stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Ethical Hacking 12 Penetration Testing Flashcards | StudBud
Explore
/
Ethical Hacking 12 Penetration Testing
Ethical Hacking 12 Penetration Testing
30 terms
·
StudBud Administration
·
32 plays
Imported from external platform
Flashcards
30 cards
F
Practice quiz
P
Host live
L
Questions
30
Answers
1
What type of pen testing is where a hacker attacks w/o obtaining internal or secret info with help from the org itself?
Whitebox
Purplebox
Blackbox
Bluebox
2
What type of pen testing is where a hacker attacks and procures only partial information from the organization?
Redbox
Whitebox
Graybox
Yellowbox
3
As part of the organization's activities, many parameters are tested against the regulation, what are they? (3 answers)
Administrators
Information Sensitivity
User activity
Chief Information Security Officer (CISO)
4
If an Automated Scanning Type uses a proxy, what type of scanning is this?
POC
Passive
Projection
Progressive
5
Most web scanners work by dividing the test into two parts, what are they? (2 answers)
Auditing
Creeping
Dissecting
Crawling
6
The main advantage of Automated Scanning is what? (2 answers)
lower cost
work with dynamic variables
performed regularly
locate more complex and less obvious vulnerabilities
7
If you are going to search and enumerate the company's technologies, what tools would you use? (3 answers)
Nessus
ZoomScan
DMitry
GHDB
8
What is true about Nikto? (3 answers)
has scanning & monitoring capabilities covering various web servers
uses complex syntax
detects vulnerabilities such as programming errors or malicious files
is open-source software used to scan & detect web app vulnerabilities
9
GDPR regulates sensitive information about what clients?
European
American
Indian
African
10
What is true about Burp Suite Professional (3 answers)
offers both Passive and Actrive Scanning mode
has the techniques & methodologies used for manual pen testing audits
provides a proof of concept
the most common tool used by penetration testers
11
What is true about ZAP? (3 answers)
written in Java and developed by the OWASP community
stands for Zual Attack Proxy
free graphical tool for web application security testing
contains extensions that are similar to Burp Suite
12
What type of pen testing is where an hacker obtains all info, regarding the site, infrastructure, & internal data?
Whitebox
Greenbox
Goldbox
Orangebox
13
What is true about Manual Vulnerability Testing? (2 answers)
do not require a fixed script
flexible
work with static variables
no customization
14
If an Automated Scanning Type inspects a page via fuzzing, what type of scanning is this?
Active
Available
Access
Action
15
Which report contains details about the exploitation and remediation options?
developer
designer
exploit
executive
16
Which of the following security headers would you check for on the server's website? (3 answers)
HTTPS Strict-Transport-Security
X-XXS Mode
Access-Control-Allow-Origin
Content Security Policy (CSP)
17
Any company that wants to be certified in information security management, must deal with what regulator?
ISO/IEC
IPS/IDS
ISM/IBO
ICM/IDC
18
In the world of regulations, there will most likely be a gap between policy and its implementation.
False
True
19
If you want to be SOX compliant, your regulator is who?
Federal Energy Regulatory Commission
Bureau of Safety and Environmental Enforcement
The Pipeline and Hazardous Materials Safety Administration
Securities and Exchange Commission
20
Which risks are considered transverse? (3 answers)
gaps between policy and its implementation
Insufficient identification
Lack of security measures that put the company at risk
Lack of awareness regarding cybersecurity procedures in daily processes
21
What two types of reports to web scanners create? (2 answers)
executive
exploit
developer
designer
22
What is true about VEGA (3 answers)
focuses on SQL and XSS injections
open-source vulnerability scanner
can help less experienced penetration testers categorize findings
written in Java, command line based, and runs on Linux, but not Windows
23
What is true about Netsparker? (3 answers)
can automatically parse, execute and analyze the output of JavaScript
provides a proof of concept (POC) to the attacker
an application rather than a web interface
contains a spider and a fuzzer
24
Most web scanners can enter a webpage that requires an authenticated session.
False
True
25
What is not part of an Anatomy of a Report?
Introduction
Executive Summary
Return on Investment
Details of Findings
26
What things should a general summary of an executive report contain? (3 answers)
a numerical score
explanation of the technical terms used
pie chart or a graph
state of the organization’s security
27
How is each vulnerability assigned? (3 answers)
financial
risk
probability
severity
28
If your company wants to be PCI DSS compliant, this would involve what?
credit cards
money transfers
bitcoin
US dollars
29
If a pen testing report is intended for the IT Department, what type of report should be filed?
Developer
Exploit
Detailed
Executive
30
What is true about Acunetix? (3 answers)
a automated web application scanning tool
explores the site’s structure and attempts to locate available pages
crafts an auto pen testing report, downloaded from it's report dashboard
contains an AJAX Spider
