Get 2022 Most Reliable GIAC GPEN Training Materials [Q153-Q175]

Q153. You want to perform an active session hijack against Secure Inc. You have found a target that allows Telnet session. You have also searched an active session due to the high level of traffic on the network. What should you do next?

Q154. Which of the following tools can be used to enumerate networks that have blocked ICMP Echo packets, however, failed to block timestamp or information packet or not performing sniffing of trusted addresses, and it also supports spoofing and promiscuous listening for reply packets?

Q155. You want to search the Apache Web server having version 2.0 using google hacking. Which of the following search queries will you use?

Q156. Which of the following is a person-to-person attack in which an attacker convinces the target that he or she has a problem or might have a certain problem in the future and that he, the attacker, is ready to help solve the problem?

Q157. You enter the following URL on your Web browser:
http://www.we-are-secure.com/scripts/..%co%af../..%co%
af../windows/system32/cmd.exe?/c+dir+c:
What task do you want to perform?

Q158. John works as a Professional Penetration Tester. He has been assigned a project to test the Website security of www.we-are-secure Inc. On the We-are-secure Website login page, he enters =’or”=’ as a username and successfully logs on to the user page of the Web site. Now, John asks the we-are-secure Inc. to improve the login page PHP script. Which of the following suggestions can John give to improve the security of the we-are-secure Website login page from the SQL injection attack?

Q159. Which of the following is the correct syntax to create a null session?

Q160. When a DNS server transfers its zone file to a remote system, what port does it typically use?

Q161. Which of the following tools uses exploits to break into remote operating systems?

Q162. You work as a Web developer in the IBM Inc. Your area of proficiency is PHP. Since you have proper knowledge of security, you have bewared from rainbow attack. For mitigating this attack, you design the PHP code based on the following algorithm:
key = hash(password + salt)
for 1 to 65000 do
key = hash(key + salt)
Which of the following techniques are you implementing in the above algorithm?

Q163. You are a Web Administrator of Millennium Inc. The company has hosted its Web site within its network.
The management wants the company’s vendors to be able to connect to the corporate site from their locations through the Internet. As a public network is involved in this process, you are concerned about the security of data transmitted between the vendors and the corporate site.
Which of the following can help you?

Q164. While performing a code audit, you discover a SQL injection vulnerability assuming the following vulnerable query, what user input could be injected to make the query true and return data?
select * from widgets where name = ‘[user-input]’;

Q165. ACME corporation has decided to setup wireless (IEEE 802.11) network in it’s sales branch at Tokyo and found that channels 1, 6, 9,11 are in use by the neighboring offices. Which is the best channel they can use?

Q166. The employees of EWS Inc. require remote access to the company’s Web servers. In order to provide solid wireless security, the company uses EAP-TLS as the authentication protocol. Which of the following statements are true about EAP-TLS?
Each correct answer represents a complete solution. Choose all that apply.

Q167. SIMULATION
Fill in the blank with the appropriate act name.
The ____act gives consumers the right to ask emailers to stop spamming them.

Q168. You have connected to a Windows system remotely and have shell access via netcat. While connected to the remote system you notice that some Windows commands work normally while others do not An example of this is shown in the picture below Which of the following best describes why tins is happening?

Q169. What is the sequence in which packets are sent when establishing a connection to a secured network?

Q170. Which of the following Web authentication techniques uses a single sign-on scheme?

Q171. Why is it important to have a cheat sheet reference of database system tables when performing SQL Injection?

Q172. Which of the following is an open source Web scanner?

Q173. What is the most likely cause of the responses on lines 10 and 11 of the output below?

Q174. You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing.
Recently, your company has assigned you a project to test the security of the we-aresecure. com Web site.
For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless whether the ports are open or close. Sometimes, IPID is being incremented by more than one value. What may be the reason?

Q175. John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He has successfully performed the following steps of the preattack phase to check the security of the We-are-secure network:
l Gathering information
l Determining the network range
l Identifying active systems
Now, he wants to find the open ports and applications running on the network. Which of the following tools will he use to accomplish his task?