CompTIA And Security Exam 2

Buffer overflows occur when an application receives more data than it is programmed to accept. This situation can cause an application to terminate. The termination may leave the system sending the data with temporary access to privileged levels in the attacked system.

Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 135

The only preventative measure in dealing with social engineering attacks is to educate your users and staff to never give out passwords and user Ids over the phone, via e-mail, or to anyone who is not positively verified as being who they say they are.

Reference:
Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 87

The only preventative measure in dealing with social engineering attacks is to educate your users and staff to never give out passwords and user Ids over the phone, via e-mail, or to anyone who is not positively verified as being who they say they are. Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 87

A distributed denial of service (DDOS) attack utilizes a botnet. A botnet is a network of compromised computers or devices that are under the control of a malicious actor. These compromised devices, also known as bots, are used to flood a target system or network with an overwhelming amount of traffic, rendering it inaccessible to legitimate users. By using a botnet, the attacker can amplify the impact of the attack by coordinating multiple sources of traffic simultaneously.

Denial of service (DoS) attack is a type of attack where the purpose is to stop a workstation or service from functioning. In a DoS attack, the attacker overwhelms the target system with a flood of illegitimate requests or excessive traffic, causing the system to become unresponsive or crash. This prevents legitimate users from accessing the system or service. The goal of this attack is to disrupt the availability of the targeted resource rather than gaining unauthorized access or stealing information.

Spyware is a type of malicious software that is designed to monitor and collect information about a user's online activities without their knowledge or consent. It can track browsing history, keystrokes, login credentials, and other sensitive data. By installing spyware on a user's device, an attacker can gain unauthorized access to their online activities and monitor them. This makes spyware the correct answer for monitoring online activities.

Trojan horses are programs that enter a system or network under the guise of another program. A Trojan Horse may be included as an attachment or as part of an installation program. The Trojan Horse could create a back door or replace a valid program during installation. The Trojan Program would then accomplish its mission under the guise of another program. Trojan Horses can be used to compromise the security of your system and they can exist on a system for years before they are detected.

Reference:
Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 84

A Trojan horse is a program that appears to be useful but contains hidden code that allows unauthorized individuals to exploit or destroy data. It is commonly known as a program that deceives users by pretending to perform a legitimate function, but in reality, it carries out malicious activities in the background. Unlike viruses and worms that can self-replicate and spread, a Trojan horse relies on the user to unknowingly install it. Once installed, it can give unauthorized individuals access to the infected system, allowing them to exploit or destroy data.

Social engineering is any means of using people to seek out information. These people practice espionage to: break in without detection, disguise themselves in, trick others into giving them access, or trick others into giving them information.

Social engineering attacks work because of the availability heuristic, law of reciprocity, and law of consistency. In the past people have had experiences where a co-worker with a legitimate problem asked for help and been grateful for it. So by consistency, they feel the urge to help others again the way they've helped out somebody in the past. By availability, when someone asks for help, they associate that ask for help for every legitimate cry for help, and times when they needed help themselves and were helped; so essentially they're being a good Samaritan. If an awareness program were to be implemented where employees could be aware of social engineering tactics, they would be more likely to think about them, and be more suspect of an attack when someone does ask for a favor. With this knowledge in intuition, an employee will make a smarter decision.

Dictionaries may be used in a cracking program to determine passwords. A short dictionary attack involves trying a list of hundreds or thousands of words that are frequently chosen as passwords against several systems. Although most systems resist such attacks, some do not. In one case, one system in five yielded to a particular dictionary attack.

When a server or application accepts more input than it is expecting, it can lead to a buffer overflow. This occurs when the input exceeds the allocated memory space, causing the excess data to overwrite adjacent memory locations. This can result in the corruption of data, system crashes, or even the execution of malicious code. A buffer overflow is a common vulnerability that can be exploited by attackers to gain unauthorized access or disrupt the functioning of a system.

Phishing refers to the act of attempting to acquire personal and sensitive information, such as bank account details, by posing as a trustworthy entity in electronic communication. In this scenario, the user receives an email requesting personal data and bank account details, indicating an attempt to deceive and obtain sensitive information. Therefore, the correct answer is phishing.

Social engineering is a process where an attacker attempts to acquire information about your network and system by talking to people in the organization. A social engineering attack may occur over the phone, be e-mail, or by a visit. Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 87

DOS attacks prevent access to resources by users authorized to use those resources. An attacker may attempt to bring down an e-commerce website to prevent or deny usage by legitimate customers.

Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 53

The word spoofing was popularized in the air-force. When a fighter jet notices an enemy missile (air-to-air or surface-to-air) coming, the pilot will fire off a flair or a chaff (depending on whether or not the missile is heat seeking or radar guided) to spoof (trick) the missile into going after the wrong target. IP spoofing works the same way, and is commonly used by computer hackers because it's easy to implement, it takes advantage of someone else's trust relationship, it makes it harder to identify the source of the true attack, and it focuses attention away to an innocent 3rd party.

A worm is a type of malicious code that can self-replicate and spread across computer networks without the need for human involvement. Unlike viruses or Trojan horses, worms can exploit vulnerabilities in computer systems and use them to propagate themselves automatically. They can spread through email attachments, network shares, or even by exploiting security flaws in operating systems. Once a worm infects a system, it can replicate itself and spread to other vulnerable systems without any human intervention. This makes worms particularly dangerous as they can quickly infect and spread across a large number of computers or networks.

Because of human rights laws, it is unlawful to use technology to directly control people's emotions and behaviors. For this reason social engineering attacks cannot be deterred through technical means.

When the system administrator's user ID is deleted and the system starts deleting files, it indicates the presence of a logic bomb. A logic bomb is a type of malicious code that lies dormant until a specific condition or trigger is met, such as the deletion of a user ID. Once triggered, it executes a predefined action, in this case, deleting files. Unlike viruses and worms, logic bombs do not self-replicate or spread to other systems.

A Trojan horse attaches itself to another file, such as a word processing document. Trojan horses may also arrive as part of an e-mail for free game, software, or other file. When the Trojan horse activates and performs its task, it infects all of the word processing or template files. Consequently, every new file will carry the Trojan horse. The Trojan horse may not be visible because it masks itself inside of a legitimate program.

Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 80

A worm is a type of malware that is capable of replicating and spreading independently across networks without the need for user interaction. Unlike viruses, which require a host file to attach themselves to, worms can self-replicate and spread by exploiting vulnerabilities in computer systems. This allows them to quickly and efficiently infect multiple devices and networks, making them a particularly dangerous and difficult form of malware to control and eradicate.

Social engineering is a process where an attacker attempts to acquire information about your network and system by talking to people in the organization. A social engineering attack may occur over the phone, by e-mail, or by a visit. The answer is not written in the book, but the easiest way to gain information would be social engineering.

Reference:
Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 87

The TCP/IP (Transmission Control Protocol/Internet Protocol) session state is altered in a way that intercepts legitimate packets and allows a third party host to insert acceptable packets. Thus hijacking the conversation, and continuing the conversation under the disguise of the legitimate party, and taking advantage of the trust bond.

In IP Spoofing a hacker tries to gain access to a network by pretending his or her machine has the same network address as the internal network.

Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 515

Nmap is a well-known and widely used port scanning tool. It is designed to scan networks and discover open ports on remote systems. Nmap provides a comprehensive set of features and options that allow users to perform various types of scans, such as TCP, UDP, SYN, and more. It also offers advanced techniques like OS fingerprinting and version detection. Nmap is highly flexible and can be used for both legitimate network administration tasks and malicious activities, making it a popular choice among both security professionals and hackers.

The computer is part of a DDoS attack, where multiple compromised computers are used to overwhelm a target server or network with a flood of internet traffic, causing it to become unavailable to legitimate users.

A worm is different from a virus. Worms reproduce themselves, are self-contained and do not need a host application to be transported. The Trojan horse program may be installed as part of an installation process. They do not reproduce or self replicate.

Reference:
Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, pp 83, 85

Worms are dangerous because they can enter a system by exploiting a 'hole' in an operating system. They don't' need a host file, and they don't need any user intervention to replicate by themselves. Some infamous worms were: Morris, Badtrans, Nimda, and Code Red.

A seems to be the best answer. The other answers involving objects and social engineering are verbal attacks.

SYN flood is a DoS attack in which the hacker sends a barrage of SYN packets. The receiving station tries to respond to each SYN request for a connection, thereby tying up all the resources. All incoming connections are rejected until all current connections can be established.

Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 530

A Trojan horse is a type of malicious code that disguises itself as a harmless file or program, such as a game, in order to trick users into downloading and installing it. Once installed, it can perform various malicious activities, such as stealing sensitive information, damaging files, or allowing unauthorized access to the system. In this case, the freely distributed game is purposely installed and played by the user, unknowingly allowing the Trojan horse to enter the system and carry out its malicious actions.

A back door is a programming mechanism that allows administrative access to a system while bypassing the usual access control methods. It is often used by system administrators or developers for troubleshooting or maintenance purposes. However, it can also be exploited by attackers to gain unauthorized access to a system. Unlike a logic bomb, which is a malicious code that triggers a harmful action at a specific time or event, a back door is intentionally created to provide a secret entry point into a system. It is different from a Trojan horse, which disguises itself as a legitimate program to deceive users. A software exploit, on the other hand, is a vulnerability in a software program that can be exploited by an attacker to gain unauthorized access or control over the system.

The correct answer is to look at the source IP address in the SMTP header of the emails. The SMTP header contains information about the origin of the email, including the source IP address. By examining the source IP address, it can be determined whether the emails originated internally or externally. This can help in identifying whether the ex-employee is still accessing the company's email system or if the emails are coming from an external source.

Input validation is the programming method that should be used to stop buffer overflow attacks. Buffer overflow attacks occur when a program tries to store more data in a buffer than it can handle, leading to potential security vulnerabilities. Input validation involves checking and validating user input to ensure that it meets certain criteria and does not exceed the buffer's capacity. By implementing input validation, developers can prevent buffer overflow attacks by ensuring that only valid and safe input is accepted by the program.

A worm is a type of malicious software that can spread across computer networks without the need for user intervention. Unlike viruses or Trojan horses, worms are self-replicating and can exploit vulnerabilities in network protocols to automatically infect other computers. Once a worm gains access to a network, it can spread rapidly and cause significant damage by consuming network resources, stealing sensitive information, or carrying out other malicious activities. Therefore, the correct answer is that a worm can be transmitted without user intervention.

The SYN flood attack works when a source system floods and end system with TCP SYN requests, but intentionally does not send out acknowledgements (ACK). Since TCP needs confirmation, the receiving computer is stuck with half-open TCP sessions, just waiting for acknowledgement so it can reset the port. Meanwhile the connection buffer is being overflowed, making it difficult or impossible for valid users to connect, therefore their service is denied.

Brute force is a method of password guessing where every possible combination of characters is tried until the correct password is found. This method requires the longest attack time because it systematically tries every possible option, which can be time-consuming, especially for longer and more complex passwords. Dictionary attacks, rainbow attacks, and birthday attacks are all more efficient methods that exploit weaknesses in password systems, such as common or easily guessable passwords, precomputed tables, or hash collisions, respectively.

A spoofing attack is simple an attempt by someone or something masquerading as someone else. This type of attack is usually considered an access attack.

Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 56

A logic bomb is a type of malicious code that remains dormant within a system until a specific condition or trigger occurs, such as a user opening a particular program. Once activated, it carries out a destructive action, in this case deleting the contents of attached network drives and removable storage devices. Unlike a Trojan horse, which disguises itself as a legitimate program, a logic bomb is specifically designed to cause harm once triggered. A honeypot is a different concept altogether, referring to a trap set up to detect and monitor unauthorized access attempts. A worm, on the other hand, is a self-replicating malware that spreads across networks without the need for user interaction.

Heuristic analysis is used by anti-virus software to detect unknown viruses. This method involves analyzing the behavior and characteristics of files and programs to identify potential threats. It uses a set of rules and algorithms to determine if a file or program is suspicious or malicious based on its actions, structure, or code. By using heuristic analysis, anti-virus software can detect and block new and previously unknown viruses that may not have been identified by traditional virus definitions.

Social engineering is using deception to engineer human emotions into granting access.

Poor programming techniques and lack of code review can result in a buffer overflow attack. This type of attack occurs when a program writes data outside the allocated memory buffer, causing the program to crash or allowing an attacker to execute malicious code. Inadequate programming practices and the absence of code review can lead to vulnerabilities in the code, making it easier for attackers to exploit and carry out buffer overflow attacks.

A birthday attack is based on the principle that amongst 23 people, the probability of 2 of them having the same birthday is greater the 50%. By that rational if an attacker examines the hashes of an entire organizations passwords, they'll come up with some common denominators.

If a virus threat is for real, the major anti-virus players like Symantec, McAfee, or Sophos will know about it before you, and they will have details on their sites. Incorrect answers: Searching for and deleting a file is not only a waste of time with today's OS's complex directory systems, but its also ineffective. One can miss a file, the file could be hidden, the wrong file can be deleted, and worst of all: when you delete a file it doesn't really get completely deleted, instead it gets sent to a 'recycle bin.' Broadcasting an alert and creating panic isn't the right thing to do, because it will waste bandwidth, and perhaps terrorizing the users is the original intent of the attack. The act of locating and downloading a patch isn't just time consuming, but there's a chance that the patch itself could be the virus, or the process of resetting the computer could activate the virus.

Port 3389 is the correct answer because it is the default port used by Microsoft's Remote Desktop Protocol (RDP), which allows users to connect to a computer remotely and login. RDP is commonly used for remote administration and accessing files or applications on a remote computer.

A Smurf attack is a type of DDoS attack where an attacker sends a large number of ICMP ping requests (PING packets) with the source IP address set to the target PC's IP address and the destination IP address set to the broadcast address. This causes all the devices on the network to respond to the ping requests, overwhelming the target PC with an excessive amount of traffic and potentially causing it to crash or become unavailable.

In such a scenario the most rational answer is to tell your network administrator. Most network administrators don't have much to do most of the day, so they live for an opportunity like this. Incorrect Answers: Deleting the file wouldn't be good, because deleting a file doesn't necessarily eliminate a problem, as it could put it to your email trash folder, or to your recycle bin. This will give you a false sense of security, and work against the process of containment. Copying the email to all distribution lists, is another mistake, because if indeed the email does contain a virus, you'll only spread it. Ignoring the problem isn't a good problem, although virus hoaxes are common, all it takes is one real virus to cause a mini-disaster.

A virus is a piece of software designed to infect a computer system. I can go into this further, but the answer is obvious. Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 76

SNMP (Simple Network Management Protocol) is used to verify the equipment status and modify the configuration or settings of network gadgets. SNMP allows network administrators to monitor and manage network devices such as routers, switches, and servers. It provides a standardized way to collect and organize information about these devices, as well as the ability to remotely configure and control them. SNMP operates on the application layer of the TCP/IP protocol stack and uses a manager-agent model, where the network devices act as agents and the network administrator's workstation acts as the manager.

A Worm is a type of malicious software that can spread across computer networks without the need for a client to distribute it. Unlike viruses, worms are standalone programs that can replicate and spread themselves without attaching to other files or programs. This allows them to quickly infect multiple computers and networks, causing damage and disruption. Worms can exploit vulnerabilities in network protocols and security systems, enabling them to self-propagate and infect other devices. Therefore, out of the given options, a Worm is the correct answer for the question.