Correct Answers:

Enterprise Zone, Industrial Demilitarized Zone (IDMZ) and Manufacturing Zone are correct.

The Purdue model defines communications within an OT/ICS network as working in three zones or layers—the OT Systems layer (the Manufacturing Zone), the IDMZ in the middle, and the IT Systems (Enterprise Zone).

Incorrect Answers:

SCADA Zone is incorrect.

SCADA (supervisory control and data acquisition) makes up a portion of OT networks overall, but is not a layer in the Purdue model.

Correct Answer:

Marketing, sabotage, technical support is correct.

In reverse social engineering, the attacker first markets his skills, position, and an impending problem. Next, the attacker performs sabotage against the user or network segment. Lastly, the attacker provides “technical support” to the users calling in for assistance.

Incorrect Answers:

Technical support, marketing, sabotage; sabotage, marketing, technical support; and marketing, technical support, sabotage are incorrect.

If not carried out in the correct manner, this attack wouldn’t (shouldn’t) work.

Correct Answer:

MDM is correct.

Mobile device management (MDM) is an effort to provide at least some organizational security thought to the maddening problem of mobile devices on the network. It attempts to monitor, manage, and secure the mobile devices (and associated service providers and mobile operating systems) in use in the organization. Much like Group Policy and such in the Microsoft Windows world, MDM helps in pushing security policies, application deployment, and monitoring of mobile devices. Some of the solutions include XenMobile, MaaS360, AirWatch, and MobiControl.

Incorrect Answers:

802.1x, BYOD, and CCMP are incorrect.

802.1x is the wireless standards family.

BYOD sounds like fun, but it’s really “Bring Your Own Device” (a policy allowing personal mobile devices on organizational networks).

CCMP is a function inside WPA2.

Correct Answer:

Chosen-cipher-text attacks is correct. In a chosen-cipher-text attack, the bad guy chooses a particular cipher-text message and attempts to discern the key through comparative analysis with multiple keys and a plain-text version. Because RSA uses a public key to encrypt and a private key to decrypt, an attacker could use the public key to encrypt tons of things for analysis.

Incorrect Answers:

Known-plain-text attacks, sequence-timing attacks, and rubber hose attacks are incorrect.

The hacker has both plain-text and corresponding cipher-text messages in a known-plain-text attack (plain-text copies are scanned for repeatable sequences, which are then compared to the cipher-text versions).

Sequence-timing attacks do not exist.

Rubber hose attacks, in addition to sounding hilarious, are violent social engineering efforts.

Correct Answer:

Announce to the users when you will begin testing is correct.

If the goal is to see if there are weak passwords being used in the environment on an average day, why in the world would you make it an uncommon day by telling people to change their passwords right before you start testing?

Incorrect Answers:

Sit down with the customer and develop a scope before testing, attempt brute-force attacks against any hashes provided or stolen, and suggest education and hardening techniques on discovered passwords are incorrect.

All of these actions make perfect sense regarding an ethical hacker being asked to test and report on weak passwords.

Correct Answer:

Bluejacking is correct.

Bluejacking is a Bluetooth attack where the attacker sends unsolicited messages to the target.

Incorrect Answers:

Bluesmacking, bluesniffing, and bluescarfing are incorrect.

Bluesmacking is a DoS attack.

Bluesniffing is an effort to sniff data from Bluetooth exchanges.

Bluescarfing is the actual theft of data from a Bluetooth device.

Correct Answers:

Core Impact and CANVAS are correct.

Both Core Impact and CANVAS are automated pen test application suites.

Incorrect Answers:

Nmap and Netcat are incorrect.

Nmap is a port scanner.

Netcat is a multipurpose scanner and backdoor.

Correct Answer:

Software tools that use a combination of encryption and code manipulation to render malware as undetectable to antivirus is correct.

“Crypters” are software tools that use a combination of encryption and code manipulation to render malware as undetectable to AV and other security-monitoring products (in Internet lingo, it’s referred to as “fud,” for “fully undetectable”).

Incorrect Answers:

Software tools that use compression to pack the malware executable into a smaller size, software that appears to perform a desirable function for the user prior to running or installing it but instead performs a function that steals information or otherwise harms the system, and software that hides data in other files are incorrect.

“Packers” are a variant of crypters and use compression to pack the malware executable into a smaller size.

Trojans look innocent but turn naughty after installation.

Steganography tools hide data in existing image, video, or audio files.

Correct Answer:

Procedure is correct.

A procedures document is a step-by-step description of how to accomplish a specific task.

Incorrect Answers:

Guideline, standard, and policy are incorrect.

Guidelines are discretionary but highly encouraged (that is, you may not absolutely require DAR protection on all systems, but your guidelines document might encourage users to use it anyway).

A standard defines technical aspects of your security architecture (like what software and hardware are necessary) and is mandatory.

A policy is an overarching document that contains the purpose, scope, responsibilities, and compliance details of your security program.

Correct Answer:

1 is correct.

An XOR operation requires two inputs. If the bits match, the output is a 0; if they don’t, it’s a 1.

Incorrect Answers:

0, depends on the encryption algorithm used, and none are incorrect.

The output is a 0 only when the bits match.

The other answers are distractors.