When using penetration testing to verify the strength of your security policy, which of the fol-

12. A. A brute force attack is an attempt to discover passwords for user accounts by systematically

attempting every possible combination of letters, numbers, and symbols.

13. C. Strong password policies, physical access control, and two-factor authentication all improve

the protection against brute force and dictionary password attacks. Requiring remote logons has no direct affect on password attack protection; in fact, it may offer sniffers more opportunities to grab password packets from the data stream.

14. D. Spoofing is the replacement of valid source and destination IP and port addresses with false

ones. It is often used in DoS attacks but is not considered a DoS attack itself. Teardrop, Smurf, and ping of death are all DoS attacks.

15. C. A SYN flood attack is waged by breaking the standard three-way handshake used by TCPIP

to initiate communication sessions. Exploiting a packet processing glitch in Windows 95 is a Win- Nuke attack. The use of an amplification network is a Smurf attack. Oversized ping packets are used in a ping of death attack.

16. A. In a land attack, the attacker sends a victim numerous SYN packets that have been spoofed

to use the same source and destination IP address and port number as the victim’s. The victim then thinks it sent a TCPIP session-opening a packet to itself.

17. D. In a teardrop attack, an attacker exploits a bug in operating systems. The bug exists in the

routines used to reassemble i.e., resequence fragmented packets. An attacker sends numerous specially formatted fragmented packets to the victim, which causes the system to freeze or crash. 18. C. Spoofing grants the attacker the ability to hide their identity through misdirection. It is there- fore involved in most attacks.

19. B. A spamming attack is a type of denial of service attack. Spam is the term describing unwanted

e-mail, newsgroup, or discussion forum messages. It can be an advertisement from a well-mean- ing vendor or a floods of unrequested messages with viruses or Trojan horses attached.

20. C. In a hijack attack, which is an offshoot of a man-in-the-middle attack, a malicious user is

positioned between a client and server and then interrupts the session and takes it over. Chapter 3 ISO Model, Network Security, and Protocols THE CISSP EXAM TOPICS COVERED IN THIS CHAPTER INCLUDE: International Organization for StandardizationOpen Systems Interconnection ISOOSI Layers and Characteristics Communications and Network Security InternetIntranetExtranet Components Network Services