Network Security Unit 3 REVIEW

Network Security Unit 3 REVIEW The _____ mailing list is a widely known, major source of public vulnerability announcements. - ANS: Bugtraq Most C++ catastrophe vulnerabilities rely on uninitialized function pointers in a class. T/F - ANS: True _____ verify that an organization's security policies are prudent (cover the right issues) and are being implemented correctly. - ANS: Audits Probably the most popular port scanner is _____, which runs on both UNIX and windows systems. - ANS: nmap Organizations are safe from sniffer attacks when their computing environment is primarily a switched network environment. T/F - ANS: False Which vulnerability can occur if a programmer does not properly validate user imput and allows an attacker to include unintended SQL input that can be passed to a database? - ANS: Command injection The CVSS _____ Score is set by the organization using the software. - ANS: Environmental A _____ (sometimes called a network protocol analyzer) is a network tool that collects copies of packets from the network and analyzes them or stores the packets for later analysis. - ANS: Packet sniffer Requirements for a complex password system include using a _____ value, implementing strong encryption, requiring periodic password changes, and generally implementing a system where guessing a password or its hash is very difficult. - ANS: salt A _____ uses all the techniques and tools available to an attacker in an attempt to compromise or penetrate an organization's defenses. - ANS: Penetration test If Web software can access parts of the underlying operating system's file system through normal URL mappings, a(n) ____ may occur. - ANS: Directory traversal attack SPIKE can fuzz any protocol that utilizes ____. - ANS: TCP/IP Wired networks are just as vulnerable to sniffing as wireless networks. T/F - ANS: True 802.11 wireless networks exist as ____ on nearly all large networks. - ANS: subnets The most realistic type of penetration test is a ____ box test. - ANS: Black A(n) ____ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software. - ANS: Passive Implementing applications that verify the true communication destination during execution help prevent vulnerabilities associated with ____. - ANS: Trusting network name resolution