Ethical Hacking and Penetration Testing
Exam Preparation Guide
Course Introduction
This course provides an in-depth exploration of ethical hacking principles and penetration testing methodologies used to safeguard computer systems and networks. Students will learn how to think like an attacker by identifying vulnerabilities, exploiting common security flaws, and deploying tools and techniques used by cybersecurity professionals. Emphasis is placed on legal and ethical considerations, responsible disclosure, and adherence to industry standards. Through a combination of theoretical concepts and hands-on labs, participants will develop skills in reconnaissance, scanning, enumeration, vulnerability analysis, exploitation, and reporting, preparing them for real-world security assessments and entry-level positions in cybersecurity.
Recommended Textbook
Principles of Computer Security CompTIA Security+ and Beyond 3rd Edition by Wm. Arthur Conklin
Available Study Resources on Quizplus
25 Chapters
1136 Verified Questions
1136 Flashcards
Source URL: https://quizplus.com/study-set/2933 Page 2
Chapter 1: Introduction and Security Trends
Available Study Resources on Quizplus for this Chatper
49 Verified Questions
49 Flashcards
Source URL: https://quizplus.com/quiz/58443
Sample Questions
Q1) The second step an administrator can take in minimizing possible avenues of attack is _______________.
Answer: system hardening
Q2) According to the Computer Crime and Security Survey,the four types of attacks that increased from 2007 to 2008 were
A)Viruses,insider abuse,laptop theft,and unauthorized access
B)Unauthorized access,theft/loss of proprietary information,misuse of web applications,and DNS attacks
C)Viruses,insider abuse,misuse of web applications,and DNS attacks
D)Laptop theft,unauthorized access,and theft/loss of proprietary information
Answer: B
Q3) In 2009 _______________ was cut and resulted in widespread phone and Internet outages in the San Jose area of California.
Answer: fiber cable
Q4) As the level of sophistication of attacks _________,the level of knowledge necessary to exploit vulnerabilities decreased.
Answer: increased
To view all questions and flashcards with answers, click on the resource link above.
3
Chapter 2: General Security Concepts
Available Study Resources on Quizplus for this Chatper
65 Verified Questions
65 Flashcards
Source URL: https://quizplus.com/quiz/58442
Sample Questions
Q1) _______________ security takes a granular view of security by focusing on protecting each computer and device individually instead of addressing protection of the network as a whole.
Answer: Host
Q2) The objective of the Bell-LaPadula security model is integrity.
A)True
B)False
Answer: False
Q3) The policies of the Bell-LaPadula model are
A)Ring (no read down)and Low-Water-Mark (no write up)
B)*-Property (no write up)and Simple Security Rule (no read down)
C)Ring (no read up)and Low-Water-Mark (no write down)
D)*-Property (no write down)and Simple Security Rule (no read up)
Answer: D
Q4) Network security places the emphasis on controlling access to external resources from internal entities.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Operational-Organizational Security
Available Study Resources on Quizplus for this Chatper
43 Verified Questions
43 Flashcards
Source URL: https://quizplus.com/quiz/58441
Sample Questions
Q1) _______________ are the step-by-step instructions on how to implement policies in the organization.
Answer: Procedures
Q2) Choosing the location of equipment can have an impact on your security.Explain the security issues you would consider when placing various types of equipment.
Answer: Wireless access points should be placed where it is difficult for outsiders to access.Monitors should not face windows.Devices that have electromagnetic emanation should be contained properly.
Q3) Voice recognition,iris scans,and facial geometry can be used for biometric access controls.
A)True
B)False
Answer: True
Q4) TEMPEST is a program developed by the US department of defense to protect equipment from the ill effects of weather and other natural disasters.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: The Role of People in Security
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/58440
Sample Questions
Q1) An attacker posts a flier offering services to clean computers of a virus that is sweeping the Internet,speeding them up as a result.A person concerned that he may have the virus because his computer was running slow,calls the attacker,asking for help.This is an example of ___________________.
Q2) Phishing is the most common form of social engineering attack related to computer security.
A)True
B)False
Q3) Spear phishing is when an attacker attempts to redirect a user to a bogus web site that appears similar to the web site the user had intended to access.
A)True
B)False
Q4) Social engineers attempt to exploit the natural tendencies of people.They do this by
A)First trying to evoke sympathy;if this fails,then by fear of confrontation
B)First trying to evoke fear of confrontation and then by sympathy
C)First trying to guess passwords and then use a password cracker
D)First trying to evoke passion and then fear
Q5) Give an example of a hoax and how it might actually be destructive.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Cryptography
Available Study Resources on Quizplus for this Chatper
49 Verified Questions
49 Flashcards
Source URL: https://quizplus.com/quiz/58439
Sample Questions
Q1) Which of the following is NOT a hashing algorithm
A)SHA1
B)MD2
C)SHA3
D)MD5
Q2) The ROT13 cipher is an example of a
A)Shift cipher
B)Substitution cipher
C)Transposition cipher
D)Vigenère cipher
Q3) _______________ puts the plaintext through a simplified cipher to try to deduce what the key is likely to be in a full version of the cipher.
Q4) All of the following are asymmetric encryption algorithms EXCEPT:
A)RSA
B)3DES
C)ECC
D)ElGamal
Q5) The Vigenère cipher is a polyalphabetic substitution cipher.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Public Key Infrastructure
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/58438
Sample Questions
Q1) A(n)_______________ is a construct of systems,personnel,applications,protocols,technologies,and policies that work together to provide a certain level of protection.
Q2) Which of the following is not one of the three forms of trust models?
A)Hybrid
B)Star
C)Peer-to-peer
D)Hierarchical
Q3) One of the steps necessary to validate a certificate is to
A)Explore private key protection
B)Know certificate authorizations
C)Calculate a message digest for the certificate
D)Check out different types of public key infrastructures
Q4) What is a public key infrastructure?
A)A structure that enables parties to use communications such as e-mail
B)A structure that provides all of the components needed for entities to communicate securely and in a predictable manner
C)A structure that enables secure communications in chat rooms,and when instant messaging and text messaging
D)Is another name for digital signatures
Page 8
To view all questions and flashcards with answers, click on the resource link above.
Chapter 7: Standards and Protocols
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/58437
Sample Questions
Q1) Which is the strongest implementation class of WTLS?
A)First class
B)Class 1
C)Class 2
D)Class 3
Q2) IPsec is short for the "second" version of IP.
A)True
B)False
Q3) List and define 5 of the 12 sections detailed by the ISO/IEC 27002 Standard.
Q4) _______________ allows the encapsulation of one packet inside another to hide the original packet.
Q5) What is IPsec?
A)A collection of IP security features designed to introduce security at the network or packet-processing layer
B)An application that encrypts e-mail
C)A standard setting group that dictates internet security standards
D)The company to first introduce the concept of encryption
Q6) _______________ provides a method for implementing a key exchange protocol and for negotiating a security policy.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Physical Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/58436
Sample Questions
Q1) Drive imaging is the term used for copying all the image files from one drive to another.
A)True
B)False
Q2) The best fire extinguisher for an wood,paper and cloth fires is a
A)Class A
B)Class B
C)Class C
D)Class D
Q3) A(n)___________ is a token that can enable cryptographic types of authentication.
Q4) A house key is an example of a(n)__________.
Q5) Explain very simply how biometrics works
Q6) Which of the following are examples of the concept of layered access in physical security?
A)Firewall,IDS,CCTV
B)Fences,gates,mantrap,doors
C)CCTV,walls,antivirus
D)RFID,biometrics,personal firewalls
Q7) What is multiple-factor authentication?
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Network Fundamentals
Available Study Resources on Quizplus for this Chatper
55 Verified Questions
55 Flashcards
Source URL: https://quizplus.com/quiz/58435
Sample Questions
Q1) The method of packaging packets so that they can traverse a network in a secure manner is called _______________.
Q2) LAN and WAN networks can be connected.
A)True
B)False
Q3) Network components connected to the same cable are often called "the backbone" in which topology?
A)Star
B)Bus
C)Ring
D)Hybrid
Q4) Which protocol is responsible for resolving an IP address to a MAC address?
A)DNS
B)ARP
C)RARP
D)ICMP
Q5) _______________ describes network components that are connected to the same cable,often called "the backbone."
Q6) What is NAT and what is it used for?
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Infrastructure Security
Available Study Resources on Quizplus for this Chatper
42 Verified Questions
42 Flashcards
Source URL: https://quizplus.com/quiz/58434
Sample Questions
Q1) The following are steps in securing a workstation EXCEPT:
A)Install NetBIOS and IPX
B)Install antivirus
C)Remove unnecessary software
D)Disable unnecessary user accounts
Q2) What are the different types of removable media?
Q3) What protocol is used to manage IP address space?
A)ICMP
B)DHCP
C)TCP
D)SNMP
Q4) A bridge works on layer 3 of the OSI model.
A)True
B)False
Q5) A hub operates at
A)Layer 1,the physical layer
B)Layer 2,the data link layer
C)Layer 2,the MAC layer
D)Layer 3,the network layer
Q6) What are the four common methods for connecting equipment at the physical layer?
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Authentication and Remote Access
Available Study Resources on Quizplus for this Chatper
46 Verified Questions
46 Flashcards
Source URL: https://quizplus.com/quiz/58433
Sample Questions
Q1) _______________ is the collection of billing and other detail records.
Q2) The main weakness of SSH is that all traffic is sent in the clear.
A)True
B)False
Q3) What does SSH stand for?
A)Simple Security Hardware
B)Secure Socket Help
C)Secure Shell
D)Scientifically Secure Hard Drive
Q4) _______________ is the granting of specific permissions based on the privileges held by the account.
Q5) Protecting only the data portion of a packet is referred to as _______________ protection.
Q6) What does RADIUS stand for?
A)Real Access Device Invisible Users Solution
B)Rational Available Device Incremental Users Service
C)Remote Authentication Dial-In User Service
D)Remote Authentication Device Invisible Users Solution
Q7) Protecting the header information of a packet is referred to as _______________ protection.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Wireless
Available Study Resources on Quizplus for this Chatper
43 Verified Questions
43 Flashcards
Source URL: https://quizplus.com/quiz/58432
Sample Questions
Q1) Why is wireless problematic from a security standpoint?
A)There is no control over physical limitations.
B)Insufficient signal strength
C)There is no control over the physical layer of traffic.
D)There is no control over the network.
Q2) WEP was not designed with confidentiality in mind.
A)True
B)False
Q3) Which of the following specifications of 802.11 has the highest speed?
A)g
B)n
C)i
D)s
Q4) _____________ means to make certain that no unauthorized individuals read the packets you transmit over the Internet.
A)Integrity
B)Confidentiality
C)Authentication
D)WTLS
Q5) If unauthorized wireless is set up,it is known as a(n)_______________.
Page 14
To view all questions and flashcards with answers, click on the resource link above.
Chapter 13: Intrusion Detection Systems and Network
Security
Available Study Resources on Quizplus for this Chatper
49 Verified Questions
49 Flashcards
Source URL: https://quizplus.com/quiz/58431
Sample Questions
Q1) Windows Defender does all of the following EXCEPT:
A)Spyware detection and removal
B)Real-time malware protection
C)Spam filtering
D)Examine programs running on your computer
Q2) Content-based signatures detect character patterns and TCP flag settings.
A)True
B)False
Q3) The main purpose of a honeypot is
A)To identify hackers so they can be tracked down by the FBI
B)To slow hackers down by providing an additional layer of security that they must pass before accessing the actual network
C)To distract hackers away from attacking an organization's live network
D)To help security professionals better understand and protect against threats to the system
Q4) What must you do in order to sniff the traffic on all ports on a switch?
A)Nothing;you can see all the traffic on a switch by default.
B)Nothing;a switch does not allow you do see all traffic.
C)Enable port mirroring.
D)Run a cable to each port.
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: Baselines
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/58430
Sample Questions
Q1) When hardening Mac OS X,the same guidelines for all UNIX systems apply.
A)True
B)False
Q2) Which of the following is NOT a general step in securing a networking device?
A)Choosing good passwords
B)Password-protecting the console
C)Maintaining SNMP community strings
D)Turning off unnecessary services
Q3) Mac OS X FileVault encrypts files with 3DES encryption.
A)True
B)False
Q4) Which of the following is the command to stop a service in UNIX?
A)Stop
B)Kill
C)End
D)Finish
Q5) List three of the security features of Windows Vista.
Q6) In Solaris,one can use the __________ command to modify the permissions associated with a file or directory.
Q7) List four of the new modifications and capabilities of Windows 2003 Server.
To view all questions and flashcards with answers, click on the resource link above. Page 16
Chapter 15: Types of Attacks and Malicious Software
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/58429
Sample Questions
Q1) List and describe the steps a hacker takes to attack a network.
Q2) The term ___________ refers to software that has been designed for some nefarious purpose.
A)virus
B)worm
C)Trojan horse
D)malware
Q3) Scanning is when an attacker attempts to crash the system with programs such as ping sweep or superscan.
A)True
B)False
Q4) A birthday attack is a type of logic bomb virus that releases its payload on some famous person's birthday,such as Michelangelo.
A)True
B)False
Q5) How can social engineering be used to gain access to a computer network and what is the best way to prevent it from happening?
Q6) Describe some of the types of attacks that can be launched against a network.
Q7) What should be included in a security audit?
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 16: E-Mail and Instant Messaging
Available Study Resources on Quizplus for this Chatper
47 Verified Questions
47 Flashcards
Source URL: https://quizplus.com/quiz/58428
Sample Questions
Q1) A type of malicious code that appears to be a safe program but that actually has a hidden purpose is called a ____________.
A)virus
B)hoax
C)Trojan
D)worm
Q2) Viruses that are scripted to send themselves to other users are known as ______________.
Q3) What TCP port does SMTP use?
A)25
B)110
C)143
D)443
Q4) Securing e-mail is something that must be done by
A)Networking administrators
B)Security administrators
C)Outlook express
D)Users
Q5) A(n)_______________ is a mail server that will accept mail from everyone.
Page 18
Q6) Briefly give two examples of how hoax e-mails work.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 17: Web Components
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/58427
Sample Questions
Q1) What are some of the security issues associated with web applications and plug-ins?
Q2) Which is a 100% secure method to download applications from the Internet?
A)Signed applets
B)SSH
C)HTTPS
D)There is none.
Q3) The SFTP protocol incorporates what into FTP?
A)SSL
B)Secure java scripting
C)28 bit encryption key
D)the TCP protocol
Q4) _______________ is an application-level protocol that operates over a wide range of lower level protocols.
Q5) Which of the following do not enhance the security of the browser?
A)Browser plug-ins
B)Patches
C)Disabling javascript
D)Rejecting cookies
Q6) What are some of the security concerns regarding scripting?
To view all questions and flashcards with answers, click on the resource link above. Page 19
Chapter 18: Secure Software Development
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/58426
Sample Questions
Q1) Scoring the efforts to reduce the effects of threats occurs in which step of threat modeling?
A)Step 2-Enumerate assets
B)Step 7-Score and rank threats
C)Step 8-Create threat trees
D)Step 9-Determine and score mitigation
Q2) You are interviewing for a job as a software developer.The interviewer asks you to explain good software development practices.
Q3) Testing is not an essential part of the generation of secure code.
A)True
B)False
Q4) Unvalidated input that changes the code functioning in an unintended way is which type of coding error?
A)Canonicalization error
B)Improper output handling
C)Injection
D)Buffer overflow
Q5) _______________ is the systematic application of a series of malformed inputs to test how the program responds.
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 19: Disaster Recovery, Business Continuity, and Organizational Policies
Available Study Resources on Quizplus for this Chatper
53 Verified Questions
53 Flashcards
Source URL: https://quizplus.com/quiz/58425
Sample Questions
Q1) Name at least four high-level policies an organization needs to consider.
Q2) Which security policy establishes an organization's need to take reasonable precautions to demonstrate that it is being responsible in its operations (and to avoid possible litigation)?
A)AUP
B)E-mail policy
C)Due diligence
D)Separation of duties
Q3) What is the term for step-by-step instructions that describe exactly how employees are expected to act in a given situation or to accomplish a specific task?
A)Policies
B)Procedures
C)Standards
D)Usage lists
Q4) The goal of the AUP is to ensure employee productivity,while limiting organizational liability due to inappropriate use of the organization's assets.
A)True
B)False
21
To view all questions and flashcards with answers, click on the resource link above.
Chapter 20: Risk Management
Available Study Resources on Quizplus for this Chatper
42 Verified Questions
42 Flashcards
Source URL: https://quizplus.com/quiz/58424
Sample Questions
Q1) Which of the following is the value for the number of times an event is expected to occur in a year?
A)SLE
B)ALE
C)SRO
D)ARO
Q2) Residual risk is covered by insurance companies.
A)True
B)False
Q3) Which management tool is used for diagramming the interdependencies between project activities,showing the sequence and duration of each activity?
A)Pareto charts
B)Gantt charts
C)Interrelationship digraphs
D)PERT charts
Q4) Once an organization implements a security plan,they can expect to remain secure for an extended period of time.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 22
Chapter 21: Change Management
Available Study Resources on Quizplus for this Chatper
35 Verified Questions
35 Flashcards
Source URL: https://quizplus.com/quiz/58423
Sample Questions
Q1) _______________ is the process of controlling changes to items that have been baselined.
Q2) What is configuration control?
A)Ensures that configuration items are built and maintained according to the requirements,standards,or contractual agreements
B)Ensures that only approved changes to a baseline are allowed to be implemented
C)Ensures all changes made separate from the baseline are well documented and controlled
D)Identifies which assets need to be controlled.
Q3) A configuration item is an asset that needs to be controlled or managed.
A)True
B)False
Q4) Configuration status accounting consists of the procedures for tracking and maintaining data relative to each configuration item in the baseline.
A)True
B)False
Q5) _____________ is the process of identifying which assets need to be managed and controlled.
Q6) A(n)______________ is used to track changes through the change control board.
To view all questions and flashcards with answers, click on the resource link above. Page 23
Chapter 22: Privilege Management
Available Study Resources on Quizplus for this Chatper
39 Verified Questions
39 Flashcards
Source URL: https://quizplus.com/quiz/58422
Sample Questions
Q1) _______________ tells the system how many passwords to remember and does not allow a user to reuse an old password.
Q2) Role-based access control is a method of managing access and privileges based on a set of predefined rules.
A)True
B)False
Q3) _______________ control what the user is allowed to do with the objects on the system.
Q4) Minimum password age policy specifies the number of days a password may be used before it must be changed.
A)True
B)False
Q5) Administrator,root,and superuser are accounts that have the power to do anything that can be done on a system.
A)True
B)False
Q6) Describe methods of account management (SSO,time of day,logical token,account expiration).
Q7) What are the differences between user,group,and role management?
Page 24
To view all questions and flashcards with answers, click on the resource link above.
Chapter 23: Computer Forensics
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/58421
Sample Questions
Q1) Only one person is needed to collect and document evidence obtained in performing forensics on a computer system.
A)True
B)False
Q2) What is a software bomb?
A)A firework that destroys all the disks and CDs in your library
B)Any commands executed on the computer that have an adverse effect on the data being investigated
C)Screensavers that show fireworks going off
D)Software trying to access a computer
Q3) To be credible in court proceedings,what are the three standards that evidence must meet?
Q4) Evidence offered by the witness that is not based on the personal knowledge of the witness-but is being offered to prove the truth of the matter asserted-falls under the exclusionary rule.
A)True
B)False
Q5) _______________ performs a function similar to the familiar parity bits,checksum,or cyclical redundancy check (CRC).
To view all questions and flashcards with answers, click on the resource link above. Page 25
Chapter 24: Legal Issues and Ethics
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/58420
Sample Questions
Q1) The DMCA protects the rights of recording artists and the music industry.
A)True
B)False
Q2) What is a law passed by a legislative branch of government called?
A)Statutory law
B)Administrative law
C)Common law
D)Blue law
Q3) Which law makes it a crime to knowingly access a computer that is either considered a government computer or used in interstate commerce,or to use a computer in a crime that is interstate in nature?
A)Computer Fraud and Abuse Act
B)Stored Communications Act
C)CAN-SPAM Act
D)Sarbanes-Oxley Act
Q4) _____________ is the unauthorized entry into a computer system via any means.
A)Computer trespass
B)Computer entry
C)Computer hacking
D)Cyber crime
To view all questions and flashcards with answers, click on the resource link above. Page 26
Chapter 25: Privacy
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/58419
Sample Questions
Q1) A privacy-enhancing technology called cookie cutter does which of the following?
A)Makes copies of your information for safe keeping
B)Makes sure when you connect to sites you use the same appropriate information
C)Prevents the transfer of cookies between browsers and web servers.
D)Is used by server to prevent the use of unnecessary cookies
Q2) What is PII as it relates to privacy?
Q3) What are some issues associated with technology and privacy?
Q4) In the United States the primary path to privacy is _______.In Europe the primary path to privacy is _________.
A)opt-in;opt-in
B)opt-in;opt-out
C)opt-out;opt-out
D)opt-out;opt-in
Q5) The three things that should govern how good citizenry collects PII are notice,choice,and consent.
A)True
B)False
Q6) _______________ are designed to prevent the transfer of cookies between browsers and web servers.
Q7) Define privacy.
To view all questions and flashcards with answers, click on the resource link above. Page 27