CEHPC Practice Questions

On Debian-based systems like Kali Linux, apt-get update is the command used to download package information from all configured sources. This command updates the local cache of available packages, ensuring the system knows about the latest versions and dependencies before an upgrade is performed. It is the necessary first step in the system update process.

A. sudo update upgrade is not a valid command. update and upgrade are arguments for a package manager like apt-get, not standalone commands in this context.

B. sudo apt-get update•• is syntactically incorrect due to the trailing special characters (••), which would cause the command to fail in the shell.

- Kali Linux Development Team. (2023). Updating Kali Linux. Kali Linux Documentation. Retrieved from https://www.kali.org/docs/general-use/updating-kali/. The document states, "The first step is to run sudo apt update," which is the modern equivalent of apt-get update.

- The Debian Administrator's Handbook, 2nd ed. (2021). Section 6.2.3, "Upgrading." Describes the system upgrade process, which begins with apt-get update or apt update to fetch the latest list of packages.

Penetration testing is governed by strict legal and ethical principles. All testing activities, especially the exploitation of vulnerabilities, must be preceded by explicit, written consent from the target organization. This authorization is formalized in a contract and a "Rules of Engagement" document, which defines the scope and limits of the test. Performing such acts without consent is a criminal offense under laws like the Computer Fraud and Abuse Act (CFAA) in the U.S. and similar legislation worldwide. Therefore, a pentester's actions are strictly bound by the law and the authorized scope of the engagement.

A. YES, we have all the freedom: This is incorrect. Pentesters operate under strict legal and contractual constraints, not with absolute freedom.

C. YES, we have all the power to perform these processes without consent: This is false and illegal. Acting without consent is a crime, not a professional privilege.

1. Scarfone, K., Souppaya, M., & Orebaugh, A. (2008). NIST Special Publication 800-115: Technical Guide to Information Security Testing and Assessment. National Institute of Standards and Technology. Section 2.2, "Establishing the Assessment Rules of Engagement," emphasizes the necessity of a formal agreement before testing. DOI: https://doi.org/10.6028/NIST.SP.800-115

2. Graves, K. (2010). Official Certified Ethical Hacker Review Guide. Cengage Learning. (Used as a textbook in university curricula). Chapter 1, "Introduction to Ethical Hacking," explicitly states that the key difference between hacking and ethical hacking is obtaining permission.

3. Stanford University. (n.d.). CS 182: Ethics, Public Policy, and Technological Change. Course Syllabus. Stanford, CA: Stanford University. Courses of this nature in reputable institutions cover the legal and ethical necessity of consent for actions that affect computer systems.

Netcat (often abbreviated as nc) is a command-line networking utility renowned for its versatility. It can read and write data across network connections using either TCP or UDP protocols. Its functionality is so broad that it is often referred to as the "Swiss-army knife for TCP/IP." It is used by network administrators and security professionals for a wide range of tasks, including port scanning, banner grabbing, transferring files, and creating backdoors. It is open-source and available for various operating systems, including Linux, Windows, and macOS.

A. Netcat is not exclusive to Windows; it is a cross-platform tool widely used on Unix-like systems as well.

C. Netcat is not exclusive to Linux; it is a cross-platform tool with popular implementations available for Windows.

1. Nmap.org. (n.d.). Ncat - Netcat for the 21st Century. Nmap Project. Retrieved from https://nmap.org/ncat/. Ncat is the Nmap project's modern reimplementation of Netcat, described as a "feature-packed networking utility which reads and writes data across networks from the command line."

2. University of California, Berkeley. (n.d.). EECS 122: Introduction to Communication Networks Course Materials. The course often includes labs demonstrating the use of Netcat for network debugging and exploration on Unix-based systems.

3. Bowen, B., & Deir, A. (2008). Offensive Countermeasures: The Art of Active Defense. Chapter 4. Discusses Netcat as a fundamental, cross-platform tool for network reconnaissance and establishing connections.

Whois is a request/response protocol widely used for querying databases that store the registration details of Internet resources, such as domain names and IP address blocks. The name is a contraction of the phrase "who is". The service provides publicly accessible information about the registered owner (registrant), as well as administrative and technical contacts. This data is crucial for network administrators, cybersecurity professionals, and law enforcement to identify the parties responsible for a given internet resource.

B. Whois provides registration data, which is often a business address or is obscured by a privacy service; it does not guarantee the owner's exact residential location.

C. Whois is a digital protocol and a distributed online database system, not a single, physical directory from the early internet.

1. Mockapetris, P. (1987). RFC 1034: Domain Names - Concepts and Facilities. Internet Engineering Task Force (IETF). Section 3.1. Available at: https://datatracker.ietf.org/doc/html/rfc1034

2. Daigle, L. (2004). RFC 3912: WHOIS Protocol Specification. Internet Engineering Task Force (IETF). Section 1. Available at: https://datatracker.ietf.org/doc/html/rfc3912

3. ICANN (Internet Corporation for Assigned Names and Numbers). (n.d.). About WHOIS. Retrieved from https://whois.icann.org/en/about-whois. (This page explains the purpose and function of the WHOIS service as overseen by ICANN).

Phishing is a form of social engineering where an attacker, masquerading as a reputable entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack, or the revealing of sensitive information. The goal is to steal sensitive data like credit card and login information or to install malware on the victim’s machine.

B. This describes a brute-force attack, a cryptographic attack that involves systematically checking all possible keys or passwords until the correct one is found.

C. This describes network sniffing or eavesdropping, where an attacker intercepts data packets in transit over a network to capture sensitive information.

1. Khonji, M., Iraqi, Y., & Jones, A. (2013). Phishing Detection: A Literature Survey. IEEE Communications Surveys & Tutorials, 15(4), 2091-2121. (See Section II.A. "Phishing Definition", p. 2092). DOI: 10.1109/SURV.2013.032213.00067

2. Stanford University IT. (n.d.). Phishing. Retrieved from https://uit.stanford.edu/security/phishing. (See "What is phishing?" section).

3. Massachusetts Institute of Technology (MIT). (n.d.). Phishing. Information Systems & Technology. Retrieved from https://ist.mit.edu/security/phishing. (See "What is Phishing?" section).

Practicing on VulnHub machines is legal because it occurs within a controlled, isolated environment that you own (e.g., a local virtual machine). The creators of these machines provide them with the explicit intent that they be used for security training and practice. Legality issues with hacking arise from unauthorized access to systems or networks owned by others. Since you are the owner of the local environment and have implicit permission from the creator, no laws are broken. This is a standard and accepted method for hands-on cybersecurity education.

A. This is factually incorrect; the entire purpose of VulnHub machines is that they are intentionally built with vulnerabilities for practice.

B. This is incorrect because access is implicitly authorized by the machine's creator for educational purposes within your own environment.

1. Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. (The law hinges on "unauthorized access" or "exceeding authorized access," neither of which applies to practicing on your own local, self-contained virtual machine).

2. Parso, T. (2018). Teaching Ethical Hacking in a University Setting. In 2018 IEEE 11th International Conference on Global Security, Safety and Sustainability (ICGS3), 100-105. https://doi.org/10.1109/ICGS3.2018.8353278 (This paper discusses the necessity of using isolated lab environments, like local VMs, to teach hacking skills legally and ethically).

3. Stanford University. CS 155: Computer and Network Security. Project 1: Buffer Overflows. (Course materials often instruct students to perform attack exercises on provided virtual machines, establishing the academic and legal precedent for using contained, vulnerable systems for education).

Yes, the File Transfer Protocol (FTP) can be breached using various techniques. Standard FTP, as defined in RFC 959, is inherently insecure because it transmits authentication credentials (username and password) and data in cleartext. This makes it highly vulnerable to sniffing attacks, where an attacker can intercept the traffic and capture the credentials. It is also susceptible to brute-force attacks, packet capture, and port stealing, making it an outdated and insecure protocol for transferring sensitive data without additional security layers like FTPS or SFTP.

A. This is factually incorrect. Standard FTP is widely recognized in the cybersecurity community as an insecure protocol due to its lack of encryption.

C. While social engineering is a valid attack vector, it is only one method. The protocol itself has technical vulnerabilities that can be exploited directly.

1. Postel, J., & Reynolds, J. (1985). RFC 959: File Transfer Protocol. Internet Engineering Task Force (IETF). Section 5.1 discusses the user authentication process, which does not specify encryption.

2. University of California, Berkeley. CS 161: Computer Security, Lecture Notes on Network Security. The course materials frequently cite FTP as a classic example of an insecure protocol that transmits credentials in the clear, making it vulnerable to eavesdropping.

3. Forouzan, B. A. (2013). Data Communications and Networking (5th ed.). McGraw-Hill. Chapter 26, "Multimedia," often discusses FTP and its security limitations in university networking courses.

A security breach is an incident that results in confirmed, unauthorized access to and/or disclosure of sensitive, protected, or confidential data. It is a violation of a system's security policy. This can involve personal data (like social security numbers or financial information) or corporate data (such as trade secrets or intellectual property). The consequences can range from data theft and modification to complete system compromise, affecting an organization's integrity, confidentiality, and availability.

A. Hacking the "entire Internet" is a fictional concept; a security breach is a specific incident affecting a particular system or organization, not a global network.

B. An "Internet breakup" is a nonsensical term in this context. It does not describe a cybersecurity incident and has no established technical meaning.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53 Rev. 5). Appendix A, "Glossary," p. A-6. Defines a breach as "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence..."

2. General Data Protection Regulation (GDPR). (2016). Regulation (EU) 2016/679. Article 4(12). Defines a 'personal data breach' as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data..."

Social engineering is a non-technical intrusion technique that relies on human interaction and psychological manipulation. It involves tricking people into breaking normal security procedures or divulging confidential information. Asking a user to disclose their password over the phone is a classic example of pretexting, a social engineering tactic where an attacker creates a fabricated scenario (e.g., pretending to be IT support) to gain the victim's trust and persuade them to provide sensitive data like a password.

A. Antivirus software is a technical security control designed to detect and remove malicious software; it is a defense against attacks, not an attack itself.

B. Updating the operating system is a fundamental technical security practice (patch management) to fix known vulnerabilities and protect against exploits.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63-3: Digital Identity Guidelines. https://doi.org/10.6028/NIST.SP.800-63-3 (Section 5.2.2 discusses social engineering as a primary threat to authentication processes, including phishing and pretexting).

2. Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015). Advanced social engineering attacks. Journal of Information Security and Applications, 22, 113-122. https://doi.org/10.1016/j.jisa.2014.09.005 (Defines social engineering as "the art of manipulating people into performing actions or divulging confidential information").

3. Stanford University. (n.d.). Social Engineering. IT Protects - Stanford University Information Security Office. (Defines social engineering and provides examples such as phishing, baiting, and pretexting, which includes eliciting information over the phone).

Private IP addresses are reserved address blocks intended for use in private networks, such as a home, school, or business Local Area Network (LAN). These addresses are not routable on the global internet, which prevents devices on a private network from being directly accessible from the outside. This design allows for a vast number of private networks to reuse the same address ranges without conflict. To communicate with the internet, devices on a private network use a router or gateway that performs Network Address Translation (NAT) to a public IP address.

A. The IP address assigned by an Internet Service Provider (ISP) for internet access is a public IP address, not a private one.

B. This is incorrect. Private IP addresses are widely used within millions of local networks worldwide for internal device communication.

1. Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G. J., & Lear, E. (1996). RFC 1918: Address Allocation for Private Internets. Internet Engineering Task Force (IETF). (See Abstract and Section 3, "Private Address Space").

2. Dordal, P. L. (2019). An Introduction to Computer Networks (2nd ed.). Loyola University Chicago. (Chapter 9.5, "Private Addresses", para. 1-2).

3. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. (Chapter 4.4.2, "The Network Address Translation (NAT) Router").