During a red team engagement simulating a targeted attack on a smart office environment, an ethical hacker identifies a thermostat used for regulating temperature across multiple floors. While analyzing its firmware management process, the tester discovers that the device accepts older versions without verifying their integrity or authenticity. The attacker successfully loads a previously deprecated firmware that contains known vulnerabilities and gains unauthorized access to the broader network by exploiting reintroduced flaws. No mechanisms are in place to prevent version rollback or verify firmware trustworthiness. Which IoT security issue is most accurately demonstrated in this scenario?

• A. Lack of secure update mechanisms
• B. Use of insecure third-party components
• C. Denial-of-service through physical tampering
• D. Insecure network service exposure

설명: (Fast2test 회원만 볼 수 있음)

Jake, a network security specialist, is trying to prevent network-level session hijacking attacks in his company. While studying different types of such attacks, he learns about a technique where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets. Which of the following types of network-level session hijacking attacks is Jake studying?

• A. Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing
• B. TCP/IP Hijacking
• C. UDP Hijacking
• D. RST Hijacking

During a black-box security assessment of a large enterprise network, the penetration tester scans the internal environment and identifies that TCP port 389 is open on a domain controller.
Upon further investigation, the tester runs the ldapsearch utility without providing any authentication credentials and successfully retrieves a list of usernames, email addresses, and departmental affiliations from the LDAP directory. The tester notes that this sensitive information was disclosed without triggering any access control mechanisms or requiring login credentials.
Based on this behavior, what type of LDAP access mechanism is most likely being exploited?

• A. Anonymous LDAP binding
• B. LDAP over SSL (LDAPS)
• C. Authenticated LDAP with Kerberos
• D. LDAP via RADIUS relay

설명: (Fast2test 회원만 볼 수 있음)

You're an IT security analyst at a fast-growing fintech startup. Recently, you've noticed an uptick in network traffic anomalies. You decide to perform a more thorough network scan using the ICMP Echo Request method. During the scan, you notice that a certain set of IPs in your network are not returning any Echo Reply, but other network functionalities seem to be operating normally. How would you interpret this situation?

• A. The lack of an Echo Reply is a clear sign of a major breach in progress.
• B. The scanned IPs are likely unused and can be considered for future expansion.
• C. The non-responsive IPs indicate severe network congestion that needs immediate addressing.
• D. The firewall or another security control is probably blocking the ICMP Echo Requests.

설명: (Fast2test 회원만 볼 수 있음)

Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered. John decided to perform a TCP SYN ping scan on the target network.
Which of the following Nmap commands must John use to perform the TCP SYN ping scan?

• A. nmap -sn -PS < target IP address >
• B. nmap -sn -PP < target IP address >
• C. nmap -sn -PA < target IP address >
• D. nmap -sn -PO < target IP address >