Q15. In which of the following attacks does an attacker create the IP packets with a forged (spoofed) source IP address with the purpose of concealing the identity of the sender or impersonating another computing system?

Q16. John is a malicious attacker. He illegally accesses the server of We-are-secure Inc. He then places a backdoor in the We-are-secure server and alters its log files. Which of the following steps of malicious hacking includes altering the server log files?

Q17. Which of the following tools can be used as penetration tools in the Information system auditing process?
Each correct answer represents a complete solution. Choose two.

Q18. Which of the following steps can be taken as countermeasures against sniffer attacks?
Each correct answer represents a complete solution. Choose all that apply.

Q19. Which of the following ensures that a party to a dispute cannot deny the authenticity of their signature on a document or the sending of a message that they originated?

Q20. John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-
secure.com. He has successfully completed the following steps of the pre-attack phase:
* Information gathering
* Determining network range
* Identifying active machines
* Finding open ports and applications
* OS fingerprinting
* Fingerprinting services
Now John wants to perform network mapping of the We-are-secure network. Which of the following tools can he use
to accomplish his task?
Each correct answer represents a complete solution. Choose all that apply.

Q21. In which of the following scanning methods do Windows operating systems send only RST packets irrespective of
whether the port is open or closed?

Q22. Who are the primary victims of smurf attacks on the contemporary Internet system?

Q23. Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you
will definitely install the game on your computer. He picks up a Trojan and joins it to chess.exe. The size of chess.exe
was 526,895 bytes originally, and after joining this chess file to the Trojan, the file size increased to 651,823 bytes.
When he gives you this new game, you install the infected chess.exe file on your computer. He now performs various
malicious tasks on your computer remotely. But you suspect that someone has installed a Trojan on your computer
and begin to investigate it. When you enter the netstat command in the command prompt, you get the following results:
C:WINDOWS>netstat -an | find “UDP”
UDP IP_Address:31337 *:*
Now you check the following registry address:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
In the above address, you notice a ‘default’ key in the ‘Name’ field having ” .exe” value in the
corresponding ‘Data’ field. Which of the following Trojans do you think your friend may have installed on your
computer on the basis of the above evidence?

Q24. Which of the following tools are used as a network traffic monitoring tool in the Linux operating system?
Each correct answer represents a complete solution. Choose all that apply.

Q25. Andrew, a bachelor student of Faulkner University, creates a gmail account. He uses ‘Faulkner’ as the password for the gmail account. After a few days, he starts receiving a lot of e-mails stating that his gmail account has been hacked. He also finds that some of his important mails have been deleted by someone.
Which of the following methods has the attacker used to crack Andrew’s password?
Each correct answer represents a complete solution. Choose all that apply.

Q26. Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Adam uses antivirus software, anti-spyware software, and keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Adam finds that his computer is even more noticeably slow. He also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Adam notices that his computer only has about 10 GB of free space available. Since his hard drive is a 200 GB hard drive, Adam thinks this is very odd.
Which of the following is the mostly likely the cause of the problem?

Q27. Which of the following statements about reconnaissance is true?

Q28. Against which of the following does SSH provide protection?
Each correct answer represents a complete solution. Choose two.

Q29. Which of the following types of attacks is the result of vulnerabilities in a program due to poor programming techniques?

Q30. Rick works as a Computer Forensic Investigator for BlueWells Inc. He has been informed that some confidential information is being leaked out by an employee of the company. Rick suspects that someone is sending the information through email. He checks the emails sent by some employees to other networks. Rick finds out that Sam, an employee of the Sales department, is continuously sending text files that contain special symbols, graphics, and signs. Rick suspects that Sam is using the Steganography technique to send data in a disguised form. Which of the following techniques is Sam using?
Each correct answer represents a part of the solution. Choose all that apply.

Q31. Which of the following functions in c/c++ can be the cause of buffer overflow?
Each correct answer represents a complete solution. Choose two.

Q32. Which of the following applications automatically calculates cryptographic hashes of all key system files that are to be monitored for modifications?