MCS411 FINAL EXAMINATION

Why is it important for ethical hackers to follow a structured approach during a security assessment?

• To ensure they can charge higher fees for their services.

• To create a comprehensive report for stakeholders.

• To avoid legal issues and ensure ethical standards are met.

• To limit the scope of their testing to only the most critical systems.

What key components should be included in the final report of a penetration testing engagement?

• Executive summary, detailed findings, remediation recommendations, and appendices.

• Marketing strategy, team performance review, and budget analysis.

• Client feedback, project timeline, and training materials.

• Technical specifications, user manuals, and product support details.

What are the essential steps a security expert must undertake during a vulnerability assessment to effectively identify and mitigate potential security risks?

• Network segmentation techniques

• The essential steps include planning, scanning, analyzing vulnerabilities, exploiting weaknesses, and providing recommendations.

• Encryption protocols

• Security awareness training

During a cybersecurity audit, a team of experts from the PNG National Cyber Security is tasked with evaluating the vulnerability management practices of a public sector organization. Which tools would be most effective for conducting a thorough vulnerability assessment to uncover potential weaknesses?

• Qualys, Rapid7, Tenable.io, Nexpose

• TCPDump

• Suricata

• Burp Suite

What methods do social engineers employ to manipulate their victims into revealing sensitive information?

• By using emotional appeals to create a sense of urgency.

• Through the implementation of advanced encryption techniques.

• By sending phishing emails that appear legitimate.

• By conducting in-depth background checks on their targets.

Question 7. In a recent cybersecurity workshop, John discusses the importance of recognizing deceptive emails that appear to be from legitimate sources. He highlights how these tactics are often employed by cybercriminals to manipulate individuals into disclosing sensitive information. What are some prevalent methods used in social engineering attacks?

• Malware distribution

• Spoofing

• DDoS attacks

• Phishing, pretexting, baiting, tailgating

Jamie is tasked with improving the security measures of her company's wireless network. She needs to identify potential vulnerabilities that could be exploited by hackers.

• Ignoring the importance of regular firmware updates

• Assessing wireless network security by performing site surveys, checking for rogue access points, implementing strong encryption methods, monitoring for unauthorized devices, and ensuring user authentication protocols are robust.

• Utilizing weak passwords for network access

• Relying solely on hardware firewalls

What are some common vulnerabilities that Rina should consider when securing her café's wireless network?

• Improved network performance

• Increased customer loyalty

• Common vulnerabilities include weak passwords, outdated firmware, and lack of encryption.

• Enhanced marketing opportunities

During a security assessment, Alex discovers that a web application is vulnerable to cross-site scripting (XSS) attacks. What is a typical way that attackers can take advantage of this type of vulnerability?

• Attackers can exploit XSS vulnerabilities by injecting harmful scripts into web pages viewed by other users.

• By directly manipulating the server's configuration files

• Through increasing the application's response time

• By changing the color scheme of the website

During a security audit of a banking application, the security team discovered several critical vulnerabilities that could be exploited by attackers. Which of the following vulnerabilities should the team prioritize for remediation?

• Malware Injection

• Denial of Service (DoS)

• Buffer Overflow

• SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Insecure Direct Object References (IDOR), Security Misconfiguration, Sensitive Data Exposure, Broken Authentication, and Insufficient Logging and Monitoring.