Pass the SANS Certified Incident Handler SEC504 Questions and answers with CertsForce

Viewing page 5 out of 10 pages
Viewing questions 41-50 out of questions
Questions # 41:

Which of the following is used to gather information about a remote network protected by a firewall?

Options:

A.

Warchalking


B.

Wardialing


C.

Firechalking


D.

Firewalking


Expert Solution
Questions # 42:

You want to add a netbus Trojan in the chess.exe game program so that you can gain remote access to a friend's computer. Which of the following tools will you use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Tripwire


B.

Yet Another Binder


C.

Pretator Wrapper


D.

Beast


Expert Solution
Questions # 43:

Which of the following applications automatically calculates cryptographic hashes of all key system files that are to be monitored for modifications?

Options:

A.

Tripwire


B.

TCPView


C.

PrcView


D.

Inzider


Expert Solution
Questions # 44:

Which of the following rootkits adds additional code or replaces portions of an operating system, including both the kernel and associated device drivers?

Options:

A.

Hypervisor rootkit


B.

Boot loader rootkit


C.

Kernel level rootkit


D.

Library rootkit


Expert Solution
Questions # 45:

An Active Attack is a type of steganography attack in which the attacker changes the carrier during the communication process. Which of the following techniques is used for smoothing the transition and controlling contrast on the hard edges, where there is significant color transition?

Options:

A.

Soften


B.

Rotate


C.

Sharpen


D.

Blur


Expert Solution
Questions # 46:

Adam works as an Incident Handler for Umbrella Inc. He is informed by the senior authorities that the server of the marketing department has been affected by a malicious hacking attack. Supervisors are also claiming that some sensitive data are also stolen.

Adam immediately arrived to the server room of the marketing department and identified the event as an incident. He isolated the infected network from the remaining part of the network and started preparing to image the entire system. He captures volatile data, such as running process, ram, and network connections.

Which of the following steps of the incident handling process is being performed by Adam?

Options:

A.

Recovery


B.

Eradication


C.

Identification


D.

Containment


Expert Solution
Questions # 47:

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint.

Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Options:

A.

nmap -sS


B.

nmap -sU -p


C.

nmap -O -p


D.

nmap -sT


Expert Solution
Questions # 48:

Which of the following IP packet elements is responsible for authentication while using IPSec?

Options:

A.

Authentication Header (AH)


B.

Layer 2 Tunneling Protocol (L2TP)


C.

Internet Key Exchange (IKE)


D.

Encapsulating Security Payload (ESP)


Expert Solution
Questions # 49:

You execute the following netcat command:

c:\target\nc -1 -p 53 -d -e cmd.exe

What action do you want to perform by issuing the above command?

Options:

A.

Listen the incoming data and performing port scanning


B.

Capture data on port 53 and performing banner grabbing


C.

Capture data on port 53 and delete the remote shell


D.

Listen the incoming traffic on port 53 and execute the remote shell


Expert Solution
Questions # 50:

Which of the following is an Internet mapping technique that relies on various BGP collectors that collect information such as routing updates and tables and provide this information publicly?

Options:

A.

AS Route Inference


B.

Path MTU discovery (PMTUD)


C.

AS PATH Inference


D.

Firewalking


Expert Solution
Viewing page 5 out of 10 pages
Viewing questions 41-50 out of questions