Untitled Quiz
64 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which command is used to print all process information in Linux?

  • ls -d
  • su
  • ps -ef (correct)
  • ls -l

What does the number '4' signify in the command 'chmod 741'?

  • Read-only permission
  • Write permission
  • Execute permission (correct)
  • All permissions

Which command is used to view the last 100 lines of a file log in Linux?

  • grep -100 log
  • tail -100 log (correct)
  • cat -100 log
  • mv -100 log

In Oracle, which user has the highest default privileges?

<p>sys (A)</p> Signup and view all the answers

What does HTTP status code 403 indicate?

<p>Access to the requested resource is forbidden (A)</p> Signup and view all the answers

Which SQL command is used to add a column to an existing table?

<p>update (D)</p> Signup and view all the answers

Which header allows a response to redirect to a new location?

<p>Location (D)</p> Signup and view all the answers

How can a file be uploaded to a server with no internet access due to a command execution vulnerability?

<p>FTP (B)</p> Signup and view all the answers

What attack method involves inputting an excessively long string into a limited space?

<p>Buffer Overflow (D)</p> Signup and view all the answers

Which command shows the Linux kernel version?

<p>uname -a (D)</p> Signup and view all the answers

What is the approximate time required to brute force a 56-bit key using an exhaustive method at a speed of $10^6$ attempts per second?

<p>5.4x10^24 years (A)</p> Signup and view all the answers

Which group was established in February 2014, with Xi Jinping as its leader?

<p>Central Network Security and Informatization Leading Group (C)</p> Signup and view all the answers

What date did the Cybersecurity Law come into effect?

<p>June 1, 2017 (C)</p> Signup and view all the answers

What kind of attack can be performed using XXE vulnerabilities?

<p>Read server files (A)</p> Signup and view all the answers

Which of the following is considered an active defense technology?

<p>Honeypot Technology (A)</p> Signup and view all the answers

Which status code is returned when a user does not have permission to access a given page?

<p>403 (C)</p> Signup and view all the answers

In a Linux system, where are the operational logs stored?

<p>/var/log (C)</p> Signup and view all the answers

Which tool is typically used for SQL injection attacks?

<p>sqlmap (C)</p> Signup and view all the answers

What information can be directly obtained by conducting a port scan on a target host?

<p>Services running on open ports of the target host (A)</p> Signup and view all the answers

What cannot effectively defend against XSS attacks?

<p>Data encryption (D)</p> Signup and view all the answers

Which of the following statements about phishing is incorrect?

<p>Phishing is unrelated to web services (D)</p> Signup and view all the answers

Which of the following statements about server-side request forgery (SSRF) vulnerabilities is correct?

<p>SSRF vulnerabilities are server-based attacks (C)</p> Signup and view all the answers

What is the primary purpose of APT attacks?

<p>Persistent intrusion for strategic control (C)</p> Signup and view all the answers

Which command can be used to retrieve DNS records?

<p>dig (D)</p> Signup and view all the answers

Which command in SQL is used to completely remove a table?

<p>drop (C)</p> Signup and view all the answers

Which of the following configurations is NOT included in Apache's default parsed suffixes?

<p>.pht (C)</p> Signup and view all the answers

Which is not a characteristic of APT attacks?

<p>Rare occurrence (A)</p> Signup and view all the answers

In a network, what happens if a switch receives a packet with a destination MAC address not in its MAC address table?

<p>The packet is broadcasted to all interfaces (C)</p> Signup and view all the answers

What is the default port for Redis databases?

<p>6379 (A)</p> Signup and view all the answers

Which command would NOT reveal the hostname of a Windows system?

<p>set (B)</p> Signup and view all the answers

Which version of MySQL is necessary to use the base64() function?

<p>5.5 version (A)</p> Signup and view all the answers

Which type of algorithm is RSA classified as?

<p>Asymmetric algorithm (B)</p> Signup and view all the answers

What does data integrity ensure?

<p>Users receive exactly what was sent (A)</p> Signup and view all the answers

Which command is used to view the /var/log/wtmp log?

<p>last (C)</p> Signup and view all the answers

What is the incorrect statement regarding SUID permissions?

<p>SUID permissions are universally applicable to all files (D)</p> Signup and view all the answers

Which policy can potentially impact normal production business if enabled?

<p>Limit security audit recording (B)</p> Signup and view all the answers

Which of these tools is commonly used for web vulnerability scanning?

<p>IBM APPSCAN (B)</p> Signup and view all the answers

What is the purpose of setting IP-MAC binding?

<p>Prevent unauthorized access (D)</p> Signup and view all the answers

Which command enables a user to view currently logged-in users on a Windows server?

<p>query user (D)</p> Signup and view all the answers

What data structure is formed when high-level protocols pass data to the network layer?

<p>Data packet (C)</p> Signup and view all the answers

Which method can be used to prevent replay attacks effectively?

<p>Implement one-time encryption methods (A)</p> Signup and view all the answers

What action cannot be performed by a CSRF attack?

<p>Steal user credentials (A)</p> Signup and view all the answers

Which of the following describes the characteristics of an SQL killer worm virus?

<p>Consumes large amounts of network bandwidth (C)</p> Signup and view all the answers

The strongest credential authentication method among the following is?

<p>MS-CHAP (A)</p> Signup and view all the answers

Which attack is characterized by impersonating someone by using their information in messages?

<p>Social engineering attack (C)</p> Signup and view all the answers

What is NOT included in the purpose of digital signatures?

<p>Receiver identity confirmation (A)</p> Signup and view all the answers

What is the essence of ARP spoofing?

<p>Provide a virtual combination of MAC and IP addresses (B)</p> Signup and view all the answers

What is not a typical security monitoring mechanism for upload functionalities?

<p>Client-side JavaScript validation (B)</p> Signup and view all the answers

Which technology can provide real-time protection against internal, external attacks, and misoperations?

<p>Intrusion detection (C)</p> Signup and view all the answers

Which network attack is characterized by the TCP three-way handshake process?

<p>SYN Flood attack (C)</p> Signup and view all the answers

Which SQL command requires the least permissions for reading operating system files?

<p>LoadFile (D)</p> Signup and view all the answers

Which statement about CC attacks is incorrect?

<p>CC attacks can easily gain control of target machines (A)</p> Signup and view all the answers

Which OSI security architecture layer provides data integrity services?

<p>Data Link Layer (A)</p> Signup and view all the answers

What describes the trend in network attack methods?

<p>Increasing sophistication of attack tools (D)</p> Signup and view all the answers

What command can be used with nmap to skip host discovery for the known active host 192.168.20.20?

<p>nmap -Pn 192.168.20.20 (B)</p> Signup and view all the answers

Which PHP function is used to prevent SQL injection?

<p>mysql_real_escape_string (C)</p> Signup and view all the answers

Which command is used in sqlmap to retrieve all database names?

<p>dbs (A)</p> Signup and view all the answers

What is incorrect about the description of IIS short file name vulnerabilities?

<p>Short-named files do not have corresponding short file names. (B)</p> Signup and view all the answers

Which command can be used to check Linux password expiration?

<p>passwd (D)</p> Signup and view all the answers

What command is used for a SYN scan with nmap?

<p>-sS (A)</p> Signup and view all the answers

Which method allows IP address to domain name resolution?

<p>Reverse (C)</p> Signup and view all the answers

What incorrect pairing of Linux file permissions is displayed?

<p>rwx-r--r-- 622 (D)</p> Signup and view all the answers

In HTTP status codes, which one indicates redirection?

<p>302 (A)</p> Signup and view all the answers

Which of the following tools is commonly used for web vulnerability scanning?

<p>Acunetix WVS (AWVS) (A)</p> Signup and view all the answers

Flashcards

XXE (XML External Entity Injection) vulnerability

An XXE vulnerability allows attackers to read server files and potentially gain unauthorized access.

WebLogic default credentials

The default username and password used by WebLogic, used by attackers for unauthorized access.

Apache access log path

The configuration directive in Apache that defines the location of access logs, crucial for auditing web traffic.

HTTP 403 error

A HTTP status code indicating that the server has forbidden access to a resource.

Signup and view all the flashcards

File inclusion vulnerability

Vulnerability that enables an attacker to execute malicious files through a web application.

Signup and view all the flashcards

SSRF (Server-Side Request Forgery) vulnerability

A vulnerability that allows attackers to make arbitrary requests to internal or external services from the server.

Signup and view all the flashcards

SQL injection attack

A technique used to inject SQL statements into an application to retrieve sensitive data from a database.

Signup and view all the flashcards

HTTPS certificate issues

Problems with HTTPS certificates that could lead to warnings or security issues, such as expired or invalid certificates.

Signup and view all the flashcards

XSS (Cross-Site Scripting) vulnerability

A vulnerability that enables attackers to inject malicious scripts into a web application.

Signup and view all the flashcards

Redis default port

Redis uses the default port for communication, making it accessible during attacks.

Signup and view all the flashcards

SQL injection vulnerability

A vulnerability where malicious SQL code is inserted into an application's input fields, potentially allowing attackers to execute unauthorized SQL commands and gain access to or modify database data.

Signup and view all the flashcards

Cross-Site Scripting (XSS)

A vulnerability where malicious scripts are injected into a website viewed by other users, potentially allowing attackers to steal cookies, redirect users, or perform other malicious activities.

Signup and view all the flashcards

Cross-site request forgery (CSRF)

An attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.

Signup and view all the flashcards

Denial-of-service (DoS) attack

An attack designed to make a machine or network resource unavailable to its intended users by temporarily or permanently disrupting services.

Signup and view all the flashcards

SQL Server Authentication

A method of authenticating users to a SQL Server database by using Windows or SQL-based credentials.

Signup and view all the flashcards

TCP SYN flood attack

A denial-of-service attack that overwhelms a server by sending a large number of TCP connection requests without completing the three-way handshake.

Signup and view all the flashcards

ARP spoofing

A man-in-the-middle attack where a malicious actor sends falsified ARP messages to a network, causing target devices to redirect network traffic to the attacker's device.

Signup and view all the flashcards

Social engineering attack

Manipulating individuals to reveal sensitive information or perform actions that compromise security.

Signup and view all the flashcards

Google Hacking

Using specific search queries to identify vulnerabilities and sensitive information on websites.

Signup and view all the flashcards

Firewall

A network security system that controls the incoming and outgoing network traffic based on predefined security rules.

Signup and view all the flashcards

Digital Signature

A cryptographic technique that authenticates the origin of a message and ensures that it hasn't been altered or tampered with.

Signup and view all the flashcards

Data Encryption

The process of transforming data into an unintelligible format to protect it from unauthorized access.

Signup and view all the flashcards

Network Security

The protection of computer networks and the data they contain from unauthorized access, use, disclosure, disruption, modification, or destruction.

Signup and view all the flashcards

Default user with highest privileges in Oracle

The sys user in Oracle has the highest privileges and is used for administrative tasks.

Signup and view all the flashcards

Linux command to display last 100 lines of a file

The tail -100 log command displays the last 100 lines of a file called 'log'.

Signup and view all the flashcards

SQL injection vulnerable code

Code that allows attackers to manipulate SQL queries by inserting malicious code, leading to data breaches.

Signup and view all the flashcards

HTTP 302 status code meaning

A 302 status code means the requested resource has been temporarily moved to a new URL.

Signup and view all the flashcards

What is the first line of database security?

The first line of database security is proper management and security of the operating system where the database resides.

Signup and view all the flashcards

Linux command to list all processes with full information

The ps -ef command lists all processes with extensive information, including process IDs, user names, and command arguments

Signup and view all the flashcards

How to add a column to an existing table in Oracle

Use the ALTER TABLE command followed by the table name and the ADD clause to add a new column to an existing table.

Signup and view all the flashcards

Which SQL injection technique is NOT recommended?

Using ?id=1 and 1=1 is not recommended, as it is too obvious and can be easily detected by security systems.

Signup and view all the flashcards

Weblogic default account

Weblogic has multiple default accounts, including admin, weblogic, and system. These accounts have default passwords that should be changed for security.

Signup and view all the flashcards

Which attack exploits buffer overflow?

Buffer overflow attacks exploit vulnerabilities in programs where data exceeding the allocated memory space can overwrite critical data, potentially leading to code execution.

Signup and view all the flashcards

56-bit Key Cracking Time

If you try every possible combination of a 56-bit key at a rate of 1 million attempts per second, it would take roughly 5.4 x 10^24 years to find the correct key.

Signup and view all the flashcards

Central Network Security and Informationization Leading Group

Established in February 2014, this key group in China aims to guide and oversee the nation's cybersecurity and informationization efforts.

Signup and view all the flashcards

When did China's Cybersecurity Law Come into Effect?

The Cybersecurity Law of China, passed on November 7, 2016, officially went into effect on June 1, 2017.

Signup and view all the flashcards

Cybersecurity Central Authority

The State Cyberspace Administration of China (CAC) is tasked with coordinating and supervising cybersecurity activities in the country.

Signup and view all the flashcards

Active Defense Technique Example

Honey Pot technology acts as a decoy, attracting attackers to a seemingly vulnerable system, allowing security personnel to observe and analyze their actions.

Signup and view all the flashcards

Linux Log Location

Linux system logs are typically found in the '/var/log' directory. This directory contains various system events and activity logs.

Signup and view all the flashcards

Port Scanning Reveals?

By scanning a target host's open ports, attackers can discover which services are running on that host and potentially identify vulnerabilities.

Signup and view all the flashcards

What is NOT true about Phishing?

Phishing is a type of social engineering attack that does not necessarily involve web services. It can be deployed through various channels like email or phone calls.

Signup and view all the flashcards

Lateral Movement in APT Attacks

Once attackers gain a foothold in a network, they attempt to move horizontally, gaining access to more systems and expanding their control within the target organization.

Signup and view all the flashcards

SQL Injection Result

Beyond testing for SQL Server, a successful SQL injection attack can reveal the username associated with the database connection. Careful crafting of the injection is required.

Signup and view all the flashcards

BASE64 Function in MySQL

The base64() function in MySQL is used to encode data into a base64-encoded string. It is a common method for representing binary data as text, often used for transferring data over HTTP.

Signup and view all the flashcards

MySQL Comment Syntax

MySQL supports various syntax for comments in SQL statements to explain or disable code portions. Common syntax includes --, #, and /* ... */.

Signup and view all the flashcards

HTTP Header: X-Forwarded-For

The X-Forwarded-For header is used in web servers to track the original client IP address when a request is forwarded through multiple proxies.

Signup and view all the flashcards

Asymmetric Encryption Algorithm

Asymmetric encryption algorithms use two keys: a public key for encryption and a private key for decryption. Encrypting with the public key can only be decrypted with the private key, and vice versa.

Signup and view all the flashcards

PDR Model in Information Security

The PDR (People, Process, and Technology) model is a framework for information security that emphasizes the importance of all three components in achieving effective security.

Signup and view all the flashcards

Data Integrity

Data integrity ensures that data remains accurate, complete, and consistent over its lifecycle. It prevents unauthorized modifications, ensures data authenticity, and maintains data consistency.

Signup and view all the flashcards

Half-Open Scan

A half-open scan (SYN scan) sends a SYN packet (start of a TCP connection) to a target port. The server responds with a SYN-ACK packet, but the client does not complete the handshake by sending an ACK packet. This allows information gathering without establishing a full connection.

Signup and view all the flashcards

Buffer Overflow Vulnerability

A buffer overflow occurs when a program writes more data into a buffer than its allocated memory space. This can overwrite adjacent memory locations, potentially executing malicious code.

Signup and view all the flashcards

NMAP

NMAP (Network Mapper) is a powerful network scanning tool used to discover hosts and services on a network. It identifies open ports, operating systems, and potential vulnerabilities.

Signup and view all the flashcards

WebLogic Default Port

WebLogic, a Java application server, typically listens on port 7001 for HTTP requests by default. This port is often targeted by attackers trying to access the server.

Signup and view all the flashcards

Nmap -sF

Nmap FIN scan is a stealthy method of scanning that does not send full TCP segments, making it harder to detect. It sends a FIN packet to the target port and awaits a TCP RST (reset) response. If the RST packet is received, it indicates a live host and an open port.

Signup and view all the flashcards

Nmap -sX

Nmap Xmas scan sends several TCP flags simultaneously: FIN, URG (Urgent), and PUSH. This combination is unusual and allows detection of open ports by the response. However, it is not very stealthy as it stands out.

Signup and view all the flashcards

Nmap -sN

Nmap Null scan sends a TCP packet with all flags set to zero. It is a stealthy method of scanning because it doesn't generate any traffic that is typical of a full TCP connection. However, it is less reliable than other scans.

Signup and view all the flashcards

Telnet/FTP Security

Telnet and FTP transfer data in plain text, making them vulnerable to eavesdropping, as passwords and usernames can be intercepted during transmission.

Signup and view all the flashcards

nmap -Pn

The -Pn option tells nmap to skip the host discovery phase when scanning. It is used when you already know the target host is up and active.

Signup and view all the flashcards

MySQL load_file() Injection

In MySQL, the load_file() function allows reading the content of a file on the server's file system. An attacker could exploit this function by injecting malicious SQL code to gain access to sensitive files.

Signup and view all the flashcards

HTTP 302

HTTP 302 is a redirect status code. It indicates that the requested resource has moved temporarily to a different URL.

Signup and view all the flashcards

Nmap -sV

Nmap -sV performs a version scan to identify the versions of applications running on discovered open ports.

Signup and view all the flashcards

SQL Injection: dbs

In SQLmap, the 'dbs' command is used to enumerate (list) all databases on a vulnerable MySQL server.

Signup and view all the flashcards

Burp Suite

Burp Suite is a powerful web application security testing tool used by security professionals to find and exploit vulnerabilities in web applications.

Signup and view all the flashcards

Study Notes

Question Selection

  • Questions cover various security topics, including vulnerabilities, network protocols, and web applications.
  • Questions are multiple choice format, testing knowledge of specific commands, attack types, and system configurations.
  • Question sets include different levels of difficulty, assessing different areas of security expertise.
  • Topics include: XXE (XML External Entity Injection), WebLogic vulnerabilities, Apache configuration, SQL injection, SSRF (Server-Side Request Forgery), security protocols, and more.
  • Question sets evaluate knowledge base of security concepts and their practical application.

Question Details

  • Question 1: Vulnerability types, focusing on various attack vectors and their consequences.
  • Question 2: Network security, identifying correct commands for network analysis and potential attacks.
  • Question 3: Web application security, determining appropriate actions to protect against vulnerabilities.
  • Question 4: Understanding of specific tools and their intended use in security testing.
  • Question 5: Various security topics, covering general security concepts and best practices to avoid breaches.
  • Question 6: Multiple-choice questions testing the knowledge of different aspects of security.

Database Security

  • Question 10: SQLSERVER database authentication modes, specifically focusing on which modes are incorrect.
  • Question 11: Exploiting vulnerabilities in SQLSERVER database authentication.
  • Question 12: Understanding SQL Server authentication mechanisms.
  • Question 13: Discussing common issues with web script programming.

Network security vulnerabilities

  • Question 13: Exploiting various network vulnerabilities, focusing on specific types of attacks and their effects.
  • Question 14: Identifying specific attacks based on malicious activities and the characteristics of those activities.
  • Question 15-16: General overview and characteristics of server-side attacks and their effects on web applications.

General Network Attacks

  • Question 18: Different attack vectors and their characteristics.
  • Question 19: Different aspects of attack methods to exploit system vulnerabilities.

WEB Application Security

  • Question 20: Identifying security threats by examining web application behavior.
  • Question 24: Examines specific vulnerabilities in different attack types.
  • Question 25: Exploring techniques and strategies used to mitigate vulnerabilities.
  • Question 26: Reviewing types of attacks and methods/protocols used.

General Security Concepts

  • Question 27: Reviewing types of attacks (e.g., SQL injection).
  • Question 28-29: Covering different attacks and vulnerabilities.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

Past Paper Questions - Security Exam

More Like This

Untitled Quiz
37 questions

Untitled Quiz

WellReceivedSquirrel7948 avatar
WellReceivedSquirrel7948
Untitled Quiz
55 questions

Untitled Quiz

StatuesquePrimrose avatar
StatuesquePrimrose
Untitled Quiz
18 questions

Untitled Quiz

RighteousIguana avatar
RighteousIguana
Untitled Quiz
48 questions

Untitled Quiz

StraightforwardStatueOfLiberty avatar
StraightforwardStatueOfLiberty
Use Quizgecko on...
Browser
Open
Browser
Browser