Select Two (Multi-Select) Questions

Hydra

Why it fails: Hydra is a robust online password cracking tool designed to perform rapid brute-force and dictionary attacks against various network services and authentication protocols. Unlike offline crackers, Hydra directly attempts credentials against live services like SSH, FTP, HTTP, and SMB, making it suitable for testing the strength of network service authentication. It does not process pre-obtained password hashes but rather interacts with the target service in real-time to guess login credentials.

Nmap

Why it fails: Nmap, or Network Mapper, is fundamentally a network discovery and security auditing tool, not a password cracker. Its primary functions involve host discovery, port scanning, service version detection, and operating system fingerprinting across networks. While it can identify potential vulnerabilities in services, Nmap does not possess any built-in capabilities for cracking password hashes or performing credential brute-force attacks against discovered services.

Wireshark

Why it fails: Wireshark is a powerful network protocol analyzer used for capturing and interactively examining network traffic in real-time or from saved packet capture files. Its core functionality involves deep inspection of individual packets to understand network communication, diagnose issues, and analyze protocol behavior. Although it can reveal plaintext credentials if they traverse the network unencrypted, Wireshark itself is a passive monitoring tool and does not actively crack passwords or hashes.

Exploiting SUID binaries to gain root

Why it fails: Exploiting SUID (Set User ID) binaries to gain root privileges is a technique primarily used for privilege escalation, not for covering tracks. SUID binaries allow a user to execute a program with the permissions of the file owner, typically root, enabling an attacker to gain higher access levels on a Unix-like system. While crucial for an attacker to achieve full control, this action itself does not conceal past activities or remove evidence of the attacker's presence; it merely elevates their current operational capabilities.

Disabling Windows Defender via Group Policy

Why it fails: Disabling Windows Defender via Group Policy is primarily a defense evasion technique rather than a method for covering tracks after compromise. This action prevents the security software from detecting ongoing or future malicious activity, allowing an attacker to operate with less risk of immediate detection. While it facilitates an attack, it does not retroactively remove evidence of past actions, delete logs, or conceal existing malicious artifacts, which are the core objectives of covering tracks.

Use of return-oriented programming (ROP)

Why it fails: Return-oriented programming (ROP) is an advanced exploitation technique used *after* a buffer overflow has successfully corrupted the stack, typically to bypass Data Execution Prevention (DEP). ROP involves chaining together small snippets of existing code (gadgets) within the program's memory to achieve arbitrary code execution. Therefore, ROP itself is a *consequence* or *method of exploitation*, not an initial indicator that a buffer overflow *is occurring*.

High CPU usage

Why it fails: High CPU usage indicates that a process is consuming significant processing power, which can be caused by numerous factors such as inefficient algorithms, infinite loops, heavy computational tasks, or even other types of malware. While a program might enter an infinite loop or perform excessive computations *after* a buffer overflow has been exploited, high CPU usage is not a direct or specific indicator of the buffer overflow event itself, which primarily involves memory corruption.

Ping sweep

Why it fails: A ping sweep is an active reconnaissance technique because it involves sending Internet Control Message Protocol (ICMP) echo requests to a range of IP addresses. This direct interaction with target systems elicits responses, such as ICMP echo replies, which can be detected by intrusion detection systems (IDS) or logged by the target network. The act of sending these probes directly to the target makes it an observable and potentially traceable action.

Banner grabbing with Telnet

Why it fails: Banner grabbing using Telnet is an active reconnaissance method as it requires establishing a direct connection to a target system's open port, such as port 23 for Telnet or port 80 for HTTP. By initiating a session and sending specific commands or connection requests, the attacker directly interacts with the service to elicit identifying information like software versions. This direct communication leaves a footprint on the target server's logs, making it detectable.

Port scanning

Why it fails: Port scanning is an inherently active reconnaissance technique because it involves sending various types of network packets, such as SYN or ACK flags, to a target host's ports to determine which services are listening. This direct probing of a target's network interfaces generates traffic that can be easily detected by firewalls, intrusion detection systems, and network monitoring tools. The goal is to map the attack surface by identifying open ports, which necessitates direct interaction with the target system.

DNS spoofing

Why it fails: DNS spoofing redirects name resolution to a fraudulent address, so a client connects to an attacker's server rather than an existing session being taken over. It tempts because it is a redirection attack, but session hijacking requires capturing and reusing a valid session identifier.

MAC flooding

Why it fails: MAC flooding exhausts a switch's CAM table, forcing frames to flood, which enables sniffing rather than hijacking an established session. It tempts because it is a layer-two attack that can precede session theft, but it is a traffic-disclosure technique, not session hijacking itself.

ARP poisoning

Why it fails: ARP poisoning manipulates the ARP cache to intercept traffic, enabling session hijacking rather than being one itself; it is a precursor technique. It is tempting because it is a common attack vector, but it belongs to man-in-the-middle positioning, not the hijacking of an already-established session token.

Social engineering

Why it fails: Social engineering is an initial access vector that manipulates individuals into divulging confidential information or performing actions that compromise security, rather than a direct system hacking technique. While it can lead to system compromise, it operates on human psychology and trust, preceding the technical actions performed on a system during the system hacking phase. It's distinct from the post-exploitation activities within a compromised host.

Network sniffing

Why it fails: Network sniffing involves passively capturing and analyzing data packets traversing a network segment. While it is a valuable reconnaissance and information gathering technique, often used to obtain credentials or sensitive data from the network, it is not considered a core system hacking technique. System hacking focuses on direct interaction and manipulation of the compromised host's operating system and applications, whereas sniffing primarily operates at the network layer.

Disable SNMP on all devices

Why it fails: Disabling SNMP outright removes the enumeration vector, but the scenario requires countermeasures that retain monitoring capability, so it fails the operational requirement. It is tempting because decommissioning the service is genuinely the strongest hardening step where no management platform depends on it — for example, on isolated hosts with no SNMP-based monitoring.

Enable SNMPv3 with default passwords

Why it fails: SNMPv3 with default passwords leaves the community-string weakness intact, since default credentials are publicly known and trivially guessed. SNMPv3 is tempting because it adds authentication and encryption, but only when strong, unique credentials are configured; leaving defaults enabled defeats the entire purpose of the upgrade.

Use SNMPv1 with community string 'private'

Why it fails: Incorrect: Using SNMPv1 with the community string 'private' is a default configuration that attackers know; it offers no security and actually facilitates enumeration.

Memory analysis

Why it fails: Memory analysis is a specialized forensic technique that involves examining the contents of a computer's volatile memory (RAM) at a specific point in time. While incredibly valuable for uncovering hidden processes, injected code, rootkits, or data exfiltration attempts, it is typically performed after an incident or during dynamic analysis to capture runtime artifacts. It serves as a powerful tool within incident response and advanced analysis, rather than a primary, overarching category of malware analysis methodology itself, which are broadly defined as static or dynamic.

Signature analysis

Why it fails: Signature analysis is a detection method where known patterns, hashes, or unique byte sequences of previously identified malware are matched against suspicious files. This technique is highly effective for detecting known threats quickly and is a core component of many antivirus solutions, often employed during static scanning. However, it is a specific detection mechanism rather than a comprehensive analysis methodology used to deeply understand novel malware's full functionality and intent, which requires more in-depth static or dynamic approaches.

Heuristic analysis

Why it fails: Heuristic analysis is a proactive detection technique that identifies potential malware by recognizing suspicious characteristics or behaviors, even if a specific signature is unknown. This method relies on rules, algorithms, or machine learning models to evaluate attributes like unusual file permissions, suspicious API call sequences, or abnormal process activity. While effective for detecting zero-day threats and polymorphic malware, it is fundamentally a detection strategy employed by security products, not a primary methodology for comprehensive, in-depth malware reverse engineering or behavioral understanding.

Biometric door lock

Why it fails: A biometric door lock primarily functions as an authentication mechanism, verifying an individual's identity before granting access. However, it does not inherently prevent 'tailgating' or 'piggybacking,' where an unauthorized person follows closely behind an authorized individual who has just successfully authenticated. The lock opens for the authenticated user, but it lacks a physical barrier to restrict subsequent, unverified entries.

CCTV cameras

Why it fails: CCTV cameras are a crucial component of a comprehensive security system, primarily serving as a deterrent and a detective control. They provide visual surveillance and record events, which can be invaluable for monitoring, real-time alerts to security personnel, and post-incident forensic analysis. However, CCTV cameras do not physically impede or prevent unauthorized individuals from tailgating an authorized person through an access point.

Security guard

Why it fails: A security guard represents a human-based administrative or personnel control rather than a physical security device or mechanism. While guards are highly effective for observation, intervention, and enforcing access policies, their presence relies on human vigilance and judgment. They do not provide the automated, mechanical, and consistent physical restriction against tailgating that purpose-built devices offer.

ARP poisoning

Why it fails: ARP poisoning is a man-in-the-middle attack.

DNS cache poisoning

Why it fails: DNS cache poisoning is an attack to redirect traffic.

ICMP flooding

Why it fails: ICMP flooding is a denial-of-service attack, not enumeration.

Slowloris

Why it fails: Slowloris is an application-layer (Layer 7) denial-of-service attack designed to exhaust a web server's connection pool. It operates by opening numerous partial HTTP connections to the target server and then slowly sending subsequent HTTP headers. This keeps the connections open indefinitely, preventing other legitimate users from connecting, but it does not involve amplifying traffic volume; instead, it consumes server resources through prolonged, incomplete requests.

SYN flood

Why it fails: A SYN flood is a classic Layer 4 (TCP) denial-of-service attack that exploits the three-way handshake. The attacker sends a high volume of SYN requests to the target server, often with spoofed source IP addresses. The server responds with SYN-ACK packets and allocates resources for these half-open connections, awaiting the final ACK. Since the ACK never arrives from the spoofed source, the server's connection table becomes exhausted, preventing legitimate connections, but without amplifying data volume.

Ping of Death

Why it fails: The Ping of Death is an older, specific type of denial-of-service attack that exploits vulnerabilities in a system's IP fragmentation and reassembly process. It involves sending an ICMP echo request (ping) packet that is intentionally malformed to exceed the maximum allowed IP packet size (65,535 bytes) when reassembled. This oversized packet could cause buffer overflows, crashes, or system instability on vulnerable targets, but it does not amplify the volume of traffic.

Enabling DHCP snooping

Why it fails: Enabling DHCP snooping primarily secures the DHCP infrastructure by preventing rogue DHCP servers and ensuring clients receive IP addresses from legitimate sources. While it builds a crucial binding table of MAC-IP-port-VLAN mappings, it does not directly validate or prevent malicious ARP requests or replies itself. Its role is foundational for Dynamic ARP Inspection (DAI), but not a direct ARP poisoning prevention technique on its own.

Disabling STP on all ports

Why it fails: Disabling Spanning Tree Protocol (STP) on all ports is entirely ineffective against ARP poisoning and is, in fact, detrimental to network stability. STP's purpose is to prevent network loops by blocking redundant paths, not to validate ARP packets or secure MAC-IP bindings. Removing STP would introduce the risk of broadcast storms and MAC address table instability, which could exacerbate network issues rather than prevent ARP-related attacks.

Running a vulnerability scanner

Why it fails: Running a vulnerability scanner is an active reconnaissance technique used to identify weaknesses in a target system before or during an attack, not after to cover tracks. This process generates significant network traffic, system logs, and potentially triggers intrusion detection systems, making the attacker's presence highly visible and easily detectable. Far from concealing activity, it actively broadcasts an attacker's probing actions, directly contradicting the goal of stealth.

Enabling firewall rules

Why it fails: Enabling firewall rules is generally counterproductive for an attacker attempting to maintain access or cover their presence on a compromised system. Attackers typically aim to weaken or disable firewalls to facilitate command-and-control communication, data exfiltration, or lateral movement. Actively enabling new rules could inadvertently block their established backdoors or communication channels, and any modification to firewall configurations leaves clear, auditable evidence that security teams can easily discover during an investigation.

Creating new user accounts

Why it fails: Creating new user accounts, while a common method for establishing persistence on a compromised system, is not a technique for covering tracks; rather, it generates significant forensic evidence. Every new user account creation, especially one with elevated privileges, is meticulously logged by the operating system (e.g., Windows Security Event ID 4720). These distinct log entries provide clear indicators of compromise that are easily discoverable during a security audit or incident response investigation, directly undermining the objective of stealth.

Captured network packets

Why it fails: Captured network packets cannot be obtained directly through SNMP. SNMP is a protocol designed for managing and monitoring network devices by collecting specific management information from MIBs, not for intercepting or storing the actual data plane traffic. Tools like Wireshark or tcpdump are used for packet capture, operating at a lower level of the network stack.

User account passwords

Why it fails: User account passwords are not stored in SNMP Management Information Bases (MIBs) and therefore cannot be obtained via SNMP queries. Storing sensitive credentials like passwords in MIBs would represent a severe security vulnerability, as SNMP community strings, especially in versions 1 and 2c, are often transmitted in cleartext. MIBs are designed to store operational and configuration data, not authentication secrets.

Modify network interface settings

Why it fails: While SNMP can be used to modify network interface settings if write access is configured (e.g., via a specific write community string in SNMPv1/v2c or authenticated write operations in SNMPv3), the question specifically asks what *information can be obtained*. Modifying settings is an *action* or *configuration task*, not the *retrieval of information*. Therefore, this option describes an operational capability rather than an informational retrieval.

Penetration testing

Why it fails: Penetration testing is a simulated cyberattack against a computer system, network, or web application to check for exploitable vulnerabilities. While it involves security assessment, its primary goal is to identify weaknesses in an organization's defenses, not to dissect and understand the internal workings or behavior of a specific piece of malicious software. Therefore, it is distinct from the methodologies used for malware analysis.

Network analysis

Why it fails: Network analysis, in the context of malware, specifically focuses on monitoring and dissecting the network traffic generated by malicious software during its execution. While critical for identifying command-and-control servers, data exfiltration, or propagation attempts, it is inherently a component or technique employed within dynamic analysis, which observes the malware's behavior in a live environment. It is not considered a standalone primary category of malware analysis.

Code review

Why it fails: Code review, when applied to malware, involves a meticulous examination of the malware's disassembled or decompiled source code to understand its logic, algorithms, and potential vulnerabilities. This process is a fundamental technique within static analysis, where the code is scrutinized without execution to identify functions, data structures, and malicious intent. It is a specific method within static analysis, rather than a distinct primary type of malware analysis itself.

snmpwalk -v2c -c public target

Why it fails: snmpwalk is for SNMP, not SMB.

nmap -sU -p 445 target

Why it fails: UDP scan on port 445 is not typical; SMB uses TCP 445. The command does not enumerate shares.

nbtstat -A target

Why it fails: nbtstat enumerates NetBIOS names, not SMB shares directly.

Tries every possible combination of characters

Why it fails: This describes a pure brute-force attack, which attempts every single character combination within a defined character set and length. While theoretically guaranteed to find any password, the computational resources and time required for modern password lengths (e.g., 8+ characters with mixed complexity) make this approach practically infeasible. It would take an astronomically long time, rendering it unsuitable for typical penetration test timelines.

Relies on precomputed hash chains

Why it fails: This technique, commonly associated with rainbow tables, involves using large precomputed tables of hashes and their corresponding plaintext values. While historically effective against unsalted hashes, modern secure password storage practices almost universally employ salting. Salting adds a unique random value to each password before hashing, rendering precomputed hash chains ineffective as each hash becomes unique, preventing lookup in generic tables.

Input validation

Why it fails: Input validation is not an effective mitigation against CSRF because CSRF attacks do not rely on malicious or malformed input data. Instead, CSRF exploits the trust a web application places in a user's browser to perform legitimate actions, even if those actions are initiated by an attacker. The attack's success hinges on the browser automatically sending valid session cookies with a forged request for an otherwise legitimate operation, making input data integrity irrelevant.

Using anti-CSRF tokens

Why it fails: "Using anti-CSRF tokens" is functionally synonymous with "Using CSRF tokens." While CSRF tokens are indeed an effective mitigation, presenting "anti-CSRF tokens" as a separate, distinct answer option creates redundancy. The term simply emphasizes the protective nature of CSRF tokens, which are unique, unpredictable values embedded in requests to verify their legitimate origin.

Using HTTPOnly cookies

Why it fails: HTTPOnly cookies are primarily designed to mitigate Cross-Site Scripting (XSS) attacks by preventing client-side scripts from accessing cookie data. However, they do not prevent CSRF attacks because CSRF exploits the browser's automatic inclusion of cookies in requests to a site where the user is authenticated, regardless of whether a script can read those cookies. The attack does not rely on cookie theft, but on the browser's implicit trust.

Port knocking

Why it fails: Port knocking is a network access control mechanism where a user attempts to connect to a series of closed ports in a specific, predefined sequence to open a single, otherwise closed, port on the firewall. This technique is primarily used for stealthy remote access and authentication, not for filtering or absorbing the high volumes of malicious traffic characteristic of a Distributed Denial of Service (DDoS) attack. It does not prevent the initial flood of packets from reaching the network perimeter.

ARP poisoning

Why it fails: ARP poisoning, also known as ARP spoofing, is a malicious technique where an attacker sends falsified Address Resolution Protocol (ARP) messages over a local area network. This links an attacker's MAC address with the IP address of a legitimate network device, such as a router or another host, to intercept or modify traffic. As an offensive technique used to disrupt or eavesdrop on network communications, it is fundamentally an attack vector, not a defensive mitigation strategy against DDoS attacks.

MAC filtering

Why it fails: MAC filtering is a Layer 2 access control method that permits or denies network access based on a device's unique Media Access Control (MAC) address. While it can be used for basic access control on small, static networks, it is easily bypassed by MAC spoofing and is entirely ineffective against Distributed Denial of Service (DDoS) attacks. DDoS attacks typically involve a vast number of spoofed or legitimate, but compromised, IP addresses and operate at higher network layers, rendering MAC-based filtering irrelevant for large-scale volumetric attacks.

Hiding files

Why it fails: "Hiding files" is an incorrect answer because while "Hiding" is indeed a phase within the CHPSET methodology, the term "Hiding files" is overly narrow and specific. The comprehensive 'Hiding' phase encompasses a broader range of post-exploitation activities, including concealing malicious processes, rootkits, and backdoors, as well as manipulating log files to cover tracks, not solely limited to file-level concealment. This phase aims to maintain persistence and evade detection by security mechanisms.

Scanning ports

Why it fails: Scanning ports is an incorrect answer because it primarily constitutes a reconnaissance activity, typically performed during the initial phases of an attack, such as footprinting and scanning, which precede the system hacking (CHPSET) methodology. While crucial for identifying open services and potential entry points, port scanning is a discovery mechanism rather than a direct component of the post-exploitation or system interaction phases defined by CHPSET. It helps identify targets for CHPSET, but is not part of CHPSET itself.