- (Topic 1)
Bret is a web application administrator and has just read that there are a number of surprisingly common web application vulnerabilities that can be exploited by unsophisticated attackers with easily available tools on the Internet. He has also read that when an organization deploys a web application, they invite the world to send HTTP requests. Attacks buried in these requests sail past firewalls, filters, platform hardening, SSL, and IDS without notice because they are inside legal HTTP requests. Bret is determined to weed out vulnerabilities.
What are some of the common vulnerabilities in web applications that he should be concerned about?

1. A. Non-validated parameters, broken access control, broken account and session management, cross-site scripting and buffer overflows are just a few common vulnerabilities
2. B. Visible clear text passwords, anonymous user account set as default, missing latest security patch, no firewall filters set and no SSL configured are just a few common vulnerabilities
3. C. No SSL configured, anonymous user account set as default, missing latest security patch, no firewall filters set and an inattentive system administrator are just a few common vulnerabilities
4. D. No IDS configured, anonymous user account set as default, missing latest security patch, no firewall filters set and visible clear text passwords are just a few common vulnerabilities

Correct Answer: A

- (Topic 6)
MX record priority increases as the number increases. (True/False.

1. A. True
2. B. False

Correct Answer: B
The highest priority MX record has the lowest number.

- (Topic 3)
Low humidity in a data center can cause which of the following problems?

1. A. Heat
2. B. Corrosion
3. C. Static electricity
4. D. Airborne contamination

Correct Answer: C

- (Topic 8)
A program that defends against a port scanner will attempt to:

1. A. Sends back bogus data to the port scanner
2. B. Log a violation and recommend use of security-auditing tools
3. C. Limit access by the scanning system to publicly available ports only
4. D. Update a firewall rule in real time to prevent the port scan from being completed

Correct Answer: D

- (Topic 6)
You have initiated an active operating system fingerprinting attempt with nmap against a target system:

What operating system is the target host running based on the open ports shown above?

1. A. Windows XP
2. B. Windows 98 SE
3. C. Windows NT4 Server
4. D. Windows 2000 Server

Correct Answer: D
The system is reachable as an active directory domain controller (port 389, LDAP)