An attacker attaches a rogue router in a network. He wants to redirect traffic to a LAN attached to his router as part of a man-in-the-middle attack. What measure on behalf of the legitimate admin can mitigate this attack?

• A. Only using OSPFv3 will mitigate this risk.
• B. Redirection of the traffic cannot happen unless the admin allows it explicitly.
• C. Disable all routing protocols and only use static routes.
• D. Make sure that legitimate network routers are configured to run routing protocols with authentication.

When you return to your desk after a lunch break, you notice a strange email in your inbox. The sender is someone you did business with recently, but the subject line has strange characters in it.
What should you do?

• A. Delete the email and pretend nothing happened
• B. Forward the message to your company's security response team and permanently delete the message from your computer.
• C. Forward the message to your supervisor and ask for her opinion on how to handle the situation
• D. Reply to the sender and ask them for more information about the message contents.

Why would an attacker want to perform a scan on port 137?

• A. To check for file and print sharing on Windows systems
• B. To disrupt the NetBIOS SMB service on the target host
• C. To discover information about a target host using NBTSTAT
• D. To discover proxy servers on a network

When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is

• A. OSSTMM addresses controls and OWASP does not.
• B. OSSTMM is gray box testing and OWASP is black box testing.
• C. OWASP is for web applications and OSSTMM does not include web applications.
• D. OWASP addresses controls and OSSTMM does not.