John works as a Penetration Tester in a security service providing firm named you-are-secure Inc. Recently, John's company has got a project to test the security of a promotional Website www.missatlanta.com and assigned the pen-testing work to John. When John is performing penetration testing, he inserts the following script in the search box at the company home page:

After pressing the search button, a pop-up box appears on his screen with the text - "Hi, John." Which of the following attacks can be performed on the Web site tested by john while considering the above scenario?

1. A. Replay attack
2. B. CSRF attack
3. C. Buffer overflow attack
4. D. XSS attack

Correct Answer: D

Which of the following statements are true about firewalking?
Each correct answer represents a complete solution. Choose all that apply.

1. A. To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall.
2. B. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall.
3. C. A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall.
4. D. Firewalking works on the UDP packets.

Correct Answer: ABC

Which of the following is a technique for creating Internet maps?
Each correct answer represents a complete solution. Choose two.

1. A. Active Probing
2. B. AS PATH Inference
3. C. Object Relational Mapping
4. D. Network Quota

Correct Answer: AB

Which of the following is the most common vulnerability that can affect desktop applications written in native code?

1. A. SpyWare
2. B. DDoS attack
3. C. Malware
4. D. Buffer overflow

Correct Answer: D

John works as a Network Administrator for We-are-secure Inc. He finds that TCP port 7597 of the Weare- secure server is open. He suspects that it may be open due to a Trojan installed on the server. He presents a report to the company describing the symptoms of the Trojan. A summary of the report is given below:
Once this Trojan has been installed on the computer, it searches Notpad.exe, renames it Note.com, and then copies itself to the computer as Notepad.exe. Each time Notepad.exe is executed, the Trojan executes and calls the original Notepad to avoid being noticed.
Which of the following Trojans has the symptoms as the one described above?

1. A. NetBus
2. B. Qaz
3. C. eBlaster
4. D. SubSeven

Correct Answer: B