The correct answer is:

Integrity

Why?

A hash is used to ensure the integrity of data. By generating a unique hash value for data (such as a file), you can compare the hash of the original data with the hash of the received or stored data to ensure that it has not been altered or tampered with.

Why not the others?

❌ Authentication: Authentication is typically achieved using passwords, biometric data, or multi-factor authentication, not by hashing. ❌ Confidentiality: Confidentiality is ensured through encryption, not hashing. ❌ Availability: Availability refers to ensuring that systems and data are accessible when needed, which is unrelated to hashing.

Key Takeaway: Hashing is primarily used to ensure data integrity by verifying that the data has not been changed.

The correct answer is:

Display passwd content to prompt

Why?

The Shellshock vulnerability in Bash allows attackers to execute arbitrary commands through specially crafted environment variables. In the given command:

• x=’(){ :;};echo exploit’ bash Cc ‘cat/etc/passwd’

  • The x variable is being set to a function definition with malicious code.

  • The bash shell is then invoked, triggering the function, which includes the echo exploit command, but more importantly, the attacker is able to inject additional commands (cat /etc/passwd) into the environment.

  • This cat /etc/passwd command is executed, which outputs the contents of the /etc/passwd file (which contains user information like usernames and hashed passwords) to the shell prompt.

Why not the others?

❌ Removes the passwd file:

• The command does not remove the file, it only attempts to display its contents.

❌ Changes all passwords in passwd:

• The attack does not modify the file, only reads it.

❌ Add new user to the passwd file:

• There is no command in the injection that would add users to the file. It only reads and displays the contents of /etc/passwd.

Key Takeaway:
The Shellshock vulnerability allows the attacker to inject arbitrary commands, and in this case, the command is used to display the contents of the /etc/passwd file, which could reveal sensitive information such as user names and hashed passwords.

The correct answer is:

This is a scam as everybody can get a @yahoo address, not the Yahoo customer service employees.

Why?

The key reason this is a scam is that the email address provided is from a free email service (Yahoo), which anyone can sign up for. A legitimate customer service representative from Yahoo Bank would use a corporate email address (e.g., @yahoo.com, but from a business domain, not a personal one). The fact that it’s a personal email address indicates that this is likely a phishing attempt.

Why not the others?

❌ This is a scam because Bob does not know Scott.

• Not knowing the sender is suspicious, but it doesn’t necessarily confirm a scam. Phishing attempts often use fake identities, so while it’s suspicious, this alone isn’t a guarantee of a scam.

❌ Bob should write to scottmelby@yahoo.com to verify the identity of Scott.

• Contacting the email in the message could lead to further phishing attempts or exposing Bob to malicious activity. It’s safer to directly contact the company through official contact methods.

❌ This is probably a legitimate message as it comes from a respectable organization.

• A legitimate organization would not ask Bob to contact an individual using a personal email address. This is a classic phishing tactic.

Key Takeaway:
The use of a free email service like Yahoo is a strong indicator of a scam, especially when the message claims to be from a legitimate organization like Yahoo Bank.

The correct answer is:

A penetration test actively exploits vulnerabilities in the targeted infrastructure, while a vulnerability scan does not typically involve active exploitation.

Why?

Penetration testing goes beyond identifying vulnerabilities — it attempts to exploit them, simulating real-world attacks. This helps confirm whether a vulnerability can actually be used to compromise the system.

Why not the others?

❌ Vulnerability scans only do host discovery and port scanning by default: They do more than that — including identifying known vulnerabilities.

❌ It is not C…: The statement is actually incorrect — pen tests are manual or semi-automated, and vuln scans are usually automated.

❌ Pen tester tools have more comprehensive databases: Not necessarily — vulnerability scanners often have larger CVE databases.

Key Takeaway: Penetration tests simulate real attacks, providing a deeper, more realistic security assessment than just scanning.

The correct answer is:

WHOIS

Why?
WHOIS is a publicly accessible system that allows users to look up information about the ownership and registration details of domain names. It contains details like registrant name, email, phone number, registrar, and expiration dates.

Why not the others?

❌ CAPTCHA: Used to distinguish humans from bots, not related to domain registration.

❌ IANA: Manages global IP address allocation and DNS root zone, but not individual domain ownership records.

❌ IETF: Develops internet standards and protocols, not a database of domain contact information.

Key Takeaway:
WHOIS provides transparency about who owns and manages domain names, making it a valuable tool for security investigations and due diligence.

The correct answer is:

Social Engineering

Why?

Social Engineering involves manipulating or deceiving people into divulging confidential information or granting access to systems, often without the use of technical means. It’s a «low-tech» method because it primarily relies on human interaction and psychological manipulation rather than complex tools or techniques.

Why not the others?

❌ Eavesdropping:

• Eavesdropping is a passive form of interception, typically done using technical tools, such as wiretapping or surveillance, making it a more technical approach.

❌ Scanning:

• Scanning refers to actively probing systems or networks for vulnerabilities, typically using tools like Nmap or others, which is more technical.

❌ Sniffing:

• Sniffing involves capturing and analyzing network traffic, usually with specialized software or hardware, which is a technical method.

Key Takeaway:
Social engineering is a low-tech way of exploiting human psychology to gain unauthorized access to systems, making it effective even without technical skills.

The correct answer is:

An authentication system that creates one-time passwords that are encrypted with secret keys.

Why?

A counter-based authentication system typically involves generating one-time passwords (OTPs) that are based on a counter that increments with each use. These OTPs are typically encrypted with a secret key to ensure security. The most common example of such systems are hardware tokens or software-based authenticators that generate time-based or counter-based passwords, often used in multi-factor authentication (MFA).

Why not the others?

❌ A biometric system that bases authentication decisions on behavioral attributes:

• This describes behavioral biometrics, not counter-based authentication. Behavioral biometrics analyze patterns in actions like typing speed or mouse movements.

❌ A biometric system that bases authentication decisions on physical attributes:

• This describes physical biometrics, such as fingerprints or retina scans, not counter-based authentication.

❌ An authentication system that uses passphrases that are converted into virtual passwords:

• This is more aligned with systems using passphrases for authentication, not counter-based systems generating one-time passwords.

Key Takeaway:
Counter-based authentication systems generate one-time passwords that are encrypted with secret keys, ensuring secure authentication.

The correct answer is:

http-methods

Why?

The http-methods script in Nmap is specifically designed to identify the HTTP methods supported by a web server. This script will help detect critical methods like PUT and DELETE, as well as other common methods such as GET, POST, HEAD, and TRACE.

Why not the others?

❌ http enum:

• This script is used for enumerating web server directories and files, not for detecting HTTP methods.

❌ http-headers:

• This script retrieves the HTTP headers from a web server. While it provides useful information about the server, it does not focus on identifying the available HTTP methods.

❌ http-git:

• This script is specifically designed to detect and enumerate Git repositories on a web server, not for identifying HTTP methods.

Key Takeaway:
To identify the supported HTTP methods on a web server, use the http-methods script in Nmap.

The correct answer is:

BBProxy

Why?

BBProxy is a tool specifically designed to exploit vulnerabilities in BlackBerry devices by using the Blackjacking attack method. Blackjacking allows an attacker to bypass network defenses by impersonating a BlackBerry device, enabling them to gain unauthorized access to a corporate network.

Why not the others?

❌ Paros Proxy:

• Paros Proxy is a web proxy tool used for testing and scanning web applications, but it is not specific to BlackBerry devices or Blackjacking attacks.

❌ Blooover:

• Blooover is a tool used for Bluetooth hacking, specifically targeting Bluetooth devices, not BlackBerry devices.

❌ BBCrack:

• BBCrack is a tool designed to crack BlackBerry device PINs, not for performing Blackjacking attacks.

Key Takeaway:
To perform a Blackjacking attack on a BlackBerry device, BBProxy is the appropriate tool to use.

The correct answer is:

The internal operation of a system is only partly accessible to the tester.

Why?

Gray-box testing is a methodology where the tester has partial knowledge of the internal workings of the system, such as access to source code or system architecture, but does not have complete access to all system details. This approach combines aspects of both white-box testing (where the tester has full access) and black-box testing (where the tester has no internal knowledge).

Why not the others?

❌ Only the external operation of a system is accessible to the tester:

• This describes black-box testing, where the tester has no knowledge of the system’s internal operations.

❌ Only the internal operation of a system is known to the tester:

• This describes white-box testing, where the tester has full knowledge of the internal workings of the system.

❌ The internal operation of a system is completely known to the tester:

• This again describes white-box testing, not gray-box testing.

Key Takeaway:
Gray-box testing provides the tester with limited internal knowledge of the system, which allows them to test more effectively while still focusing on external functionality.

The correct answer is:

Stealth/Tunneling virus

Why?

Stealth/Tunneling virus is designed to actively hide from antivirus programs by intercepting service calls and altering the way they function. These viruses manipulate the system’s calls to prevent the antivirus from detecting them. They may reroute or modify the communication between the system and antivirus tools to evade detection.

Why not the others?

❌ Macro virus:

• A macro virus is a type of virus that infects documents and spreadsheets by exploiting macro language vulnerabilities (e.g., in Microsoft Word or Excel), but it does not specifically hide by altering system calls.

❌ Cavity virus:

• A cavity virus is designed to embed itself into the «unused» space in a file, filling cavities within the file to avoid detection, but it does not manipulate system calls or hide in the way a stealth virus does.

❌ Polymorphic virus:

• A polymorphic virus changes its appearance every time it infects a system, making it harder to detect based on its signature. However, it does not specifically hide by altering system calls.

Key Takeaway:
A stealth/tunneling virus hides from detection by intercepting and altering system calls made by antivirus software.

The correct answer is:

Reconnaissance

Why?

Reconnaissance refers to the process of gathering information about a target system, organization, or individual. In the context of phishing attacks, this involves hackers researching a company’s internal structure, including logos, email formatting, key personnel (like the CEO), and other identifiers, to create a more convincing phishing message.

Why not the others?

❌ Exploration:

• Exploration is not a standard term in the context of cybersecurity attacks. Reconnaissance is the correct term for gathering information.

❌ Investigation:

• Investigation refers to the process of analyzing or studying something after an event has occurred, often in the context of incident response or forensics, rather than gathering intelligence for an attack.

❌ Enumeration:

• Enumeration involves gathering more specific details about a system, such as usernames, shares, or services during an attack, but does not specifically refer to the broader research phase like reconnaissance.

Key Takeaway:
Reconnaissance is the phase where hackers gather information about a company to create more convincing and targeted phishing attacks.

The correct answer is:

ESP transport mode

Why?

ESP (Encapsulating Security Payload) transport mode is used for encrypting the payload of packets while leaving the original IP header intact. This mode is ideal for securing communication within the same LAN as it ensures confidentiality and data integrity without needing to modify the entire packet. It is typically used for end-to-end communication, such as between two hosts within a local network.

Why not the others?

❌ ESP confidential:

• There is no mode called «ESP confidential» in IPSec. The correct term is ESP transport mode for confidentiality.

❌ AH permiscuous:

• AH (Authentication Header) is used for packet-level authentication, but it does not provide encryption (confidentiality). The term «permiscuous» is not a standard term used in IPSec modes.

❌ AH Tunnel mode:

• AH tunnel mode is used for authenticating the entire IP packet, including the header, and is typically used in site-to-site communication or when routing traffic over untrusted networks. It does not provide confidentiality, unlike ESP.

Key Takeaway:
For securing data within the same LAN while ensuring confidentiality, ESP transport mode is the appropriate choice.

The correct answer is:

Ettercap

Why?

Ettercap is a popular tool for performing Man-in-the-Middle (MITM) attacks on local networks, especially with ARP poisoning. It can intercept and modify traffic, including injecting malicious HTML or other types of content into the communication between two hosts. In this scenario, Ettercap would be the most likely tool used to inject HTML code and exploit the machines.

Why not the others?

❌ Wireshark:

• Wireshark is a network protocol analyzer used for sniffing traffic. It doesn’t have the ability to modify or inject content into packets like Ettercap.

❌ Aircrack-ng:

• Aircrack-ng is primarily a suite of tools for cracking WEP and WPA-PSK encryption keys on wireless networks. It is not typically used for injecting HTML or performing MITM attacks.

❌ Tcpdump:

• Tcpdump is another network sniffer, similar to Wireshark, that captures packets for analysis. Like Wireshark, it does not have the capability to modify or inject data into the communication.

Key Takeaway:
Ettercap is the tool most likely used for injecting malicious HTML in a MITM attack, as it specializes in packet interception and modification.

The correct answer is:

A web server facing the Internet, an application server on the internal network, a database server on the internal network

Why?

This architecture ensures that the web server, which is exposed to the Internet, handles public-facing requests, while the application and database servers are kept within the internal network for added security. This setup minimizes the risk of exposing sensitive internal systems to external threats while allowing proper communication between the servers.

Why not the others?

❌ All three servers need to be placed internally:

• This setup would not allow the application to be accessible from the Internet, which is required for the software package to function correctly.

❌ A web server and the database server facing the Internet, an application server on the internal network:

• Exposing the database server to the Internet poses a significant security risk, as the database contains sensitive data. It should be kept in the internal network.

❌ All three servers need to face the Internet so that they can communicate between themselves:

• Exposing all servers to the Internet increases the attack surface, especially the database server, which should be protected behind the web and application layers.

Key Takeaway:
For better security, the web server should face the Internet, while the application and database servers should be kept on the internal network.

The correct answer is:

Accept the risk

Why?

Since the risk has been reduced from 50% to 10% through implemented controls, and the risk threshold is 20%, the risk is now below the threshold and deemed acceptable. It would be unnecessary to invest more resources in further reducing the risk below 10%, as doing so may not yield proportional benefits.

Why not the others?

❌ Introduce more controls to bring risk to 0%:

• This is not cost-effective. Reducing the risk further may require excessive resources with diminishing returns, especially since the risk is already well below the threshold.

❌ Mitigate the risk:

• Mitigating the risk further is unnecessary, as the risk is already below the threshold of 20%. More mitigation might not result in a sufficient return on investment.

❌ Avoid the risk:

• Avoiding the risk entirely could require a complete overhaul of the application or business process, which may not be feasible or beneficial in terms of business goals and profit.

Key Takeaway:
Since the risk is now below the threshold, the best decision is to accept the risk, allowing the project to continue with the most business profit.

The correct answer is:

3

Why?

A multihomed firewall is one that has more than one network interface, typically used to separate networks (such as an internal network, a demilitarized zone (DMZ), and an external network). The minimum number of network connections for a basic multihomed firewall is 3: one for the internal network, one for the external network (Internet), and one for the DMZ.

Why not the others?

❌ 5:

• This is an overestimation. While a multihomed firewall can have more than 3 interfaces for more complex network setups, 3 is the minimum for basic multihoming.

❌ 4:

• This is also overkill for a basic multihomed firewall. The minimum requirement is 3 interfaces.

❌ 2:

• A 2-interface firewall is typically not considered «multihomed» because it only connects two networks, not three (internal, external, and DMZ).

Key Takeaway:
The minimum number of network connections for a multihomed firewall is 3, to separate the internal network, DMZ, and external network.

The correct answer is:

Rotate employees handling credit card transactions on a yearly basis to different departments.

Why?

This is not a PCI compliance recommendation. PCI focuses on securing cardholder data, controlling access, and using encryption, but rotating employees between departments is not part of the standard.

Why not the others?

❌ Use a firewall between the public network and the payment card data:

• This is a PCI requirement to protect cardholder data from unauthorized access.

❌ Use encryption to protect all transmission of cardholder data over any public network:

• Encrypting cardholder data during transmission is a key PCI recommendation.

❌ Limit access to cardholder data to as few individuals as possible:

• This is a best practice under PCI compliance to reduce risk.

Key Takeaway:
PCI compliance focuses on securing data through encryption, access control, and firewalls, but rotating employees is not a recommended practice.

The correct answer is:

The solution implements the two authentication factors: physical object and physical characteristic

Why?

• The solution combines two authentication factors:

  1. Something you have (RFID badge – a physical object).

  2. Something you are (walking pattern – a physical characteristic, biometric).

Why not the others?

❌ Although the approach has two phases, it actually implements just one authentication factor:

• This is incorrect because two distinct factors (RFID badge and walking pattern) are used.

❌ The solution will have a high level of false positives:

• There’s no direct evidence suggesting this would be the case; it depends on the accuracy of the walking pattern recognition technology.

❌ Biological motion cannot be used to identify people:

• This is incorrect, as biological motion (e.g., walking patterns) can indeed be used for identification in biometric systems.

Key Takeaway:
The system uses both a physical object (RFID badge) and a physical characteristic (walking pattern), making it a multi-factor authentication solution.

The correct answer is:

Meet-in-the-middle attack

Why?

• This attack targets 2-key DES, where encrypting with two keys is no more secure than using a single key. The attacker tries to meet in the middle by encrypting the plaintext with one key and decrypting the ciphertext with the second key.

Why not the others?

❌ Man-in-the-middle attack: Intercepts communication, not related to breaking DES.

❌ Replay attack: Involves retransmitting valid data, not breaking encryption.

❌ Traffic analysis attack: Involves analyzing traffic patterns, not attacking DES encryption.

Key Takeaway:
The meet-in-the-middle attack shows that 2-key DES is no more secure than 1-key DES.

Step 1: Calculate SLE (Single Loss Expectancy)

SLE represents the total cost for a single event of loss, in this case, a hard drive failure.

SLE formula:

$$SLE=AssetValue\times ExposureFactor(EF)$$

Given:

• Asset Value = Cost of a new hard drive = $300

• EF = 1 (100%), meaning the asset is fully lost in the failure

So:

$$SLE=300\times 1=300$$

Step 2: Calculate ARO (Annual Rate of Occurrence)

ARO represents how often the event (hard drive failure) happens in a year.

Given:

• The failure happens once every 3 years.

So:

ARO=13 (once every 3 years)=0.33ARO = \frac{1}{3} \text{ (once every 3 years)} = 0.33ARO=31​ (once every 3 years)=0.33

Step 3: Calculate ALE (Annual Loss Expectancy)

ALE is the total expected loss in a year, which is the product of SLE and ARO.

ALE formula:

$$ALE=SLE\times ARO$$

Substitute the values:

$$ALE=300\times 0.33=99$$

Step 4: Calculate the cost of the recovery operation per year

Next, we calculate the cost of recovery per year.

• Time to restore OS and software: 10 hours

• Time to restore the database: 4 hours

• Total time: 10 + 4 = 14 hours

• Recovery person’s hourly wage: $10/hour

So, the recovery cost per failure is:

$$14\times 10=140\text{ dollars}$$

Step 5: Total annual cost (SLE + recovery cost)

Now, we add the SLE and annual recovery cost to get the total annual cost.

$$TotalAnnualCost=ALE+(Recoverycostperfailure\times ARO)$$ $$TotalAnnualCost=99+(140\times 0.33)=99+46.2=145.2$$

Closest Approximate Answer:

The closest approximate cost of this replacement and recovery operation per year is $146.

Answer: $146.

The correct answer is:

Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.

Why?

SSL/TLS uses asymmetric cryptography at the beginning of a session to securely exchange a symmetric session key. After that, the session uses symmetric encryption (like AES), which is faster and more efficient for encrypting bulk data.

Why not the others?

❌ Supporting both types of algorithms allows less-powerful devices…: That’s a side benefit, not the main advantage.

❌ Symmetric algorithms provide a failsafe…: SSL/TLS doesn’t fall back to symmetric if asymmetric fails.

❌ Symmetric encryption allows the server to transmit keys out-of-band: That’s incorrect — the key is transmitted securely within the session using asymmetric encryption.

Key Takeaway: SSL/TLS combines the security of asymmetric encryption for key exchange with the efficiency of symmetric encryption for ongoing communication.

The correct answer is:

Open-source intelligence

Why?

• Open-source intelligence (OSINT) refers to the collection of publicly available information that can be used for actionable intelligence. This includes data from sources like websites, social media, public records, and other freely accessible materials. OSINT is often used in cybersecurity, threat analysis, and investigative work.

Why not the other options?

❌ Real intelligence:

• «Real intelligence» is not a specific term in the context of information gathering and lacks the precise meaning associated with OSINT.

❌ Social intelligence:

• Social intelligence refers to the ability to understand and manage social situations and relationships, not specifically about collecting publicly available information.

❌ Human intelligence:

• Human intelligence (HUMINT) is derived from human sources, such as direct interaction or espionage, rather than from publicly available, overt information.

Key Takeaway:
The correct term for the collection of publicly available, actionable information is Open-source intelligence (OSINT).

The correct answer is:

Network-based intrusion detection system (NIDS)

Why?

• NIDS is best suited for large environments where critical assets require extra scrutiny. It monitors network traffic across sensitive segments and is ideal for identifying malicious activities in real-time, providing insights into traffic between systems and detecting potential attacks targeting networked devices or critical infrastructure.

Why not the other options?

❌ Honeypots:

• Honeypots are decoy systems used to attract attackers and study their behavior. They are not designed for comprehensive network monitoring or detecting threats in real environments.

❌ Firewalls:

• Firewalls primarily control traffic flow and block unauthorized access but do not provide in-depth analysis of network traffic or detect sophisticated attacks like a NIDS.

❌ Host-based intrusion detection system (HIDS):

• HIDS is useful for monitoring individual hosts but does not offer the broad network monitoring capabilities needed for large environments with critical assets.

Key Takeaway:
For large environments with critical assets, NIDS provides the necessary visibility and monitoring of sensitive network segments, making it the best choice for detecting network-based threats.

The correct answer is:

Determine the impact of enabling the audit feature.

Why?

• Before enabling auditing, the bank needs to assess how the audit feature will affect system performance, storage, and operational workflows. Understanding the potential impact ensures that the system will handle the audit logs effectively without causing issues such as performance degradation or excessive storage consumption.

Why not the other options?

❌ Perform a vulnerability scan of the system:

• A vulnerability scan is important for overall security but doesn’t directly relate to enabling auditing, which is the focus of the question.

❌ Perform a cost/benefit analysis of the audit feature:

• While cost/benefit analysis is valuable, the primary concern first is understanding the system’s capacity to handle auditing, rather than the costs and benefits themselves.

❌ Allocate funds for staffing of audit log review:

• Staffing considerations are important but come after understanding the impact of enabling auditing. It’s better to know the system’s needs first.

Key Takeaway:
The bank should first determine the impact of enabling auditing to ensure the system can handle it appropriately before proceeding with implementation.

The correct answer is:

Perform an Xmas scan

Why?

• The CoX flag in Nmap is shorthand for an Xmas scan, which is a type of scan that sends a TCP packet with the FIN, URG, and PSH flags set. This can be used to determine if a port is open or closed by analyzing the response (or lack thereof) from the target.

Why not the other options?

❌ Perform an eXpress scan:

• There is no «eXpress scan» option in Nmap. This is a misunderstanding of the flag.

❌ Output the results in truncated format to the screen:

• Nmap doesn’t use the CoX flag for truncation; truncation of results is handled differently, typically with the -v (verbose) or --max-retries flags.

❌ Output the results in XML format to a file:

• To output in XML format, the -oX flag is used, not CoX.

Key Takeaway:
The CoX flag in Nmap is used to perform an Xmas scan, a stealthy scanning technique that sends a combination of TCP flags to probe open ports.

The correct answer is:

Brute force

Why?

• Brute force tries all possible combinations of characters until the correct one is found. It’s the slowest because it doesn’t use optimizations like dictionary attacks or rainbow tables.

Why not the other options?

❌ Dictionary attack:

• Faster than brute force, as it uses a predefined list of common passwords.

❌ Shoulder surfing:

• A physical method that doesn’t require computational effort and isn’t a cracking technique.

❌ Rainbow tables:

• Faster than brute force, but depends on precomputed tables and doesn’t work well against salted passwords.

Key Takeaway:
Brute force is the most time-consuming and effort-intensive method.

The correct answer is:

File system permissions

Why?

• The presence of unknown files (such as a tarball, shell scripts, and a binary) in the root directory, uploaded and executed by an anonymous FTP user, indicates that the FTP server is improperly configured. Specifically, the file system permissions are likely misconfigured, allowing an unauthorized user (the anonymous FTP user) to upload files to critical areas of the server and execute them. Normally, anonymous users should not have such privileges, especially on sensitive directories like the root directory.

Why Not the Other Options?

❌ Privilege escalation:

• Privilege escalation occurs when a user gains higher-level access than initially granted, often by exploiting a vulnerability in the system. In this case, the issue is more related to misconfigured file system permissions, not escalating privileges once logged in.

❌ Directory traversal:

• Directory traversal is an attack where an attacker navigates outside the intended directory, often trying to access sensitive files. However, in this case, the attacker seems to be uploading files directly into the root directory, not trying to navigate beyond the allowed directory.

❌ Brute force login:

• Brute force login attacks involve repeatedly trying different combinations of usernames and passwords to gain unauthorized access. However, this scenario indicates that the attacker used an anonymous FTP login, not brute-forcing credentials.

Key Takeaway:
The root cause of this attack is improper file system permissions, which allowed the anonymous FTP user to upload and execute malicious files, including the “nc” binary, effectively giving the attacker remote control.

The correct answer is:

Clickjacking Attack

Why?

• A clickjacking attack involves placing a transparent or disguised iframe over a legitimate web page, tricking the victim into clicking on something other than what they perceive. In this case, the victim thinks they are clicking on a «Do you want to make $1000 in a day?» URL, but they are actually clicking on a hidden link controlled by the attacker.

Why Not the Other Options?

❌ Session Fixation:

• Session fixation is an attack where the attacker sets a user’s session ID to a known value, allowing the attacker to hijack the session. It is unrelated to tricking users into clicking invisible links.

❌ HTML Injection:

• HTML Injection involves inserting malicious HTML or JavaScript into a page, but it doesn’t specifically involve tricking a user into clicking an invisible link.

❌ HTTP Parameter Pollution:

• HTTP Parameter Pollution is an attack where attackers inject malicious parameters into the URL or HTTP request. It’s not related to the scenario of tricking the user with a transparent iframe.

Key Takeaway:
Clickjacking is the term for attacks that manipulate user clicks, often by using invisible or misleading elements, as demonstrated in this scenario.

The correct answer is:

Kismet

Why?

• Kismet is a powerful tool for detecting wireless networks on a Linux platform. It supports various 802.11 standards (including 802.11a/b/g/n) and can passively detect and capture wireless LANs, identifying details such as SSIDs, signal strength, encryption type, and more.

Why Not the Other Options?

❌ Abel:

• Abel is not a tool for wireless network detection; it is a password cracking tool.

❌ Netstumbler:

• Netstumbler is a tool for detecting wireless networks, but it is designed for Windows, not Linux.

❌ Nessus:

• Nessus is a vulnerability scanner, not specifically for detecting wireless LANs. It is used for security assessments and vulnerability scanning, including network-based vulnerabilities.

Key Takeaway:
For detecting wireless LANs and sniffing 802.11 networks on Linux, Kismet is the go-to tool.

The correct answer is:

Traffic is Blocked on UDP Port 53

Why?

• UDP port 53 is used for DNS queries. If this port is blocked, the system cannot resolve domain names (like www.google.com) into IP addresses. That’s why typing the IP address directly into the browser works, but using the URL does not.

Why Not the Other Options?

❌ Traffic is Blocked on TCP Port 80:

• If TCP port 80 (used for HTTP) were blocked, even accessing the website via IP wouldn’t work — but in this case, IP access is working, so port 80 is clearly open.

❌ Traffic is Blocked on TCP Port 54:

• TCP port 54 is not used for standard web or DNS services, so blocking it would not cause this kind of issue.

❌ Traffic is Blocked on UDP Port 80:

• Port 80 typically uses TCP, not UDP. Blocking UDP 80 wouldn’t affect normal web browsing or DNS resolution.

Key Takeaway:
If URLs don’t work but IPs do, suspect DNS issues — most commonly caused by blocking UDP port 53, which is essential for name resolution.

The correct answer is:

IPsec

Why?

• IPsec (Internet Protocol Security) operates at Layer 3 (Network Layer) and provides end-to-end encryption for all traffic (including FTP) by:

  • Encrypting packets at the IP level.

  • Supporting transport mode (host-to-host) and tunnel mode (network-to-network).

• Unlike application-layer solutions (e.g., SFTP, FTPS), IPsec secures all traffic between endpoints, regardless of the application protocol.

Why Not the Other Options?

❌ SFTP (SSH File Transfer Protocol):

• Operates at Layer 7 (Application Layer) over SSH, not Layer 3.

❌ SSL (Secure Sockets Layer):

• Operates at Layer 5 (Session Layer) and is used for HTTPS, not FTP.

❌ FTPS (FTP Secure):

• Operates at Layer 7 (Application Layer) by adding SSL/TLS to FTP.

Key Takeaway:

For Layer 3 encryption of FTP (or any protocol), IPsec is the only option.

The correct answer is:

Using encryption protocols to secure network communications

Why?

• Encryption (e.g., TLS/SSL, IPsec, WPA3) renders intercepted data unreadable to sniffers.

• Even if traffic is captured, the attacker cannot decipher it without cryptographic keys.

• Examples: HTTPS for web, SSH for remote access, VPNs for network tunnels.

Why Not the Other Options?

❌ «Register all machines’ MAC addresses»:

• MAC filtering prevents unauthorized devices from connecting but does not encrypt traffic.

❌ «Use static IP addresses»:

• IP assignment methods have no impact on sniffing prevention.

❌ «Restrict physical access to server rooms»:

• While important for physical security, it doesn’t stop network-based sniffing (e.g., MITM attacks).

Key Takeaway:

Encryption is the only definitive defense against sniffing. Other measures are supplementary.

The correct answer is:

nmap -T4 -F 10.10.0.0/24

Why?

• -T4: Enables aggressive timing (faster scan).

• -F: Scans 100 most common ports (fast enumeration).

• 10.10.0.0/24: Targets the entire subnet of the compromised server (10.10.0.5).

Why Not the Other Options?

❌ nmap -T4 -q 10.10.0.0/24:

• -q is not a valid Nmap flag.

❌ nmap -T4 -r 10.10.1.0/24:

• -r disables random port order (slower), and the subnet (10.10.1.0/24) is incorrect for 10.10.0.5.

❌ nmap -T4 -O 10.10.0.0/24:

• -O enables OS detection (unnecessary for quick host discovery).

Key Takeaway:

For rapid network enumeration, combine:

• -T4 (speed) + -F (fast port scan) + correct subnet.

The correct answer is:

Whisker

Why?

• Whisker is a classic tool designed specifically for IDS evasion, including session splicing (fragmentation of attack payloads across multiple packets).

• It manipulates HTTP requests by splitting them into small, irregular packets to bypass signature-based IDS detection.

Why Not the Other Options?

❌ tcpsplice: A tool for TCP stream manipulation (e.g., merging logs), not IDS evasion.
❌ Burp: A web proxy for application testing, not packet fragmentation.
❌ Hydra: A password-cracking tool, unrelated to session splicing.

Key Takeaway:

Whisker pioneered IDS evasion techniques like session splicing, making it the correct choice.

The correct answer is:

Residual risk

Why?

• Residual risk is the remaining risk after:

  • Implementing security controls (countermeasures).

  • Mitigating known vulnerabilities.

• It represents the acceptable risk level an organization agrees to tolerate.

Why Not the Other Options?

❌ Impact risk: Not a standard term; impact refers to the severity of a risk, not its remaining level.
❌ Deferred risk: Risks postponed for later handling (e.g., due to budget constraints), not residual.
❌ Inherent risk: The baseline risk before any controls are applied.

Key Takeaway:

Residual risk = Risk left after mitigation. Organizations must monitor it to decide if further action is needed.

The correct answer is:

Evil Twin Attack

Why?

• An Evil Twin Attack involves setting up a rogue Wi-Fi access point that mimics a legitimate network (e.g., «Free Airport Wi-Fi»).

• Attackers use it to:

  • Eavesdrop on communications (e.g., steal passwords, credit card details).

  • Redirect users to phishing sites.

• It’s the wireless equivalent of phishing, exploiting trust in familiar network names.

Why Not the Other Options?

❌ Sinkhole Attack: Redirects traffic to a malicious node (common in IoT/botnets, not Wi-Fi spoofing).
❌ Collision Attack: Cryptographic attack (e.g., forcing hash collisions), unrelated to Wi-Fi.
❌ Signal Jamming Attack: Disrupts wireless signals (DoS), not impersonation.

Key Takeaway:

Evil Twin = Fake Wi-Fi hotspot + phishing/snooping.

The correct answer is:

Something you have and something you know

Why?

• Smart card = Something you have (physical token).

• PIN = Something you know (secret code).

• Together, they satisfy two-factor authentication (2FA) by combining possession + knowledge.

Why Not the Other Options?

❌ «Something you are and something you remember» → Incorrect. «Something you are» refers to biometrics (e.g., fingerprint), not a smart card.
❌ «Something you know and something you are» → Incorrect. This would be password + biometric, not smart card/PIN.
❌ «Something you have and something you are» → Incorrect. This would be smart card + biometric, omitting the PIN.

Key Takeaway:

Smart card + PIN = Physical token + secret knowledge, a classic 2FA model.

The correct answer is:

Application

Why?

• Application-layer firewalls (or application proxies) inspect payload content (not just headers/ports).

  • They detect IRC traffic disguised on port 80 by analyzing protocol behavior (e.g., HTTP vs. IRC).

  • Outbound HTTP is allowed because it adheres to expected application rules.

• Lower-layer firewalls (e.g., packet filtering, stateful) would miss this, as they only check ports/IPs.

Why Not the Other Options?

❌ Circuit-level firewall: Operates at Layer 5 (session layer), but doesn’t inspect payloads.
❌ Stateful firewall: Tracks connections (Layer 4), but doesn’t analyze application data.
❌ Packet-filtering firewall: Blocks based on ports/IPs (Layer 3/4), ignoring content.

Key Takeaway:

Blocking IRC-over-80 while allowing HTTP confirms deep packet inspection (DPI) at Layer 7.

The correct answer is:

The network devices are not all synchronized.

Why?

• Event log mismatches often occur when devices (firewalls, proxies, IDS) lack time synchronization (e.g., via NTP).

• Without synchronized clocks, timestamps in logs cannot be accurately correlated, hindering forensic analysis.

• This is a common operational issue (not malicious tampering or false positives).

Why Not the Other Options?

❌ «Proper chain of custody was not observed»

• Chain of custody ensures log integrity after collection, but doesn’t explain timestamp mismatches during logging.

❌ «The attacker altered or erased events»

• While possible, it’s less likely all devices’ logs were compromised vs. a systemic sync issue.

❌ «The security breach was a false positive»

• Log misalignment doesn’t imply a false breach—it’s a technical/logging problem.

Key Takeaway:

For accurate forensic correlation, network devices must use synchronized timekeeping (e.g., NTP).

The correct answer is:

Nikto

Why?

• Nikto is an open-source web server scanner that performs comprehensive tests, including:

  • Detecting dangerous files/CGIs (e.g., outdated scripts, misconfigurations).

  • Checking for 6,000+ vulnerabilities (e.g., XSS, SQLi, file disclosure).

  • Scanning for obsolete server software and default files.

Why Not the Other Options?

❌ John the Ripper: A password-cracking tool, not a web scanner.
❌ Dsniff: A network sniffing/swiss-army toolkit for MITM attacks (e.g., ARP spoofing).
❌ Snort: A network intrusion detection system (NIDS), not a web vulnerability scanner.

Key Takeaway:

Nikto specializes in automated web server assessments, making it ideal for finding risky files, CGIs, and misconfigurations.

The correct answer is:

123

Why?

• NTP (Network Time Protocol) primarily uses UDP port 123 for time synchronization between devices.

• This port is standardized by IANA (Internet Assigned Numbers Authority) for NTP communications.

Why Not the Other Options?

❌ UDP 113 → Historically used for IDENT protocol (authentication service), now largely obsolete.
❌ UDP 69 → Used for TFTP (Trivial File Transfer Protocol), not time synchronization.
❌ UDP 161 → Used for SNMP (Simple Network Management Protocol), not NTP.

Key Takeaway:

NTP relies on UDP 123 for clock synchronization across networks.

The correct answer is:

The gateway is not routing to a public IP address.

Why?

• The computer can transfer files locally (same subnet: 192.168.1.0/24), confirming:

  • The IP address is valid and private (RFC 1918).

  • The gateway is on the same network.

• Internet access failure indicates the gateway (router) isn’t forwarding traffic to the ISP (public IP) due to:

  • Misconfigured NAT/firewall.

  • ISP connectivity issues.

  • Incorrect default route on the gateway.

Why Not the Other Options?

❌ «The computer is not using a private IP address»

• 192.168.1.0/24 is a private IP range (valid for LANs).

❌ «The gateway and computer are not on the same network»

• Both are on 192.168.1.0/24 (local communication works).

❌ «The computer is using an invalid IP address»

• The IP is valid (local file transfers succeed).

Key Takeaway:

When local networking works but Internet access fails, the issue is beyond the LAN—typically the gateway’s routing/NAT.

The correct answer is:

Macro virus

Why?

• Macro viruses specifically target Microsoft Office (e.g., Word, Excel) by embedding malicious code in document macros (VBA scripts).

• They spread when infected documents are opened and macros are enabled.

• Examples: Melissa, Love Letter.

Why Not the Other Options?

❌ Polymorphic virus: Changes its code to evade detection (not Office-specific).
❌ Multipart virus: Infects both files and boot sectors (e.g., Ghostball).
❌ Stealth virus: Hides its presence (e.g., Frodo) but doesn’t target Office.

Key Takeaway:

Macro viruses exploit Office’s macro functionality, making them the primary threat to documents.

The correct answer is:

Checking if the remote host is alive

Why?

• Vulnerability scanners first verify host availability (e.g., via ICMP echo, ARP, or TCP SYN) before proceeding with deeper scans.

• This avoids wasting time scanning non-responsive hosts.

• Common methods include:

  • ICMP ping (if not blocked).

  • TCP ACK/SYN probes (e.g., to port 80/443).

  • ARP requests (in local networks).

Why Not the Other Options?

❌ OS Detection: Performed after confirming the host is alive.
❌ Firewall Detection: Requires active host communication (post-discovery).
❌ TCP/UDP Port Scanning: Executed only if the host is reachable.

Key Takeaway:

Host discovery is the foundational step in vulnerability scanning.

The correct answer is:

Hping

Why?

• Hping is a powerful network tool that can craft custom TCP packets (e.g., SYN requests) to check host availability when ICMP is blocked.

• Unlike standard ping (ICMP-based), hping can:

  • Send TCP SYN/ACK probes (like a port scan).

  • Evade basic ICMP filters.

  • Analyze responses (e.g., RST packets) to confirm host presence.

Why Not the Other Options?

❌ Traceroute: Relies on ICMP or UDP by default (also blocked if ICMP is disabled).
❌ TCP ping: While valid, it’s a subset of hping’s functionality (hping is more versatile).
❌ Broadcast ping: Uses ICMP broadcast, which is often disabled and irrelevant for targeted TCP checks.

Key Takeaway:

When ICMP is blocked, hping (with TCP probes) is the most robust alternative to confirm host reachability.

The correct answer is:

Social engineering

Why?

• The attack involved manipulating the receptionist by impersonating her boss (spoofed email) and tricking her into:

  1. Disclosing sensitive information (the original PDF).

  2. Clicking malicious links (delivered via a modified PDF).

• This is a classic social engineering attack, exploiting human trust rather than technical vulnerabilities.

Why Not the Other Options?

❌ Piggybacking: Unauthorized physical entry by following someone (e.g., slipping through a door).
❌ Tailgating: Similar to piggybacking but typically involves bypassing physical security (e.g., hiding behind an employee).
❌ Eavesdropping: Secretly listening to communications (e.g., network sniffing), not active deception.

Key Takeaway:

The attack relied entirely on psychological manipulation (spoofing authority + eliciting actions), defining it as social engineering.

The correct answer is:

The WAP does not recognize the client’s MAC address

Why?

• If the Access Point (WAP) is not responding to association requests, but the client can detect the network (sees the SSID), the issue is likely MAC address filtering.

• Many WAPs restrict access to pre-approved MAC addresses. If the new client’s MAC isn’t whitelisted, the WAP will ignore its requests.

• The problem is not connectivity-related (since the client sees the network) or DHCP-related (association happens before DHCP).

Why Not the Other Options?

❌ «The client cannot see the SSID of the wireless network»

• The sniffer confirms the client can see the network (SSID is visible).

❌ «Client is configured for the wrong channel»

• The client detects the WAP, so it’s on the correct channel.

❌ «The wireless client is not configured to use DHCP»

• DHCP issues arise after association. The WAP isn’t responding at all.

Presentation

Why?

• The Presentation layer (Layer 6) of the OSI model is responsible for data translation, encryption, and decryption.

• PKI-based encryption (e.g., S/MIME, PGP) occurs at this layer before the data is formatted for transmission or after it is received.

• This ensures the message content (not just the transport) is secured end-to-end.

Why Not the Other Layers?
❌ Application (Layer 7): Handles user interfaces and email protocols (e.g., SMTP, HTTP), but not encryption.
❌ Transport (Layer 4): Manages end-to-end connections (e.g., TLS/SSL for secure channels), but PKI encrypts the message itself, not the transport.
❌ Session (Layer 5): Controls dialogues between systems, not data transformation.

Key Takeaway:
PKI secures the message content at the Presentation layer, independent of transport (e.g., TLS) or application protocols.