Q31 - Which DNS resource record can indicate how long any "DNS poisoning" could last?

1. MX
2. SOA
3. NS
4. TIMEOUT

Q32 - During the process of encryption and decryption, what keys are shared?During the process of encryption and decryption, what keys are shared?

1. Private keys
2. User passwords
3. Public keys
4. Public and private keys

Q33 - Using Windows CMD, how would an attacker list all the shares to which the current usercontext has access?

1. NET USE
2. NET CONFIG
3. NET FILE
4. NET VIEW

Q34 - What does the following command in netcat do? nc -l -u -p55555 < /etc/passwd

1. logs the incoming connections to /etc/passwd file
2. loads the /etc/passwd file to the UDP port 55555
3. grabs the /etc/passwd file when connected to UDP port 55555
4. deletes the /etc/passwd file when connected to the UDP port 55555

Q35 - Sandra is the security administrator of XYZ.com. One day she notices that the XYZ.com Oracledatabase server has been compromised and customer information along with financial data has beenstolen. The financial loss will be estimated in millions of dollars if the database gets into the hands ofcompetitors. Sandra wants to report this crime to the law enforcement agencies immediately. Whichorganization coordinates computer crime investigations throughout the United States?

1. NDCA
2. NICP
3. CIRP
4. NPC
5. CIA

Q36 - Which of the following is a characteristic of Public Key Infrastructure (PKI)?

1. Public-key cryptosystems are faster than symmetric-key cryptosystems.
2. Public-key cryptosystems distribute public-keys within digital signatures.
3. Public-key cryptosystems do not require a secure key distribution channel.
4. Public-key cryptosystems do not provide technical non-repudiation via digital signatures.

Q37 - A network administrator received an administrative alert at 3:00 a.m. from the intrusiondetection system. The alert was generated because a large number of packets were coming into thenetwork over ports 20 and 21. During analysis, there were no signs of attack on the FTP servers. How should the administratorclassify this situation?

1. True negatives
2. False negatives
3. True positives
4. False positives

Q38 - In the OSI model, where does PPTP encryption take place?

1. Transport layer
2. Application layer
3. Data link layer
4. Network layer

Q39 - Websites and web portals that provide web services commonly use the Simple Object Access Protocol SOAP.Which of the following is an incorrect definition or characteristics in the protocol?

1. Based on XML
2. Provides a structured model for messaging
3. Exchanges data between web services
4. Only compatible with the application protocol HTTP

Q40 - A common cryptographical tool is the use of XOR. XOR the following binary values: 10110001 and 00111010

1. 10001011
2. 11011000
3. 10011101
4. 10111100

Q41 - Which of the following resources does NMAP need to be used as a basic vulnerability scanner covering several vectors like SMB, HTTP and FTP?

1. A. Metasploit scripting engine
2. Nessus scripting engine
3. NMAP scripting engine
4. SAINT scripting engine

Q42 - During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network. What is this type of DNS configuration commonly called?

1. Split DNS
2. DNSSEC
3. DynDNS
4. DNS Scheme

Q43 - A security administrator notices that the log file of the company's webserver contains suspicious entries:

Based on source code analysis, the analyst concludes that the login.php script is vulnerable to

1. command injection.
2. SQL injection.
3. directory traversal.
4. LDAP injection.

Q44 - PGP, SSL, and IKE are all examples of which type of cryptography?

1. Public Key
2. Secret Key
3. Hash Algorithm
4. Digest

Q45 - Which of the following commands runs snort in packet logger mode?

1. ./snort -dev -h ./log
2. ./snort -dev -l ./log
3. ./snort -dev -o ./log
4. ./snort -dev -p ./log

Q46 - An Internet Service Provider (ISP) has a need to authenticate users connecting using analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Frame Relay network. Which AAA protocol is most likely able to handle this requirement?

1. A. RADIUS
2. DIAMETER
3. Kerberos
4. TACACS+

Q47 - Smart cards use which protocol to transfer the certificate in a secure manner?

1. A. Extensible Authentication Protocol (EAP)
2. Point to Point Protocol (PPP)
3. Point to Point Tunneling Protocol (PPTP)
4. Layer 2 Tunneling Protocol (L2TP)

Q48 - Every company needs a formal written document which spells out to employees precisely what they are allowed to use the company's systems for, what is prohibited, and what will happen to them if they break the rules. Two printed copies of the policy should be given to every employee as soon as possible after they join the organization. The employee should be asked to sign one copy, which should be safely filed by the company. No one should be allowed to use the company's computer systems until they have signed the policy in acceptance of its terms. What is this document called?

1. Information Audit Policy (IAP)
2. Information Security Policy (ISP)
3. Penetration Testing Policy (PTP)
4. Company Compliance Policy (CCP)

Q49 - One way to defeat a multi-level security solution is to leak data via

1. a bypass regulator.
2. steganography.
3. a covert channel.
4. asymmetric routing.

Q50 - Your next door neighbor, that you do not get along with, is having issues with their network, so he yells to his spouse the network's SSID and password and you hear them both clearly. What do you do with this information?

1. Nothing, but suggest to him to change the network's SSID and password.
2. Sell his SSID and password to friends that come to your house, so it doesn't slow down your network.
3. Log onto to his network, after all it's his fault that you can get in.
4. Only use his network when you have large downloads so you don't tax your own network.

Q51 - A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a user from the IT department had a dial-out modem installed. Which security policy must the security analyst check to see if dial-out modems are allowed?

1. Firewall-management policy
2. Acceptable-use policy
3. Remote-access policy
4. Permissive policy

Q52 - You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration?
alert tcp any any -> 192.168.100.0/24 21 (msg: "FTP on the network!";)

1. An Intrusion Detection System
2. A firewall IPTable
3. A Router IPTable
4. FTP Server rule

Q53 - Which of the following open source tools would be the best choice to scan a network for potential targets?

1. NMAP
2. NIKTO
3. CAIN
4. John the Ripper

Q54 - Which of the following is the successor of SSL?

1. TLS
2. RSA
3. GRE
4. IPSec

Q55 - Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN standards on a linux platform?

1. Kismet
2. Nessus
3. Netstumbler
4. Abel

Q56 - Joseph was the Web site administrator for the Mason Insurance in New York, who's main Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to administer the Web site. One night, Joseph received an urgent phone call from his friend, Smith. According to Smith, the main Mason Insurance web site had been vandalized! All of its normal content was removed and replaced with an attacker's message ''Hacker Message: You are dead! Freaks!" From his office, which was directly connected to Mason Insurance's internal network, Joseph surfed to the Web site using his laptop. In his browser, the Web site looked completely intact. No changes were apparent. Joseph called a friend of his at his home to help troubleshoot the problem. The Web site appeared defaced when his friend visited using his DSL connection. So, while Smith and his friend could see the defaced page, Joseph saw the intact Mason Insurance web site. To help make sense of this problem, Joseph decided to access the Web site using hisdial-up ISP. He disconnected his laptop from the corporate internal network and used his modem to dial up the same ISP used by Smith. After his modem connected, he quickly typed www.masonins.com in his browser to reveal the following web page:

H@cker Mess@ge:
Y0u @re De@d! Fre@ks!

After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal network, and used Secure Shell (SSH) to log in directly to the Web server. He ran Tripwire against the entire Web site, and determined that every system file and all the Web content on the server were intact. How did the attacker accomplish this hack?

1. ARP spoofing
2. SQL injection
3. DNS poisoning
4. Routing table injection

Q57 - Under what conditions does a secondary name server request a zone transfer from a primary name server?

1. When a primary SOA is higher that a secondary SOA
2. When a secondary SOA is higher that a primary SOA
3. When a primary name server has had its service restarted
4. When a secondary name server has had its service restarted
5. When the TTL falls to zero

Q58 - Which of the following can take an arbitrary length of input and produce a message digest output of 160 bit?

1. SHA-1
2. MD5
3. HAVAL
4. MD4

Q59 - You went to great lengths to install all the necessary technologies to prevent hacking attacks, such as expensive firewalls, antivirus software, anti-spam systems and intrusion detection/prevention tools in your company's network. You have configured the most secure policies and tightened every device on your network. You are confident that hackers will never be able to gain access to your network with complex security system in place.
Your peer, Peter Smith who works at the same department disagrees with you. He says even the best network security technologies cannot prevent hackers gaining access to the network because of presence of "weakest link" in the security chain.
What is Peter Smith talking about?

1. Untrained staff or ignorant computer users who inadvertently become the weakest link in your security chain
2. "zero-day" exploits are the weakest link in the security chain since the IDS will not be able to detect these attacks
3. "Polymorphic viruses" are the weakest link in the security chain since the Anti-Virus scanners will not be able to detect these attacks
4. Continuous Spam e-mails cannot be blocked by your security system since spammers use different techniques to bypass the filters in your gateway

Q60 - Which of the following types of firewalls ensures that the packets are part of the established session?

1. Stateful inspection firewall
2. Circuit-level firewall
3. Application-level firewall
4. Switch-level firewall