Exam simulator: Attacks, Threats, and Vulnerabilities – Part B

A hacker introduced corrupt Domain Name System (DNS) data into a DNS resolver’s cache with the aim of redirecting users either to the wrong websites or to his own computer. What type of DNS attack did the hacker implement in this scenario?

Which of the following attacks is a Network Layer DDoS attack?

The type of hackers that violates computer security systems without permission, stealing the data inside for their own personal gain or vandalizing the system is commonly known as:

A hacker wants to attack a network with the aim of maintaining ongoing access to the targeted network rather than to get in and out as quickly as possible with the ultimate goal of stealing information over a long period of time. What type of attacking technique will the hacker use in this case?

Which of the following terms refers to Information Technology (IT) applications and infrastructure that are managed and utilized without the knowledge of the enterprise’s IT department?

Which of the following statements are true regarding Cloud-based security vulnerabilities? (Choose all the apply)

A zero-day attack is an attack that exploits a potentially serious software security weakness that the vendor or developer may be unaware of.  (True/False)

You have set up an Intrusion detection system (IDS) and suddenly the IDS identifies an activity as an attack but the activity is acceptable behavior. The state, in this case, is known as:

Which of the following options is a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures?

You have been hired as a penetration tester for a company to locate and exploit vulnerabilities in its target’s outward-facing services. You are not provided with any architecture diagrams or source code. This means that you are relying on dynamic analysis of currently running programs and systems within the target network.

Which of the following pentesting assignments are you currently on?

The document that lists out the specifics of your penetration testing project to ensure that both the client and the engineers working on a project know exactly what is being tested when it’s being tested, and how it’s being tested is known as:

__________ is the first step where hacker gathers as much information as possible to find ways to intrude into a target system or at least decide what type of attacks will be more suitable for the target.

Which of the following cybersecurity testing exercise team does not focus exclusively on attacking or defending, but they do both?

The technique of redirecting victims from a current page to a new URL which is usually a phishing page that impersonates a legitimate site and steals credentials from the victims is known as:

The type of hackers that are experts in compromising computer security systems and use their abilities for good, ethical, and legal purposes rather than bad, unethical, and criminal purposes is commonly known as:

What type of attack is when an attacker takes over a regular user account on a network and attempts to gain administrative permissions?

A web developer wants to protect its web application from session hijacking attacks. Which of the following actions should a web developer perform to prevent an attacker from exploiting valid sessions? (Choose all that apply.)

Your company is using a Web Vulnerability Scanner tool named Acunetic to check whether your website and web applications are vulnerable. While you were reviewing a scan report you saw the following URL:

http://test.webarticles.com/show.asp? view= ../../../../../Windows/system.ini  HTTP/1.1

What type of attack is conducted on that website?

Which of the following options is a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures?

You have been hired as a penetration tester for conducting an assessment. The company wants to include ONLY cross-site scripting and SQL injection from the list of authorized activities. Which of the following documents would include this limitation?