1. Chapter 7: Identifying Advanced Attacks
McKinley Technology HS - Cybersecurity

2. Question 1
An attacker enters a string of data in a web application’s input form and crashes it. What type of attack is this?
DoS
DDoS
Man-in-the-Middle
Header manipulation

3. Question 2 What will protect against a SYN attack? Input validation
Error handling
Flood guard
Cross-site scripting

4. Question 3 What can an administrator use to detect a DDoS attack?
Privilege escalation
Performance baseline
Web form sanitization
Antivirus software

5. Question 4
A user browsing the Internet notices erratic behavior right before the user’s system crashes. After rebooting, the system is slow and the user detects hundreds of outbound connections. What likely occurred?
The system has become a botnet
The system is hosting a botnet
The system is spamming other users
The system has joined a botnet

6. Question 5
A computer is regularly communicating with an unknown IRC server and sending traffic without user interaction. What is likely causing this?
Buffer overflow
Cross-site scripting
Botnet
Rootkit

7. Question 6
Of the following choices, what uses a command and control server?
DoS attacks
Trojans
Man-in-the-Middle
Botnet

8. Question 7
Of the following choices, what type of attack can intercept traffic and insert malicious code into a network conversation?
Spim
Xmas attack
LDAP attack
Man-in-the-middle

9. Question 8 What can a header manipulation attack modify? Flags Buffers
Databases
Signature definitions

10. Question 9
An attacker is sending false hardware address updates to a system, causing the system to redirect traffic to an attacker. What type of attack is this?
IRC
ARP poisoning
Xmas attack
DNS poisoning

11. Question 10 What can mitigate ARP poisoning attacks in a network?
Disable unused ports on a switch
Man-in-the-middle
DMZ
VLAN segregation

12. Question 11
You manage a server hosting a third-party database application. You want to ensure that the application is secure and all unnecessary services are disabled. What should you perform?
Secure code review
Application hardening
White box testing
Black box testing

13. Question 12
Of the following choices, what is a step used to harden a database application?
Enabling all services
Disabling default accounts and changing default passwords
Disabling SQL
Disabling stored procedures

14. Question 13
An organization develops its own software. Of the following choices, what is a security practice that should be included in the process?
Check vendor documentation
SDLC Waterfall model
Code review
Enabling command injection

15. Question 14
An attacker in entering incorrect data into a form on a web page. The result shows the attacker the type of database used by the website and provides hints on what SQL statements the database accepts. What can prevent this?
Error handling
Antivirus software
Anti-spam software
Flood guards

16. Question 15
Your organization hosts several websites accessible on the Internet and is conducting a security review of these sites. Of the following choices, that is the most common security issue for web-based applications?
Input validation
Phishing
Whaling
Social engineering

17. Question 16
An IDS detected a NOOP sled. What kind of attack does this indicate?
Input validation
SQL injection
Cross-site scripting
Buffer overflow

18. Question 17
A web-based application expects a user to enter eight characters into the text box. What is a potential vulnerability for this application?
Input validation
Buffer overflow
SYN flood
Flood guard

19. Question 18
Of the following choices, what can help prevent SQL injection attacks?
Output validation
NOOP sleds
Stored procedures
Antivirus software

20. Question 19
A web developer wants to prevent cross-site scripting. What should the developer do?
Use input validation to remove hypertext
Use input validation to remove cookies
Use input validation to SQL statements
Use input validation to overflow buffers

21. Question 20
A website prevents users from using the less- than character (<) when entering data into forms. What is it trying to prevent?
Logic bomb
Cross-site scripting
Fuzzing
SQL injection

22. Question 21
While analyzing an application log, you discover several entries where a user has entered the following command into a web-based form:…/etc/passwd. What does this indicate?
Fuzzing
Kiting
Command injection attack
DoS

23. Question 22
In regards to secure coding practices, why is input validation important? A. It mitigates buffer overflow attacks. B. It makes the code more readable. C. It provides an application configuration baseline. D. It meets gray box testing standards.

24. Question 24
Which of the following steps should follow the deployment of a patch? A. Antivirus and anti-malware deployment B. Audit and verification C. Fuzzing and exploitation D. Error and exception handling

25. Question 25
A security administrator is observing congestion on the firewall interfaces and a high number of half open incoming connections from different external IP addresses. Which of the following attack types is underway? A. Cross-site scripting B. SPIM C. Client-side D. DDoS