Correct Answer:

Shodan is correct.

Shodan allows users to search for very specific types of hosts, which can be very helpful to attackers—ethical or not.

Incorrect Answers:

Whois, nslookup, and Burp Suite are incorrect.

Whois provides registrar and technical POC information.

Nslookup is a command-line tool for DNS lookups.

Burp Suite is a website/application hacking tool.

Correct Answer:

CSRF is correct.

OWASP defines CSRF (cross-site request forgery) as a type of attack that occurs when a malicious website, e-mail, blog, instant message, or program causes a user’s web browser to perform an unwanted action on a trusted site for which the user is currently authenticated. The idea is simple, and the results are extraordinarily evil: take over an already-authenticated web session and have the victim’s browser send messages for you.

Incorrect Answers:

SQL injection, weak input validation, and XSS are incorrect.

These attacks do not match the scenario given.

Correct Answer:

CCTT is correct.

A Covert Channel Tunneling Trojan (CCTT) enables attackers to gain shell interfaces into and out of a network using authorized channels covertly. It involves the use of a CCTT box acting as an internal server communicating with a CCTT client externally using allowed channels—like an HTTP tunnel, for instance.

Incorrect Answers:

Ransomware, E-banking Trojan, and RAT are incorrect.

Ransomware is a Trojan that locks access to the operating system until the victim pays a ransom (usually in bitcoin).

E-banking Trojans deal with online banking, and remote access Trojans (RATs) are designed to open a direct channel between attacker and victim.

Correct Answer:

Software tools that use a combination of encryption and code manipulation to render malware as undetectable to antivirus products is correct.

Crypters are software tools that use a combination of encryption and code manipulation to render malware as undetectable to AV and other security-monitoring products (in Internet lingo, it’s referred to as “fud,” for “fully undetectable”).

Incorrect Answers:

Software tools that use compression to pack the malware executable into a smaller size, software that appears to perform a desirable function for the user prior to running or installing it but instead performs a function that steals information or otherwise harms the system, and software that appears to perform a desirable function for the user prior to running or installing it but instead performs a function that steals information or otherwise harms the system are incorrect.

“Packers” are a variant of crypters and use compression to pack the malware executable into a smaller size.

Trojans look innocent but turn evil after installation.

Steganography tools hide data in existing image, video, or audio files.

Correct Answer:

Asymmetric encryption is correct. Asymmetric encryption protects the data as well as provides for nonrepudiation.

Incorrect Answers:

Steganography, Hash, and Symmetric encryption are incorrect.

Steganography allows you to hide messages, and symmetric encryption allows you to hide communications, but neither provides for nonrepudiation.

Hash is incorrect because this is not the function of a hash.

Correct Answer:

The site may be vulnerable to SQL injection is correct.

The error message clearly displays a SQL error, showing there’s an underlying SQL database to contend with, and it’s most likely not configured correctly.

Incorrect Answers:

The site may be vulnerable to XSS, the site may be vulnerable to buffer overflow, and this site may be vulnerable to a malware injection are incorrect.

The error message doesn’t provide enough information to indicate cross-site scripting or buffer overflow.

Malware may be a possibility, but that can’t be determined from this output.

Correct Answers:

All web spiders are prevented from indexing any page on the site is correct.

Robots.txt files are annoying little entries on the exam but are easy enough to figure out. The User-agent section defines which web crawler you’re attempting to advise (in this case, all of them). The Disallow section defines those areas you do not want the crawler to sift through; just having a slash (/) effectively states “don’t look at anything here.”

Incorrect Answers:

All web spiders are allowed to index any page on the site, only authenticated web spiders are prevented from indexing any page on the site, and only authenticated web spiders are allowed to index any page on the site are incorrect.

These answers do not match the * entry in User-agent and the / entry in Disallow.

Correct Anser:

X.509 is correct.

X.509 is an ITU-T standard for digital certificates.

Incorrect Answers:

X.25, XOR, and X.500 are incorrect.

X.25 is an ITU-T standard for WNA communication.

XOR is a commonly used mathematical computation.

X.500 is a standard for directory services.

Correct Answer:

Source port manipulation is correct.

Source port manipulation is exactly what is sounds like—swap the port with a well-known port, and a poorly configured IDS or firewall will happily let you through.

Incorrect Answers:

Source routing, IP address decoy, and packet fragmentation are incorrect.

Source routing refers to sending a packet with a specified route.

IP address decoy refers to manually specifying the IP address of decoys to evade the IDS: this makes it difficult for the IDS to determine which IP you’re actually scanning.

Packet fragmentation is exactly what it sounds like and is not even remotely similar to what is being asked.

Correct Answers:

Core Impact and CANVAS are correct.

Both Core Impact and CANVAS are automated pen test application suites. Automated tests—using a tool such as CANVAS or Core Impact—are generally faster and cheaper than manual pen testing, which involves a professional team and a predefined scope/agreement. They are more susceptible to false positives and false negatives, and they also don’t necessarily care about any scope or test boundary.

Incorrect Answers:

Netcat, Cheops-ng, and Nmap are incorrect.

Netcat is a multipurpose scanner and backdoor (sometimes labeled as a Trojan).

Nmap is a port scanner.

Cheops-ng is an older tool used for network mapping.