Volume 2

Which TCP flag indicates that a connection should be torn down abruptly?

Responses?

• ACK

• URG

• FIN

• RST

Answer explanation

Six control bits describe the packet's role in the connection:

SYN: Synchronize

ACK: Acknowledgment

FIN: End a connection

RST: Tear down a connection

URG: Urgent data are included

PSH: Data should be pushed through the TCP stack

Which of the following is a challenge of working with OSINT data?

Responses?

• Using bitcoin to pay for access to data services

• Properly decrypting various data sources

• Converting different HTML and XML versions

• Collecting from numerous and disparate data sources

Answer explanation

The primary problem with OSINT data collection is the number of unique data sources, each providing disparate data from varied search criteria. Many OSINT data services are free, but some require registration prior to use. Other OSINT data services require payment, sometimes charged as a price per search, a subscription model, a one-time cost, or one of many other variations.

What is the following Google search designed to do?

wireless site:somecompany.net

• Search for all instances of the term "wireless" on the somecompany.net website

• Find pages similar to somecompany.net that also mention the term "wireless"

• Display all pages containing both the terms "somecompany.net" and "wireless site"

• Display all pages with the term "wireless" in them that link to somecompany.net

Answer explanation

The site: directive allows an attacker to search for pages on just a single site or domain, narrowing down and focusing the search. The search "wireless site:somecompany.net" produces a search result for the term "wireless" limited to the site somecompany.net.

When interrogating a DNS server to discover information about the target domain, what tool can be used in controlling the output of DNS queries with more granularity?

• dnsstuff

• Dig

• mxtoolbox

• dnsquery

Answer explanation

The two primary tools to interrogate DNS servers are nslookup and Dig. Nslookup is available by default on Windows systems and some UNIX platforms. Dig is arguably a more powerful tool since you can control the output of DNS queries with more granularity than with nslookup. Windows users can install the BIND software that includes Dig, allowing you to run Dig on Windows systems as well.

DeepBlueCLI is an open-source framework that automatically parses Windows event logs. What log does DeepBlueCLI parse when you run it with no arguments?

.\DeepBlue.ps1

• PowerShell Event Log

• Security Event Log

• Application Event Log

• System Event Log

Answer explanation

When at a PowerShell prompt as an Administrator and run .\DeepBlue.ps1 without any arguments, the security log will be read.

When performing reconnaissance, what data is collected before sending any packets to the target?

• Open ingress ports

• A network diagram

• Open egress ports

• Open-source intelligence

Answer explanation

Before sending the first packet to a target, a modern attacker will harvest open-source intelligence (OSINT) information. OSINT refers to the cumulative data available about a target online, whether that is a target organization, target person, or other entity.

Which tool can detect attacks by analyzing offline Windows event log files?

• DeepBlueCLI

• Metasploit Log Analyzer

• SRUM-Dump

• PowerShell Empire

Answer explanation

DeepBlueCLI can detect multiple attacks, including several Metasploit exploits, Mimikatz, PowerShell Empire, password guessing, and password spraying. It can be used to analyze offline log files as well as event logs on the local system or a system on the Windows domain network.

What header field in IPv6 is similar to the TTL field in an IPv4 header?

• Class

• Flow Label

• TTL

• Hop Limit

Answer explanation

The time-to-live (TTL) field in IPv4 and the hop limit field in IPv6 both indicate how many hops the packet can go across the network before it is discarded. If exceeded, the router returns an ICMP error message to the sender.

Which tool uses a list of hostnames or IP addresses to collect X.509 certificates and cipher details, saving the output in a JSON-formatted file?

• TLS-Scan

• EyeWitness

• nmap

• grep

Answer explanation

TLS-Scan by Binu Ramakrishnan (https://github.com/prbinu/tls-scan) is a Linux and macOS tool that reads from a list of IP addresses, one per line, and extracts certificate information from the identified TLS server on a given port. TLS-Scan can extract TLS information from HTTPS-enabled websites and other ports, such as TLS-enabled mail services.

End users often configure SMB services to copy files or to share printers on their workstations. What TCP port number does the SMB protocol use?

• 554

• 3074

• 443

• 445

Answer explanation

SMB is an application layer protocol that implements file and printer sharing, authentication, remote admin, and other features. These features are used throughout most Windows deployments over TCP port 445.