An ethical hacker is hired to evaluate the defenses of an organization's database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system's signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?

• A. Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form
• B. Manipulating white spaces in SQL queries to bypass signature detection
• C. Implementing sophisticated matches such as "OR 'john' = john" in place of classical matches like "OR
  1-1"
• D. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing

In an attempt to damage the reputation of a competitor organization, Hailey, a professional hacker, gathers a list of employee and client email addresses and other related information by using various search engines, social networking sites, and web spidering tools. In this process, she also uses an automated tool to gather a list of words from the target website to further perform a brute-force attack on the previously gathered email addresses.
What is the tool used by Hailey for gathering a list of words from the target website?

• A. Shadowsocks
• B. CeWL
• C. Orbot
• D. Psiphon

You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic. If you did not have a VPN, how would you identify whether someone is performing an ARP spoofing attack on your laptop?

• A. You should use netstat to check for any suspicious connections with another IP address within the LAN.
• B. You should check your ARP table and see if there is one IP address with two different MAC addresses.
• C. You cannot identify such an attack and must use a VPN to protect your traffic, r
• D. You should scan the network using Nmap to check the MAC addresses of all the hosts and look for duplicates.

Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to implant malicious backdoors in its firmware. He also identified that an installed backdoor can persist even if the server is reallocated to new clients or businesses that use it as an laaS.
What is the type of cloud attack that can be performed by exploiting the vulnerability discussed in the above scenario?

• A. Man-in-the-cloud (MITC) attack
• B. Metadata spoofing attack
• C. Cloud cryptojacking
• D. Cloudborne attack