ObjectiveMcq
Print Protected
This page is protected for print. Use the website to view the content.
What information can be obtained from WHOIS information about a domain?
Encryption keys
Social media profiles
File attachments
Technical and administrator contacts
WHOIS information about a domain includes technical and administrator contacts, providing key information about who is responsible for the domain and potential contacts for social engineering and OSINT activities.
What information can be obtained through a WHOIS query?
File attachments of a domain
Encryption keys of a domain
IP address block databases
Registered users of domains and IP address blocks
A WHOIS query allows searching databases of registered users of domains and IP address blocks, providing useful information about an organization or individual based on their registration information.
Who manages the Domain Name System (DNS) root zone?
Internet Corporation for Assigned Names and Numbers (ICANN)
Internet Assigned Numbers Authority (IANA)
Domain registrars
Regional NICs
The Internet Assigned Numbers Authority (IANA) manages the DNS root zone.
What is external footprinting in the context of passive reconnaissance?
Gathering information about the target's internal network
Conducting on-site testing
Gathering information about the target from external sources
Identifying vulnerabilities in the target's systems
External footprinting in passive reconnaissance involves gathering information about the target from external sources, focusing on domains, IP ranges, and routes for the organization.
What can be valuable in identifying an organization's technology stack?
Email addresses
Social media profiles
Public records
Certifications and job responsibilities
Information about an organization's technology stack can be found in certifications, job responsibilities, and technologies mentioned in social media profiles, résumés, job postings, and publications.
How can social media platforms like LinkedIn and Facebook be leveraged to identify employees?
By scripting and searching profiles
By reviewing corporate email addresses
By using online directories
By checking organizational charts
Social media platforms like LinkedIn and Facebook can be leveraged by scripting and searching profiles to identify employees.
What web archive provides point-in-time snapshots of websites and other data?
Google Archive
Internet Explorer Archive
Website Snapshot Archive
Internet Archive
The Internet Archive (https://archive.org) provides point-in-time snapshots of websites and other data, including information that may have been removed from the web.
Where can valuable metadata be found in common business files like Microsoft Office files and PDFs?
In the file's text and data
In the file's attachments
In the file's encryption
In the file's metadata
Valuable metadata in common business files can include information such as authors, creation dates/times, and software versions.
Which metadata scanning tool uses a search engine to gather metadata information from various file types?
ExifTool
MetadataScanner
FOCA
Collected Archives Tool
FOCA is a metadata scanning tool that uses a search engine to gather metadata information from files like Microsoft Office documents, PDF files, and others.
What tool is designed to allow quick viewing of document metadata?
MetadataScanner
ExifTool
FOCA
Collected Archives Tool
ExifTool is designed to allow quick and easy viewing of document metadata during penetration testing.
What goals do attackers seek to achieve, according to the DAD triad?
Destruction, Alteration, Denial
Denial, Absence, Distortion
Disclosure, Alteration, Derivation
Destruction, Adaptation, Disruption
Attackers seek to achieve the goals of destruction, alteration, and denial, as described by the DAD triad.
What goals do cybersecurity professionals strive to achieve, according to the CIA triad?
Confidentiality, Integrity, Availability
Complexity, Intricacy, Adaptability
Consistency, Innovation, Accessibility
Confusion, Inconsistency, Absence
Cybersecurity professionals strive to protect the confidentiality, integrity, and availability of information and systems, as described by the CIA triad.
In penetration testing, what is the significance of adopting the hacker mindset?
Enhancing cloud security
Ensuring consistent application of security policies
Conducting cloud security audits
Identifying weaknesses in security infrastructure
Adopting the hacker mindset in penetration testing helps identify weaknesses in the organization's security infrastructure.
What is the purpose of CloudBrute in penetration testing?
Exploiting Amazon Web Services (AWS)-hosted environments
Identifying cloud components used by an organization
Rule enforcement for consistent application of security policies
Cloud security auditing
CloudBrute is a scanner used to identify the cloud components used by an organization.
Which tool is a rule enforcement engine that allows the consistent application of security policies across cloud environments?
Pacu
CloudBrute
Cloud Custodian
ScoutSuite
Cloud Custodian is a rule enforcement engine that allows the consistent application of security policies across cloud environments.
What is the primary focus of Pacu, a cloud exploitation framework?
Exploiting Amazon Web Services (AWS)-hosted environments
Identifying cloud components used by an organization
Cloud security auditing
Rule enforcement for consistent application of security policies
Pacu is a cloud exploitation framework focused on Amazon Web Services (AWS)-hosted environments.
Which cloud security auditing tool can work across commonly used cloud environments?
CloudBrute
ScoutSuite
Cloud Custodian
Pacu
ScoutSuite is a cloud security auditing tool that can work across commonly used cloud environments.
