Security + Chapter 9 Part 5

A method used by hackers to determine what ports are open or in use on a system or network, this is known as?

The act of probing a system to identify open ports, this is known as?

Which attack or process can be expanded to develop a footprint of an organization, using an IP address they probe all addresses in range, to gain knowledge of your network?

Which tool looks at the banner, or header information messages sent with data to find out about the systems?

An attack method in which a hacker gains access to a packet header, this is known as?

Which method uses the banner to identify the host, the OS it's running, etc?

Which utility can be used to snag a banner?

Which two tools can be used to snag a banner?

Which attack looks at the banner, or header information messages sent with data to find out about systems, they can identify the host, the OS it's running, etc?

When measuring security and vulnerability in the network which three should you focus on?

__________________ is a comparison of the present state of a system compared to its baseline.

The comparison of the present state of a system to its baseline is known as?

A comparison of the present state of a system to its baseline is known as?

What requires IT to provide internal controls that reduce the risk of unauthorized transactions, and checks to make sure that things are operating status quo?

What is used in baseline reporting to alert administrators when modifications are made?

What is the process of looking at all custom written code for holes that may exist?

An evaluation of source code used to identify potential weaknesses in an application, this is known as?

Which process looks at custom written code for holes that may exist looking for injection attacks, cross site forgery, etc?

Which process examines changes in custom written codes for injection, cross site request forgery, and authentication?

What process is used to examine source codes, or custom written codes?

When doing code review which assessment is done when you simply read the code?

Which assessment is done in code review when you use tools to scan the code?

Components available to be used by an attacker against the product or application itself is known as?

What is the area of an application that is available to users who are authenticated and those who are NOT to exploit application vulnerabilities and possibly launch an attack?

What minimizes the possibility of exploitation by reducing the amount of code and limiting potential damage in an attack surface?

Potential damage by an attack surface can be limited by turning off?

Which approach to security involves using a control framework to focus on the foundational infrastructure?

Which assessment examines the ports and protocols used, the rules, segmentation, and access control?

What describes an entire family of software that has nefarious intentions about your networks and computers?

Trust or false: All networks and systems are susceptible to DoS attacks and DDoS attacks?

Which attacks can occur using either existing maintenance hooks or developmental tools to examine the internal operations of a program?

Which attack is also referred to inserting into a machine a program or service that allows authentication to be bypassed and gain access?

Code within software that provides a back door entry capability is known as?

Backdoor attacks occur sometimes because of existing ___________________ _____________.

Which attack does an attacker pretend to be another user or machine to gain access?

Which attack occurs when a user masquerades as another user or system?

Which attack occurs when a user or system masquerades as someone else and assumes the privileges and access rights of the real user or system?

In which attack does a hacker place himself between (middle) a client and a host to intercept communications between them?

Which attack are based on a principle that a system can be placed between or in the middle of two legitimate users to capture or exploit the information sent between them?

What are the 3 types of password attacks or methods?

Which password attack is a dictionary of common words used to attempt to find a users password?

Which password attack or method works by randomly trying to guess a password repeatedly against a known account ID?

What is the best example of a hybrid password attack?

Which password attack is considered a hybrid attack and it has stored hash values to test against the password values?

The best example of a hybrid password attack uses a _____________ ____________ of stored hash values to test against the password values.

An attack launched against applications and higher-level services, is known as?

What involves using features or capabilities of a software product in a manner either unplanned for or unanticipated by the software manufacturer, the original feature enhanced the functionality of the product, but created a potential vulnerability?

What are the 5 most common viruses floating around today?

What are programs or viruses that enter a system or network under the guise of another program?

What are programs or snippets of code that execute when a certain predefined event occurs?

What software looks for a signature in the virus to determine what type of virus it is, it then takes action to neutralize the virus based on a virus definition database?

What part of the antivirus software needs to be kept up to date?

Which type of response allows software to manage resources and take action in the network if an incident occurs?

Which type of response involves notification and reporting attacks or suspicious activities?