A company’s Web development team has become aware of a certain type of security vulnerability in their Web software. To mitigate the possibility of this vulnerability being exploited, the team wants to modify the software requirements to disallow users from entering HTML as input into their Web application.
What kind of Web application vulnerability likely exists in their software?

1. A. Cross-site scripting vulnerability
2. B. SQL injection vulnerability
3. C. Web site defacement vulnerability
4. D. Gross-site Request Forgery vulnerability

Correct Answer: A

Becky has been hired by a client from Dubai to perform a penetration test against one of their remote offices. Working from her location in Columbus, Ohio, Becky runs her usual reconnaissance scans to obtain basic information about their network. When analyzing the results of her Whois search, Becky notices that the IP was allocated to a location in Le Havre, France. Which regional Internet registry should Becky go to for detailed information?

1. A. ARIN
2. B. APNIC
3. C. RIPE
4. D. LACNIC

Correct Answer: C
Regional Internet Registries (RIRs):
ARIN (American Registry for Internet Numbers) AFRINIC (African Network Information Center) APNIC (Asia Pacific Network Information Center)
RIPE (Réseaux IP Européens Network Coordination Centre)
LACNIC (Latin American and Caribbean Network Information Center)

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

1. A. An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111
2. B. An alert is generated when any packet other than a TCP packet is seen on the network and destined for the 192.168.1.0 subnet
3. C. An alert is generated when a TCP packet is originated from port 111 of any IP address to the 192.168.1.0 subnet
4. D. An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111

Correct Answer: D

Robert, a professional hacker, is attempting to execute a fault injection attack on a target IoT device. In this process, he injects faults into the power supply that can be used for remote execution, also causing the skipping of key instructions. He also injects faults into the clock network used for delivering a synchronized signal across the chip.
Which of the following types of fault injection attack is performed by Robert in the above scenario?

1. A. Frequency/voltage tampering
2. B. Optical, electromagnetic fault injection (EMFI)
3. C. Temperature attack
4. D. Power/clock/reset glitching

Correct Answer: D
These types of attacks occur when faults or glitches are INJECTED into the Power supply that can be used for remote execution.

A technician is resolving an issue where a computer is unable to connect to the Internet using a wireless access point. The computer is able to transfer files locally to other machines, but cannot successfully reach the Internet. When the technician examines the IP address and default gateway they are both on the 192.168.1.0/24. Which of the following has occurred?

1. A. The computer is not using a private IP address.
2. B. The gateway is not routing to a public IP address.
3. C. The gateway and the computer are not on the same network.
4. D. The computer is using an invalid IP address.

Correct Answer: B