Mile2 Mile2 Certifications MK0-201 Questions & Answers

• Question 61:

  When doing an ACK flag scanning the target host is sent TCP packets with the ACK flag set and the reply is then analyzed.

  Which of the following items within the response packets would be used to determine if the port was open on the remote host?(Choose two)

  A. The Time To Live field

  B. The source port

  C. The destination port

  D. The Window field

  Correct Answer: AD

• Question 62:

  An administrator has just completed the installation of Nessus on a Linux System that will only have physical space for the server and no monitor.The administrator was told that Nessus has to be run when performing assessments from the system front end you installed Nessus on.

  A. True

  B. False

  Correct Answer: B

• Question 63:

  Bob is working as an Instrusion Detection System administrator for a company called CCCure.

  Being a keen analyst he has noted a very large amount of SYN packet being sent to some of his external IP addresses.

  At first it looked like normal daily traffic but somehow it seems that after his internet facing hosts sends a SYN/ACK reply back to the connection request,the final ACK packet is never received from the remote host.

  What type of scan does this pattern indicate?

  A. A FIN Scan

  B. A Vanilla port scan

  C. A Half-Open Scan

  D. A NULL scan

  Correct Answer: C

• Question 64:

  Assuming SNMP Agent devices are IPSec-capable,why would implementing IPSec help protect SNMP Agents?Choose three.

  A. SNMP is installed by default on Windows computers

  B. SNMP v.2 sends the community name in cleartext

  C. SNMP v.2 does not encrypt any data

  D. IPSec would protect against an attacker spoofing the IP address of the SNMP Management station

  Correct Answer: BCD

• Question 65:

  Which tools and or techniques can be used to remove an Alternative Data Stream on an NTFS file? Choose two.

  A. Ads_cat

  B. ADSChecker

  C. ADS_Del

  D. Copy the NTFS file containing the stream to a FAT partition,delete the original TFS file,copy the FAT file back to NTFS

  Correct Answer: D

• Question 66:

  Which of the following might be used to give false positives when a UDP scan is being performed against a DMZ server running DNS?Choose the best answer.

  A. On the firewall,block ICMP TTL Exceeded

  B. On the firewall,block all incoming UDP

  C. On the firewall,block all TCP SYN packets

  D. On the firewall,block all ICMP Port Unreachable messages

  Correct Answer: D

• Question 67:

  Which of the following best describes a Script Kiddie?

  A. A programmer who is less than 18 years old but already creating exploits that take advantage of vulnerabilities in software

  B. A programmer who reverses engineer application in order to find weaknesses

  C. A person who uses already written software or tools in order to compromise systems

  D. A person who mastered scripting language since a very early age

  Correct Answer: C

• Question 68:

  It is common knowledge that a Penetration Test relies on a testers ability to collect information from

  different sources.

  Only about 35% to 40% of the information collected will be from technical sources.

  Which of the following would NOT be one of the common ways for a security tester to collect information?

  A. Physical Access

  B. Authorized Access

  C. Social Access

  D. Digital Access

  Correct Answer: B

• Question 69:

  One of your clients has been the victim of a brute force attack against their SSH server.

  They ask you what could be done to protect their Linux servers.You propose the use of IP Tables (the built in kernel firewall) to limit connection attempts to protect their servers.You agree with your client to limit connections to the SSH port to a maximum of only three trials per minutes consideirng there is only one administrator who has a valid need to connect remotely onto this port.

  If the threshold of three connectors is exceeded,the attacker will have to wait for another 60 seconds before it will resume allowing connections again.

  Which of the following IP Tables entry would meet your clients needs?

  A. iptables-A INPUT -p tcp -dport 23 -m state -state NEW -m recent -update -second 60 -hitcount4 -rttl name SSH -j DROP

  B. iptables-A INPUT -p tcp -dport 22 -m state -state NEW -m recent -update -second 60 -hit count3 -rttl name SSH -j DROP

  C. iptables-A INPUT -p tcp -dport 22 -m state -state NEW -m recent -update -second 60 -hitcount4 -rttl name SSH -j DROP

  D. iptables-A OUTPUT -p tcp -dport 23 -m state -state NEW -m recent -update -second 60 -hitcount4 -rttl name SdSH -j DROP

  Correct Answer: C

• Question 70:

  In symmetric cryptosystem,how many keys are needed to communicate securely between 10 different people who all wish to have a key pair to talk to each other?

  A. 2

  B. 1

  C. 45

  D. 90

  Correct Answer: C