Correct Answer:

Contain is correct.

The incident handling (or incident response) steps generally include identification (sometimes also called discovery), containment, eradication, recovery, and lessons learned. In this example, the IR team is quite clearly containing the issue. Finally, as an aside, IR teams also take great pains to ensure evidence is preserved as best as possible. I’d assume in this scenario the IR person _already_ took steps to retain memory-resident artifacts and such before shutting things down. The important aspect of this question, however, is to know which IR steps go where.

Incorrect Answers:

Recovery, eradicate, and identify are incorrect.

Each of these is a valid step in the process, but none equates to the action described.

Correct Answer:

Fuzzing is correct.

If you want a user to input their name in a form field, that’s great—but what happens if they enter 27 digits? Or a series of characters matching a script or database query? Fuzzing is an automated testing method where tons of randomly generated entries are jammed into the application to see what happens.

Incorrect Answers:

Mutation, randomizing, and insertion-force are incorrect.

These answers are added as distractors.

Correct Answers:

War driving is correct.

When it comes to attacks, there are several “war” variants: war dialing, war walking, and war driving. War driving involves driving around looking for open access points.

Incorrect Answers

War chalking, war stalking, and war sighting are incorrect.

War chalking involves drawing symbols to notify others of access point availability and information.

The other two answers are invalid.

Correct Answer:

Ip.addr == 202.99.58.3 and tcp.flags.syn is correct.

Wireshark syntax uses double equals signs. Before the test, review the syntax items in Wireshark—it’ll pay off.

Incorrect Answers:

Ip == 202.99.58.3 and tcp.syn, ip.addr = 202.99.58.3 and syn = 1, and ip.equals 202.99.58.3 and syn.equals on are incorrect. These answers are not in correct syntax.

Correct Answers:

IKE-scan is correct.

IKE-scan is an IPSec VPN scanning, fingerprinting, and testing tool.

Incorrect Answers:

Wireshark, Nikto, Black Widow, and ARPwatch are incorrect.

Wireshark is used for packet capture and sniffing.

Nikto and Black Widow are both involved in web server examination and testing.

ARPwatch is not applicable here.

Correct Answer:

WPA-2 is the best available encryption security for the system, and SSIDs do not provide any effective security measures for a wireless network are correct.

While WPA-3 is near on the horizon, for now WPA-2 is the best available encryption standard for wireless. SSIDs do nothing for security other than frustrate casual (lazy) attackers. It’s not the intent of an SSID to do anything other than identify a network.

Incorrect Answers:

WEP is the best encryption security for the system, and regardless of encryption, turning off SSID broadcast protects the system are incorrect.

WEP is poor encryption (and never the correct answer on this exam for security purposes).

SSID broadcast is nearly irrelevant to security.

Correct Answer:

False-positive generation is correct.

Lots of traffic can oftentimes provide “cover fire” for your attack. The very presence of so many false positives and so much traffic on its own indicates _something_ is going on, but the idea is valid.

Incorrect Answers:

Session splicing, source routing, and address spoofing are incorrect.

Session splicing, source routing, and address spoofing have nothing to do with generating large amounts of traffic.

Correct Answers:

Technical, physical, and operational are correct.

Physical measures are all the things you can touch, taste, smell, or get shocked by. Technical measures are those using technology to protect explicitly at the physical level. Operational measures are the policies and procedures you set up to enforce a security-minded operation.

Incorrect Answers:

Computer based, human based, and policy based are incorrect.

Computer based and human based are social engineering attack types, and policy based is a distractor.

Correct Answer:

Security team members attacking a network is correct.

The team simulating an attacking force is considered to be red. In a traditional war game scenario, the red team is attacking “black box” style, given little to no information to start things off.

Incorrect Answers:

Security team members defending a network, security team members with full knowledge of the internal network, and outside attackers are incorrect.

Blue teams are defense-oriented. They concentrate on preventing and mitigating the attacks and efforts of the red team/bad guys, and they operate with full knowledge of internal networking. Outside attackers is irrelevant here.

Correct Answer:

The attacker generates or manually specifies false IP addresses in order to evade an IDS or firewall is correct.

It may be a bit picky here, but you’ll thank me later. The decoy addresses confuse the IDS by making it appear the attack/scan is coming from multiple IPs, which makes it difficult to determine who is actually scanning the network.

Incorrect Answers:

The attacker changes the source IP address to change the appearance of where an attack is coming from, the attacker specifies a route in order to evade an IDS or firewall, and the attacker manipulates port numbers in order to evade an IDS are incorrect.

Changing the single source IP is referred to as IP spoofing.

Specifying a route to force is known as source routing.

Manipulating actual port numbers with common port numbers is known as source port manipulation.