Security Auditing and Assessment
Solved Exam Questions
Course Introduction
Security Auditing and Assessment introduces students to the principles, techniques, and methodologies used to evaluate and improve the security posture of information systems. The course covers the development and implementation of audit frameworks, risk assessment methodologies, and compliance requirements, emphasizing both technical and managerial aspects of security audits. Students will learn how to perform vulnerability assessments, conduct penetration testing, generate audit reports, and ensure adherence to industry standards and regulatory mandates. Practical labs, case studies, and real-world scenarios provide hands-on experience in identifying security weaknesses and recommending remediation strategies in organizational environments.
Recommended Textbook
Hands On Ethical Hacking and Network Defense 2nd Edition by Michael T. Simpson
Available Study Resources on Quizplus
13 Chapters
673 Verified Questions
673 Flashcards
Source URL: https://quizplus.com/study-set/2085 Page 2
Chapter 1: Ethical Hacking Overview
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/41510
Sample Questions
Q1) What are four different skills a security tester needs?
Answer: -Knowledge of network and computer technology
-Ability to communicate with management and IT personnel
-An understanding of the laws that apply to your location
-Ability to apply the necessary tools to perform your tasks
Q2) sometimes employed by companies to perform penetration tests
Answer: I
Q3) The SysAdmin, Audit, Network, Security (SANS) Institute offers training and IT security certifications through Global Information Assurance Certification (GIAC).
A)True
B)False
Answer: True
Q4) ____ takes penetration testing to a higher level.
A)Hacking
B)Cracking
C)Security testing
D)Packet sniffing
Answer: C
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Tcpip Concepts Review
Available Study Resources on Quizplus for this Chatper
57 Verified Questions
57 Flashcards
Source URL: https://quizplus.com/quiz/41511
Sample Questions
Q1) ____ is a fast but unreliable delivery protocol that operates on the Transport layer.
A)IP
B)TCP
C)TFTP
D)UDP
Answer: D
Q2) The most widely used is protocol is ____.
A)IPX/SPX
B)ATM
C)TCP/IP
D)NetBIOS
Answer: C
Q3) In the TCP/IP stack, the Transport layer includes network services and client software.
A)True
B)False
Answer: False
Q4) An octet is equal to ____________________ bits, which equals one byte.
Answer: eight
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: Network and Computer Attacks
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/41512
Sample Questions
Q1) Macro viruses are hard to create.
A)True
B)False
Answer: False
Q2) The most effective approach to protect a network from malware being introduced is to conduct structured training of all employees and management.
A)True
B)False
Answer: True
Q3) Computer crime is the fastest growing type of crime worldwide.
A)True
B)False
Answer: True
Q4) Antivirus software compares ____________________ of known viruses against the files on the computer; if there's a match, the software warns you that the program or file is infected.
Answer: signatures programming code
To view all questions and flashcards with answers, click on the resource link above.
Page 5
Chapter 4: Footprinting and Social Engineering
Available Study Resources on Quizplus for this Chatper
51 Verified Questions
51 Flashcards
Source URL: https://quizplus.com/quiz/41513
Sample Questions
Q1) A(n) ____ is a 1-pixel x 1-pixel image file referenced in an <IMG> tag, and it usually works with a cookie.
A)image bug
B)zone transfer
C)Bugnosis detector
D)Web bug
Q2) ____ is a tool that is used to perform DNS zone transfers.
A)Whois
B)Netcat
C)Metis
D)Dig
Q3) The HTTP CONNECT method starts a remote application-layer loopback of the request message.
A)True
B)False
Q4) How can a computer criminal use HTTP methods before running an exploit on a server?
Q5) How can DNS be used for footprinting?
Q6) Why is ATM shoulder surfing much easier than computer shoulder surfing?
Q7) What is "competitive intelligence"?
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Port Scanning
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/41514
Sample Questions
Q1) In any *NIX system, after saving a script, you need to make it executable so that you can run it. From the command line, type ____.
A)chmod +execute script_name
B)chmod +x script_name
C)chmod -execute script_name
D)chmod -x script_name
Q2) Closed ports respond to a(n) ____ with an RST packet.
A)XMAS scan
B)SYN scan
C)Connect scan
D)ACK scan
Q3) An OpenVAS____________________ is a security test program (script) that can be selected from the client interface.
Q4) Port scanning is a method of finding out which services a host computer offers.
A)True
B)False
Q5) A closed port can be vulnerable to an attack.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Enumeration
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/41515
Sample Questions
Q1) replaced the Registry with Active Directory for object storage
A)Windows 98
B)Windows 95
C)Windows Server 2003
D)Fedora Linux
E)Solaris
F)Windows XP Professional
G)Novell Open Enterprise Server
H)Windows 2000 Server/Professional
I)Windows NT 3.51 Server/Workstation
Q2) uses SUSE Linux as its OS
A)Windows 98
B)Windows 95
C)Windows Server 2003
D)Fedora Linux
E)Solaris
F)Windows XP Professional
G)Novell Open Enterprise Server
H)Windows 2000 Server/Professional
I)Windows NT 3.51 Server/Workstation
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Programming for Security Professionals
Available Study Resources on Quizplus for this Chatper
53 Verified Questions
53 Flashcards
Source URL: https://quizplus.com/quiz/41516
Sample Questions
Q1) Why is documenting computer programs essential?
Q2) List and describe the variable types used in C.
Q3) How does C's for loop work?
Q4) ____ takes you from one area of a program (a function) to another area.
A)Branching
B)Looping
C)Testing
D)Dividing
Q5) The C programming language was developed by ____ at Bell Laboratories in 1972.
A)James Gosling
B)Larry Wall
C)Dennis Ritchie
D)Larry Tesler
Q6) In Perl, the keyword "____" is used in front of function names.
A)func
B)declare
C)sub
D)proc
Q7) Mention three C compilers and on which operating systems they are available.
Q8) What is a dangerous thing about programming in the C language?
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Desktop and Server Os Vulnerabilities
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/41517
Sample Questions
Q1) A common Linux rootkit is ____.
A)Back Orfice
B)Kill Trojans
C)Packet Storm Security
D)Linux Rootkit 5
Q2) The Conficker worm took advantage of a vulnerability in ____ to run arbitrary code on susceptible hosts.
A)SQL Server
B)RPC
C)Windows Registry
D)NetBIOS
Q3) To determine whether a system is vulnerable to an RPC-related issue, the best tool is
A)Nessus
B)Winfingerprint
C)MBSA
D)Unicornscan
Q4) What should a password policy include?
Q5) Why should you review logs regularly? How should you accomplish this task?
Page 10
Q6) RPC stands for ________________________.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Embedded Operating Systems: The Hidden Threat
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/41518
Sample Questions
Q1) slimmed down version of Windows XP
A)Windows Embedded Standard
B)Green Hill Software
C)RTLinux
D)VxWorks
E)RTEMS
F)embedded operating system
G)Quebec
H)QNX
I)SCADA
Q2) Which of the following could be considered the biggest security threat for an organization?
A)spyware
B)employees
C)kernels
D)routers
Q3) QNX, from QNX Software Systems, is a commercial
Q4) Embedded systems include their own operating system, called a(n) "_________________________".
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Hacking Web Servers
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/41519
Sample Questions
Q1) In Windows, IIS stands for ______________________________.
Q2) To check whether a CGI program works, you should save the program to the ____ directory of your Web server, and then enter the URL in your Web browser.
A)bin
B)cgi-bin
C)cgi
D)scripts
Q3) All CFML tags begin with "____".
A)(?)
B)CF
C)CFML
D)%
Q4) Dynamic Web pages need special components for displaying information that changes depending on user input or information obtained from a back-end server. What kind of components can Web pages use to achieve this?
Q5) ____________________ Web pages display the same information regardless of the time of day or the user who activates the page.
Q6) What is ActiveX Data Objects (ADO)?
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Hacking Wireless Networks
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/41520
Sample Questions
Q1) What are the basic components of a wireless network?
Q2) ____ is the most popular type of WLAN technology.
A)Infrared (IR)
B)Narrowband
C)Spread spectrum
D)Microwave
Q3) The ____ standard can achieve a throughput of 54 Mbps.
A)802.11b
B)802.11e
C)802.11g
D)802.11i
Q4) What is frequency-hopping spread spectrum (FHSS)?
Q5) What is the IEEE 802.15 standard?
Q6) WPA improves encryption by using ____.
A)WEP
B)TKIP
C)802.1X
D)RADIUS
Q7) What is the function of a WG of the IEEE?
Q8) What is the role of a WNIC?
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Cryptography
Available Study Resources on Quizplus for this Chatper
58 Verified Questions
58 Flashcards
Source URL: https://quizplus.com/quiz/41521
Sample Questions
Q1) In a ____ attack, the attacker has messages in both encrypted form and decrypted forms.
A)chosen-ciphertext
B)chosen-plaintext
C)known plaintext
D)ciphertext-only
Q2) digital document that verifies that the two parties exchanging data over the Internet are really who they claim to be
A)asymmetric encryption
B)collision free
C)symmetric encryption
D)certificate
E)hashing
F)collision
G)stream cipher
H)message digest
I)block cipher
Q3) What is a digital signature?
Q4) ____________________ attacks are used to find the same hash value for two different inputs.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Network Protection Systems
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/41522
Sample Questions
Q1) ____ is an open-source network-based IDS.
A)NetRanger
B)Snort
C)Aladdin
D)Entercept
Q2) To see what information is stored in RAM, a Cisco administrator would type this command: ____.
A)show running-config
B)show startup-config
C)show flash
D)show ip route
Q3) A honeypot appears to have important data or sensitive information stored on it.
A)True
B)False
Q4) ____________________ are hardware devices used on a network to send packets to different network segments.
Q5) A standard IP access list is restricted to source IP addresses. A)True
B)False
Q6) What is the difference between passive and active IDSs?
Page 15
To view all questions and flashcards with answers, click on the resource link above.