- (Topic 8)
Steven the hacker realizes that the network administrator of XYZ is using syskey to protect organization resources in the Windows 2000 Server. Syskey independently encrypts the hashes so that physical access to the server, tapes, or ERDs is only first step to cracking the passwords. Steven must break through the encryption used by syskey before he can attempt to brute force dictionary attacks on the hashes. Steven runs a program called “SysCracker” targeting the Windows 2000 Server machine in attempting to crack the hash used by Syskey. He needs to configure the encryption level before he can launch attach.
How many bits does Syskey use for encryption?

1. A. 40 bit
2. B. 64 bit
3. C. 256 bit
4. D. 128 bit

Correct Answer: D
SYSKEY is a utility that encrypts the hashed password information in a SAM database using a 128-bit encryption key.

- (Topic 5)
What are the three types of authentication?

1. A. Something you: know, remember, prove
2. B. Something you: have, know, are
3. C. Something you: show, prove, are
4. D. Something you: show, have, prove

Correct Answer: B

- (Topic 3)
Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall. From the following signature, what will Snort look for in the payload of the suspected packets?
alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG. "BACKDOOR SIG -
SubSseven 22";flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids, 485;) alert

1. A. The payload of 485 is what this Snort signature will look for.
2. B. Snort will look for 0d0a5b52504c5d3030320d0a in the payload.
3. C. Packets that contain the payload of BACKDOOR SIG - SubSseven 22 will be flagged.
4. D. From this snort signature, packets with HOME_NET 27374 in the payload will be flagged.

Correct Answer: B

- (Topic 7)
What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?

1. A. Copy the system files from a known good system
2. B. Perform a trap and trace
3. C. Delete the files and try to determine the source
4. D. Reload from a previous backup
5. E. Reload from known good media

Correct Answer: E
If a rootkit is discovered, you will need to reload from known good media. This typically means performing a complete reinstall.

- (Topic 2)
You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c

What is the hexadecimal value of NOP instruction?

1. A. 0x60
2. B. 0x80
3. C. 0x70
4. D. 0x90

Correct Answer: D