- (Topic 3)
An ethical hacker is testing a web application of a financial firm. During the test, a 'Contact Us' form's input field is found to lack proper user input validation, indicating a potential Cross-Site Scripting (XSS) vulnerability. However, the application has a stringent Content Security Policy (CSP) disallowing inline scripts and scripts from external domains but permitting scripts from its own domain. What would be the hacker's next step to confirm the XSS vulnerability?

1. A. Try to disable the CSP to bypass script restrictions
2. B. Inject a benign script inline to the form to see if it executes
3. C. Utilize a script hosted on the application's domain to test the form
4. D. Load a script from an external domain to test the vulnerability

Correct Answer: C
The hacker??s next step to confirm the XSS vulnerability would be to utilize a script hosted on the application??s domain to test the form. This is because the application??s CSP allows scripts from its own domain, but not from inline or external sources. Therefore, the hacker can try to inject a payload that references a script file on the same domain as the application, such as:
<script src="/path/to/script.js"></script>
where script.js contains some benign code, such as alert('XSS') or print('XSS'). If the script executes in the browser, then the hacker has confirmed the XSS vulnerability. Otherwise,
the CSP has blocked the script and prevented the XSS attack.
The other options are not feasible or effective for the following reasons:
✑ A. Try to disable the CSP to bypass script restrictions: This option is not feasible because the hacker cannot disable the CSP on the server side, and the browser enforces the CSP on the client side. The hacker would need to modify the browser settings or use a browser extension to disable the CSP, but this would not affect the victim??s browser or the application??s security.
✑ B. Inject a benign script inline to the form to see if it executes: This option is not effective because the application??s CSP disallows inline scripts, meaning scripts that are embedded in the HTML code. Therefore, the hacker would not be able to inject a script tag or an event handler attribute that contains some code, such as:
<script>alert('XSS')</script> or <input type="text" onfocus="alert('XSS')"> The CSP would block these scripts and prevent the XSS attack.
✑ D. Load a script from an external domain to test the vulnerability: This option is not
effective because the application??s CSP disallows scripts from external domains, meaning scripts that are loaded from a different domain than the application. Therefore, the hacker would not be able to inject a script tag that references a script file on another domain, such as:
<script src="https://example.com/script.js"></script>
The CSP would block these scripts and prevent the XSS attack. References:
✑ 1: Content Security Policy (CSP) - HTTP | MDN
✑ 2: What is Content Security Policy (CSP) | Header Examples | Imperva
✑ 3: Content-Security-Policy (CSP) Header Quick Reference
✑ 4: What is cross-site scripting (XSS)? - PortSwigger
✑ 5: Cross Site Scripting (XSS) | OWASP Foundation
✑ 6: The Impact of Cross-Site Scripting Vulnerabilities and their Prevention
✑ 7: XSS Vulnerability 101: Identify and Stop Cross-Site Scripting

- (Topic 2)
which of the following protocols can be used to secure an LDAP service against anonymous queries?

1. A. SSO
2. B. RADIUS
3. C. WPA
4. D. NTLM

Correct Answer: D
In a Windows network, nongovernmental organization (New Technology) local area network Manager (NTLM) could be a suite of Microsoft security protocols supposed to produce authentication, integrity, and confidentiality to users.NTLM is that the successor to the authentication protocol in Microsoft local area network Manager (LANMAN), Associate in Nursing older Microsoft product. The NTLM protocol suite is enforced in an exceedingly Security Support supplier, which mixes the local area network Manager authentication protocol, NTLMv1, NTLMv2 and NTLM2 Session protocols in an exceedingly single package. whether or not these protocols area unit used or will be used on a system is ruled by cluster Policy settings, that totally different|completely different} versions of Windows have different default settings. NTLM passwords area unit thought-about weak as a result of they will be brute-forced very simply with fashionable hardware.
NTLM could be a challenge-response authentication protocol that uses 3 messages to authenticate a consumer in an exceedingly affiliation orientating setting (connectionless is similar), and a fourth extra message if integrity is desired.
✑ First, the consumer establishes a network path to the server and sends a
NEGOTIATE_MESSAGE advertising its capabilities.
✑ Next, the server responds with CHALLENGE_MESSAGE that is employed to determine the identity of the consumer.
✑ Finally, the consumer responds to the challenge with Associate in Nursing AUTHENTICATE_MESSAGE.
The NTLM protocol uses one or each of 2 hashed word values, each of that are keep on the server (or domain controller), and that through a scarcity of seasoning area unit word equivalent, that means that if you grab the hash price from the server, you??ll evidence while not knowing the particular word. the 2 area unit the lm Hash (a DES-based operate applied to the primary fourteen chars of the word born-again to the standard eight bit laptop charset for the language), and also the nt Hash (MD4 of the insufficient endian UTF-16 Unicode password). each hash values area unit sixteen bytes (128 bits) every.
The NTLM protocol additionally uses one among 2 a method functions, looking on the NTLM version. National Trust LanMan and NTLM version one use the DES primarily based LanMan a method operate (LMOWF), whereas National TrustLMv2 uses the NT MD4 primarily based a method operate (NTOWF).

- (Topic 1)
A zone file consists of which of the following Resource Records (RRs)?

1. A. DNS, NS, AXFR, and MX records
2. B. DNS, NS, PTR, and MX records
3. C. SOA, NS, AXFR, and MX records
4. D. SOA, NS, A, and MX records

Correct Answer: D

- (Topic 3)
In both pharming and phishing attacks, an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims.
What is the difference between pharming and phishing attacks?

1. A. In a pharming attack, a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DN
2. B. In a phishing attack, an attacker provides the victim with a URL that is either misspelled or looks similar to the actual websites domain name
3. C. In a phishing attack, a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DN
4. D. In a pharming attack, an attacker provides the victim with a URL that is either misspelled or looks very similar to the actual websites domain name
5. E. Both pharming and phishing attacks are purely technical and are not considered forms of social engineering
6. F. Both pharming and phishing attacks are identical

Correct Answer: A

- (Topic 2)
Abel, a cloud architect, uses container technology to deploy applications/software including all its dependencies, such as libraries and configuration files, binaries, and other resources that run independently from other processes in the cloud environment. For the containerization of applications, he follows the five-tier container technology architecture. Currently. Abel is verifying and validating image contents, signing images, and sending them to the registries. Which of the following tiers of the container technology architecture Is Abel currently working in?

1. A. Tier-1: Developer machines
2. B. Tier-4: Orchestrators
3. C. Tier-3: Registries
4. D. Tier-2: Testing and accreditation systems

Correct Answer: D
The official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls. formal declaration by a designated accrediting authority (DAA) or principal accrediting
authority (PAA) that an information system is approved to operate at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural safeguards. See authorization to operate (ATO). Rationale: The Risk Management Framework uses a new term to refer to this concept, and it is called authorization.
Identifies the information resources covered by an accreditation decision, as distinguished from separately accredited information resources that are interconnected or with which information is exchanged via messaging. Synonymous with Security Perimeter.
For the purposes of identifying the Protection Level for confidentiality of a system to be accredited, the system has a conceptual boundary that extends to all intended users of the system, both directly and indirectly connected, who receive output from the system. See authorization boundary. Rationale: The Risk Management Framework uses a new term to
refer to the concept of accreditation, and it is called authorization. Extrapolating, the accreditation boundary would then be referred to as the authorization boundary.