CCNA Cybersecurity Operations (Version 1.1) – CyberOps Chapter 6 Exam Answers 2019
What is the motivation of a white hat attacker?
- taking advantage of any vulnerability for illegal personal gain
- fine tuning network devices to improve their performance and efficiency
- studying operating systems of various platforms to develop a new system
- discovering weaknesses of networks and systems to improve the security level of these systems
White hat attackers break into networks or computer systems in order to discover weaknesses for the purpose of improving the security of these systems. These break-ins are done with permission from the owner or the organization. Any results are reported back to the owner or the organization.
Which type of hacker is motivated to protest against political and social issues?
- script kiddie
- vulnerability broker
Hackers are categorized by motivating factors. Hacktivists are motivated by protesting political and social issues.
Which security threat installs on a computer without the knowledge of the user and then monitors computer activity?
Spyware normally installs on a system without end-user knowledge and monitors activity on a computer, which can then be sent to the source of spyware. Viruses infect systems and execute malicious code. Worms self-replicate and propagate across networks from a singular host, consuming a lot of bandwidth. Adware is normally distributed through downloaded software and results in the exhibition of several pop-up windows on the system.
What is a significant characteristic of virus malware?
- A virus is triggered by an event on the host system.
- Once installed on a host system, a virus will automatically propagate itself to other systems.
- A virus can execute independently of the host system.
- Virus malware is only distributed over the Internet.
A virus is malicious code that is attached to a legitimate program or executable file, and requires specific activation, which may include user actions or a time-based event. When activated, a virus can infect the files it has not yet infected, but does not automatically propagate itself to other systems. Self-propagation is a feature of worms. In addition to being distributed over the Internet, viruses are also spread by USB memory sticks, CDs, and DVDs.
What are the three major components of a worm attack? (Choose three.)
- an enabling vulnerability
- an infecting vulnerability
- a payload
- a penetration mechanism
- a probing mechanism
- a propagation mechanism
A computer can have a worm installed through an email attachment, an executable program file, or a Trojan Horse. The worm attack not only affects one computer, but replicates to other computers. What the worm leaves behind is the payload–the code that results in some action.
What type of malware has the primary objective of spreading across the network?
- Trojan horse
The main purpose of a worm is to self-replicate and propagate across the network. A virus is a type of malicious software that needs a user to spread. A trojan horse is not self-replicating and disguises itself as a legitimate application when it is not. A botnet is a series of zombie computers working together to wage a network attack.
What is a characteristic of a Trojan horse as it relates to network security?
- Malware is contained in a seemingly legitimate executable program.
- Extreme quantities of data are sent to a particular network device interface.
- An electronic dictionary is used to obtain a password to be used to infiltrate a key network device.
- Too much information is destined for a particular memory block, causing additional memory areas to be affected.
A Trojan horse carries out malicious operations under the guise of a legitimate program. Denial of service attacks send extreme quantities of data to a particular host or network device interface. Password attacks use electronic dictionaries in an attempt to learn passwords. Buffer overflow attacks exploit memory buffers by sending too much information to a host to render the system inoperable.
Which type of Trojan horse security breach uses the computer of the victim as the source device to launch other attacks?
The attacker uses a proxy Trojan horse attack to penetrate one device and then use that device to launch attacks on other devices. The DoS Trojan horse slows or halts network traffic. The FTP trojan horse enables unauthorized file transfer services when port 21 has been compromised. A data-sending Trojan horse transmits data back to the hacker that could include passwords.
Why would a rootkit be used by a hacker?
- to do reconnaissance
- to try to guess a password
- to gain access to a device without being detected
- to reverse engineer binary files
Hackers use rootkits to avoid detection as well as hide any software installed by the hacker.
A senior citizen receives a warning on the computer that states that the operating system registry is corrupt and to click a particular link to repair it. Which type of malware is being used to try to create the perception of a computer threat to the user?
Scareware is a type of malware that attempts to shock or induce anxiety by creating a perception of a threat. Phishing tries to get the user to divulge some information. A DoS attack tries to disrupt service on a network. Adware usually appears in pop-ups trying to get the user to buy something or to visit a website.
A company pays a significant sum of money to hackers in order to regain control of an email and data server. Which type of security attack was used by the hackers?
- Trojan horse
Ransomware involves the hackers preventing user access to the infected and controlled system until the user pays a specified amount.
A user is curious about how someone might know a computer has been infected with malware. What are two common malware behaviors? (Choose two.)
- The computer beeps once during the boot process.
- The computer emits a hissing sound every time the pencil sharpener is used.
- The computer gets increasingly slower to respond.
- No sound emits when an audio CD is played.
- The computer freezes and requires reboots.
Common symptoms of computers infected with malware:Appearance of files, applications, or desktop icons
Security tools such as antivirus software or firewalls turned off or changed
Emails spontaneously sent to others
Modified or missing files
Slow system or browser response
Unfamiliar processes or services running
Unknown TCP or UDP ports open
Connections made to unknown remote devices
What is the term used when a malicious party sends a fraudulent email disguised as being from a legitimate, trusted source?
Phishing is used by malicious parties who create fraudulent messages that attempt to trick a user into either sharing sensitive information or installing malware.
What is the primary goal of a DoS attack?
- to facilitate access to external networks
- to prevent the target server from being able to handle additional requests
- to obtain all addresses in the address book within the server
- to scan the data on the target server
A denial of service (DoS) attack attempts to overwhelm a system or process by sending large amounts of data or requests to the target. The goal is to keep the system so overwhelmed handling false requests that it is unable to respond to legitimate ones.
What causes a buffer overflow?
- launching a security countermeasure to mitigate a Trojan horse
- downloading and installing too many software updates at one time
- attempting to write more data to a memory location than that location can hold
- sending too much information to two or more interfaces of the same device, thereby causing dropped packets
- sending repeated connections such as Telnet to a particular device, thus denying other data sources
By sending too much data to a specific area of memory, adjacent memory locations are overwritten, which causes a security issue because the program in the overwritten memory location is affected.
What are two purposes of launching a reconnaissance attack on a network? (Choose two.)
- to retrieve and modify data
- to scan for accessibility
- to escalate access privileges
- to gather information about the network and devices
- to prevent other users from accessing the system
Gathering information about a network and scanning for access is a reconnaissance attack. Preventing other users from accessing a system is a denial of service attack. Attempting to retrieve and modify data, and attempting to escalate access privileges are types of access attacks.
What is a main purpose of launching an access attack on network systems?
- to prevent other users from accessing the system
- to gather information about the network
- to scan for accessible networks
- to retrieve data
Gathering information about a network and scanning for access is a reconnaissance attack. Preventing other users from accessing a system is a denial of service attack.
Which access attack method involves a software program that attempts to discover a system password by the use of an electronic dictionary?
- buffer overflow attack
- port redirection attack
- denial of service attack
- brute-force attack
- IP spoofing attack
- packet sniffer attack
An access attack tries to affect services that affect entry into accounts, databases, and other sensitive information. Access attacks commonly involve a dictionary ths is used to guess a specific user password. A brute-force access attack would try to access an account via repeated attempts.
An attacker is using a laptop as a rogue access point to capture all network traffic from a targeted user. Which type of attack is this?
- trust exploitation
- buffer overflow
- man in the middle
- port redirection
An access attack tries to gain access to a resource using a hijacked account or other means. The five types of access attacks include the following:password – a dictionary is used for repeated login attempts
trust exploitation – uses granted privileges to access unauthorized material
port redirection – uses a compromised internal host to pass traffic through a firewall
man-in-the-middle – an unauthorized device positioned between two legitimate devices in order to redirect or capture traffic
buffer overflow – too much data sent to a memory location that already contains data
What is a ping sweep?
- a network scanning technique that indicates the live hosts in a range of IP addresses.
- a software application that enables the capture of all network packets that are sent across a LAN.
- a scanning technique that examines a range of TCP or UDP port numbers on a host to detect listening services.
- a query and response protocol that identifies information about a domain, including the addresses that are assigned to that domain.
A ping sweep is a tool that is used during a reconnaissance attack. Other tools that might be used during this type of attack include a ping sweep, port scan, or Internet information query. A reconnaissance attack is used to gather information about a particular network, usually in preparation for another type of network attack.
In what way are zombies used in security attacks?
- They are maliciously formed code segments used to replace legitimate applications.
- They target specific individuals to gain corporate or personal information.
- They are infected machines that carry out a DDoS attack.
- They probe a group of machines for open ports to learn which services are running.
Zombies are infected computers that make up a botnet. The zombies are used to deploy a distributed denial of service (DDoS) attack.
What is the term used to describe an email that is targeting a specific person employed at a financial institution?
- target phishing
- spear phishing
Spear phishing is a phishing attack customized to reach a specific person or target.
What is a botnet?
- a network that allows users to bring their own technology
- a network of infected computers that are controlled as a group
- an online video game intended for multiple players
- a group of web servers that provide load balancing and fault tolerance
One method of executing a DDoS attack involves using a botnet. A botnet builds or purchases a botnet of zombie hosts, which is a group of infected devices. The zombies continue to create more zombies which carry out the DDoS attack.
What are two evasion methods used by hackers? (Choose two.)
- access attack
- resource exhaustion
The following methods are used by hackers to avoid detection:Encryption and tunneling – hide or scramble the malware content
Resource exhaustion – keep the host device too busy to detect the invasion
Traffic fragmentation – split the malware into multiple packets
Protocol-level misinterpretation – sneak by the firewall
Pivot – use a compromised network device to attempt access to another device
Rootkit – allow the hacker to avoid detection as well as hide software installed by the hacker
Which type of security attack would attempt a buffer overflow?
Denial of service (DoS) attacks attempt to disrupt service on the network by either sending a particular device an overwhelming amount of data so no other devices can access the attacked device or by sending malformed packets.
What are three techniques used in social engineering attacks? (Choose three.)
- buffer overflow
- sending junk email
Phishing is an attempt to get a user to divulge information. Vishing is a type of phishing that uses voice and the phone system. With pretexting, the hacker lies to the user in an attempt to obtain information.
Match the security concept to the description.
Match the network security testing technique with how it is used to test network security. (Not all options are used.)
Network scanning tools are used to probe network devices, servers and hosts for open TCP or UDP ports. Vulnerability scanning tools are used to discover security weaknesses in a network or computer system. Penetration testing tools are used to determine the possible outcome of a successful attack on a network or computer system.