrapment
Intruding into a honeypot is not illegal
Intruding into a DMZ is not illegal
(X)Enticement

60. Paul’s company is in the process of undergoing a complete security audit including logical and physical security testing.  After all logical tests were performed: it is now time for the physical round to begin.  None of the employees are made aware of this round of testing.  The security-auditing firm sends in a technician dressed as an electrician.  He waits outside in the lobby for some employees to get to work and follows behind them when they access the restricted areas.  After entering the main office he is able to get into the server telling the IT manager that there is a problem with the outlets in that room.
What type of attack has the technician performed?

Backtrapping
Fuzzing
(X)Tailgating
Man trap attack

61. Harold is a web designer who has completed a website for ghttech.net.  As part of the maintenance agreement he signed with the client, Harold is performing research online and seeing how much exposure the site has received so far.  Harold navigates to google.com and enters the following search.
	link:www.ghttech.net
What will this search produce?

All search engines that link to .net domains
(X)All sites that link to ghttech.net
Sites that contain the code: link:www.ghttech.net
All sites that ghttech.net links to

62. John and Hillary work at the same department company.  John wants to find out Hillary’s network password so he can take a look at her documents on the file server.  He enables Lophtcrack program to sniffing mode.  John sends Hillary an email with a link to \\FilerServer1\sales.sls
What information will he be able to gather from this?

The SAM file from Hillary’s computer
The SID of Hillary’s network account
(X)Hillary’s network username and password hash
The network shares that Hillary has permission

63. Where would you find a list of well known ports on your Windows 2003 Server?

(X)%systemroot%\system32\drivers\etc\services
%systemroot%\system32\WBEM\services
%systemroot%\system32\services
%systemroot%\driver\etc\services

64. After undergoing a security audit, it was suggested that a hardened computer be placed in the DMZ to run firewall software.  What is this hardened computer called?

(X)Bastion firewall
Perimeter host
Perimeter firewall
Bastion host

65. Harold is the senior security analyst for a law firm on the East coast.  He wants to test the security of his company’s web pages so he decides to use Form Scalpel from an outside connection through a proxy server over HTTPS.  What will be the results from Harold’s test?

Form Scalpel will extract all javascript and perl code
Form Scalpel will not work over an HTTPS connection
(X)He will be able to extract all the forms from the pages
Form Scalpel will not work through a proxy server connection

66. Why is it essential that security analysts know Cisco routers inside and out?

99% of Enterprise routers are Cisco
(X)75% of Enterprise routers are Cisco
90% of Internet core routers are Cisco
25% of Internet core routers are Cisco

67. You are a security analyst performing a reconnaissance on a company you will be carrying out a penetration test for.  You conduct a search for IT jobs on Dice.com and find the following information for an open position

	7+ years experience in Windows server environment
	5+ years experience in Exchange 2000/2003 environment
	Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are required
	MCSA desire, MCSE, CEH preferred
	No Unix/Linux Experience needed

What is this information posted on the job website considered?

Social engineering exploit
Competitive exploit
(X)Information vulnerability
Trade Secret

68. What is the target host IP in the following command?
#>Firewalk –F 80 10.10.150.1 172.16.28.95 –p UDP

Firewalk does not scan target hosts
This command is using FIN packets, which cannot scan target hosts
(X)10.10.150.1
172.16.28.95

69. You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers:
http://172.168.4.131/level/99/exec/show/config

After typing in this URL you are presented with configuration file for that router.  What have you discovered?

(X)HTTP Configuration Arbitrary Administrative Access Vulnerability
Cisco IOS Arbitrary Administrative Access Online Vulnerability
URL Obfuscation Arbitrary Administrative Access Vulnerability
HTML Configuration Arbitrary Administrative Access Vulnerability

70. James is testing the ability of is routers to withstand DoS attacks.  James sends ICMP ECHO requests to the broadcast address of his network.  What type of DoS attack is James testing against his network?

SYN Flood
(X)Smurf
Fraggle
Trinoo

71. Julia is a senior security analyst for Berber Consulting group.  She is currently working on a contract for a small accounting firm in Florida.  They have given her permission to perform social engineering attacks on the company to see if their in-house training did any good.  Julia calls the main number for the accounting firm and talks to the receptionist.  Julia says that she is an IT technician from the company’s main office in Iowa.  She states that she needs the receptionist’s network username and password to troubleshoot a problem they are having.  Julia says that Bill Hammond, the CEO of the company, requested this information.  After hearing the name of the CEO, the receptionist gave Julia all the information she asked for.
What principal of social engineering did Julia use?

Friendship/Liking
Reciprocation
Scarcity
(X)Social Validation

72. As a security analyst you setup a false survey website that will require users to create a username and strong password.  You send the link to all the employees of the company.  What information will you be able to gather?

The MAC address of the employees’ computers
Bank account numbers and the corresponding routing numbers
(X)The employees network usernames and passwords
The IP address of the employees’ computers

73. George is the network administrator of a large Internet company on the west coast.  Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department.  Few Managers are using SFTP programs on their computers.  Before talking to his boss, George wants to have some proof of their activity.
George wants to use Ethercal to monitor network traffic, but only SFTP traffic to and from his network.  What filter should George use in Ethercal

Udp port 22 and host 172.16.281/24
Net port 22
(X)Src port 22 and dst port 22
Src port 23 and dst port 23

74. As part of the reconnaissance you are performing on a network, you use dnstracer to find valuable information.  You type in the following command:
C:\>dnstracer “-q” ptr 164.58.245.134.in-addr.arpa
What information will this return?

The in-addr.arpa record(s) for 164.58.245.134
The host file record for 164.58.245.134
(X)The PTR record(s) for 164.58.245.134
The A record(s) for 164.58.245.134

75. You work as a penetration tester for Hammond Security Consultants.  You are currently working on a contract for the state government of California.  Your next step is to initiate a DoS attack on their network.  Why would you want to initiate a DoS attack on a system you are testing?

Demonstrate that no system can be protected against DoS attacks
(X)Use attack as a launching point to penetrate deeper into the network
List weak points on their network
Show outdated equipment so it can be replaced

76. The objective of this act to protect consumers’ personal financial information held by financial institutions and their service providers

Sarbanes-Oxley 2002
California SB 1386
(X)Gramm-Leach-Bliley Act
HIPAA

77. Paulette works for an IT security consulting company that is currently performing an audit for the firm ACE Unlimited.  Paulette’s duties include logging on to all the company’s network equipment to ensure IOS versions are up-to-date and all the other security setting are as stringent as possible.  Paulette presents the following screenshot to her boss so he can inform the client about the necessary changed needed to be made.  From the screenshot, what changes should the client company make?

The banner should include the Cisco tech support contact information as well
(X)Remove any identifying numbers, names, or version information
The banner should not state that “only authorized personnel may proceed”

78. Why is it important to mention ROI when presenting executive report finding of a security analysis?

There is no need to mention ROI in an executive report since that should be reserved for a financial report
ROI has nothing to do with a thorough security analysis report
(X)Executives will not spend money unless there is a return on investment
There is no need to mention ROI in an executive report since that should be reserved for a technical report

79. You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers.  What type of firewall must you implement to abide by this policy?

Packet filtering firewall
Application-level proxy firewall
(X)Statefull firewall
Circuit-level proxy firewall

80. You are working on a thesis for a doctorate degree in Computer Science.  Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years.  You navigate to archive.org and view the HTML code of news.com.  You then navigate to the current news.com website and copy over the source code.  While searching through the code, you come across something abnormal:
<img src=http://coolwebsearch.com/ads/pixel.news.com width=1 height=1 border=0>
What have you found?

CGI code
Trojan.downloader
Blind bug
(X)Web bug

81. A packet is sent to a router that does not have the packet’s destination address in its route table.  How will the packet get to its proper destination?

(X)Gateway of last resort
Root internet servers
Reverse DNS 
Border Gateway Protocol

82. Harold is a security analyst who has just run the rdisk/s command to grab the backup SAM file on a computer.  Where should Harold navigate on the computer to find the file?

(X)%system$root%\repair
%systemroom%\system32\drivers\etc
%systemroot%\system32\LSA
%systemroot%\LSA

83. Frank is working on a vulnerability assessment for a company on the West coast.  The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments.  After discovering numerous known vulnerabilities detected by temporary IDS he set up, he notices a number of items that show up as unknown but questionable in his logs.  He looks up the behavior on the Internet, but cannot find anything related.
What organization should Frank submit the log to find out if it is a new vulnerability or not

RIPE
APIPA
(X)CVE
IANA

84. For security reasons and to conserve the number of public IP addresses owned by his company, Jason uses NAT to translate the private IPs on his internal network to a private IP.  Jason decides to use 192.169.0.0 through 192.169.255.255 for his internal IPs.  Jason’s company decides to pay for a security audit.  Why would the security audit company recommend that Jason change his internal IP address scheme?

His IP scheme includes too many Class C networks
(X)His IP scheme does not fall under RFC 1918
His IP scheme does not fall under RFC 19872
His IP scheme includes too many class B networks

85. After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks.  What countermeasures could he take to prevent DDoS attacks?

(X)Disable direct broadcasts
Enable direct broadcasts
Disable BGP
Enable BGP

86. Jessica works as a systems administrator for a large electronics firm.  She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests.  What type of scan is Jessica going to perform?

Tracert
Smurf scan
Ping trace
(X)ICMP ping sweep

87. You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas.  You discover Domain Controllers through enumeration.  You connect to one of the Domain Controllers on port 389 using ldp.exe
What are you trying to accomplish here?

Enumerate MX and A records from DNS
Establish a remote connection to the Domain Controller
Poison the DNS records with false records
(X)Enumerate domain user accounts and built-in groups

88. George is performing security analysis for Hammond and Sons LLC.  He is testing security vulnerabilities of their wireless network.  He plans on remaining as “stealthy” as possible during the scan.  Why would a scanner like Nessus not be recommended in this situation?

(X)Nessus is too loud
There are no ways of performing a “stealthy” wireless scan
Nessus is not a network scanner
Nessus cannot perform wireless testing

89. After attending a security class, William decides to set up a dual-honed proxy for the network of his small business. He installs an extra network card on his computer, creates ACL rules, and enables packet forwarding.  William also turns a sniffer to monitor traffic on his new proxy.  He quickly notices source IPs he added to his ACL are still able to send to his network and through his proxy.  Why is William seeing this result?

Only one network card should be used for a dual-homed proxy
(X)Packet forwarding should be disabled
Dual-homed proxies need at least three network cards, two for functionality and one for monitoring
ACL rules should not be used with a proxy

90. Tom works as Unix systems administrator for Jacob and Co.  He needs to run brute force attacks on the passwords of his users to ensure that they are abiding by the corporate password policy.  Where can Tom find these passwords?

/drivers/etc/shadow
/etc/pwd
(X)/etc/passwd
/root/hidden

91. What is the smallest possible Windows shellcode?

(X)800 bytes
1000 bytes
600 bytes
100 bytes

92. Why would a Web administrator remove the .htr extension from the list of application extensions on IIS?

(X)Disallow users from changing their passwords through a web page
Prevent users from accessing server side includes which are a security threat
Prevent users from printing documents through Internet printers
Prevent users from bypassing access control lists on the Web server