Pass the SANS Certified Incident Handler SEC504 Questions and answers with CertsForce

Viewing page 1 out of 10 pages
Viewing questions 1-10 out of questions
Questions # 1:

John, a part-time hacker, has accessed in unauthorized way to the www.yourbank.com banking Website and stolen the bank account information of its users and their credit card numbers by using the SQL injection attack. Now, John wants to sell this information to malicious person Mark and make a deal to get a good amount of money. Since, he does not want to send the hacked information in the clear text format to Mark; he decides to send information in hidden text. For this, he takes a steganography tool and hides the information in ASCII text by appending whitespace to the end of lines and encrypts the hidden information by using the IDEA encryption algorithm. Which of the following tools is John using for steganography?

Options:

A.

Image Hide


B.

2Mosaic


C.

Snow.exe


D.

Netcat


Expert Solution
Questions # 2:

The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries of the default Windows Address Book (WAB). Which of the following registry values can be used to identify this worm?

Options:

A.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices


B.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run


C.

HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"


D.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run


Expert Solution
Questions # 3:

Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Adam uses antivirus software, anti-spyware software, and keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Adam finds that his computer is even more noticeably slow. He also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Adam notices that his computer only has about 10 GB of free space available. Since his hard drive is a 200 GB hard drive, Adam thinks this is very odd.

Which of the following is the mostly likely the cause of the problem?

Options:

A.

Computer is infected with the stealth kernel level rootkit.


B.

Computer is infected with stealth virus.


C.

Computer is infected with the Stealth Trojan Virus.


D.

Computer is infected with the Self-Replication Worm.


Expert Solution
Questions # 4:

Which of the following statements about Denial-of-Service (DoS) attack are true?

Each correct answer represents a complete solution. Choose three.

Options:

A.

It disrupts services to a specific computer.


B.

It changes the configuration of the TCP/IP protocol.


C.

It saturates network resources.


D.

It disrupts connections between two computers, preventing communications between services.


Expert Solution
Questions # 5:

You check performance logs and note that there has been a recent dramatic increase in the amount of broadcast traffic. What is this most likely to be an indicator of?

Options:

A.

Virus


B.

Syn flood


C.

Misconfigured router


D.

DoS attack


Expert Solution
Questions # 6:

Adam works as a Network Administrator for PassGuide Inc. He wants to prevent the network from DOS attacks. Which of the following is most useful against DOS attacks?

Options:

A.

SPI


B.

Distributive firewall


C.

Honey Pot


D.

Internet bot


Expert Solution
Questions # 7:

Which of the following Denial-of-Service (DoS) attacks employ IP fragmentation mechanism?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Land attack


B.

SYN flood attack


C.

Teardrop attack


D.

Ping of Death attack


Expert Solution
Questions # 8:

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

Options:

A.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup


B.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto


C.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices


D.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start


Expert Solution
Questions # 9:

Which of the following is spy software that records activity on Macintosh systems via snapshots, keystrokes, and Web site logging?

Options:

A.

Spector


B.

Magic Lantern


C.

eblaster


D.

NetBus


Expert Solution
Questions # 10:

Which of the following is a computer worm that caused a denial of service on some Internet hosts and dramatically slowed down general Internet traffic?

Options:

A.

Klez


B.

Code red


C.

SQL Slammer


D.

Beast


Expert Solution
Viewing page 1 out of 10 pages
Viewing questions 1-10 out of questions