Which of the following statements about a zone transfer correct? (Choose 3)

A. A zone transfer is accomplished with DNS
B. A zone transfer is accomplished with the nslookup service
C. A zone transfer passes all zone information that a DNS server maintains
D. A zone transfer passes all zone information that a nslookup server maintains
E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections
F. Zone transfer cannot occur on the Internet.

Ans: A , C , E

Q1
Doug is conducting a port scan of a target network. He knows that his client target network
has a web server and that there is a mail server which is up and running. Dough has been sweeping the network but has not been able to elicit any response from the remote target.
Which of the following could be the most likely cause behind this lack of response?  Select 4

a. UDP is filtered by a gateway
b. The packet TTL value is too low and cannot reach the target
c. The host might be down
d. The destination network might be down
e. The TCP windows size does not match
f. ICMP is filterd by a gateway

ans: A,B,C,D

i thought the answer is A,C,D,F

Q2
You have the SOA presented below in you Zone. Your secondary servers have not been able to contact your primary server to synchronise information. How long will the secondary servers attempt to conact the primary server before it considers that zone is dead and stops responding to queries?
college.edu (200302028 3600 3600 6+4800 3600)

a. 1 day
b. 1 hour
c. 1 week
d. 1 month

Answer: C

i thought the answer is 1 hour??
60sec x 60 = 3600seconds

Q3
Joe worried that network adminstrator miht detect the wiretap program by querying
the interfaces to see of they are running in promiscuous mode.

a. Block output to the console whenever the user runs ifconfig command by running screen
capture utility
b. Run the wiretap program in stealth mode from being detected by the ifconfig command
c. Repalce original ifconfig utility with the rootkit version of ifconfig hiding
Promiscuous information being displayed on the console
d. You cannor disable Promiscuous mode detection on Linux Systems.

Answer given is D, and I thought answer should be C.

Q 4
A following attack on web server using obstructed URL:
http://www.example.com/scri[t.ext?template%2e%2e%2e%2e%2e%2f%65%74%63%2f%7

how to protect information systems from these attacks

A. Configure web server to deny alerts from these attacks
B. Create rules in IDS to alert on strange Unicode requests
C. Use SSL authentication on Web Servers
D. Enable Active scri[ts detection at the firewall and routers.

Answer given is B

The only reason i thought of its IDS deployed infront of the web server (DMZ segment)

what about A? can we configure the webserver to deny unicode request?

5.
Bubba has just accessed he preferred ecommerce web site and has spotted an item that he would like to buy. Bubba considers the price a bit too steep. He looks at the source code of the webpage and decides to
save the page locally, so that he can modify the page variables. In the context of web application security,
what do you think Bubba has changes?

A. A hidden form field value.
B. A hidden price value.
C. An integer variable.
D. A page cannot be changed locally, as it is served by a web server.

Answer given is A.

I was thinking whether the answer could be D.
Even the entire page is downloaded into our PC, we changed the value locally, but it doesnt reflect in the server such via POST method...

Hackers find use for Google Code Search
Shortcut for vulnerability seekers (whatever their hat color)

October 06, 2006  (IDG News Service) -- Google Inc. has inadvertently given online attackers a new tool.

The company's new source-code search engine, unveiled Thursday as a tool to help simplify life for developers, can also be misused to search for software bugs, password information and even proprietary code that shouldn't have been posted to the Internet in the first place, security experts said Friday.

Unlike Google's main Web search engine, Google Code Search peeks into the actual lines of code whenever it finds source-code files on the Internet. This will make it easier for developers to search source code directly and dig up open-source tools they may not have known about, but it has a drawback.

"The downside is that you could also use that kind of search to look for things that are vulnerable and then guess who might have used that code snippet and then just fire away at it," said Mike Armistead, vice president of products with source-code analysis provider Fortify Software Inc.

Attackers could also search code for vulnerabilities in password mechanisms, or to search for phrases within software such as "this file contains proprietary," possibly unearthing source code that should never have been posted to the Internet.

Security experts say that the security implications of Google Code Search are noteworthy, if not earth-shattering.

Skilled hackers may already be able to do this type of search with Google's Web search engine, but Code Search is "another tool that makes it a tad easier for the attacker," said Johnny Long, a security researcher with Computer Sciences Corp, in an e-mail interview.

For its part, Google did not have much to say about possible misuse of its new product. "Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement.

Google has never said much about the steps it takes to cut down on this kind of misuse of its search engine, though the issue comes up from time to time. In July, Websense Inc. used a little known binary search capability within Google Inc.'s search engine to look for malware on the Internet.

While Google Code Search will probably not have much of an effect on popular open-source projects, which are already heavily scrutinized, it could help ferret out vulnerabilities in lesser known pieces of code, according to Lev Toger, a software developer with Beyond Security Ltd.

"Using Google's code search, it's much easier to find interesting code portions," he said via e-mail. "If your task is to find vulnerability in some random code, this filtering can save you a lot of time. "

He does not want to attack the system containing the IDS

Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80