NO.19 You have been assigned to perform a vulnerability assessment of a web server located at IP address 20.20.10.26. Identify the vulnerability with a severity score of &A. You can use the OpenVAS vulnerability scanner, available with the Parrot Security machine, with credentials admin/password for this challenge.

NO.20 Lorenzo, a security professional in an MNC, was instructed to establish centralized authentication, authorization, and accounting for remote-access servers. For this purpose, he implemented a protocol that is based on the client-server model and works at the transport layer of the OSI model.
Identify the remote authentication protocol employed by Lorenzo in the above scenario.

NO.21 The IH&R team in an organization was handling a recent malware attack on one of the hosts connected to the organization’s network. Edwin, a member of the IH&R team, was involved in reinstating lost data from the backup media. Before performing this step, Edwin ensured that the backup does not have any traces of malware.
Identify the IH&R step performed by Edwin in the above scenario.

NO.22 You’ve been called in as a computer forensics investigator to handle a case involving a missing company laptop from the accounting department, which contained sensitive financial data. The company suspects a potential data breach and wants to recover any evidence from the missing device. What is your MOST important initial action regarding the digital evidence?

NO.23 Desmond, a forensic officer, was investigating a compromised machine involved in various online attacks. For this purpose. Desmond employed a forensic tool to extract and analyze computer-based evidence to retrieve information related to websites accessed from the victim machine. Identify the computer-created evidence retrieved by Desmond in this scenario.

NO.24 A renowned research institute with a high-security wireless network recently encountered an advanced cyber attack. The attack was not detected by traditional security measures and resulted in significant data exfiltration. The wireless network was equipped with WPA3 encryption, MAC address filtering, and had disabled SSID broadcasting. Intriguingly. the attack occurred without any noticeable disruption or changes in network performance. After an exhaustive forensic analysis, the cybersecurity team pinpointed the attack method. Which of the following wireless network-specific attacks was most likely used?

NO.25 Steve, a network engineer, was tasked with troubleshooting a network issue that is causing unexpected packet drops. For this purpose, he employed a network troubleshooting utility to capture the ICMP echo request packets sent to the server. He identified that certain packets are dropped at the gateway due to poor network connection.
Identify the network troubleshooting utility employed by Steve in the above scenario.

NO.26 FinTech Corp, a financial services software provider, handles millions of transactions daily. To address recent breaches In other organizations. It Is reevaluating Its data security controls. It specifically needs a control that will not only provide real-time protection against threats but also assist in achieving compliance with global financial regulations. The company’s primary goal is to safeguard sensitive transactional data without impeding system performance. Which of the following controls would be the most suitable for FinTech Corp’s objectives?

NO.27 Maisie. a new employee at an organization, was given an access badge with access to only the first and third floors of the organizational premises. Maisie Hied scanning her access badge against the badge reader at the second-floor entrance but was unsuccessful. Identify the short-range wireless communication technology used by the organization in this scenario.

NO.28 As a cybersecurity technician, you were assigned to analyze the file system of a Linux image captured from a device that has been attacked recently. Study the forensic image ‘Evidenced.img” in the Documents folder of the “Attacker Machine-1” and identify a user from the image file. (Practical Question)

NO.29 Ryleigh, a system administrator, was instructed to perform a full back up of organizational data on a regular basis. For this purpose, she used a backup technique on a fixed date when the employees are not accessing the system i.e., when a service-level down time is allowed a full backup is taken. Identify the backup technique utilized by Ryleigh in the above scenario.

NO.30 A company decided to implement the cloud infrastructure within its corporate firewall 10 secure sensitive data from external access. The company invested heavily in creating a cloud architecture within its premises to manage full control over its corporate data.
Which of the following types of cloud deployment models did the company implement in this scenario?

NO.31 A John-the-Ripper hash dump of an FTP server’s login credentials is stored as “target-file” on the Desktop of Attacker Machine-2. Crack the password hashes in the file to recover the login credentials of the FTP server.
The FTP root directory hosts an exploit file. Read the exploit file and enter the name of the exploit’s author as the answer. Hint: Not all the credentials will give access to the FTP. (Practical Question)

NO.32 A large multinational corporation is In the process of upgrading its network infrastructure to enhance security and protect sensitive data. As part of the upgrade, the IT team is considering implementing stateful multilayer inspection firewalls and application-level gateway firewalls.
How do stateful multilayer inspection firewalls differ from application-level gateway firewalls in terms of their packet filtering capabilities and the layers of the OSI model they inspect?

NO.33 A startup firm contains various devices connected to a wireless network across the floor. An AP with Internet connectivity is placed in a corner to allow wireless communication between devices.
To support new devices connected to the network beyond the APS range, an administrator used a network device that extended the signals of the wireless AP and transmitted it to uncovered area, identify the network component employed by the administrator to extend signals in this scenario.

NO.34 An employee was fired from his security analyst job due to misconduct. While leaving, he installed a Trojan server on his workstation at 172.30.20.75. As an ethical hacker, you are asked to identify and connect to the Trojan server and explore available files. Enter the name of the VBScript file located in the Pictures folder of the workstation. Hint: You can use one of the Ttojan client applications available at “Z:CCT-ToolsCCT Module 01 Information Security Threats and VulnerabilitiesRemote Access Ttojans (RAT)” of Attacker Machine-1. (Practical Question)

NO.35 The SOC department in a multinational organization has collected logs of a security event as
“Windows.events.evtx”. Study the Audit Failure logs in the event log file located in the Documents folder of the
-Attacker Maehine-1″ and determine the IP address of the attacker. (Note: The event ID of Audit failure logs is
4625.)
(Practical Question)

NO.36 Sam, a software engineer, visited an organization to give a demonstration on a software tool that helps in business development. The administrator at the organization created a least privileged account on a system and allocated that system to Sam for the demonstration. Using this account, Sam can only access the files that are required for the demonstration and cannot open any other file in the system.
Which of the following types of accounts the organization has given to Sam in the above scenario?

NO.37 Ayden works from home on his company’s laptop. During working hours, he received an antivirus software update notification on his laptop. Ayden clicked on the update button; however, the system restricted the update and displayed a message stating that the update could only be performed by authorized personnel.
Which of the following PCI-DSS requirements is demonstrated In this scenario?

NO.38 Tristan, a professional penetration tester, was recruited by an organization to test its network infrastructure. The organization wanted to understand its current security posture and its strength in defending against external threats. For this purpose, the organization did not provide any information about their IT infrastructure to Tristan. Thus, Tristan initiated zero-knowledge attacks, with no information or assistance from the organization. Which of the following types of penetration testing has Tristan initiated in the above scenario?

NO.39 Finley, a security professional at an organization, was tasked with monitoring the organizational network behavior through the SIEM dashboard. While monitoring, Finley noticed suspicious activities in the network; thus, he captured and analyzed a single network packet to determine whether the signature included malicious patterns. Identify the attack signature analysis technique employed by Finley in this scenario.