Q13. What is one thing a tester can do to ensure that the software is trusted and is not changing or tampering with critical data on the back end of a system it is loaded on?

Q14. The following is part of a log file taken from the machine on the network with the IP address of
192.168.0.110:

What type of activity has been logged?

Q15. SNMP is a protocol used to query hosts, servers, and devices about performance or health status data. This protocol has long been used by hackers to gather great amount of information about remote hosts. Which of the following features makes this possible? (Choose two.)

Q16. A hacker was able to sniff packets on a company’s wireless network. The following information was discovered:

Using the Exlcusive OR, what was the original message?

Q17. Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?

Q18. An unauthorized individual enters a building following an employee through the employee entrance after
the lunch rush. What type of breach has the individual just performed?

Q19. Which of the following is assured by the use of a hash?

Q20. Which security strategy requires using several, varying methods to protect IT systems against attacks?

Q21. You have several plain-text firewall logs that you must review to evaluate network traffic. You know that in order to do fast, efficient searches of the logs you must use regular expressions.
Which command-line utility are you most likely to use?

Q22. A new wireless client is configured to join a 802.11 network. This client uses the same hardware and software as many of the other clients on the network. The client can see the network, but cannot connect. A wireless packet sniffer shows that the Wireless Access Point (WAP) is not responding to the association requests being sent by the wireless client.
What is a possible source of this problem?

Q23. Which of the following is a serious vulnerability in the popular OpenSSL cryptographic software library? This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.

Q24. International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining

Q25. Bob received this text message on his mobile phone: “Hello, this is Scott Smelby from the Yahoo Bank.
Kindly contact me for a vital transaction on: [email protected]”. Which statement below is true?

Q26. Which of the following is the structure designed to verify and authenticate the identity of individuals within
the enterprise taking part in a data exchange?

Q27. Your team has won a contract to infiltrate an organization. The company wants to have the attack be as realistic as possible; therefore, they did not provide any information besides the company name.
What should be the first step in security testing the client?

Q28. Your company was hired by a small healthcare provider to perform a technician assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer?

Q29. Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack of a built-in-bounds checking mechanism?

Output:
Segmentation fault

Q30. An attacker is trying to redirect the traffic of a small office. That office is using their own mail server, DNS server and NTP server because of the importance of their job. The attacker gain access to the DNS server and redirect the direction www.google.com to his own IP address. Now when the employees of the office wants to go to Google they are being redirected to the attacker machine. What is the name of this kind of attack?

Q31. Jimmy is standing outside a secure entrance to a facility. He is pretending to have a tense conversation on his cell phone as an authorized employee badges in. Jimmy, while still on the phone, grabs the door as it begins to close.
What just happened?

Q32. Scenario:
1. Victim opens the attacker’s web site.
2. Attacker sets up a web site which contains interesting and attractive content like ‘Do you want to make
$1000 in a day?’.
3. Victim clicks to the interesting and attractive content url.
4. Attacker creates a transparent ‘iframe’ in front of the url which victim attempt to click, so victim thinks that he/she clicks to the ‘Do you want to make $1000 in a day?’ url but actually he/she clicks to the content or url that exists in the transparent ‘iframe’ which is setup by the attacker.
What is the name of the attack which is mentioned in the scenario?

Q33. PGP, SSL, and IKE are all examples of which type of cryptography?

Q34. During the process of encryption and decryption, what keys are shared?