Joseph has just been hired on to a contractor company of the Department of Defense as their
Senior Security Analyst. Joseph has been instructed on the company’s strict security policies that
have been implemented, and the policies that have yet to be put in place. Per the Department of
Defense, all DoD users and the users of their contractors must use two-factor authentication to
access their networks. Joseph has been delegated the task of researching and implementing the
best two-factor authentication method for his company. Joseph’s supervisor has told him that they
would like to use some type of hardware device in tandem with a security or identifying pin

number. Joseph’s company has already researched using smart cards and all the resources
needed to implement them, but found the smart cards to not be cost effective. What type of device
should Joseph use for two-factor authentication?

What is the term 8 to describe an attack that falsifies a broadcast ICMP echo request and includes
a primary and secondary victim?

What type of attack is shown here?

What is the goal of a Denial of Service Attack?

What is the correct order of steps in CEH System Hacking Cycle?

What do you call a system where users need to remember only one username and password,
and be authenticated for multiple services?

Identify SQL injection attack from the HTTP requests shown below:

Clive has been monitoring his IDS and sees that there are a huge number of ICMP Echo Reply
packets that are being received on the external gateway interface. Further inspection reveals that
they are not responses from the internal hosts’ requests but simply responses coming from the
Internet.
What could be the most likely cause?

To see how some of the hosts on your network react, Winston sends out SYN packets to an IP
range. A number of IPs respond with a SYN/ACK response. Before the connection is established
he sends RST packets to those hosts to stop the session. Winston has done this to see how his
intrusion detection system will log the traffic. What type of scan is Winston attempting here?

What would best be defined as a security test on services against a known vulnerability database
using an automated tool?