Tremp is an IT Security Manager, and he is planning to deploy an IDS in his small company. He is looking for an IDS with the following characteristics: -Verifies success or failure of an attack Monitors system activities Detects attacks that a network-based IDS fails to detect. Near real-time detection and response Does not require additional hardware Lower entry cost. Which type of IDS is best suited for Tremps requirements?


A. Network-based IDS
B. Open source-based IDS
C. Host-based IDS
D. Gateway-based IDS

While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts and displays a video of cats playing a piano. The next business day, the user receives what looks like an email from his bank, indicating that his bank account has been accessed from a foreign country. The email asks the user to call his bank and verify the authorization of a funds transfer that took place. What Web browser-based security vulnerability was exploited to compromise the user?


A. Clickjacking
B. Cross-Site Scripting
C. Cross-Site Request Forgery
D. Web form input validation

During an Xmas scan, what indicates a port is closed?


A. RST
B. SYN
C. ACK
D. No return response

What does the oX flag do in an Nmap scan?


A. Perform an Xmas scan
B. Perform an eXpress scan
C. Output the results in truncated format to the screen
D. Output the results in XML format to a file

The purpose of a _______is to deny network access to local area networks and other information assets by unauthorized wireless devices.


A. Wireless Analyzer
B. Wireless Jammer
C. Wireless Access Point
D. Wireless Access Control List

You have just been hired to perform a pen test on an organization that has been subjected to a large-scale attack. The CIO is concerned with mitigating threats and vulnerabilities to totally eliminate risk. What is one of the first things you should do when given the job?


A. Establish attribution to suspected attackers
B. Interview all employees in the company to rule out possible insider threats
C. Explain to the CIO that you cannot eliminate all risk, but you will be able to reduce risk to acceptable levels.
D. Start the wireshark application to start sniffing network traffic.

The tools which receive event logs from servers, network equipment, and applications, and perform analysis and correlation on those logs, and can generate alarms for security relevant issues, are known as what?


A. Network Sniffer
B. Vulnerability Scanner
C. Intrusion Prevention Server
D. Security Incident and Event Monitoring

Risks=Threats x Vulnerabilities is referred to as the:


A. BIA equation
B. Disaster recovery formula
C. Risk equation
D. Threat assessment

Which of the following is assured by the use of a hash?


A. Authentication
B. Confidentially
C. Availability
D. Integrity

You have successfully gained access to your clients internal network and successfully comprised a Linux server which is part of the internal IP network. You want to know which Microsoft Windows workstations have file sharing enabled. Which port would you see listening on these Windows machines in the network?


A. 161
B. 3389
C. 445
D. 1433