Page 819 - StudyBook.pdf

Self Test Appendix • Appendix 803

14. Management was rather upset to find out that someone has been hosting a music file transfer
site on one of your servers. Internal employees have been ruled out as it appears it was an out-
sider.What most likely went wrong?
A. Anonymous access
B. No Web access control
C. No SSL
D. No bandwidth controls
A.Anonymous access allows visitors to send and receive files from the FTP server without
having to use an assigned username and password. One of the first application-hardening activi-
ties a security professional does, is disable anonymous access or disable FTP completely if it is
not needed.
Answer B, C, and D are incorrect because using authentication on the company’s Web site
would not have alleviated the problem.Also, the use of SSL again would have no effect on FTP.
Finally, while bandwidth control may have slowed the damage, it would not have prevented it.

15. Someone played a bad joke on your company.Visitors accessing the Web site were redirected to
your competitors Uniform Resource Locator (URL). Can you describe what the attackers did?
A. Cross-site scripting
B. DNS cache poisoning
C. DoS attack
D. ARP cache poisoning
B. Cache poisoning is an attack in which the attacker sends the DNS server bogus DNS
responses.As the changes accumulate and are replicated to other DNS servers, the effect is that
the user is redirected to a bogus site.This type of activity can be used to make a site appear to
have been defaced or changed, or can be used to redirect the user to a similar looking sight so
that some type of online scam can be attempted.
Answer A is incorrect because cross-site scripting usually occurs by attempting to get a user to
click on a link on a Web site or embedding it in an e-mail.Answer C in incorrect because a
DoS attack would make the site unreachable.Answer D is incorrect because ARP cache poi-
soning is typically done to attempt man-in-the-middle (MITM) attacks.

Chapter 9: Basics of Cryptography

1. You have selected to use 3DES as the encryption algorithm for your company’s Virtual Private
Network (VPN).Which of the following statements about 3DES are true?
A. 3DES requires significantly more calculation than most other algorithms.
B. 3DES is vulnerable to brute-force attacks.
C. 3DES is an example of a symmetric algorithm.
D. 3DES can be broken in only a few days using state-of-the-art techniques.

www.syngress.com