SANS Certified Incident Handler SEC504 Questions & Answers

• Question 21:

  Victor works as a professional Ethical Hacker for SecureNet Inc. He wants to use Steganographic file system method to encrypt and hide some secret information.

  Which of the following disk spaces will he use to store this secret information? Each correct answer represents a complete solution. Choose all that apply.

  A. Slack space

  B. Hidden partition

  C. Dumb space

  D. Unused Sectors

  Correct Answer: ABD

• Question 22:

  You run the following PHP script:

  $password = mysql_real_escape_string($_POST["password"]); ?>

  What is the use of the mysql_real_escape_string() function in the above script. Each correct answer

  represents a complete solution. Choose all that apply.

  A. It can be used to mitigate a cross site scripting attack.

  B. It can be used as a countermeasure against a SQL injection attack.

  C. It escapes all special characters from strings $_POST["name"] and $_POST["password"] except ' and ".

  D. It escapes all special characters from strings $_POST["name"] and $_POST["password"].

  Correct Answer: BD

• Question 23:

  Which of the following controls is described in the statement given below?

  "It ensures that the enforcement of organizational security policy does not rely on voluntary web application user compliance. It secures information by assigning sensitivity labels on information and comparing this to the level of security a user is operating at."

  A. Role-based Access Control

  B. Attribute-based Access Control

  C. Discretionary Access Control

  D. Mandatory Access Control

  Correct Answer: D

• Question 24:

  Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it to chess.exe. The size of chess.exe was 526,895 bytes originally, and after joining this chess file to the Trojan, the file size increased to 651,823 bytes. When he gives you this new game, you install the infected chess.exe file on your computer. He now performs various malicious tasks on your computer remotely. But you suspect that someone has installed a Trojan on your computer and begin to investigate it. When you enter the netstat command in the command prompt, you get the following results:

  C:\WINDOWS>netstat -an | find "UDP" UDP IP_Address:31337 *:*

  Now you check the following registry address:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServic es

  In the above address, you notice a 'default' key in the 'Name' field having " .exe" value in the corresponding 'Data' field.

  Which of the following Trojans do you think your friend may have installed on your computer on the basis of the above evidence?

  A. Qaz

  B. Donald Dick

  C. Tini

  D. Back Orifice

  Correct Answer: D

• Question 25:

  Which of the following is used to determine the operating system on the remote computer in a network environment?

  A. Spoofing

  B. Reconnaissance

  C. OS Fingerprinting

  D. Social engineering

  Correct Answer: C

• Question 26:

  The IT administrator wants to implement a stronger security policy. What are the four most important security priorities for PassGuide Software Systems Pvt. Ltd.?

  A. Providing secure communications between the overseas office and the headquarters.

  B. Implementing Certificate services on Texas office.

  C. Protecting employee data on portable computers.

  D. Providing two-factor authentication.

  E. Ensuring secure authentication.

  F. Preventing unauthorized network access.

  G. Providing secure communications between Washington and the headquarters office.

  H. Preventing denial-of-service attacks.

  Correct Answer: ACEF

• Question 27:

  You want to create an SSH tunnel for POP and SMTP protocols. Which of the following commands will you run?

  A. ssh -L 110:mailhost:110 -L 25

  B. ssh -L 110:mailhost:110 -L 25:mailhost:25 -1

  C. ssh -L 25:mailhost:110 -L 110

  D. ssh -L 110:mailhost:110 -L 25:mailhost:25 -1 user -N mailhost

  Correct Answer: D

• Question 28:

  Fill in the blank with the correct numeric value. ARP poisoning is achieved in ______ steps.

  A. 2

  Correct Answer: A

• Question 29:

  John works as a Professional Ethical Hacker for NetPerfect Inc. The company has a Linux- based network. All client computers are running on Red Hat 7.0 Linux. The Sales Manager of the company complains to John that his system contains an unknown package named as tar.gz and his documents are exploited. To resolve the problem, John uses a Port scanner to enquire about the open ports and finds out that the HTTP server service port on 27374 is open. He suspects that the other computers on the network are also facing the same problem. John discovers that a malicious application is using the synscan tool to randomly generate IP addresses.

  Which of the following worms has attacked the computer?

  A. Code red

  B. Ramen

  C. LoveLetter

  D. Nimda

  Correct Answer: B

• Question 30:

  Which of the following rootkits adds additional code or replaces portions of an operating system, including both the kernel and associated device drivers?

  A. Hypervisor rootkit

  B. Boot loader rootkit

  C. Kernel level rootkit

  D. Library rootkit

  Correct Answer: C