Question 1

Suppose your company has just passed a security risk assessment exercise. The results display that the risk of

the breach in the main company application is 50%. Security staff has taken some measures and

implemented the necessary controls. After that, another security risk assessment was performed showing that

risk has decreased to 10%. The risk threshold for the application is 20%. Which of the following risk decisions

will be the best for the project in terms of its successful continuation with the most business profit?

Options :

A : Accept the risk

B : Introduce more controls to bring risk to 0%

C : Mitigate the risk

D : Avoid the risk

Answer: A

Question 2

Which of the following commands checks for valid users on an SMTP server?

Options :

A : RCPT

B : CHK

C : VRFY

D : EXPN

Answer: C

Question 3

An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

Options :

A : He will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.

B : He will activate OSPF on the spoofed root bridge.

C : He will repeat this action so that it escalates to a DoS attack.

D : He will repeat the same attack against all L2 switches of the network.

Answer: A

Question 4

An ethical hacker is scanning a target network. They initiate a TCP connection by sending an SYN packet to a target machine and receiving a SYN/ACK packet in response. But instead of completing the three-way handshake with an ACK packet, they send an RST packet. What kind of scan is the ethical hacker likely performing and what is their goal?

Options :

A :

They are performing an SYN scan to stealthily identify open ports without fully establishing a connection

B : They are performing a TCP connect scan to identify open ports on the target machine

C : They are performing a vulnerability scan to identify any weaknesses in the target system

D : They are performing a network scan to identify live hosts and their IP addresses

Answer: A

Question 5

Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mall servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API. Which of the following tools is used by Wilson in the above scenario?

Options :

A : Factiva

B : Netcraft

C : infoga

D : Zoominfo

Answer: C