Correct answer:
WPA2 uses AES for its encryption algorithm.
Incorrect answers:
Neither RC4 nor RC5 is used in WPA2, and SHA-1 is a hash algorithm.

Correct answer:
Tailgating is correct.
This is another one of those questions that is going to drive you batty on the exam. Just remember, tailgating = a badge.
Incorrect answers:
Piggybacking is following someone in without a badge (a silly but important distinction so far as EC-Council is concerned).
Surfing and reverse SE have nothing to do with this topic.

Correct answer:
A is correct. Mobile Device Management (MDM) won’t mitigate all the risks associated with unending use of mobile devices on your network, but it’s a step in the right direction.
Incorrect answers:
WPA is an encryption algorithm.
MAC filtering is a great idea, but it’s a nightmare to keep up with and it doesn’t address the problems BYOD introduces to the environment.
Whether WAPs are from a single vendor or multiple vendors is irrelevant.

Correct answer:
net share is correct.
The net command is used to view and configure network settings on a Windows machine. Net commands can add or remove users and computers, manage network shares and print jobs, as well as a host of other functions. Entering “net share” without any switches or arguments displays all shares from the machine.
Incorrect answers:
These answers do not match the syntax provided.
The “net use” command connects a computer to or disconnects a computer from a shared resource (it can also show the shared drives the current user has mapped to).
The “net view” command is used to show a list of computers and network devices on the network.
The “net config” command displays the configurable services that are running, or displays and changes settings for a Server service or a Workstation service.

Correct answer:
The SAM file is stored in the same folder on most Windows machines, including Windows 10 boxes: C:\Windows\System32\Config\. You might also find a copy in backups (C:\Windows\Repair\Sam).
Incorrect answers:
These are not SAM file storage locations.

Correct answer:
The Evaluation Assurance Level (EAL) is the rating assigned to a product after testing. EAL levels range from 1 (functionally tested) to 7 (formally verified, designed, and tested).
Incorrect answers:
Protection profile (PP) is the set of requirements for the type of product being tested.
Target of evaluation (TOE) is the product itself.
Security target (ST) is the documentation describing the TOE and any requirements.

Correct answer:
Incident management process is correct.
Regardless of the size of your organization, a well-defined process for handling incidents is a mandatory, key part of any good security plan. After all, the last thing you want during a real incident is for confusion and panic to reign.
Incorrect answers:
Metrics are simply a measurement.
Security policy and procedure may take part in, and be referenced by, your incident management process, but they are not the best answers.

Correct answer:
Ping basically asks a host to return the packet sent. It’s used mainly to identify live hosts and to help in troubleshooting. If the host isn’t available—because it’s turned off or ICMP is being filtered by an external (or internal) device—then it cannot respond (almost like yelling to your kids who can’t hear you due to the loud music in the room). The TTL value tells the ping packet when to “die” and is decremented after passing through a router (hop). If it isn’t high enough to reach the host system, there will be no reply.
Incorrect answers:
Because all these are correct responses, E is the only appropriate choice.

Correct answer:
1 xor 1 = 1 is correct.
A little deductive reasoning—with or without any knowledge of what XOR actually is—can break this down to a 50/50 choice. If the bits do not match, the output is a 1. If the bits do match, the output is a 0.
Incorrect answers:
The remaining answers are all valid XOR operations.

Correct answer:
Fuzzing is correct.
If you want a user to input their name in a form field, that’s great—but what happens if they enter 27 digits? Or a series of characters matching a script or database query? Fuzzing is an automated testing method where tons of randomly generated entries are jammed into the application to see what happens.
Incorrect answers:
These answers are added as distractors.

Correct answer:
nmap -sS 192.168.1.0/24 -T0 is correct.
The -sS option starts the SYN scan, and -T0 puts it in paranoid mode. For study purposes, think of the “T” switches as speed limits: 0 is barely moving, whereas 5 is really cooking.
Incorrect answers:
-sT is a full TCP Connect scan
-sX starts an XMAS scan
-sO starts OS discovery

Correct answer:
Spoofing the IP address sends all of his replies to that fake address, meaning he cannot spoof his IP and still use telnet: the replies would go to the spoofed address instead of the attacker’s own.
Incorrect answers:
Because the scans are getting through, the firewall is not blocking port 23 traffic, which is telnet’s port. Answer D is a distracter.

Correct answer:
Fragmenting is correct.
Fragmenting packets is a great way to evade an IDS, for any purpose. Sometimes referred to as IP fragments, splitting a TCP header across multiple packets can serve to keep you hidden while scanning.
Incorrect answers:
Spoofing, scanning, and anonymizers don’t have anything to do with fragmenting headers.

Correct answer:
Kismet can discover wireless networks that are not sending beacon frames is correct.
Kismet’s primary use is scanning for (and sniffing) wireless networks. Even if the security admin turns beaconing off (so no one can supposedly search for the SSID), Kismet can still find the network for you.
Incorrect answers:
These statements are not true regarding Kismet.

Correct answer:
IaaS is correct.
Amazon’s EC2 provides resizable compute capacity in the cloud via VMs that can be controlled via API, thus fitting the definition of IaaS.
Incorrect answers:
These do not match the Amazon EC2 service description.

Correct answer:
Mobile Device Management (MDM) won’t mitigate all the risks associated with unending use of mobile devices on your network, but it’s a step in the right direction.
Incorrect answers:
WPA is an encryption algorithm.
MAC filtering is a great idea, but it’s a nightmare to keep up with and it doesn’t address the problems BYOD introduces to the environment.
WAPs being from a single vendor or multiple vendors is irrelevant.

Correct answer:
Anomaly based is correct.
Anomaly-based, or behavior-based, systems must be given some time to learn what is considered normal traffic. Then they will alert on anything falling outside the determined norm.
Incorrect answers:
Signature-based systems match traffic patterns to signatures.
The other two answers are irrelevant.

Correct answer:
They are used to encrypt traffic on networks is correct.
SSIDs have a singular purpose, which is to identify a network for a client. They can be up to 32 characters long, and you can turn off the SSID broadcast at the access point. However, SSIDs are included with most packets leaving the access point and are easily discoverable anyway. And they provide no encryption at all—merely identification.
Incorrect answers:
These are all true statements regarding SSIDs.

Correct answer:
It allows traffic from a specific MAC address to enter to a port is correct.
This is exceedingly confusing on purpose—because it’s how you’ll see it on the exam. “Port security” refers to a security feature on switches that allows an administrator to manually assign MAC addresses to a specific port; if the machine connecting to the port does not use that particular MAC, it isn’t allowed to even connect. Port security works on source addresses, so you’re automatically looking at “from,” not “to.” In other words, it is specifically allowing access (entering a port) to a defined MAC address—think of it as a whitelist. In other words, in truth, this type of implementation turns out to be a bit of a pain for the network staff, so most people don’t use it that way. In most cases, port security simply restricts the number of MAC addresses connected to a given port. Say your Windows 7 machine runs six VMs for testing, each with its own MAC. As long as your port security allows for at least seven MACs on the port, you’re in good shape.
Incorrect answers:
Port security works on source addressing, so you can throw out answers It stops traffic sent to a specified MAC address from entering a port and  Answer It stops traffic from a specific MAC from entering a port is incorrect because it’s not stopping a specific MAC from connecting; it’s only allowing a specific one to do so.

Correct answer:
The internal disgruntled employee represents the biggest risk to your organization. And as easy as this is to remember, you’ll definitely get asked about it on the exam.
Incorrect answers:
Script kiddies are novice hackers who rely on tools and luck.
Phishing is an e-mail social engineering attack.
A white-hat attacker would be an ethical hacker as part of an assessment.

Correct answer:
The compmgmt.msc command is used to open the Computer Management console.
Incorrect answers:
The Services MMC is opened by services.msc, and gpedit (.msc) opens the Group Policy Editor. ncpa.cp does not exist.

Correct answer:
Pure insider is correct.
A pure insider is an employee of the organization who already has legitimate credentials. 
Incorrect answers:
Insider affiliates are spouses or friends who illegally use the credentials.
Outside affiliates are outside attackers (hackers).
Inside associates are limited-access employees, such as cleaning staff.

Correct answer:
Bluejacking is correct.
Bluejacking is a Bluetooth attack where the attacker sends unsolicited messages to the target. In many cases, this is done as part of social engineering in an effort to get the user to do something beneficial for the attacker.
Incorrect answers:
Bluesmacking is a DoS attack.
Bluesniffing is an effort to sniff data from Bluetooth exchanges.
Bluescarfing is the actual theft of data from a Bluetooth device.

Correct answer:
Reload the entire system from known-good media is correct.
Sometimes a good old wipe and reload is not only faster than a clean effort, but it’s just flat out better. When it comes to rootkits, it’s really your only option—unless we’re talking a hardware-level rootkit, in which case you’re probably better off throwing the thing away.
Incorrect answers:
Nearly anything you’re doing with the data files themselves isn’t going to help in getting rid of a rootkit.
The device has been rooted, so all data should be treated as suspect.
Tripwire is a great tool, but it—or any other tool—isn’t really useful to you once the machine has been infected.

Correct answer:
Steps have been taken to protect the server against XSS is correct.
From the banner returned, you can see the server version (Server: Microsoft-IIS/7.5), what level of HTTP requests it can answer to (HTTP/1.1 200 OK), and the acceptance and use of cookies (in the Set Cookie: response section). Additionally, you can clearly see the HttpOnly entry in the cookie section, which can be used as a mitigation against XSS (setting it prevents the cookie from being accessed by any client-side scripts).
Incorrect answers:
These statements do not match the output.

Correct answer:
Private is correct.
A private cloud model is operated solely for a single organization (a.k.a. single-tenant environment), is usually not a pay-as-you-go type of operation, and is usually preferred by larger organizations.
Incorrect answers:
A community cloud model is one where the infrastructure is shared by several organizations, usually with the same policy and compliance considerations.
A public cloud model is one where services are provided over a network that is open for public use (like the Internet).
The hybrid cloud model is exactly what it sounds like—a composite of two or more cloud deployment models.

Correct answer:
The result will display Google’s cache version of the website is correct.
The cache operator will display a link to a Google cached version of the website. This is very useful for earlier “mistakes” a web admin may have left on the site but has since removed.
Incorrect answers:
Tools such as BlackWidow are used to clone a copy of the website for your machine.
This operator does not provide a visitors list to a site.
Also, the syntax is correct.

Correct answer:
PCI DSS is correct.
If you knew that PCI stood for “Payment Card Industry” and DSS stood for “Data Security Standard,” this one was a piece of cake. PCI DSS is actually an evaluation standard developed by the Payment Card Industry Security Standards Council (PCI SSC, which includes American Express, Discover, MasterCard, and Visa, by the way) to secure networks and storage environments for credit card consumer data.
Incorrect answers:
The Trusted Computer System Evaluation Criteria (TCSEC) security evaluation standard is also known as the Orange Book and was created by the DoD to define different types of access controls.
The Trusted Network Interpretation Environments Guideline (TNIEG) outlines minimum security protections required in networking environments.
Common Criteria was designed to help remove vulnerabilities in products before they’re released, and it’s an international standard. ITSEC is an encryption standard.

Correct answer:
In Windows Explorer, a drive will appear denoted as BankFiles (\\ECCCOMPUTER) (F:) and The mapped drive will remain mapped after a reboot are correct.
Net use commands were the rage back in the day. This command connects to a shared folder on ECCCOMPUTER. The shared folder is named BankFiles, and the mapping will display as a drive (F:) on the local machine. The “persistent:yes” portion means it will remain mapped forever, until the user turns it off.
Incorrect answers:
These do not reflect the outcome of the command.

Correct answer:
Firewall evasion is correct.
Tunneling through a firewall is a great evasion technique, and the tcp-over-dns tool accomplishes this by tunneling over the Domain Name System (DNS). Port 53 is usually open on firewalls because…well, everything uses and needs DNS. The tcp-over-dns tool takes advantage of that. As an aside, it also requires Java runtime environment 6.0 or later and is supported on Windows, Linux, and Solaris.
Incorrect answers:
These are not uses for the tcp-over-dns tool.

Correct answer:
Implement encryption throughout the environment is correct.
Encryption is the enemy of sniffing (and IDS). After all, if it’s encrypted at point A and decrypted only at point B, any effort to examine the traffic in between is pointless. Of the choices, this is the best available option.
Incorrect answers:
Physical security and static IP addressing won’t do a thing about sniffing.
MAC access control can provide some protection, but not at the level encryption could.

Correct answer:
Chosen-cipher-text attacks is correct.
In a chosen-cipher-text attack, the bad guy chooses a particular cipher-text message and attempts to discern the key through comparative analysis with multiple keys and a plain-text version. Because RSA uses a public key to encrypt and a private key to decrypt, an attacker could use the public key to encrypt tons of things for analysis.
Incorrect answers:
RSA is not particularly susceptible to known-plain-text attacks.
Sequence-timing attacks do not exist.
Rubber hose attacks, in addition to sounding hilarious, are violent social engineering efforts.

Correct answer:
It’s a web server used by employees all day during normal business hours and there’s “nothing” in the log? Despite this, none of the users complained about it being down at all? No, we think this one is going to require some forensics work. Call the IR team.
Incorrect answers:
The log file being corrupted would’ve been throughout.
A crisp two-hour window doesn’t match up with that.
If the system were rebooted, that in and of itself would’ve shown in the log. It defies common sense and probability that absolutely nothing occurred to the web server during normal business hours.

Correct answer:
The FIN flag brings communications to an orderly close.
Incorrect answers:
These TCP flags do not bring communications to an orderly close.

Correct answer:
Integrity is correct.
Integrity is all about ensuring the message is received at the remote destination exactly as it left—with no changes.
Incorrect answers:
Confidentiality involves protecting the message from unauthorized access.
Availability is all about making sure authorized users can get to the message when they need it.
Authentication is included as a distractor.

Correct answer:
Ensure an e-mail is from a trusted, legitimate e-mail address source, Verify the spelling and grammar are correct, and Verify all links before clicking them are correct.
Phishing e-mails can be spotted by who they are from, who they are addressed to, spelling and grammar errors, and unknown or malicious embedded links.
Incorrect answers:
The last line containing a copyright is irrelevant.

Correct answer:
Integrity is all about ensuring the message is received at the remote destination exactly as it left—with no changes.
Incorrect answers:
Confidentiality is protecting the message from unauthorized access.
Availability is all about making sure authorized users can get to the message when they need it.
Authentication is included as a distractor.

Correct answer:
Fuzzing is correct.
Fuzzing is a software testing effort where tons of randomized inputs are hurled at the application to see how it reacts.
Incorrect answers:
These answers do not match the definition provided.

Correct answer:
Shared hardware between virtualized servers is correct.
One of the primary benefits in virtualization is the reduced cost due to shared hardware. A single physical server can host multiple, concurrent VMs.
Incorrect answers:
These answers are not benefits of virtualization.

Correct answer:
The PSH flag is used when the application simply can’t wait for the data and needs it immediately. The sender will be working through a standard exchange and placing packets into the buffer as space frees up. An URG packet gets sent regardless of the buffer status; it simply goes.
Incorrect answers:
An URG flagged packet is treated with importance, almost like holding a reservation tag that lets you go to the front of the line when you arrive at your destination.
ACK is used for acknowledgments, and FIN brings an orderly close to the session.

Correct answer:
Everyone recognizes insider threats as the worst type of threat, and a disgruntled employee on the inside is the single biggest threat for security professionals to plan for and deal with.
Incorrect answers:
Script kiddies usually don’t pose much threat—defenses are aligned against them.
Phishing is a definite threat, but again defenses are in place.
White-hat attackers are hired by the organization, so they’re not an intentional threat.

Correct answer:
CSRF is correct.
The question is describing CSRF.
Incorrect answers:
This description does not match the remaining answers.

Correct answer:
Blooover is correct.
Blooover is designed and created for Bluebugging.
Incorrect answers:
BBProxy and PhoneSnoop are both BlackBerry tools, and btCrawler is a discovery option.

Correct answer:
Infrastructure as a Service (IaaS) basically provides virtualized computing resources over the Internet. 
Incorrect answers:
Software as a Service (SaaS) is simply a software distribution model—the provider offers on-demand applications to subscribers over the Internet.
Platform as a Service (PaaS) is geared toward software development because it provides a development platform that allows subscribers to develop applications without building the infrastructure it would normally take to develop and launch software.
Hybrid is a deployment model (a composite of two or more cloud deployment models).

Correct answer:
The retry interval determines how long a secondary will wait to try again, should a zone transfer not work. In this SOA record, it is set to 600 seconds (10 minutes
Incorrect answers:
Refresh interval defines the amount of time a secondary will wait before checking in to see if it needs a zone update.
Expire determines the maximum amount of time a secondary server will spend trying to “complete” a zone transfer.
TTL is the minimum time to live for all records in the zone.

Correct answer:
False positive is correct.
The IPS saw the traffic, obviously, but made a decision it was bad traffic based on previous noted behavior, when it was, indeed, normal traffic (just at an abnormal time). The traffic was flagged as malicious even though it wasn’t, which is the definition of a false positive.
Incorrect answers:
A false negative occurs when the IPS sees traffic as good when it is actually malicious. The other two answers are distractors.

Correct answer:
When the primary SOA serial number is higher is correct.
Secondary servers check in with the primary based on the refresh interval. The primary increments the serial number every time the SOA changes. If the secondary checks in and the primary’s copy has a higher serial number, then it knows the SOA has changed and it needs a new copy.
Incorrect answers:
The secondary does not request a new copy if the serial number is lower or when the server is rebooted.
The TTL reaching zero has nothing to do with requesting a zone transfer.

Correct answer:
Of the answers provided, only scanning the IP range doesn’t fit the passive role as defined by EC-Council.
Incorrect answers:
These remaining answers are all passive in nature.

Correct answer:
Banner grabbing is correct.
Banner grabbing simply involves touching a box over a port and seeing what message—what banner—comes in response. There are innumerable ways to do this, and you need to be very familiar with each and every one of them. In this example, the pen tester might have used a netcat command such as nc -vv -n 192.168.17.8 80 (where -vv is verbose mode, -n indicates no name resolution, and 80 indicates a connection to port 80).
Incorrect answers:
These answers will not provide the results shown and are not banner-grabbing techniques.

Correct answer:
Split DNS is correct.
Split DNS is recommended virtually everywhere. Internal hosts may need to see everything internal, but external hosts do not. Keep internal DNS records split away from external, as there is no need for anyone outside your organization to see them.
Incorrect answers:
The remaining answers are all distractors.

Correct answer:
The process “someproc” will stop when the user logs out and The process “someproc” will run as a background task are correct.
The ampersand (&) after the command dictates that the process should run in the background. Without anything indicating a persistent process (that is, adding “nohup” before the process name), it will die when the user logs out.
Incorrect answers:
These do not reflect the outcome of the command.

Correct answer:
Of the answers provided, only scanning the IP range fits the passive role as defined by EC-Council.
Incorrect answers:
The remaining answers are all passive in nature.

Correct answer:
nslookup -norecursive one.anywhere.com is correct.
If you can make a nonrecursive query to a DNS server looking for an _already resolved_ hostname, the box is susceptible to DNS cache snooping. To see if you can do this, you may try to find the IP address of a hostname by querying the DNS server nonrecursively (that is, not asking further DNS servers for an answer if the DNS server in question does not know it).
Incorrect answers:
The syntax is incorrect in each of these uses of nslookup.

Correct answer:
Tailgating is correct.
In tailgating, the attacker holds a fake entry badge of some sort and follows an authorized user inside.
Incorrect answers:
Piggybacking is much the same as tailgating—the attacker is following someone inside—but in this case the attacker does not have a fake badge.
Phishing is an e-mail attack.
Shoulder surfing occurs inside the building and involves looking over someone’s shoulder as he types.

Correct Answer:
The packet capture will provide the MAC addresses of other machines connected to the switch, The packet capture will display all unicast messages intended for the laptop, and The packet capture will display all broadcast messages are correct.
Switches are designed to filter traffic—that is, they send traffic intended for a destination MAC only to the port that holds the MAC address as an attached host. The exception, however, is broadcast and multicast traffic, which gets sent out every port. Because ARP is broadcast in nature, all machines’ ARP messages would be viewable.
Incorrect Answers:
The packet capture will only provide the MAC addresses of the laptop and the default gateway and E are incorrect.
The switch will filter traffic to the laptop, and MAC addresses will be available from the broadcast ARPs.

Correct answer:
Injecting parameters into a connection string using semicolons as separators is correct. Highlighted at a Black Hat conference in 2010, CSPP can be used to steal user identities and hijack web credentials. CSPP is a high-risk attack because of the relative ease with which it can be carried out and the potential results it can have. 
Incorrect answers:
All other answers are incorrect. These choices do not accurately reflect the method(s) used in this attack.

Correct answer:
False negative is correct. In this case, the IDS reacted in a negative fashion (that is, it did not send any alerts) when in fact it should have alerted. This could be due to a variety of reasons—poor configuration, anomaly-based IDS without the appropriate baseline time to learn proper traffic patterns, and so on. 
Incorrect answers:
A false positive occurs when the IDS alerts on traffic as malicious when, in truth, it is allowable and expected.
The other choices are included as distractors.

Correct answer:
host -t a somewhere.com is correct. The host command is one of several DNS lookup utilities in Linux (for example, dig will work as well). It is a simple utility for performing DNS lookups and is normally used to convert names to IP addresses, and vice versa. When no arguments or options are given, the host command displays a short summary of its command-line arguments and options. The -t switch sets the type, followed by which type (in this case, the -a option). 
Incorrect answers:
The -ns and -soa switches are for name servers and Start of Authority records, respectively.
The remaining command is incorrect syntax.

Correct Answer:
Change the password of the underlying desktop Ubuntu installation is correct.
Let’s walk through the commands: First up, sudo runs everything afterward as a superuser (assuming, of course, you are allowed, as specified in the sudoers file). mkdir makes a directory. The mount command mounts a specified resource. The chroot command changes the root file system from the Live CD to the desktop. Lastly, the passwd command lets you change the current user’s password.
Incorrect Answers:
Change the password of the Live CD install for the session, Create a password-protected share, and Install a rootkit are incorrect.
These answers do not match the output of the command-line entries.

Correct answer:
secpol.msc is correct. Stand-alone computers are not part of Active Directory, and Group Policies do not apply to them, so editing the Local Security Policy is the only option. Microsoft Management Console can be opened via the mmc command, and the Local Security Policy snap-in can be added, or you can just use secpol.msc. 
Incorrect answers:
gpedit.msc is used to open the Group Policy Editor
compmgmt.msc is used to open Computer Management
locsec.msc is not a valid command.

Correct answer:
Zigbee is correct. Zigbee is a very popular IoT connection protocol. It’s a short range wireless communication protocol based on the IEEE 203.15.4 standard for devices that transfer data infrequently at a low data rate in a restricted area and within a range of 10–100 meters. 
Incorrect answers:
Z-Wave is a low-power, short-range communication method designed primarily for home automation.
Thread is an IPv6-based protocol for IoT devices.
RFID stores data in tags that are then read using electromagnetic fields.

Correct answer:
Cloud carrier is correct. The cloud carrier is the organization that has the responsibility of transferring the data, akin to the power distributor for the electric grid. 
Incorrect answers:
The cloud consumer is the individual or organization that acquires and uses cloud products and services.
The cloud auditor is the independent assessor of cloud service and security controls.
The cloud broker acts to manage the use, performance, and delivery of cloud services as well as the relationships between providers and subscribers.

Correct answer
PSH is correct. It really does sound like an urgent request, but the PSH flag is designed for these scenarios. 
Incorrect answers:
The URG flag is used to inform the receiving stack that certain data within a segment is urgent and should be prioritized (this flag is not used much by modern protocols).
The RST flag forces a termination of communications (in both directions).
BUF is not a TCP flag.

Correct answer:
It is created by the client after the server’s identity is verified is correct. An SSL session always begins with an exchange of messages called the “SSL handshake,” which allows the server to authenticate itself to the client using public-key techniques. Next, the client and the server cooperate in the creation of symmetric keys used for encryption. 
Incorrect answers:
All other answers are incorrect. SSL keys are created after the server’s identity has been verified, not immediately upon client connection. The server’s public key is used in the verification process.

Correct Answer:
The system is checking for IPSec on remote machines is correct.
Port 500 is used by Internet Key Exchange (IKE), which is typically used in IPSec-based VPN software. IKE is used to set up the session keys.
Incorrect Answers:
The NIC is jabbering, The system is infected with malware, and The system is checking for SSL vulnerabilities are incorrect.
A jabbering NIC sends just that—jabber.
While it’s possible the system is infected with malware, because of the fixation on port 500, it’s more likely scanning for IPSec.
SSL vulnerabilities have nothing to do with this.

Correct answer:
Archive.org is correct. The good-old Wayback Machine (a.k.a. The Internet Archive, http://archive.org) has been used for a long time to pull up old copies of websites, for good and maybe not-so-good purposes. Archive.org includes “snapshots of the World Wide Web,” which are archived copies of pages taken at various points in time dating back to 1996. In the real world, this is only useful for relatively well-known sites, and even that can be hit or miss. For your exam, though, the Wayback Machine is definitely the cat’s meow. 
Incorrect answers:
Search.com is simply another search engine at your disposal. It does not hold archived copies.
Google cache holds a copy of the site only from the latest “crawl”—usually nothing older than a few days.
Pasthash.com doesn’t exist and is included as a distractor.

Correct answers:
Brutus and THC-Hydra are correct. Brutus is a fast, flexible remote password cracker. It was originally invented to help its creator check routers and network devices for default and common passwords, but has since grown and evolved into much more, and it’s among the more popular security tools available for remote password cracking. THC-Hydra is another remote password cracker. It’s a “parallelized login cracker” that provides the ability to attack over multiple protocols. 
Incorrect answers:
Nikto is not a remote password cracker. It’s an open source web-server-centric vulnerability scanner that performs comprehensive tests against web servers for multiple items.
BlackWidow is a web cloning tool, allowing you to copy an entire website for later review.

Correct answer:
Cloud subscriber is correct. The five roles defined by NIST SP 500-292 are cloud carrier, cloud consumer, cloud provider, cloud broker, and cloud auditor. Cloud subscriber sounds good, but it is not recognized within NIST SP 500-292. 
Incorrect answers:
All other answers are incorrect. These are all roles within cloud architecture.

Correct answer:
Smurf is correct. A smurf attack is a generic denial-of-service (DoS) attack against a target machine. The idea is simple: have so many ICMP requests going to the target that all its resources are taken up. To accomplish this, the attacker spoofs the target’s IP address and then sends thousands of ping requests from that spoofed IP to the subnet’s broadcast address. This, in effect, pings every machine on the subnet. Assuming they’re configured to do so, each and every one of the machines will respond to the request, effectively crushing the target’s network resources. 
Incorrect answers:
An ICMP flood occurs when the hacker sends ICMP ECHO packets to the target with a spoofed (fake) source address. The target continues to respond to an address that doesn’t exist and eventually reaches a limit of packets per second sent.
A ping of death fragments an ICMP message to send to a target. When the fragments are reassembled, the resulting ICMP packet is larger than the maximum size and crashes the system.
A SYN flood takes place when an attacker sends multiple SYN packets to a target without providing an acknowledgement to the returned SYN/ACK. This is an attack that does not necessarily work on modern systems.
A Fraggle attack uses UDP packets.

Correct answer:
Allow all privileges to the user, read-only to the group, and read-only for all others is correct. File permissions in Linux are assigned via the use of the binary equivalent for each rwx group: read-only is equivalent to 4, write is 2, and execute is 1. To accumulate permissions, you add the numbers: 4 is read-only, 6 is read and write, and adding execute to the bunch means a 7. In use, the first number corresponds to the user, the second to the group, and third is to all others. 
Incorrect answers:
All other answers are incorrect. The remaining answers do not match the 744 portion of the command.

Correct Answer:
65.93.255.255 is correct.
If you view the address 65.93.24.42 in binary, it looks like this: 01000001.01011101.00011000.00101010. The subnet mask given (/20) tells us only the first 24 bits count as the network ID (which cannot change if we are to stay in the same subnet), and the remaining 12 bits belong to the host. Turning off all the host bits (after the 20th) gives us our network ID: 01000001.01011101.00010000.00000000 (52.93.16.0/20). Turning on all the host bits gives us our broadcast address: 01000001.01011101.00011111.11111111 (65.93.31.255/20).
Incorrect Answers:
65.93.24.255, 65.93.0.255, 65.93.32.255, and 65.93.255.255 are incorrect.
These answers do not match the broadcast address for this subnet.

Correct answer:
Verification is correct. The Security Development Lifecycle (SDL) phases include Training, Requirements, Design, Implementation, Verification, Release, and Response, and each phase holds specific actions. For example, in the Training phase, core security training for developers is performed. In the Requirements phase, the level of security desired is set. In the Verification phase, dynamic analysis, fuzz testing, and attack surface reviews are performed. 
Incorrect answers:
The Implementation phase includes using approved tools and static analysis and turning off unsafe functions.
Design includes requirements, attack surface analysis, and threat modeling.
Release includes an incident response plan, final security review, and certification.

Correct Answer:
N-tier allows each tier to be configured and modified independently is correct.
While usually implemented in three tiers, n-tier simply means you have three or more independently monitored, managed, and maintained collections of servers, each providing a specific service or task.
Incorrect Answers:
Each tier must communicate openly with every other tier, N-tier always consists of presentation, logic, and data tiers, and N-tier is usually implemented on one server are incorrect.
These statements are not necessarily true regarding n-tier.

Correct answer:
DNS poisoning is correct. The externally facing DNS server is providing bad resolution to the public, while the internal name server is providing the correct address. 
Incorrect answers:
All other answers are incorrect. None of the remaining choices explains the symptoms.

Correct answer:
Insecure web interface is correct. Per OWASP, an insecure web interface can be present when an issue such as account enumeration, lack of account lockout, or weak credentials is present. Insecure web interfaces are prevalent as the intent is to have these interfaces exposed only on internal networks; however, threats from internal users can be just as significant as threats from external users. Issues with the web interface are easy to discover when examining the interface manually, along with automated testing tools to identify other issues such as cross-site scripting. 
Incorrect answers:
Insufficient authentication/authorization, insecure network services, and an insecure cloud interface are ranked second, third, and sixth, respectively.

Correct answer:
The session is hijacked after authentication is correct. Session hijacking involves predicting an acceptable sequence number during an exchange of information and taking over the communications channel. By its very nature, authentication must already be completed in order for it to work. 
Incorrect answers:
All other answers are incorrect.
Hijacking occurs after authentication, so the measure used is largely irrelevant.
Session hijacking can be carried out against all operating systems.

Correct Answer:
Full disk encryption is correct.
FDE is the appropriate control for data-at-rest protection. Pre-boot authentication provides protection against loss or theft.
Incorrect Answers:
Cloud computing, SSL/TLS, and AES are incorrect.
These answers do not protect against system folders, files, and MBR until valid credentials are provided at pre-boot.

Correct answer:
Rolling code is correct. The code used by your key fob to unlock (and in some cases) start your car is called a rolling (or hopping) code. An attacker can sniff for the first part of the code, jam the key fob, and sniff/copy the second part on subsequent attempts, allowing him to steal the code…and your car. 
Incorrect answers:
A BlueBorne attack is basically an amalgamation of techniques and attacks against known, already existing Bluetooth vulnerabilities.
KeyFobbing and Auto Scrolling don’t exist.

Correct answer:
Remove the software from the environment is correct. Removing the software, service, and so on, that contains a vulnerability is described as avoiding the risk—if it’s not there to be exploited, there’s no risk. 
Incorrect answers:
Installing patches (or a new version) is an attempt to mitigate risk.
Installing different software without vulnerabilities is called transferring risk (however, I don’t care what the software publisher says, the community will determine if there are vulnerabilities).
Leaving the software in place is an example of accepting the risk: maybe security controls are in place to where the chance of it being exploited is so small you’re willing to just accept the vulnerabilities that exist.