Ethical Hacker Security 1 — Questions and Answers
Question 1: What port number is used by LDAP protocol?
- 110
- 389 (Correct answer)
- 464
- 445
Correct answer: 389
The Lightweight Directory Access Protocol (LDAP) uses TCP port 389 for unencrypted communication. LDAP is a widely used application protocol for accessing and maintaining distributed directory information services, such as user accounts and network resources. For secure, encrypted communication, a variant known as LDAPS (LDAP Secure) typically operates over TCP port 636, using SSL/TLS encryption.
Question 2: A penetration tester is hired to do a risk assessment of a company's DMZ. <br> The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems.<br> What kind of test is being performed?
- white box
- grey box
- red box
- black box (Correct answer)
Correct answer: black box
A black box penetration test is conducted with no prior knowledge of the target system's internal structure, architecture, or source code. The tester simulates an external attacker who has no insider information, relying solely on publicly available information and reconnaissance to identify vulnerabilities. This approach provides a realistic assessment of what an external, unauthorized attacker could achieve against the organization's systems.
Question 3: How many bits encryption does SHA-1 use?
- 64 bits
- 128 bits
- 256 bits
- 160 bits (Correct answer)
Correct answer: 160 bits
SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function that produces a fixed-size output of 160 bits (20 bytes), known as a message digest. This hash value is unique for each input and is commonly used for data integrity verification and digital signatures. While historically popular, SHA-1 is now considered cryptographically weak for certain applications due to the discovery of practical collision attacks.
Question 4: What is the least important information when you analyze a public IP address in a security alert?
- ARP (Correct answer)
- Whois
- DNS
- Geolocation
Correct answer: ARP
When analyzing a public IP address in a security alert, information like Whois (owner details), DNS (associated domain names), and Geolocation (physical location) are crucial for identifying the source and nature of a threat. ARP (Address Resolution Protocol), however, maps IP addresses to MAC addresses within a local network segment. It is largely irrelevant for analyzing a public IP address that is external to the local network, as it doesn't provide global routing or ownership information.
Question 5: A medium-sized healthcare IT business decides to implement a risk management strategy. <br> Which of the following is NOT one of the five basic responses to risk?
- Avoid
- Mitigate
- Accept
- Delegate (Correct answer)
Correct answer: Delegate
The five basic responses to risk in risk management are typically: Avoid (eliminate the activity causing the risk), Mitigate (reduce the likelihood or impact of the risk), Accept (live with the risk), and Transfer (shift the risk to another party, often through insurance). 'Delegate' is not considered one of these fundamental risk responses. While tasks related to risk management can be delegated, the ultimate responsibility for the risk itself remains with the organization.
Question 6: When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?
- A bottom-up approach
- A top-down approach (Correct answer)
- A senior creation approach
- An IT assurance approach
Correct answer: A top-down approach
A top-down approach to creating a security program means that security policies and initiatives are driven and actively supported by senior management. This ensures that security is integrated into the organization's overall strategy, receives adequate resources, and is enforced throughout all levels of the company. Senior management's endorsement is critical for the success, effectiveness, and widespread adoption of any security policy or program.
Question 7: Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall.<br> From the following signature, what will Snort look for in the payload of the suspected packets?<br> <br> alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG."BACKDOOR SIG - SubSseven 22";flags: A +; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids, 485;) alert
- The payload of 485 is what this Snort signature will look for.
- Snort will look for 0d0a5b52504c5d3030320d0a in the payload. (Correct answer)
- Packets that contain the payload of BACKDOOR SIG - SubSseven 22 will be flagged.
- From this snort signature, packets with HOME_NET 27374 in the payload will be flagged.
Correct answer: Snort will look for 0d0a5b52504c5d3030320d0a in the payload.
In a Snort signature, the `content` keyword specifies a literal byte sequence that Snort will search for within the packet payload. The value `|0d0a5b52504c5d3030320d0a|` is a hexadecimal representation of a specific string. Therefore, Snort will inspect the packet's payload for this exact hexadecimal sequence to identify potential malicious activity, in this case, related to the SubSseven 22 backdoor, and trigger an alert if found.
Question 8: You work as a Security Analyst for a retail organization. In securing the company's network, you set up a firewall and an IDS. However, hackers are able to attack the network.<br> After investigating, you discover that your IDS is not configured properly and therefore is unable to trigger alarms when needed.<br> What type of alert is the IDS giving?
- True Positive
- True Negative
- False Negative (Correct answer)
- False Positive
Correct answer: False Negative
A false negative occurs when a security system, such as an Intrusion Detection System (IDS), fails to detect an actual attack or malicious activity. In this scenario, hackers successfully attacked the network, but the misconfigured IDS did not trigger an alarm, allowing the breach to go unnoticed. This is a critical failure as it means a real threat was missed, compromising the network's security.
Question 9: How can telnet be used to fingerprint a web server?
- telnet webserverAddress 80 HEAD / HTTP/1.0 (Correct answer)
- telnet webserverAddress 80 PUT / HTTP/1.0
- telnet webserverAddress 80 HEAD / HTTP/2.0
- telnet webserverAddress 80 PUT / HTTP/2.0
Correct answer: telnet webserverAddress 80 HEAD / HTTP/1.0
Fingerprinting a web server involves identifying its software and version for reconnaissance. The `HEAD / HTTP/1.0` command sent via telnet to port 80 (standard HTTP port) requests only the header information of the web page. The server's response headers often reveal crucial details like the server type (e.g., Apache, Nginx, IIS) and its version, which is vital for ethical hacking assessments.
Question 10: During a security audit of IT processes, an IS auditor found that there were no documented security procedures.<br> What should the IS auditor do?
- Terminate the audit
- Identify and evaluate existing practices (Correct answer)
- Create a procedures document
- Conduct compliance testing
Correct answer: Identify and evaluate existing practices
When documented procedures are absent during an audit, the IS auditor's primary responsibility is to understand the actual operational landscape. Identifying and evaluating existing, undocumented practices allows the auditor to assess the current state of security controls. This step is crucial for determining compliance, identifying gaps, and providing actionable recommendations for improvement and proper documentation.
Question 11: Claire is surfing the Web and, after some time, a message pops up stating her system has been infected by malware and offering a button to click for removal of the virus. After she clicks the button, another message window appears stating the system has been quarantined due to the nature of the infection and provides a link with instructions to pay in order to regain control and to clear the virus. Which of the following best describes this infection?
- Spyware
- Ransomware (Correct answer)
- Trojan
- Adware
Correct answer: Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks their computer system, then demands a payment (ransom) to restore access. The scenario explicitly describes the system being 'quarantined' and requiring payment 'to regain control and to clear the virus.' These actions are hallmark characteristics of a ransomware attack, where control is withheld until a payment is made.
Ethical Hacker Security 1
What port number is used by LDAP protocol?