312-50V13 Practice Questions

The question assesses the impact of a SYN flood attack based on the server's handling capacity. A system overload occurs when the rate of incoming SYN packets (s) surpasses the server's capacity to manage them (f). The severity of the performance degradation is directly related to the magnitude of the difference, k = s - f.

Given s = 500 packets/sec:

- In scenarios A (f=510) and C (f=505), s is less than f, so the server is not overloaded.

- In scenario B, f = 495, so k = 500 - 495 = 5. The server is overloaded.

- In scenario D, f = 490, so k = 500 - 490 = 10. The server is also overloaded.

Comparing the two overload scenarios (B and D), scenario D has a larger k value (10 vs. 5). According to the problem's formula, where response time increases exponentially with k, a larger k results in a far more significant increase in response time and a more severe system overload. Therefore, scenario D represents the most impactful attack.

A. f=510: The server's handling capacity (f=510) is greater than the attack traffic (s=500). The system is not overloaded and operates normally.

B. f=495: Although the system is overloaded (s > f), the difference k=5 is smaller than in scenario D, leading to a less severe performance degradation.

C. f=S05: The server's capacity (f=505) exceeds the attack volume (s=500), so the condition for overload and increased response time is not met.

---

1. Kaashoek

M. F.

& Zeldovich

N. (2014). 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology: MIT OpenCourseWare.

Reference: Lecture 15: Network Security

DoS

and Defenses

Section on "TCP SYN flooding".

Content: This material explains that a server has a finite-size backlog queue for pending connections. A SYN flood attack fills this queue with half-open connections. When the rate of incoming malicious SYNs (s) exceeds the server's ability to process them and clear the queue (f)

legitimate connection requests are dropped

leading to denial of service and significantly increased connection times. This directly supports the concept of an overload threshold.

2. Douligeris

C.

& Mitrokotsa

A. (2004). A survey of network-based defense mechanisms countering the DoS and DDoS problems. ACM Computing Surveys

36(4)

366–418. https://doi.org/10.1145/1041680.1041682

Reference: Section 4.1.1

"SYN Flooding Attack".

Content: The paper details how SYN flooding attacks exhaust the victim's resources by filling the Transmission Control Block (TCB) table. Since this table has a finite size (representing the capacity f)

an attack rate (s) exceeding this capacity prevents the server from accepting new

legitimate connections

causing a denial of service. The greater the excess of s over f

the more pronounced the effect.

3. Cisco. (2022). Defining Strategies to Protect Against TCP SYN Denial of Service Attacks.

Reference: Document ID: 13751

Section "SYN Flood Attack Overview".

Content: This official documentation describes how a SYN flood attack consumes server connection resources. It states

"When the connection queue is full

the server rejects all new connection requests... from legitimate hosts." This establishes the principle of a finite capacity (f). Mitigation techniques often involve rate-limiting

which explicitly defines a threshold for SYN packets; traffic exceeding this threshold is dropped

confirming the direct relationship between packet rate and system overload.

DNS tunneling is a technique used to bypass firewalls by encapsulating non-DNS traffic within DNS queries and responses. The NSTX (Nostromo) tool is specifically designed for this purpose. Since the Domain Name System (DNS) protocol operates on port 53 (both UDP and TCP), any tool performing DNS tunneling must use this port to communicate with a malicious DNS server. Firewalls are almost universally configured to allow outbound traffic on port 53 to permit legitimate name resolution, which is why attackers leverage it for covert data exfiltration.

B. Port 23: This port is used for Telnet, an unencrypted remote terminal protocol. It is unrelated to DNS tunneling and is often blocked by firewalls due to its insecurity.

C. Port 50: This port is used for the Encapsulating Security Payload (ESP) protocol, a component of IPsec used for VPNs. It is not associated with DNS.

D. Port 80: This port is used for HTTP. While HTTP tunneling is another firewall bypass technique, the question specifically asks about DNS tunneling with the NSTX tool.

1. Internet Engineering Task Force (IETF). (1987). RFC 1035: Domain Names - Implementation and Specification. Section 4.2

"Transport

" specifies that DNS transactions use UDP or TCP on port 53. This establishes port 53 as the standard for the protocol being tunneled.

2. Farnham

G. (2013). Detecting DNS Tunnelling. SANS Institute InfoSec Reading Room. Page 4 states

"DNS tunnelling works by encoding data into DNS queries and sending them to a name server the attacker controls... Since DNS traffic is on port 53 and is almost always allowed out of a network

this is an effective way to bypass most firewalls."

3. Dusi

M.

Gringoli

F.

& Salgarelli

L. (2011). A preliminary look at the privacy of DNS-based covert channels. In 2011 IEEE International Conference on Communications (ICC) (pp. 1-5). IEEE. DOI: 10.1109/icc.2011.5963359. The paper's introduction discusses how DNS-based covert channels operate over port 53 to bypass network access policies.

A hybrid attack is a password cracking methodology that combines a dictionary attack with a brute-force attack. This technique enhances a standard dictionary attack by systematically applying modifications to the words from the dictionary list. These modifications include adding numerical suffixes or prefixes, substituting characters with symbols (e.g., 'a' with '@'), and altering capitalization. This approach is significantly more effective than a simple dictionary attack against users who create passwords by slightly modifying common words (e.g., "Password123"), and it is much faster than a pure brute-force attack that tries every possible combination.

A. Full Blown: This is a descriptive phrase, not a recognized technical term for a specific password attack method in cybersecurity.

B. Thorough: This is a general adjective describing the comprehensiveness of an effort, not the name of a specific attack technique.

D. BruteDics: This is a fabricated, non-standard term. The correct industry and academic term is "hybrid attack."

1. Weir

M.

Aggarwal

S.

de Medeiros

B.

& Glodek

M. (2009). Password cracking using probabilities

patterns

and permutations. In 2009 IEEE Symposium on Security and Privacy (pp. 35-49). IEEE. This paper discusses password cracking techniques

describing methods that apply "common permutations to dictionary words

such as appending a single digit

" which is the definition of a hybrid attack. (Section III.A). DOI: https://doi.org/10.1109/SP.2009.11

2. University of California

Berkeley. (2020). CS 161: Computer Security

Lecture 6: Web Security Model & Password Hashing. Course materials describe password cracking techniques

including dictionary attacks augmented with "rules" to append numbers or symbols

which is the essence of a hybrid attack. (Slide 53

"Guessing Passwords").

3. Hashcat Official Documentation. (n.d.). Attack modes. The documentation for Hashcat

a prominent password recovery tool covered in CEH

explicitly defines hybrid attack modes. For example

attack mode 6 is "Hybrid Wordlist + Mask

" and attack mode 7 is "Hybrid Mask + Wordlist

" demonstrating the combination of dictionary files and brute-force masks. (Section: hashcat --help

Attack modes).

The STARTTLS command is an extension to the Simple Mail Transfer Protocol (SMTP) that allows an unencrypted connection to be upgraded to a secure connection using Transport Layer Security (TLS). When a client connects to an SMTP server, it can issue the STARTTLS command to signal its desire to begin a TLS handshake. If the server supports this extension, it responds positively, and the two parties negotiate a secure, encrypted channel before any sensitive information, such as login credentials or email content, is transmitted. This process is defined in RFC 3207.

A. OPPORTUNISTICTLS: This is a configuration policy where a server attempts to use TLS but will proceed with an unencrypted connection if TLS fails; it is not an SMTP command.

B. UPGRADETLS: This is a descriptive but syntactically incorrect and non-existent command within the SMTP protocol specifications.

C. FORCETLS: This describes a policy that mandates the use of TLS for a connection, refusing to proceed if a secure connection cannot be established. It is not a command.

1. Internet Engineering Task Force (IETF). (2002). RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security. Section 4

"The STARTTLS Command

" p. 3. This document formally defines the STARTTLS command

its syntax

and its function in upgrading a plaintext SMTP connection to a TLS-encrypted one.

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 2

Section 2.4.3

"Mail Access Protocols

" the text discusses SMTP and its security extensions

including the use of STARTTLS to encrypt email sessions.

3. MIT OpenCourseWare. (2017). 6.857 Computer and Network Security

Fall 2017. Lecture 15: Network Security II. The lecture notes discuss email security mechanisms

explicitly mentioning STARTTLS as the command used to initiate TLS encryption within an SMTP session.

The Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols utilize a hybrid cryptosystem to provide both security and performance. Asymmetric cryptography, while highly secure for key exchange, is computationally intensive and too slow for encrypting large volumes of data. Therefore, SSL/TLS uses asymmetric algorithms (like RSA or Elliptic Curve Diffie-Hellman) only during the initial handshake phase. The primary purpose of this phase is to authenticate the server (and optionally the client) and to securely negotiate a shared secret key. This shared key is then used to derive session keys for a symmetric algorithm (like AES), which is far more efficient and is used to encrypt the actual application data for the remainder of the session.

A. Symmetric algorithms are used after the asymmetric key exchange succeeds; they do not function as a failsafe if the initial asymmetric negotiation fails.

C. Asymmetric, not symmetric, encryption is used to securely establish the session keys in-band during the TLS handshake, not out-of-band.

D. All modern devices capable of TLS, including mobile phones, use both asymmetric and symmetric encryption in every session. It is not an either/or choice.

1. Internet Engineering Task Force (IETF) RFC 8446

"The Transport Layer Security (TLS) Protocol Version 1.3": Section 2

"Protocol Overview

" describes the handshake process where key establishment (asymmetric) and record protection (symmetric) are distinct phases. It states

"The primary goal of the handshake is to establish a set of shared keys... The keys established in the handshake are used to protect the rest of the session." This highlights the use of the handshake (asymmetric) to establish keys for the session (symmetric).

2. NIST Special Publication 800-52 Revision 2

"Guidelines for the Selection

Configuration

and Use of Transport Layer Security (TLS) Implementations": Section 3.3

"TLS Handshake Protocol

" details the process. It explains that the handshake authenticates the server and establishes a shared "master secret

" which is then used to generate symmetric keys for encrypting and authenticating the session data. This confirms the separate

specialized roles of asymmetric and symmetric crypto.

3. Boneh

D.

& Shoup

V. (2020). A Graduate Course in Applied Cryptography. Stanford University. Chapter 12

"Public-Key Encryption

" Version 0.5

page 409

discusses hybrid encryption. It states

"In practice

public-key encryption is much slower than symmetric encryption... To encrypt a long message... one should use hybrid encryption... This is how public-key encryption is used in many systems

including in TLS." This academic source confirms that the combination is used to overcome the performance limitations of asymmetric cryptography.

The Nmap -T (Timing Template) switch is used to control the timing and aggressiveness of a scan. Using a low-numbered template, such as -T0 (paranoid) or -T1 (sneaky), significantly slows down the scan by increasing the delay between sent probes. This technique is specifically designed to evade rate-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). These security systems often trigger alerts based on a high volume of connection attempts from a single source in a short period. By reducing the scan speed, the attacker's activity can blend in with normal network traffic, thereby avoiding detection.

A. -n/-R: These switches control DNS resolution. -n disables it to speed up scans, and -R forces it. They are not primary mechanisms for evading firewalls or IDS.

B. -0N/-0X/-0G: This represents invalid Nmap syntax. The likely intended options are -sN (NULL), -sX (Xmas), and -sF (FIN) scans, which are used to bypass specific stateless firewalls, not modern IDS in general.

D. -D: This switch initiates a decoy scan, which obfuscates the true source of the scan by including spoofed IP addresses. While this is an evasion technique, it aims to confuse attribution rather than prevent the scan's detection. An IDS will likely still detect the scanning activity.

1. Nmap Official Documentation: In the Nmap Reference Guide

the section on "Timing Templates (-T)" explicitly states: "The paranoid (0) and sneaky (1) modes are for IDS evasion." This confirms that the primary purpose of these specific timing templates is to bypass detection systems.

Source: Nmap Reference Guide

Chapter 15. Performance

Section: Timing Templates (-T). Retrieved from https://nmap.org/book/man-performance.html

2. University Courseware: Lecture materials from reputable computer science programs cover Nmap's evasion capabilities. For instance

course notes on network security often detail how timing manipulation is a key strategy for stealth scanning.

Source: University of Colorado

Boulder. CSCI 4273/5273 - Network and Distributed Systems Security. Lecture notes on "Network Reconnaissance" describe Nmap evasion techniques

including the use of -T0 (paranoid) for timing-based evasion.

3. Academic Publication: Research on IDS evasion techniques frequently cites Nmap's capabilities. Studies analyze how modifying scan timing parameters

as done with the -T switch

effectively reduces the likelihood of detection by common IDS platforms.

Source: Al-Harbi

A.

& Al-Aqrabi

H. (2021). A Comprehensive Review of Network Intrusion Detection Systems Evasion and Countermeasure Techniques. In Proceedings of the 3rd International Conference on Computer and Information Sciences (ICCIS). (DOI: https://doi.org/10.1109/ICCIS52649.2021.9633901). The paper discusses various evasion methods

including "Slow Scans" (Section III-A)

which corresponds to Nmap's -T functionality.

The assessment performed by Martin is a host-based assessment. This type of assessment focuses on the security posture of a single machine (a host). It involves analyzing the system's internal configuration, including user directories, registry settings, file system permissions, and installed software configurations, to identify vulnerabilities. The specific issues Martin identified, such as incorrect permissions and configuration errors, are characteristic findings of a detailed examination of an individual host's operating system and applications.

A. Credentialed assessment: This describes the method of scanning (i.e., using valid credentials to log in) rather than the target of the assessment. While a host-based assessment is often credentialed, the primary type is defined by its focus on the host.

B. Database assessment: This is a specialized assessment that focuses exclusively on identifying vulnerabilities within database management systems (e.g., SQL injection, weak credentials, misconfigurations), which is not what was described.

D. Distributed assessment: This type of assessment is used for evaluating security across multiple, often geographically separate, systems in a network, whereas Martin's task was focused on a single, standalone system.

1. NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment: Section 4.3.2

"Host-Based Scanners

" states

"Host-based scanners are installed on the host system to be reviewed... They can often provide even more information than network-based scanners by reviewing system configuration files

password files

and system logs." The vulnerabilities Martin found (registries

file permissions

configuration errors) align directly with this definition.

2. Purdue University

CS 42600 - Computer Security Courseware: In lectures on "Vulnerability Analysis

" host-based vulnerability analysis is defined as the process of examining a specific host for security weaknesses. This includes checking for misconfigurations

insecure file permissions

and outdated software

which directly corresponds to the activities performed by the administrator in the scenario.

3. Kim

D.

& Solomon

M. G. (2016). Fundamentals of information systems security (3rd ed.). Jones & Bartlett Learning. Chapter 7

"Security Operations

" describes host-based vulnerability scanning as a method to "identify vulnerabilities on an internal system" by examining its configuration

patch levels

and local security settings. This aligns with the assessment of an existing system's parameters

registries

and permissions.

The log entry shows a TCP/IP connection. The destination port is 22, which is the well-known port assigned by the Internet Assigned Numbers Authority (IANA) for the Secure Shell (SSH) protocol. In a typical client-server TCP connection, the client initiates the connection from a high-numbered, ephemeral source port (in this case, 54373) to the server's well-known service port (22). Therefore, the machine with the IP address 10.240.250.23 is the client, and the machine with the IP address 10.249.253.15 is the server running the SSH service.

A. The application is incorrect. Port 22 is for SSH, not FTP, which typically uses ports 20 and 21.

B. The client and server roles are reversed. The connection is initiated to the well-known port 22, making 10.249.253.15 the server.

C. This is false. While the SSH payload is encrypted, the TCP/IP packet headers containing source/destination IPs and ports are not, allowing for identification of the client and server.

1. Internet Assigned Numbers Authority (IANA). (2024). Service Name and Transport Protocol Port Number Registry. IANA. Retrieved from https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.

Reference Detail: The registry explicitly lists "ssh" assigned to port 22 for both TCP and UDP. This confirms the application is SSH.

2. Ylonen

T.

& Lonvick

C. (2006). RFC 4251: The Secure Shell (SSH) Protocol Architecture. Internet Engineering Task Force (IETF).

Reference Detail: Section 4.1

"Use of TCP/IP

" states

"The SSH server normally listens for connections on port 22." This officially documents the server-side port for SSH.

3. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Reference Detail: Chapter 2

Section 2.7

"Socket Programming with TCP

" explains the client-server model. The server has a welcoming socket on a well-known port

while the client's operating system assigns an ephemeral port number to the client's socket for the specific connection. This principle identifies 10.240.250.23 (source port 54373) as the client and 10.249.253.15 (destination port 22) as the server.

The location: operator is designed specifically for use within Google News to filter news articles by a specific geographical location (e.g., a city or country). It is not a general web search operator and does not apply to the broader web index. Therefore, it is ineffective and the least useful for a technical footprinting task like identifying a VPN server's login page, configuration files, or related network infrastructure, which are not typically indexed with news-specific location metadata. The other operators are fundamental to Google Hacking.

A. intitle: This operator is highly useful for finding pages with specific text in their HTML title, such as intitle:"VPN Access Portal", making it a primary tool for this task.

C. inurl: This operator is extremely effective for finding URLs that contain specific keywords common to VPN gateways, such as inurl:/remote/login or inurl:ssl-vpn.

D. link: This operator is a valid reconnaissance tool used to discover which pages link to a specific domain, potentially revealing related or unlisted company assets, including VPN portals.

1. Google. (n.d.). Refine web searches. Google Search Help. Retrieved from https://support.google.com/websearch/answer/2466433.

Reference Detail: Under the section "Search for news

" the documentation specifies the location: operator is used to "Find news from a certain location." It is not listed as a general web search refinement operator.

2. Kamran

S.

& Khan

M. N. A. (2017). Google Hacking: A new weapon in the arsenal of cyber warriors. 2017 International Conference on Communication

Computing and Digital Systems (C-CODE)

134-137. IEEE.

DOI: https://doi.org/10.1109/C-CODE.2017.7918931

Reference Detail: Section III

"Google Hacking Techniques

" lists and describes key operators for information gathering

including intitle

inurl

filetype

and site. The location operator is not mentioned as a relevant technique for this type of technical reconnaissance.

3. University of Washington. (2021). Lecture 3: Web Security: Recon. CSE 484 / CSE M 584: Computer Security and Privacy.

Reference Detail: The course lecture slides on reconnaissance techniques detail the use of Google Dorking for information gathering. The slides emphasize operators like site:

filetype:

inurl:

and intitle: as essential tools for ethical hackers. The location: operator is not included as a method for footprinting technical assets.

A Denial-of-Service (DoS) attack is an explicit attempt by an attacker to make a machine or network resource unavailable to its intended users. The primary goal is to disrupt the "availability" aspect of the CIA (Confidentiality, Integrity, Availability) triad. This is typically accomplished by flooding the targeted machine or resource with superfluous requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.

B. This describes a brute-force or dictionary attack, which is a method used to crack passwords and compromise authentication, not deny service.

C. This describes a password cracking attempt. While a poorly configured system might crash under such an attack, the primary goal is to compromise credentials, not cause a denial of service.

D. This describes impersonation, spoofing, or social engineering attacks, where the objective is to deceive a system or user to gain unauthorized access, not to disrupt availability.

1. National Institute of Standards and Technology (NIST). (2020). NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. U.S. Department of Commerce. In Section 2.3.3

"Denial of Service

" it is defined as an attack that "prevents or impairs the normal authorized use of networks

systems

or applications by exhausting resources." This directly supports the concept of preventing legitimate users from accessing a service. (Page 11).

2. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 8

"Security in Computer Networks

" a DoS attack is defined as an attack that renders a network

host

or other piece of infrastructure unusable by legitimate users. (Section 8.7.1

"Denial of Service (DoS) Attacks").

3. Saltzer

J. H.

& Kaashoek

M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann. MIT OCW 6.033 Computer System Engineering

Spring 2009. In Chapter 11

"Security and Protection

" DoS attacks are described as actions that "prevent legitimate principals from using a service." (Section 11.6.3

"Denial of Service").