Select Two (Multi-Select) Questions

Hydra

Why wrong: Hydra is a robust online password cracking tool designed to perform rapid brute-force and dictionary attacks against various network services and authentication protocols. Unlike offline crackers, Hydra directly attempts credentials against live services like SSH, FTP, HTTP, and SMB, making it suitable for testing the strength of network service authentication. It does not process pre-obtained password hashes but rather interacts with the target service in real-time to guess login credentials.

Nmap

Why wrong: Nmap, or Network Mapper, is fundamentally a network discovery and security auditing tool, not a password cracker. Its primary functions involve host discovery, port scanning, service version detection, and operating system fingerprinting across networks. While it can identify potential vulnerabilities in services, Nmap does not possess any built-in capabilities for cracking password hashes or performing credential brute-force attacks against discovered services.

Wireshark

Why wrong: Wireshark is a powerful network protocol analyzer used for capturing and interactively examining network traffic in real-time or from saved packet capture files. Its core functionality involves deep inspection of individual packets to understand network communication, diagnose issues, and analyze protocol behavior. Although it can reveal plaintext credentials if they traverse the network unencrypted, Wireshark itself is a passive monitoring tool and does not actively crack passwords or hashes.

Disable SNMP on all devices

Why wrong: Incorrect: Disabling SNMP is often impractical as many networks rely on SNMP for monitoring; the question expects realistic countermeasures that balance security and functionality.

Enable SNMPv3 with default passwords

Why wrong: Incorrect: Enabling SNMPv3 with default passwords is not effective; default passwords are easily guessed or known, providing no real security despite the protocol's encryption capabilities.

Use SNMPv1 with community string 'private'

Why wrong: Incorrect: Using SNMPv1 with the community string 'private' is a default configuration that attackers know; it offers no security and actually facilitates enumeration.

Exploiting SUID binaries to gain root

Why wrong: Exploiting SUID (Set User ID) binaries to gain root privileges is a technique primarily used for privilege escalation, not for covering tracks. SUID binaries allow a user to execute a program with the permissions of the file owner, typically root, enabling an attacker to gain higher access levels on a Unix-like system. While crucial for an attacker to achieve full control, this action itself does not conceal past activities or remove evidence of the attacker's presence; it merely elevates their current operational capabilities.

Disabling Windows Defender via Group Policy

Why wrong: Disabling Windows Defender via Group Policy is primarily a defense evasion technique rather than a method for covering tracks after compromise. This action prevents the security software from detecting ongoing or future malicious activity, allowing an attacker to operate with less risk of immediate detection. While it facilitates an attack, it does not retroactively remove evidence of past actions, delete logs, or conceal existing malicious artifacts, which are the core objectives of covering tracks.

SYN flood

Why wrong: SYN flood is a protocol attack at the transport layer.

Smurf attack

Why wrong: Smurf is a network-layer amplification attack.

UDP flood

Why wrong: UDP flood is a volumetric attack at the transport layer.

Use of return-oriented programming (ROP)

Why wrong: Return-oriented programming (ROP) is an advanced exploitation technique used *after* a buffer overflow has successfully corrupted the stack, typically to bypass Data Execution Prevention (DEP). ROP involves chaining together small snippets of existing code (gadgets) within the program's memory to achieve arbitrary code execution. Therefore, ROP itself is a *consequence* or *method of exploitation*, not an initial indicator that a buffer overflow *is occurring*.

High CPU usage

Why wrong: High CPU usage indicates that a process is consuming significant processing power, which can be caused by numerous factors such as inefficient algorithms, infinite loops, heavy computational tasks, or even other types of malware. While a program might enter an infinite loop or perform excessive computations *after* a buffer overflow has been exploited, high CPU usage is not a direct or specific indicator of the buffer overflow event itself, which primarily involves memory corruption.

Ping sweep

Why wrong: A ping sweep is an active reconnaissance technique because it involves sending Internet Control Message Protocol (ICMP) echo requests to a range of IP addresses. This direct interaction with target systems elicits responses, such as ICMP echo replies, which can be detected by intrusion detection systems (IDS) or logged by the target network. The act of sending these probes directly to the target makes it an observable and potentially traceable action.

Banner grabbing with Telnet

Why wrong: Banner grabbing using Telnet is an active reconnaissance method as it requires establishing a direct connection to a target system's open port, such as port 23 for Telnet or port 80 for HTTP. By initiating a session and sending specific commands or connection requests, the attacker directly interacts with the service to elicit identifying information like software versions. This direct communication leaves a footprint on the target server's logs, making it detectable.

Port scanning

Why wrong: Port scanning is an inherently active reconnaissance technique because it involves sending various types of network packets, such as SYN or ACK flags, to a target host's ports to determine which services are listening. This direct probing of a target's network interfaces generates traffic that can be easily detected by firewalls, intrusion detection systems, and network monitoring tools. The goal is to map the attack surface by identifying open ports, which necessitates direct interaction with the target system.

Memory analysis

Why wrong: Memory analysis is a specialized forensic technique that involves examining the contents of a computer's volatile memory (RAM) at a specific point in time. While incredibly valuable for uncovering hidden processes, injected code, rootkits, or data exfiltration attempts, it is typically performed after an incident or during dynamic analysis to capture runtime artifacts. It serves as a powerful tool within incident response and advanced analysis, rather than a primary, overarching category of malware analysis methodology itself, which are broadly defined as static or dynamic.

Signature analysis

Why wrong: Signature analysis is a detection method where known patterns, hashes, or unique byte sequences of previously identified malware are matched against suspicious files. This technique is highly effective for detecting known threats quickly and is a core component of many antivirus solutions, often employed during static scanning. However, it is a specific detection mechanism rather than a comprehensive analysis methodology used to deeply understand novel malware's full functionality and intent, which requires more in-depth static or dynamic approaches.

Heuristic analysis

Why wrong: Heuristic analysis is a proactive detection technique that identifies potential malware by recognizing suspicious characteristics or behaviors, even if a specific signature is unknown. This method relies on rules, algorithms, or machine learning models to evaluate attributes like unusual file permissions, suspicious API call sequences, or abnormal process activity. While effective for detecting zero-day threats and polymorphic malware, it is fundamentally a detection strategy employed by security products, not a primary methodology for comprehensive, in-depth malware reverse engineering or behavioral understanding.

Biometric door lock

Why wrong: A biometric door lock primarily functions as an authentication mechanism, verifying an individual's identity before granting access. However, it does not inherently prevent 'tailgating' or 'piggybacking,' where an unauthorized person follows closely behind an authorized individual who has just successfully authenticated. The lock opens for the authenticated user, but it lacks a physical barrier to restrict subsequent, unverified entries.

CCTV cameras

Why wrong: CCTV cameras are a crucial component of a comprehensive security system, primarily serving as a deterrent and a detective control. They provide visual surveillance and record events, which can be invaluable for monitoring, real-time alerts to security personnel, and post-incident forensic analysis. However, CCTV cameras do not physically impede or prevent unauthorized individuals from tailgating an authorized person through an access point.

Security guard

Why wrong: A security guard represents a human-based administrative or personnel control rather than a physical security device or mechanism. While guards are highly effective for observation, intervention, and enforcing access policies, their presence relies on human vigilance and judgment. They do not provide the automated, mechanical, and consistent physical restriction against tailgating that purpose-built devices offer.

ARP poisoning

Why wrong: ARP poisoning is a man-in-the-middle attack.

DNS cache poisoning

Why wrong: DNS cache poisoning is an attack to redirect traffic.

ICMP flooding

Why wrong: ICMP flooding is a denial-of-service attack, not enumeration.

Slowloris

Why wrong: Slowloris is an application-layer (Layer 7) denial-of-service attack designed to exhaust a web server's connection pool. It operates by opening numerous partial HTTP connections to the target server and then slowly sending subsequent HTTP headers. This keeps the connections open indefinitely, preventing other legitimate users from connecting, but it does not involve amplifying traffic volume; instead, it consumes server resources through prolonged, incomplete requests.

SYN flood

Why wrong: A SYN flood is a classic Layer 4 (TCP) denial-of-service attack that exploits the three-way handshake. The attacker sends a high volume of SYN requests to the target server, often with spoofed source IP addresses. The server responds with SYN-ACK packets and allocates resources for these half-open connections, awaiting the final ACK. Since the ACK never arrives from the spoofed source, the server's connection table becomes exhausted, preventing legitimate connections, but without amplifying data volume.

Ping of Death

Why wrong: The Ping of Death is an older, specific type of denial-of-service attack that exploits vulnerabilities in a system's IP fragmentation and reassembly process. It involves sending an ICMP echo request (ping) packet that is intentionally malformed to exceed the maximum allowed IP packet size (65,535 bytes) when reassembled. This oversized packet could cause buffer overflows, crashes, or system instability on vulnerable targets, but it does not amplify the volume of traffic.

Enabling DHCP snooping

Why wrong: Enabling DHCP snooping primarily secures the DHCP infrastructure by preventing rogue DHCP servers and ensuring clients receive IP addresses from legitimate sources. While it builds a crucial binding table of MAC-IP-port-VLAN mappings, it does not directly validate or prevent malicious ARP requests or replies itself. Its role is foundational for Dynamic ARP Inspection (DAI), but not a direct ARP poisoning prevention technique on its own.

Disabling STP on all ports

Why wrong: Disabling Spanning Tree Protocol (STP) on all ports is entirely ineffective against ARP poisoning and is, in fact, detrimental to network stability. STP's purpose is to prevent network loops by blocking redundant paths, not to validate ARP packets or secure MAC-IP bindings. Removing STP would introduce the risk of broadcast storms and MAC address table instability, which could exacerbate network issues rather than prevent ARP-related attacks.

Running a vulnerability scanner

Why wrong: Running a vulnerability scanner is an active reconnaissance technique used to identify weaknesses in a target system before or during an attack, not after to cover tracks. This process generates significant network traffic, system logs, and potentially triggers intrusion detection systems, making the attacker's presence highly visible and easily detectable. Far from concealing activity, it actively broadcasts an attacker's probing actions, directly contradicting the goal of stealth.

Enabling firewall rules

Why wrong: Enabling firewall rules is generally counterproductive for an attacker attempting to maintain access or cover their presence on a compromised system. Attackers typically aim to weaken or disable firewalls to facilitate command-and-control communication, data exfiltration, or lateral movement. Actively enabling new rules could inadvertently block their established backdoors or communication channels, and any modification to firewall configurations leaves clear, auditable evidence that security teams can easily discover during an investigation.

Creating new user accounts

Why wrong: Creating new user accounts, while a common method for establishing persistence on a compromised system, is not a technique for covering tracks; rather, it generates significant forensic evidence. Every new user account creation, especially one with elevated privileges, is meticulously logged by the operating system (e.g., Windows Security Event ID 4720). These distinct log entries provide clear indicators of compromise that are easily discoverable during a security audit or incident response investigation, directly undermining the objective of stealth.

Captured network packets

Why wrong: Captured network packets cannot be obtained directly through SNMP. SNMP is a protocol designed for managing and monitoring network devices by collecting specific management information from MIBs, not for intercepting or storing the actual data plane traffic. Tools like Wireshark or tcpdump are used for packet capture, operating at a lower level of the network stack.

User account passwords

Why wrong: User account passwords are not stored in SNMP Management Information Bases (MIBs) and therefore cannot be obtained via SNMP queries. Storing sensitive credentials like passwords in MIBs would represent a severe security vulnerability, as SNMP community strings, especially in versions 1 and 2c, are often transmitted in cleartext. MIBs are designed to store operational and configuration data, not authentication secrets.

Modify network interface settings

Why wrong: While SNMP can be used to modify network interface settings if write access is configured (e.g., via a specific write community string in SNMPv1/v2c or authenticated write operations in SNMPv3), the question specifically asks what *information can be obtained*. Modifying settings is an *action* or *configuration task*, not the *retrieval of information*. Therefore, this option describes an operational capability rather than an informational retrieval.

Penetration testing

Why wrong: Penetration testing is a simulated cyberattack against a computer system, network, or web application to check for exploitable vulnerabilities. While it involves security assessment, its primary goal is to identify weaknesses in an organization's defenses, not to dissect and understand the internal workings or behavior of a specific piece of malicious software. Therefore, it is distinct from the methodologies used for malware analysis.

Network analysis

Why wrong: Network analysis, in the context of malware, specifically focuses on monitoring and dissecting the network traffic generated by malicious software during its execution. While critical for identifying command-and-control servers, data exfiltration, or propagation attempts, it is inherently a component or technique employed within dynamic analysis, which observes the malware's behavior in a live environment. It is not considered a standalone primary category of malware analysis.

Code review

Why wrong: Code review, when applied to malware, involves a meticulous examination of the malware's disassembled or decompiled source code to understand its logic, algorithms, and potential vulnerabilities. This process is a fundamental technique within static analysis, where the code is scrutinized without execution to identify functions, data structures, and malicious intent. It is a specific method within static analysis, rather than a distinct primary type of malware analysis itself.

snmpwalk -v2c -c public target

Why wrong: snmpwalk is for SNMP, not SMB.

nmap -sU -p 445 target

Why wrong: UDP scan on port 445 is not typical; SMB uses TCP 445. The command does not enumerate shares.

nbtstat -A target

Why wrong: nbtstat enumerates NetBIOS names, not SMB shares directly.

Tries every possible combination of characters

Why wrong: This describes a pure brute-force attack, which attempts every single character combination within a defined character set and length. While theoretically guaranteed to find any password, the computational resources and time required for modern password lengths (e.g., 8+ characters with mixed complexity) make this approach practically infeasible. It would take an astronomically long time, rendering it unsuitable for typical penetration test timelines.

Relies on precomputed hash chains

Why wrong: This technique, commonly associated with rainbow tables, involves using large precomputed tables of hashes and their corresponding plaintext values. While historically effective against unsalted hashes, modern secure password storage practices almost universally employ salting. Salting adds a unique random value to each password before hashing, rendering precomputed hash chains ineffective as each hash becomes unique, preventing lookup in generic tables.

Use WEP instead of WPA2

Why wrong: Using WEP (Wired Equivalent Privacy) instead of WPA2 is a severe downgrade in security, not a defense. WEP suffers from fundamental cryptographic flaws, including a small 24-bit Initialization Vector (IV) that is often reused, making it highly susceptible to statistical attacks like the FMS attack. An attacker can typically crack a WEP key within minutes by capturing sufficient network traffic, rendering it completely ineffective against modern threats.

Enable WPA2-Mixed mode

Why wrong: Enabling WPA2-Mixed mode, also known as WPA2/WPA-Mixed or WPA2/WPA-Personal, allows older WPA (TKIP) clients to connect alongside WPA2 (AES) clients. While it offers backward compatibility, it introduces the weaker Temporal Key Integrity Protocol (TKIP) into the network. TKIP is known to be vulnerable to certain key recovery and denial-of-service attacks, compromising the overall security posture of the network by allowing the weakest link to dictate the effective security level.

Error-based

Why wrong: Error-based SQL injection is an in-band technique where an attacker intentionally crafts malicious queries that force the database to generate error messages containing sensitive information. These error messages, which might include details like table names, column names, or even query results, are then displayed directly within the web application's response. Since the data is retrieved through the same channel as the legitimate application output, it is not considered a blind SQL injection method.

Union-based

Why wrong: Union-based SQL injection is an in-band technique that uses the `UNION` operator to combine the results of an attacker's malicious query with the results of the original legitimate query. This allows the attacker to retrieve data from other tables or databases and display it directly within the web application's standard response. As the extracted data is returned within the normal application output, it is not classified as a blind SQL injection method.

Enabling HTTP Strict Transport Security (HSTS)

Why wrong: HTTP Strict Transport Security (HSTS) is a security policy mechanism that helps protect websites against downgrade attacks and cookie hijacking by forcing browsers to interact with the server only over HTTPS. While crucial for enforcing encrypted communication and preventing man-in-the-middle attacks, HSTS does not prevent Cross-Site Request Forgery (CSRF). A CSRF attack exploits the browser's trust in a user's authenticated session, regardless of whether the communication is encrypted, meaning a forged request sent over HTTPS would still be processed if the session cookie is included.

Implementing input validation on all user inputs

Why wrong: Input validation is a critical security measure designed to ensure that data submitted by users conforms to expected formats and types, preventing vulnerabilities like SQL injection or Cross-Site Scripting (XSS). However, it does not directly defend against Cross-Site Request Forgery (CSRF) attacks. CSRF exploits the browser's automatic inclusion of session cookies with requests to a trusted site, not malformed input. A valid, but unauthorized, request initiated by an attacker through the victim's browser would still pass input validation checks.

Using Content Security Policy (CSP) headers

Why wrong: Content Security Policy (CSP) is a security mechanism that helps mitigate various types of attacks, primarily Cross-Site Scripting (XSS), by specifying which content sources (e.g., scripts, stylesheets, images) are permitted to be loaded and executed by the browser. While highly effective against client-side injection vulnerabilities, CSP does not directly prevent Cross-Site Request Forgery (CSRF). CSRF attacks involve forging requests that appear legitimate to the server, originating from the victim's browser, rather than injecting malicious scripts or content into the page itself.

Input validation

Why wrong: Input validation is not an effective mitigation against CSRF because CSRF attacks do not rely on malicious or malformed input data. Instead, CSRF exploits the trust a web application places in a user's browser to perform legitimate actions, even if those actions are initiated by an attacker. The attack's success hinges on the browser automatically sending valid session cookies with a forged request for an otherwise legitimate operation, making input data integrity irrelevant.

Using anti-CSRF tokens

Why wrong: "Using anti-CSRF tokens" is functionally synonymous with "Using CSRF tokens." While CSRF tokens are indeed an effective mitigation, presenting "anti-CSRF tokens" as a separate, distinct answer option creates redundancy. The term simply emphasizes the protective nature of CSRF tokens, which are unique, unpredictable values embedded in requests to verify their legitimate origin.

Using HTTPOnly cookies

Why wrong: HTTPOnly cookies are primarily designed to mitigate Cross-Site Scripting (XSS) attacks by preventing client-side scripts from accessing cookie data. However, they do not prevent CSRF attacks because CSRF exploits the browser's automatic inclusion of cookies in requests to a site where the user is authenticated, regardless of whether a script can read those cookies. The attack does not rely on cookie theft, but on the browser's implicit trust.