Cybersecurity — Fundamentals (Security+ / CEH style)

Les questions du quiz

1. 1. Which of the following styles of fuzzer is more likely to explore paths covering every line of code in the following program?
   1. Generational
   2. Blackbox
   3. Whitebox
   4. Mutation-based
2. 2. Assume that a TLS connection has been established successfully between a client and a server. Establishing the session included checking the server certificate and executing a DiffieHelmann exchange, but the client did not provide a client certificate. Further, assume that the client and server are honest, that the client and server don’t leak their keys, and that the cryptography is good. Which of the following attacks does TLS protect against?
   1. An attacker replaying bytes that a client sent earlier.
   2. An attacker impersonating the server.
   1. True, True
   2. False, False
   3. True, False
   4. False, True
3. 3. MIT’s Kerberos KDC server has a maximum ticket lifetime of 24 hours (for most user principals). What ensures that an expired Kerberos ticket can no longer be used?
   1. The Kerberos server (KDC) refuses to establish new connections between clients and servers for expired tickets.
   2. When a client connects to a server, the server sets a 24-hour timer to terminate the connection, which ensures a client cannot remain connected past the ticket’s maximum lifetime.
   3. When a client connects to a server, the server compares the ticket’s expiration time to the server’s current clock, and refuses to authenticate the user if the ticket expiration time is in the past.
   4. When a client connects to a server, the server sends a query to the KDC to check if the ticket is still valid with respect to the KDC’s clock, and refuses to authenticate the user if the KDC reports that the ticket is expired.
4. 4. In Message Condentiality, the transmitted message must make sense to only intended
   1. Receiver
   2. Sender
   3. Modulor
   4. Translator
5. 5. Which of the following is a remote Trojan?
   1. Troya
   2. DaCryptic
   3. BankerA
   4. Game-Troj
6. 6. ______________ is a widespread app’s coding mistake made by developers which could be exploited by an attacker for gaining access or malfunctioning your system.
   1. Memory leakage
   2. Buffer-overrun
   3. Less processing power
   4. Inefficient programming
7. 7. Consider the paper Native Client: A Sandbox for Portable, Untrusted x86 Native Code by Yee et al. Ben Bitdiddle notes that NaCl uses Intel x86 segmentation to ensure that the sandboxed module does not read or write memory outside its own data area, and does not execute instructions outside its own code. Ben thinks that with these restrictions alone, executing the sandboxed module must be safe; that is, he thinks validation is not needed. Ben is wrong. Circle the types of x86 machine instructions that the validator always forbids in sandboxed code. Please ignore trampoline and springboard code.
   1. all instructions that modify segment state
   2. all loads or stores to addresses that are not 0 mod 32
   3. all indirect loads or stores (via an address in a register or variable)
   4. all indirect jumps (via an address in a register or variable)
8. 8. ____________ is also a part of darknet that is employed for transferring files anonymously.
   1. Freenet
   2. ARPANET
   3. Stuxnet
   4. Internet
9. 9. Why apps developed in languages like C, C++ is prone to Buffer-overflow?
   1. No string boundary checks in predefined functions
   2. No storage check in the external memory
   3. No processing power check
   4. No database check
10. 10. Man in the middle attack can endanger the security of Diffie Hellman method if two parties are not
    1. Joined
    2. Authenticated
    3. Submitted
    4. Shared
11. 11. An integer overflow occurs when
    1. an integer expression's result "wraps around"; instead of creating a very large number, a very small (or negative) number ends up getting created
    2. an integer is used as if it was a pointer
    3. an integer is used to access a buffer outside of the buffer's bounds
    4. there is no more space to hold integers in the program
12. 12. Let HH be a Merkle-Damgard hash function is H:X^{\leq L} \to TH:X^≤L →T. Construct a MAC from this HH as follows: \ \ S(k,m) = H(k \| m) S(k,m)=H(k∥m). This mac is insecure because:
    1. Given H(k \| m)H(k∥m) anyone can compute H(w \| k \| m \| \text{PB})H(w∥k∥m∥PB) for any ww
    2. Given H(k \| m)H(k∥m) anyone can compute H(k \| m \| w)H(k∥m∥w) for any ww
    3. Given H(k \| m)H(k∥m) anyone can compute H(k \| m \| \text{PB} \| w)H(k∥m∥PB∥w) for any ww
    4. Anyone can compute H( k \| m )H(k∥m) for any mm
13. 13. Suppose that Alice and Bob sent confidential text messages to one another last month through an encrypted messaging system. Alice and Bob are worried that an adversary might compromise one of their computers today, while they are taking the 6.858 final exam, and would then be able to decrypt those messages. Which of the following security properties can address Alice and Bob’s concern?
    1. Authentication.
    2. Deniability.
    3. Forward secrecy
    4. Backward secrecy.
14. 14. The AH Protocol provides source authentication and data integrity, but not
    1. Integrity
    2. Privacy
    3. Nonrepudiation
    4. Both A & C
15. 15. Which of the following is not a security exploit?
    1. Eavesdropping
    2. Cross-site scripting
    3. Authentication
    4. SQL Injection
16. 16. _______________ is the central node of 802.11 wireless operations.
    1. WPA
    2. Access Point
    3. WAP
    4. Access Port
17. 17. In MD-5 the length of the message digest is
    1. 160
    2. 128
    3. 64
    4. 54
18. 18. What is Nmap?
    1. It is a scanner which works by injecting packets to a range of addresses, and inferring what hosts and services might be at those addresses, based on the responses
    2. It is a network fuzz testing tool
    3. It is a map of the Internet
    4. It is a suite of tools for scripting attacks: probe, construct, encode, inject, wait for response
19. 19. How do you prevent SQL injection?
    1. Escape queries
    2. Interrupt requests
    3. Merge tables
    4. All of the above
20. 20. What does it mean to "be stealthy" during a penetration test?
    1. Performing the tests from an undisclosed location
    2. Using encryption during tests to make the source of attacks impossible to determine
    3. Performing penetration testing without the target organization knowing
    4. Taking care to avoid activities during a penetration test that might attract attention, e.g., by operators or IDS services
21. 21. Which of the following is not a transport layer vulnerability?
    1. Mishandling of undefined, poorly defined variables
    2. The Vulnerability that allows “fingerprinting” & other enumeration of host information
    3. Overloading of transport-layer mechanisms
    4. Unauthorized network access
22. 22. In Brumley and Boneh’s paper on side-channel attacks, why does blinding prevent the timing attack from working?
    1. Blinding prevents the server from using the CRT optimization, which is essential to the timing attack.
    2. Blinding changes the p and q primes that are used, so an adversary cannot learn the server’s true p and q values.
    3. Blinding randomizes the ciphertext being decrypted, thus obscuring the correlation between an adversary’s input and the timing differences.
    4. Blinding adds a random amount of time to the decryption due to the multiplication and division by the blinding random value r, which obscures the timing differences used in the attack.
23. 23. The openSSL implementation described in “Remote Timing Attacks are Practical” (by Brumley and Boneh) uses the following performance optimizations: Chinese Remainder (CR), Montgomery Representation (MR), Karatsuba Multiplication (KM), and Repeated squaring and Sliding windows (RS). Which of the following options would close the timing channel attack described in the paper if you turned the listed optimizations off?
    1. RS and KM
    2. RS and MR
    1. True, True
    2. False, False
    3. True, False
    4. False, True
24. 24. Public key encryption is advantageous over Symmetric key Cryptography because of
    1. Speed
    2. Space
    3. Key exchange
    4. Key length
25. 25. The __________ was a huge marketplace of Dark Web specifically famous for selling of illegal drugs & narcotics as well as you can find a wide range of other goods for sale.
    1. Silk Road
    2. Cotton Road
    3. Dark Road
    4. Drug Road
26. 26. The ______________ is categorized as an unknown segment of the Deep Web which has been purposely kept hidden & is inaccessible using standard web browsers.
    1. Haunted web
    2. World Wide Web
    3. Dark web
    4. Surface web
27. 27. What does EXE do when the STP solver times out on a constraint query for a particular path?
    1. Assume that the query is satisfiable and continue executing the path.
    2. Assume that the query is not satisfiable and stop executing the path
    3. Restart STP and retry the query, up to a limited number of retries.
    4. Remove a subset of the constraints and retry the query.
28. 28. To verify a digital signature we need the
    1. Sender’s Private key
    2. Sender’s Public key
    3. Receiver’s Private key
    4. Receiver’s Public key
29. 29. Suppose you want to use fuzzing on a program to try to find memory errors; which of the following statements is true?
    1. You should not use a grammar-based fuzzer, because its adherence to the grammar means it will not find memory errors
    2. Compiling the program with address sanitizer (ASAN) will make errors harder to reproduce
    3. Compiling the program with address sanitizer (ASAN) will make the source of a memory error easier to find
    4. Fuzzing doesn't find memory errors, it finds crashes and hangs
30. 30. Based on the paper “SoK: SSL and HTTPS: Revisiting past challenges and evaluating certificates trust model enhancements”, which of the following statements are false?
    1. Valid DV certificates provide more confidence to a user that she is connecting to the intended party than valid EV certificates.
    2. OCSP stapling allows a server to prove to a browser that its certificate hasn’t been revoked.
    3. DANE makes it difficult for an adversary to launch a SSL stripping attack.
    4. Server key-pinning makes it harder for an adversary to convince a CA to mint a certificate for a site and launch an MITM attack on that site.