312-50V12 Practice Questions

A NULL scan is a type of TCP port scan where the TCP packet is sent with no flags set in the header; the 6-bit flag field is set to zero. This technique is used to identify open ports on a target system without completing a TCP handshake, making it a form of stealth scan. According to RFC 793, a host receiving a TCP segment with no flags set on a closed port should respond with a RST (reset) packet. If the port is open, the host should drop the packet and send no response. The absence of a response indicates an open or filtered port to the scanner.

B. This description is too vague; many scan types involve having "certain flags" off while others are on.

C. A scan with all flags turned on is not a standard scan type and is distinct from a NULL scan. An XMAS scan has FIN, PSH, and URG flags on.

D. Packet size is not the defining characteristic of a NULL scan; the TCP header flags are the key element.

E. A NULL scan uses a valid, albeit unusual, TCP header format and is not defined by an illegal packet size.

1. Postel, J. (1981). RFC 793: Transmission Control Protocol. IETF. (Section 3.4, "Establishing a connection," implies that a segment without SYN, RST, or ACK is unexpected for a listening port, leading to no response).

2. Lyon, G. F. (2009). Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Nmap Project. (Chapter 5, "Port Scanning Techniques and Algorithms," provides a detailed definition of the NULL scan, stating it "does not set any bits (TCP flag header is 0)").

3. Stallings, W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. (Chapter 20, "Firewalls and Intrusion Detection Systems," describes NULL scans as a stealthy technique where no flags are set).

Digital signatures use asymmetric cryptography to provide authenticity, non-repudiation, and integrity. The sender (Dorian) creates a signature by using their own private key to encrypt a hash of the message. This ensures that only Dorian could have created it. The recipient (Polly) then uses Dorian's corresponding public key to decrypt the signature and verify that the message hash matches. This process confirms the sender's identity and that the message was not altered in transit.

A. Signing is done with a private key, and verification with a public key. This option reverses the process, which is functionally incorrect.

B. Signing with the recipient's (Polly's) public key is for encrypting the message for confidentiality, not for creating a digital signature.

D. The sender (Dorian) would not have access to the recipient's (Polly's) private key, as private keys must always remain secret.

1. National Institute of Standards and Technology (NIST). (2013). FIPS PUB 186-4: Digital Signature Standard (DSS). Section 4, "Digital Signature Generation and Verification."

2. Katz, J., & Lindell, Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. Chapter 12, "Digital Signatures," provides a formal definition and security model for digital signatures.

3. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 2.3, "Public Key Cryptography," explains the use of private keys for signing and public keys for verification.

The Internet Assigned Numbers Authority (IANA) officially assigns UDP port 161 for the Simple Network Management Protocol (SNMP). Early versions of SNMP (v1 and v2c) transmit data, including authentication credentials (community strings), in cleartext. This unencrypted traffic is what the administrator observed. To secure this traffic, the network must be migrated to SNMPv3. This version introduces a robust User-Based Security Model (USM) that provides message integrity, authentication, and encryption (confidentiality), addressing the critical vulnerabilities of its predecessors.

A: SNMP can carry sensitive device configuration, status, and network topology information, which is highly valuable to an attacker.

C: UDP port 161 is not used for RPC (Remote Procedure Call). Disabling a critical network management protocol is not a viable solution.

D: SNMPv2c, the most common implementation of SNMPv2, does not provide encryption; it still relies on cleartext community strings.

- IANA. (n.d.). Service Name and Transport Protocol Port Number Registry. Retrieved from https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml (Official assignment of port 161 to "snmp").

- Blumenthal, U., & Wijnen, B. (2002). RFC 3414: User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3). The Internet Society. Section 1.1 describes the provision of data integrity, authentication, and encryption.

- Stallings, W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 21, "Network Management Security," details the security flaws in SNMPv1/v2 and the cryptographic improvements in SNMPv3.

A zone transfer (AXFR) is a DNS transaction used to replicate the entire database of a DNS zone from a primary server to a secondary server. Several command-line utilities and tools are designed for this purpose. nslookup (in interactive mode), dig, and host are standard DNS query tools on Windows and Unix-like systems, respectively, that have specific options to request a full zone transfer. Sam Spade is a classic graphical network query tool for Windows that includes a zone transfer function. These tools are commonly used by administrators for diagnostics and by attackers for reconnaissance.

B. Finger is a protocol for retrieving information about users on a remote system and has no DNS functionality.

F. Netcat is a versatile networking utility for reading/writing data across network connections but lacks built-in, high-level DNS zone transfer commands.

G. Neotrace is a graphical traceroute tool used for visualizing network paths, not for querying DNS zone data.

1. Albitz, P., & Liu, C. (2006). DNS and BIND (5th ed.). O'Reilly Media. (Chapter 12, "Troubleshooting DNS and BIND," details the use of nslookup and dig for zone transfers).

2. University of California, Berkeley. (n.d.). dig(1) - Linux man page. Retrieved from EECS Department course materials. (The man page for dig explicitly documents the AXFR query type for initiating zone transfers).

3. University of Michigan. (n.d.). Host Command. Information and Technology Services. (Documentation for the host command describes the -l option for listing a whole zone, which performs a zone transfer).

4. Skoudis, E., & Zeltser, L. (2003). Malware: Fighting Malicious Code. Prentice Hall PTR. (Section on "Reconnaissance Tools" discusses the capabilities of Sam Spade, including zone transfers).

Code emulation involves running a suspicious program in a controlled, virtualized environment (a sandbox or virtual machine) to observe its behavior. The antivirus tool simulates the necessary CPU and memory operations to trick the malware into executing its malicious routines. By analyzing the actions the code takes within this safe environment, such as modifying files or making network connections, the antivirus can identify it as malicious without risking the actual host system. This is a form of dynamic analysis.

A. Heuristic analysis examines the static code for suspicious characteristics, patterns, or instructions without actually executing it in a simulated environment.

C. Scanning is a static technique that compares the file's signature (e.g., a hash) against a database of known malware signatures. It does not involve execution.

D. Integrity checking involves comparing current file hashes against a previously stored baseline of known-good hashes to detect unauthorized modifications.

- Egele, M., Scholte, T., Kirda, E., & Kruegel, C. (2008). A survey on automated dynamic malware analysis techniques and tools. ACM Computing Surveys (CSUR), 40(2), 1-42. (Section 2.1 describes the use of emulators and virtual machines for dynamic analysis). DOI: https://doi.org/10.1145/1346333.1346335

- Kirat, D., & Vigna, G. (2015). MALFOI: Automatic malware forensics and incident response. Proceedings of the 22nd Annual Network and Distributed System Security Symposium (NDSS). (This paper discusses dynamic analysis techniques that rely on executing malware in controlled environments like emulators).

Cryptographic hash functions are, by design, one-way functions. This means that it is computationally infeasible to reverse the process—that is, to derive the original input (the password) from its output (the hash). Password cracking programs do not reverse the hash. Instead, they work by taking a candidate password (a guess), applying the same hashing algorithm to it, and comparing the resulting hash with the target hash. If the hashes match, the guessed password is correct. This process is repeated with many guesses.

True: This option is incorrect because it misrepresents how both hashing algorithms and password cracking tools function. Reversing a secure hash is considered computationally impossible.

- National Institute of Standards and Technology (NIST). (2015). FIPS PUB 180-4, Secure Hash Standard (SHS). Section 4, "Properties of Secure Hash Algorithms," describes the one-way (preimage resistance) property, which makes it infeasible to find the message from the hash.

- Katz, J., & Lindell, Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. Chapter 5, "Hash Functions and Applications," formally defines the preimage resistance property of cryptographic hash functions.

- Paar, C., & Pelzl, J. (2010). Understanding Cryptography: A Textbook for Students and Practitioners. Springer. Chapter 11, "Hash Functions," explains that a core security property is preimage resistance, preventing reversal.

In DNS Mail Exchanger (MX) records, the priority is determined by a preference number. Contrary to the statement, a lower preference number indicates a higher priority. Mail Transfer Agents (MTAs) attempting to deliver email to a domain will try the mail server with the lowest preference number first. If that server is unavailable, they will proceed to the server with the next lowest number, and so on. Therefore, priority increases as the number decreases.

True: This is incorrect. A higher number in an MX record signifies a lower priority, making it a backup mail server.

- Klensin, J. (2008). RFC 5321: Simple Mail Transfer Protocol. IETF. Section 5.1, "Locating the Target Host," states, "The MX RRs contain a preference value that indicates the order in which to try the hosts... The lower the number, the higher the preference."

- Partridge, C. (1986). RFC 974: Mail Routing and the Domain System. IETF. This earlier RFC established the principle that lower preference values are tried first.

- Liu, C., & Albitz, P. (2006). DNS and BIND (5th ed.). O'Reilly Media. Chapter 5, "DNS and Electronic Mail," provides a detailed explanation and examples of MX record preference values. (Note: While a commercial publisher, this text is considered a foundational academic and professional reference in the field).

Dragonblood is a collection of vulnerabilities discovered in the WPA3 Wi-Fi security standard's Simultaneous Authentication of Equals (SAE) handshake, also known as Dragonfly. These flaws, including downgrade attacks and side-channel leaks, can allow an attacker within radio range to recover the network password. Since the target network uses WPA3, exploiting the Dragonblood vulnerabilities is the most promising and specific attack vector against the protocol itself.

B. Cross-site request forgery is a web application vulnerability and is not relevant to attacking a wireless network protocol like WPA3.

C. The Key Reinstallation Attack (KRACK) is a significant vulnerability affecting the WPA2 protocol. WPA3 was specifically designed to be resistant to KRACK attacks.

D. While AP misconfiguration can lead to vulnerabilities, Dragonblood is a specific, named vulnerability class inherent to the WPA3 SAE handshake, making it a more direct exploit.

1. Vanhoef, M., & Ronen, E. (2019). Dragonblood: A Security Analysis of WPA3’s SAE Handshake. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (pp. 1059-1076). ACM. DOI: https://doi.org/10.1145/3319535.3354221 (Section 3, "Vulnerabilities in WPA3’s SAE handshake," details the attacks.)

2. Wi-Fi Alliance. (2020). Wi-Fi CERTIFIED WPA3™ Security. "WPA3-Personal provides more robust password-based authentication... using Simultaneous Authentication of Equals (SAE), a secure key establishment protocol between devices." (The document describes SAE, the component targeted by Dragonblood).

The organization has implemented several preventative controls: static ARP entries to thwart ARP poisoning, IPv6, and encrypted protocols (SSH, SFTP) to protect data in transit. However, sniffing can still occur, for example, from a compromised endpoint within the network or via a physical tap. Since preventative measures are not foolproof, the next logical step is to implement detective controls. Network scanning and monitoring tools (like Intrusion Detection Systems - IDS) can analyze traffic patterns, detect anomalies such as a network interface card (NIC) in promiscuous mode, and alert administrators to potential sniffing activity, thereby enhancing overall security posture.

A. Using HTTP instead of HTTPS would remove encryption for web traffic, making the network more vulnerable to sniffing, which is counterproductive to the stated goal.

C. Enabling network identification broadcasts can expose more information about the network's structure and devices, potentially aiding an attacker rather than securing the network.

D. Retrieving MAC addresses from the OS is a basic administrative task, not an advanced security countermeasure. The team is already manipulating ARP caches, indicating this level of knowledge.

1. NIST Special Publication 800-94. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS). Section 2.1 discusses the role of IDPS in monitoring networks for malicious activity, which includes detecting sniffing attempts.

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. Chapter 21, "Intrusion Detection," details how network-based IDS monitors traffic for suspicious patterns, which is a direct countermeasure to detect ongoing sniffing.

3. MIT OpenCourseWare. (2014). 6.857 Computer and Network Security, Spring 2014. Lecture 10 notes discuss network attacks and defenses, highlighting monitoring as a key defensive strategy alongside encryption.

The Cyber Kill Chain model outlines the stages of a cyberattack. The "Delivery" phase is the third step, where the attacker transmits the weaponized payload to the targeted environment. Sending a malicious attachment via email is a classic example of this delivery mechanism. The goal of this phase is to get the malicious code to the victim's system, but not necessarily to execute it yet.

B. Creating malware to be used as a malicious attachment is the "Weaponization" phase (Step 2), which precedes delivery.

C. The malware being triggered when the attachment is opened is the "Exploitation" phase (Step 4), where the vulnerability is exploited.

D. The malware being installed on the target's machine is the "Installation" phase (Step 5), establishing a persistent presence.

1. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Proceedings of the 6th International Conference on Information Warfare and Security, (pp. 113-125). (This is the foundational paper by Lockheed Martin researchers defining the Cyber Kill Chain, describing Delivery on page 116).

2. University of Maryland. (2018). CMSC 414: Computer and Network Security, Lecture 20: Intrusion Detection. Slide 11. (Courseware outlining the Cyber Kill Chain steps, listing "Delivery: Transmission of weapon to target (e.g., via email attachments, websites, USB drives)").

3. SANS Institute. (2021). The Cyber Kill Chain. (Defines the seven steps, clarifying that Delivery is the transmission of the weapon to the target).