Ethical Hacking - Unit 1 Quiz
48 Questions
3 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following best defines 'Authentication'?

  • A method to assess the risk level of an asset
  • The approval process for authorized users
  • A process by which a person proves their identity (correct)
  • A measure of resource accessibility

    • What does the term 'Attack Surface' refer to?

  • The hardware vulnerabilities present in a system
  • The collection of executable software services that can be exploited (correct)
  • The total number of attacks a system has experienced
  • The physical area of a network exposed to potential breaches

    • Which of the following represents a component of the CIA triad?

  • Integrity (correct)
  • Reliability
  • Authenticity
  • Accessibility

    • What characterizes 'Malware'?

    <p>Malicious software inserted for harmful purposes</p> Signup and view all the answers

    What is meant by 'Vulnerability' in the context of information security?

    <p>Weaknesses in hardware or software that can be exploited</p> Signup and view all the answers

    Which type of rootkit modifies the core components of the operating system?

    <p>Kernel-Level Rootkit</p> Signup and view all the answers

    What is 'Risk' in terms of information security?

    <p>The likelihood of a resource being attacked</p> Signup and view all the answers

    What is a primary function of an encrypted virus?

    <p>It encrypts itself to prevent detection.</p> Signup and view all the answers

    What is the main action performed by Cross-site scripting (XSS)?

    <p>Inject malicious scripts into web pages</p> Signup and view all the answers

    How do polymorphic viruses primarily avoid detection?

    <p>By constantly rewriting their own code.</p> Signup and view all the answers

    Which option best describes 'Authorization'?

    <p>The specification of access levels for authorized users</p> Signup and view all the answers

    What are common storage media that need protection?

    <p>Hard Drives, SD cards, and CD-ROMs</p> Signup and view all the answers

    Which of the following is a common countermeasure against Cross-site request forgery (CSRF)?

    <p>Validate cookies, query strings, and form fields</p> Signup and view all the answers

    What is a common way Trojans can affect a user's system?

    <p>They monitor user activity without consent.</p> Signup and view all the answers

    Which of the following accurately describes rootkits?

    <p>They are designed to provide privileged access.</p> Signup and view all the answers

    What kind of attack allows an attacker to perform actions on behalf of an authenticated user without their consent?

    <p>Cross-site request forgery (CSRF)</p> Signup and view all the answers

    Which characteristic isNOT typical of spyware?

    <p>Creating backdoors for remote access.</p> Signup and view all the answers

    In SQL injection, what is the purpose of entering '1=1' in an SQL query?

    <p>To return all records in the database</p> Signup and view all the answers

    What important feature distinguishes metamorphic viruses from polymorphic viruses?

    <p>They completely rewrite their code with each infection.</p> Signup and view all the answers

    Which type of rootkit is typically embedded within the hardware or firmware of components?

    <p>Hardware/Firmware Level Rootkit</p> Signup and view all the answers

    Which of the following is a characteristic of adware?

    <p>It displays unwanted advertisements.</p> Signup and view all the answers

    What is one consequence of a successful SQL injection attack?

    <p>Gaining unauthorized access to sensitive data</p> Signup and view all the answers

    Hypervisor Level Rootkits exploit which of the following?

    <p>Hardware-assisted Virtualization features</p> Signup and view all the answers

    Which statement best describes stealth viruses?

    <p>They hide themselves from detection by antivirus software.</p> Signup and view all the answers

    What can result from failures in the access control mechanism?

    <p>Data destruction or modification</p> Signup and view all the answers

    Which of the following is NOT a common access control vulnerability?

    <p>Viewing account history with guest access</p> Signup and view all the answers

    What is a potential consequence of insufficient logging and monitoring?

    <p>Difficulty in detecting malicious activities</p> Signup and view all the answers

    Which OWASP Top 10 Mobile Threat relates to poorly executed coding practices during development?

    <p>M2: Inadequate Supply Chain Security</p> Signup and view all the answers

    How can XML External Entities be exploited?

    <p>By including hostile content in XML documents</p> Signup and view all the answers

    Which of the following best defines Insufficient Binary Protections in mobile applications?

    <p>Retention of sensitive information within the binary</p> Signup and view all the answers

    What type of vulnerability is associated with allowing changes to primary keys in databases?

    <p>Data Integrity Violations</p> Signup and view all the answers

    Which OWASP mobile threat is concerned with the security of data stored within the app?

    <p>M9: Insecure Data Storage</p> Signup and view all the answers

    What is the method used in whaling attacks?

    <p>Targeting specific individuals within an organization for sensitive information.</p> Signup and view all the answers

    How do fake WAPs typically lure users to connect to them?

    <p>By using names that appear trustworthy.</p> Signup and view all the answers

    What characterizes in-band SQL injection?

    <p>It utilizes the same channel for both attack and result gathering.</p> Signup and view all the answers

    What common security measure can help protect against eavesdropping attacks?

    <p>Using a VPN.</p> Signup and view all the answers

    How does error-based SQL injection work?

    <p>It elicits error messages from the database to gather structural information.</p> Signup and view all the answers

    What primarily enables a man-in-the-middle (MITM) attack to occur?

    <p>The presence of unsecured networks.</p> Signup and view all the answers

    What is a key characteristic of a session hijacking attack?

    <p>It allows attackers to take control of a user's active session.</p> Signup and view all the answers

    What is the primary goal of a time-based SQL injection attack?

    <p>To force the server to delay its response.</p> Signup and view all the answers

    Which method is NOT a recommended prevention technique for SQL injection?

    <p>Ignoring user input validation.</p> Signup and view all the answers

    Which of the following is NOT a method to protect against fake WAPs?

    <p>Always connecting to public networks.</p> Signup and view all the answers

    What role does ARP poisoning play in a MITM attack?

    <p>It allows attackers to position themselves between the victim and the host.</p> Signup and view all the answers

    What happens in blind Boolean-based SQL injections?

    <p>Attackers obtain responses based on true or false conditions.</p> Signup and view all the answers

    Which type of attack uses fake text messages to deceive individuals into revealing information?

    <p>Smishing.</p> Signup and view all the answers

    What does credential stuffing attack utilize?

    <p>A standard list of default usernames and passwords.</p> Signup and view all the answers

    Which of the following is a characteristic of broken authentication?

    <p>It compromises session tokens, passwords, and other identifiers.</p> Signup and view all the answers

    What is one reason prepared statements protect against SQL injection?

    <p>They separate SQL logic from user input.</p> Signup and view all the answers

    Study Notes

    Ethical Hacking - Unit 1

    • This unit covers ethical hacking
    • A graphic displays a figure running, with a money sack, against a black background with the words "ETHICAL HACKING" and "UNIT 1"
    • Another graphic shows a figure breaking into a phone graphic, the word "Information Security" and "Attacks and Vulnerabilities"

    Introduction to Information Security

    • Assets: Any resource needing protection from attackers.
    • System Resources:
      • Computer Equipment (Desktops, Laptops, Tablets, Servers)
      • Communication Equipment (Routers, Switches, Firewalls, Modems)
      • Storage Media (Hard Drives, CDs, DVDs, SD cards)
    • Access Control: Defines the spectrum of access granted to entities.
    • Confidentiality, Integrity, and Availability (CIA): Ensuring data privacy, consistency from origin to destination, and availability to users 24/7.

    Authentication and Authorization

    • Authentication: Process where a person proves their identity (passwords, cards, biometrics).
    • Authorization: Specifies the access levels for authorized users to resources.
    • Risk: The chances of a resource or asset being attacked.
    • Risk Analysis: Determines the level of risk associated with system assets.
    • Threat: The amount of danger the system faces from attackers.
    • Threat Types: Snooping, Traffic Analysis, Modification, Masquerading, Replaying, Denial of Service,

    Vulnerability and Attack Surface

    • Vulnerability: System weaknesses or loopholes in hardware, software, applications, and protocols exploited by attackers.
    • Attack Surface: The combination of software services an attacker can exploit due to vulnerabilities or insecure configurations.
    • Malware: Malicious software intentionally included or inserted into a system for harmful purposes.

    Types of Malware

    • Worms: Self-replicating malware that spreads across networks without a host program.
    • Viruses: Malware that attaches itself to programs and replicates copies of itself.
      • Structure: Has infection mechanism, trigger, and payload.
      • Phases: Dormant, propagation, triggering, execution.
      • Types: Encrypted, Stealth, Polymorphic, Metamorphic
    • Trojans: Malware disguised as legitimate software, while secretly executing unwanted tasks.
      • Possible damages: Data theft, system crashes, slowdowns, launchpads for DDoS attacks, remotely run commands, keystroke interception.
    • Spyware: Software for gathering user interaction information and details without permission.
    • Adware: Spyware that displays advertisements.
    • System Monitors: Spyware that monitors system activities.
    • Tracking Cookies: Spyware that collects data about user behavior on the Internet.
    • Rootkits: Software designed to provide privileged access to a remote user.
      • Types: Application level, kernel level, hardware/firmware level, hypervisor level

    Types of Vulnerabilities (Identified by OWASP)

    • Cross-Site Scripting (XSS): Injects malicious scripts into web pages.
    • Cross-Site Request Forgery (CSRF/XSRF): Tricks users into performing unwanted actions on a website.
    • SQL Injection (SQLI): Inserts harmful SQL code to access data or control the system.
      • Types: In-band, Error-based, Blind Boolean-based, Time-based
    • Broken Authentication: Vulnerable authentication that allows attackers to compromise credentials, tokens, etc.
    • Input Parameter Manipulation: Modifies data between the browser and web application.

    Types of Attacks & Prevention Mechanisms

    • Keystroke Logging: Records keystrokes covertly, either by software or hardware.
    • Denial of Service (DoS): Prevents normal communication with a resource by overwhelming requests.
    • Distributed Denial of Service (DDoS): Same as DoS, but uses multiple computers or machines.
    • Watering Hole Attack: Targets trusted services to deliver a malicious payload to an organization.
    • Brute-Force Attack: Uses trial-and-error to crack passwords/credentials.
    • Phishing : Tries to acquire sensitive data like bank account info, emails, passwords and credit card information
    • Cat Phishing : Includes creating a fake personality to steal personal data
    • Voice Phishing (Vishing): Malicious calls to steal sensitive data
    • SMS Phishing (Smishing) : Uses fake mobile texts to trick people into downloading malware,
    • Whaling : Targets high-profile individuals,
    • Fake WAP: Mimic legitimate Wi-Fi hotspots
    • Eavesdropping : Passively observing communications between devices.
    • Man-in-the-Middle (MITM): Places a hacker in between the communication channels

    Other attack types

    • Session Hijacking: Stealing sensitive information by hijacking a valid online session.
    • Clickjacking: Tricks users into clicking on different objects(link) than what they intended to click.
    • URL Obfuscation : Modifies a URL to conceal the legitimate location

    Other security aspects

    • Buffer Overflow: When more data than allocated is put into a buffer, leading to data corruption.
    • DNS Cache Poisoning : Modifies DNS cache to point to a false IP address
    • ARP Poisoning : Changes the relationship between IP address and MAC address to redirect traffic to a attacker's machine
    • Identity Theft: Stealing personal information to commit fraud.
    • IoT Attacks: Gaining access to sensitive data via Internet of Things (IoT) devices.
    • Bots and Botnets: Automated malicious software and networks of infected computers.
    • CVE Database: Centralized database of common vulnerabilities and exposures in software and hardware.

    Additional Information

    • OWASP Mobile Top 10: List of top 10 mobile security threats identified by Open Web Application Security Project (OWASP).

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Ethical Hacking UNIT 1 PDF

    Description

    Test your knowledge on Ethical Hacking with this unit 1 quiz. Explore key concepts such as information security, attacks and vulnerabilities, and the CIA triad. Prepare to dive into the essentials of securing assets and system resources effectively.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser