Total No. of Questions = 20

1. Which statement defines session hijacking most accurately?

  • A) Session hijacking involves stealing a user’s login information and using that information to pose as the user later.
  • B) Session hijacking involves assuming the role of a user through the compromise of physical tokens such as common access cards.
  • C) Session hijacking is an attack that aims at stealing a legitimate session and posing as that user while communicating with the web resource or host machine.
  • D) Session hijacking involves only web applications and is specific to stealing session IDs from compromised cookies.

Show Answer

The Correct Answer is:- C

2. Jennifer has been working with sniffing and session-hijacking tools on her company network. Since she wants to stay white hat—that is, ethical—she has gotten permission to undertake these activities. What would Jennifer’s activities be categorized as?

  • A) Passive
  • B) Monitoring
  • C) Active
  • D) Sniffing

Show Answer

The Correct Answer is:- A

3. Based on the diagram, what attack is occurring?


  • A) Session splicing
  • B) Denial-of-service
  • C) Source routing
  • D) MITM

Show Answer

The Correct Answer is:- D

4. Jennifer is a junior system administrator for a small firm of 50 employees. For the last week a few users have been complaining of losing connectivity intermittently with no suspect behavior on their part such as large downloads or intensive processes. Jennifer runs Wireshark on Monday morning to investigate. She sees a large amount of ARP broadcasts being sent at a fairly constant rate. What is Jennifer most likely seeing?

  • A) ARP poisoning
  • B) ARP caching
  • C) ARP spoofing
  • D) DNS spoofing

Show Answer

The Correct Answer is:- A

5. Which of the following is not a source of session IDs?

  • A) URL
  • B) Cookie
  • C) Anonymous login
  • D) Hidden login

Show Answer

The Correct Answer is:- C

6. Which kind of values is injected into a connection to the host machine in an effort to increment the sequence number in a predictable fashion?

  • A) Counted
  • B) Bit
  • C) Null
  • D) IP

Show Answer

The Correct Answer is:- C

7. An ethical hacker sends a packet with a deliberate and specific path to its destination. What technique is the hacker using?

  • A) IP spoofing
  • B) Source routing
  • C) ARP poisoning
  • D) Host routing

Show Answer

The Correct Answer is:- B

8. Network-level hijacking focuses on the mechanics of a connection such as the manipulation of packet sequencing. What is the main focus of web app session hijacking?

  • A) Breaking user logins
  • B) Stealing session IDs
  • C) Traffic redirection
  • D) Resource DoS

Show Answer

The Correct Answer is:- B

9. A public use workstation contains the browsing history of multiple users who logged in during the last seven days. While digging through the history, a user runs across the following web address: www.snaze.com/&w25/session=22525. What kind of embedding are you seeing?

  • A) URL embedding
  • B) Session embedding
  • C) Hidden form embedding
  • D) Tracking cookie

Show Answer

The Correct Answer is:- A

10. Julie has sniffed an ample amount of traffic between the targeted victim and an authenticated resource. She has been able to correctly guess the packet sequence numbers and inject packets, but she is unable to receive any of the responses. What does this scenario define?

  • A) Switched network
  • B) SSL encryption
  • C) TCP hijacking
  • D) Blind hijacking

Show Answer

The Correct Answer is:- D

11. Session hijacking can be performed on all of the following protocols except which one?

  • A) FTP
  • B) SMTP
  • C) HTTP
  • D) IPSec

Show Answer

The Correct Answer is:- D

12. Which technology can provide protection against session hijacking?

  • A) IPSec
  • B) UDP
  • C) TCP
  • D) IDS

Show Answer

The Correct Answer is:- A

13. Session fixation is a vulnerability in which of the following?

  • A) Web applications
  • B) Networks
  • C) Software applications
  • D) Protocols

Show Answer

The Correct Answer is:- A

14. Session hijacking can be thwarted with which of the following?

  • A) SSH
  • B) FTP
  • C) Authentication
  • D) Sniffing

Show Answer

The Correct Answer is:- C

15. XSS is typically targeted toward which of the following?

  • A) Web applications
  • B) Email clients
  • C) Web browsers
  • D) Users

Show Answer

The Correct Answer is:- C

16. A man-in-the-browser attack is typically enabled by using which mechanism?

  • A) Virus
  • B) Worms
  • C) Logic bombs
  • D) Trojans

Show Answer

The Correct Answer is:- D

17. A man-in-the-middle attack is an attack where the attacking party does which of the following?

  • A) Infect the client system
  • B) Infect the server system
  • C) Insert themselves into an active session
  • D) Insert themselves into a web application

Show Answer

The Correct Answer is:- C

18. A session hijack can happen with which of the following?

  • A) Networks and applications
  • B) Networks and physical devices
  • C) Browsers and applications
  • D) Cookies and devices

Show Answer

The Correct Answer is:- A

19. A session hijack can be initiated from all of the following except which one?

  • A) Emails
  • B) Browsers
  • C) Web applications
  • D) Cookies and devices

Show Answer

The Correct Answer is:- D

20. Session hijacking can do all of the following except which one?

  • A) Take over an authenticated session
  • B) Be used to steal cookies
  • C) Take over a session
  • D) Place a cookie on a server

Show Answer

The Correct Answer is:- D