Joel, a professional hacker, targeted a company and identified the types of websites frequently visited by its employees. Using this information, he searched for possible loopholes in these websites and injected a malicious script that can redirect users from the web page and download malware onto a victim's machine. Joel waits for the victim to access the infected web application so as to compromise the victim's machine. Which of the following techniques is used by Joel in the above scenario?

1. A. DNS rebinding attack
2. B. Clickjacking attack
3. C. MarioNet attack
4. D. Watering hole attack

Correct Answer: B

Which of the following program infects the system boot sector and the executable files at the same time?

1. A. Polymorphic virus
2. B. Stealth virus
3. C. Multipartite Virus
4. D. Macro virus

Correct Answer: C

Which of the following steps for risk assessment methodology refers to vulnerability identification?

1. A. Determines if any flaws exist in systems, policies, or procedures
2. B. Assigns values to risk probabilities; Impact values.
3. C. Determines risk probability that vulnerability will be exploited (Hig
4. D. Medium, Low)
5. E. Identifies sources of harm to an IT syste
6. F. (Natural, Huma
7. G. Environmental)

Correct Answer: C

What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?

1. A. Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail.
2. B. Asymmetric cryptography is computationally expensive in compariso
3. C. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.
4. D. Symmetric encryption allows the server to securely transmit the session keys out-of-band.
5. E. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.

Correct Answer: D

This form of encryption algorithm is asymmetric key block cipher that is characterized by a 128-bit block size, and its key size can be up to 256 bits. Which among the following is this encryption algorithm?

1. A. Twofish encryption algorithm
2. B. HMAC encryption algorithm
3. C. IDEA
4. D. Blowfish encryption algorithm

Correct Answer: A
Twofish is an encryption algorithm designed by Bruce Schneier. It’s a symmetric key block cipher with a block size of 128 bits, with keys up to 256 bits. it’s associated with AES (Advanced Encryption Standard) and an earlier block cipher called Blowfish. Twofish was actually a finalist to become the industry standard for encryption, but was ultimately beaten out by the present AES.Twofish has some distinctive features that set it aside from most other cryptographic protocols. For one, it uses pre-computed, key-dependent S-boxes. An S- box (substitution-box) may be a basic component of any symmetric key algorithm which performs substitution. within the context of Twofish’s block cipher, the S-box works to obscure the connection of the key to the ciphertext. Twofish uses a pre-computed, key-dependent S-box which suggests that the S-box is already provided, but depends on the cipher key to decrypt the knowledge .
How Secure is Twofish?Twofish is seen as a really secure option as far as encryption protocols go. one among the explanation that it wasn’t selected because the advanced encryption standard is thanks to its slower speed. Any encryption standard that uses a 128-bit or higher key, is theoretically safe from brute force attacks. Twofish is during this category.Because Twofish uses “pre-computed key-dependent S-boxes”, it are often susceptible to side channel attacks. this is often thanks to the tables being pre-computed. However, making these tables key-dependent helps mitigate that risk. There are a couple of attacks on Twofish, but consistent with its creator, Bruce Schneier, it didn’t constitute a real cryptanalysis. These attacks didn’t constitue a practical break within the cipher.
Products That Use TwofishGnuPG: GnuPG may be a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also referred to as PGP). GnuPG allows you to encrypt and sign your data and communications; it features a flexible key management system, along side access modules for all types of public key directories.KeePass: KeePass may be a password management tool that generates passwords with top-notch security. It’s a free, open source, lightweight and easy-to-use password manager with many extensions and plugins.Password Safe: Password Safe uses one master password to stay all of your passwords protected, almost like the functionality of most of the password managers on this list. It allows you to store all of your passwords during a single password database, or multiple databases for various purposes. Creating a database is straightforward , just create the database, set your master password.PGP (Pretty Good Privacy): PGP is employed mostly for email encryption, it encrypts the content of the e-mail . However, Pretty Good Privacy doesn’t encrypt the topic and sender of the e-mail , so make certain to never put sensitive information in these fields when using PGP.TrueCrypt: TrueCrypt may be a software program that encrypts and protects files on your devices. With TrueCrypt the encryption is transparent to the user and is completed locally at the user’s computer. this suggests you’ll store a TrueCrypt file on a server and TrueCrypt will encrypt that file before it’s sent over the network.