Q&A Hero

Q: Viruses, worms, and Trojan horses all represent malicious software that use _________________________ to find weaknesses or holes in operating systems and networks.

Q: The ____________________ virus did not destroy data, but instead inserted the following line in the virus-carrying document when it was opened: "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."

Q: One way to spread a(n) ____________________ virus is to attach it to a template that many users share, enabling it to spread each time the template is opened in a new document.

Q: Typically, eradicating boot or partition sector viruses involves recreating the ____________________ and Partition Boot Sector instructions.

Q: Can a boot or partition sector virus corrupt the address of the primary partition that is specified in the partition table of a disk?

Q: Does the AOL4FREE e-mail hoax contain the AOL4FREE.com attachment?

Q: Is Windows the only operating system that is vulnerable to a macro virus?

Q: In its destructive mode, will the INIT 1984 virus rename files using random characters and delete files on hard drives?

Q: Does an organizational policy work best if users are not included in the policy creation process?

Q: Should you create a new ASR set each time you add a protocol or install a new driver for a network interface card?

Q: Does Windows 2000 use an ASR set to recover from a system failure?

Q: Is one advantage of a digital signature that it helps ensure the security of your system by allowing only drivers and system files that have been verified by Microsoft?

Q: Is Sophos Anti-virus free software that can be used in Macintosh, Netware, UNIX/Linux, and Windows-based systems?

Q: Can the VCatch Basic Anti-virus program be used both in Windows and Linux environments?

Q: Which of the following operating systems would use the commands listed in the figure above?a. Windows XP b. Netware 6.x c. Red Hat Linuxd. Mac OS X

Q: What is displayed in the figure above?a. A bashrc file in Red Hat Linux c. A startup.ncf file in Netwareb. A win.ini file in Windows XP d. The kernel file in Mac OS X

Q: What is displayed in the figure above?a. Windows Update Setup Wizardb. Red Hat Network Alert Notification Toolc. Mac OS X Software Update Toold. None of the above

Q: What was one reason the Slammer worm was successful against SQL Server database servers in early 2003?a. It gained access through a previously unknown vulnerability in SQL serverb. Many administrators had not installed new patches designed to block this attackc. It was a polymorphic worm that rapidly changed signaturesd. It was a stealth worm that was difficult to detect

Q: Which of the following is notorious for enabling cookie snarfing?a. SpyNet b. PeepNetc. Cookienetd. Both a and b e. a, b, and c

Q: With which attachment was the Resume virus associated?a. Explorer.exe b. Explorer.msi c. Explorer.docd. Explorer.com

Q: How was the Melissa virus transported?a. File sharing b. Floppy disk c. Buffer overflowd. E-mail

Q: In Red Hat Linux, what mode do you need to be in to run the fdisk/mbr utility which replaces the MBR?a. Safe b. Rescue c. Recoveryd. MBR

Q: Which of the following executable file extensions is found only on Windows-based systems?a. .mst b. .msi c. .mspd. .btme. All of the above

Q: Which of the following executable file extensions can be found on a Netware 6.x system?a. .pl b. .msi c. .wsfd. .bin

Q: Which file on a Windows-based system is run when a system is booted, and can be used to rename specific files at startup?a. win.ini b. autoexec.bat c. wininit.inid. winstart.bat

Q: Which of the following is an example of a Netware 6.x file that can be the target of a virus?a. autoexec.bat b. startup.ncf c. win.inid. Both a and b

Q: Which of the following is an example of a Red Hat Linux file that can be the target of a virus?a. autoexec.bat b. inittab c. startup.ncfd. win.ini

Q: Which of the following is an example of a Trojan horse on a Mac OS system?a. Simpsons AppleScript Virus b. AOL4FREE c. Backdoor.Eggheadd. Code Red

Q: The _____ targets systems running the SQL Server database on Windows-based workstations and servers.a. Digispid.B.Worm b. Linux.Millen.Worm c. Linux.Lion.Wormd. Code Red II Worm

Q: What process does the Linux.Millen.Worm use on the attacked operating system?a. Telnet b. FTP c. DNSd. SMTP

Q: How many days of the month does the Code Red worm replicate?a. 15 b. 19 c. 23d. 29

Q: Which of the following worms uses buffer overflows to do damage?a. Code Red b. Code Red II c. Linux.Millen.Wormd. Both a and be. a, b, and c

Q: A(n) _____ virus uses defenses to make itself hard to find and detect.a. polymorphic b. stealth c. companiond. heuristic

Q: A(n) _____ virus appears to run from a file other than the one to which it is actually appended. a. stealth c. polymorphic b. armored d. companion

Q: A(n) _____ virus changes each time it is replicated, making it more difficult to create a defense against it.a. armored b. multipartite c. polymorphicd. heuristic

Q: A _____ virus can infect systems through multiple means, particularly through boot or partition sectors and through executable files.a. boot sector b. multipartite c. macrod. file infector

Q: A _____ virusspreads to instruction set files typically used by word processors, spreadsheets, databases, and other programs.a. boot sector b. file infector c. macrod. multipartite

Q: A _____ virus appends to program files such as system files, executable files, driver files, and supplementary files, including .dlls.a. partition sector b. file infector c. macrod. multipartite

Q: The _____ virus can only become destructive if the user executes an infected file on a Friday the thirteenth.a. Linux.Millen.Worm b. INIT 1984 c. W32.Pinfid. Code Red II

Q: _____ is designed so that it does not infect all of these file types at once, but only a limited number each time Windows Explorer runs.a. INIT 1984 b. Code Red c. Slammer wormd. W32.Pinfi

Q: What is another name for malicious software?a. malsoft b. malware c. scriptwared. scriptsoft

Q: In Red Hat Linux, what command do you need to use to create a boot disk?a. mkboot b. makebootdisk c. mkbootdiskd. makebtdsk

Q: What do you need to have for Red Hat Linux if a system file on the hard disk is corrupted?a. An ERD b. An ASR set c. A boot diskd. An MBR

Q: How many copies of the ASR set should you have for a server?a. 1 b. 2 c. 3d. 4

Q: Which of the following operating systems uses an emergency repair disk?a. Windows 2000 Server b. Windows 2000 Pro c. Windows XP Prod. Windows 2003 Servere. Both a and b

Q: Which of the following Microsoft operating systems uses driver signing?a. Windows XP b. Windows MEc. Windows 98d. Windows 95 e. Both a and c

Q: Which anti-virus software is available for use on Macintosh, NetWare, UNIX/Linux, and Windows-based systems?a. AntiVir Personal Edition b. HandyBits VirusScan c. McAfee VirusScand. Sophos Anti-Virus

Q: Which anti-virus software is available for use on only Windows and Mac OS systems?a. Central Command Vexira AntiVirus b. F-Prot AV c. Norton AntiVirusd. McAfee VirusScane. Both c and d

Q: Which of the following virus programs is available for purchase on a Windows-based workstation?a. AntiVir Personal Edition b. Handybits Viruscan c. VCatch Basicd. Sophos Anti-viruse. Both b and d

Q: Mac OS and NetWare automatically display the boot load information to the screen each time one of these systems is booted. _________________________

Q: Software exploitation is particularly aimed at new software and new software versions. _________________________

Q: A(n) boot sector virus typically infects or replaces the instructions in the MBR or the Partition Boot Sector. _________________________

Q: Batch files and scripts are files that contain code or instructions that are run by a(n) interpreter. _________________________

Q: A(n) macro virus, worm, or Trojan horse is a file that contains lines of computer code that can be run. _________________________

Q: The Digispid.B.Worm targets systems running the SQL Server database on Windows-based workstations and servers. _________________________

Q: The Code Red worm replicates for the first 23 days of the month and then stops. _________________________

Q: A(n) stealth virus uses defenses to make itself hard to find and detect. _________________________

Q: File infector viruses can infect systems through multiple means, particularly through boot or partition sectors and through executable files. _________________________

Q: The first stage of virus spread that occurs is replication within the infected system. _________________________

Q: Organizational policy works best when users are included in the process, so that they know the importance of security.

Q: The Windows 2003 Server ASR set backs up all system files, system settings, and application data files.

Q: Windows 2000 Server allows you to create an ERD, which enables you to fix problems that may arise with the server, such as corrupted system files.

Q: The Netware 6.x operating system has a software update tool that connects to the Internet to obtain patches.

Q: Cookie snarfing is an attack where a spyware operator can reconstruct a user's every move on the Internet by capturing cookies or the information contained in the cookies.

Q: Boot or partition sector viruses particularly affect Windows and Netware systems.

Q: In Netware, the startup.ncf file contains commands used by the server.exe startup program.

Q: Backdoor.Egghead is an example of a worm that is spread by buffer overflows.

Q: A benign virus is one that replicates but does not inflict harm on a computer.

Q: The W32.Pinfi virus is an example of a destructive virus that can infect Mac OS systems.

Q: List four mediums over which computer networks can transmit data.

Q: List three common password options that are offered in the BIOS.

Q: What are the five basic operating system components?

Q: What six basic tasks does an operating system perform?

Q: List four hardening techniques that can be used with networks.

Q: List five types of VPN security that can be provided by operating systems.

Q: List six features that operating systems provide for hardening a system.

Q: List five organizations that provide information, assistance, and training in types of system attacks and how to prevent them.

Q: Which three NLMs enable a workstation to remotely access the Netware system console?

Q: Match the following terms to the appropriate definitions.a. Attribute f. LSRRb. Buffer g. Macroc. Buffer overflow h. Source routingd. DoS attack i. Spoofinge. DDos attack j. Worm1/ Occurs when there is more data to store in a buffer than the buffer can hold2/ The address of the source computer is changed3/ A computer causes other computers to launch attacks directed at one or more targets4/ The sender of a packet specifies the precise path that a packet will take5/ A form of source routing that specifies only one portion of a route6/ A characteristic associated with a directory, folder, or file7/ Flooding a network with frames or packets containing errors8/ A program that replicates and replicates on the same computer9/ A storage area in a device that temporarily saves information in memory10/ A set of instructions for an activity that is performed frequently

Q: Once an attacker has found available IP addresses, they may then run ____________________ software to find a system on which a key port is open or not in use.