Pass the SANS Certified Incident Handler SEC504 Questions and answers with ExamsMirror

Which of the following is used to determine the range of IP addresses that are mapped to a live hosts?

Which of the following statements about smurf is true?

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint.

Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Which of the following types of rootkits replaces regular application binaries with Trojan fakes and modifies the behavior of existing applications using hooks, patches, or injected code?

You want to measure the number of heaps used and overflows occurred at a point in time. Which of the following commands will you run to activate the appropriate monitor?

Fill in the blank with the appropriate term.

______ is a technique used to make sure that incoming packets are actually from the networks that they claim to be from.

Which of the following is the method of hiding data within another media type such as graphic or document?

Which of the following are the rules by which an organization operates?

Which of the following virus is a script that attaches itself to a file or template?

Which of the following strategies allows a user to limit access according to unique hardware information supplied by a potential client?