SANS SEC504 Exam Dumps

John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each correct answer represents a complete solution. Choose all that apply. 

Which of the following tasks can be performed by using netcat utility?Each correct answer represents a complete solution. Choose all that apply. 

John works as a Network Administrator for We-are-secure Inc. He finds that TCP port 7597 of the Weare- secure serveris open. He suspects that it may be open due to a Trojan installed on the server. He presents a report to the companydescribing the symptoms of the Trojan. A summary of the report is given below:Once this Trojan has been installed on the computer, it searches Notpad.exe, renames it Note.com, and then copies itselfto the computer as Notepad.exe. Each time Notepad.exe is executed, the Trojan executes and calls the original Notepadto avoid being noticed.Which of the following Trojans has the symptoms as the one described above?

Which of the following procedures is designed to enable security personnel to identify, mitigate, and recover frommalicious computer incidents, such as unauthorized access to a system or data, denialof-service, or unauthorized changesto system hardware, software, or data? 

You work as a professional Ethical Hacker. You are assigned a project to test the security of www.weare-secure.com.You somehow enter in we-are-secure Inc. main server, which is Windows based.While you are installing the NetCat tool as a backdoor in the we-are-secure server, you see the file credit.dat having thelist of credit card numbers of the company's employees. You want to transfer the credit.dat file in your local computer sothat you can sell that information on the internet in the good price. However, you do not want to send the contents of thisfile in the clear text format since you do not want that the Network Administrator of the we-are-secure Inc. can get anyclue of the hacking attempt. Hence, you decide to send the content of the credit.dat file in the encrypted format.What steps should you take to accomplish the task? 

Fill in the blank with the correct numeric value. ARP poisoning is achieved in ______ steps.

You have forgotten your password of an online shop. The web application of that online shop asks you to enter youremail so that they can send you a new password. You enter your [email protected] press the submit button.The Web application displays the server error. What can be the reason of the error? 

Jane works as a Consumer Support Technician for ABC Inc. The company provides troubleshooting support to users.Jane is troubleshooting the computer of a user who has installed software that automatically gains full permissions on hiscomputer. Jane has never seen this software before. Which of the following types of malware is the user facing on hiscomputer? 

You want to add a netbus Trojan in the chess.exe game program so that you can gain remote access to a friend'scomputer. Which of the following tools will you use to accomplish the task?Each correct answer represents a complete solution. Choose all that apply. 

Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping the conversation and keeps the password. After the interchange is over, Eve connects to Bob posing as Alice; when asked for a proof of identity, Eve sends Alice's password read from the last session, which Bob accepts. Which of the following attacks is being used by Eve? 

Which of the following is used to gather information about a remote network protected by a firewall?  

Which of the following statements are correct about spoofing and session hijacking?Each correct answer represents a complete solution. Choose all that apply. 

Windump is a Windows port of the famous TCPDump packet sniffer available on a variety of platforms. In order to usethis tool on the Windows platform a user must install a packet capture library.What is the name of this library? 

Which of the following is used to determine the operating system on the remote computer in a network environment?  

Which of the following IP packet elements is responsible for authentication while using IPSec?  

You run the following PHP script:<?php $name = mysql_real_escape_string($_POST["name"]);$password = mysql_real_escape_string($_POST["password"]); ?>What is the use of the mysql_real_escape_string() function in the above script. Each correct answer represents acomplete solution. Choose all that apply. 

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small-sized packets to thetarget computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of thefollowing tools can be used toperform session splicing attacks?Each correct answer represents a complete solution. Choose all that apply. 

Adam works as a Security Administrator for Umbrella Technology Inc. He reported a breach in security to his seniormembers, stating that "security defenses has been breached and exploited for 2 weeks by hackers." The hackers hadaccessed and downloaded 50,000 addresses containing customer credit cards and passwords. Umbrella Technology waslooking to law enforcement officials to protect their intellectual property.The intruder entered through an employee's home machine, which was connected to Umbrella Technology's corporateVPN network. The application called BEAST Trojan was used in the attack to open a "back door" allowing the hackersundetected access. The security breach was discovered when customers complained about the usage of their credit cardswithout their knowledge.The hackers were traced back to Shanghai, China through e-mail address evidence. The credit card information was sentto that same e-mail address. The passwords allowed the hackers to access Umbrella Technology's network from a remotelocation, posing as employees.Which of the following actions can Adam perform to prevent such attacks from occurring in future? 

Which of the following are the rules by which an organization operates?

Which of the following types of rootkits replaces regular application binaries with Trojan fakes and modifies thebehavior of existing applications using hooks, patches, or injected code? 

Which of the following are the limitations for the cross site request forgery (CSRF) attack?Each correct answer represents a complete solution. Choose all that apply. 

Which of the following Linux rootkits allows an attacker to hide files, processes, and network connections?Each correct answer represents a complete solution. Choose all that apply.

Adam works as an Incident Handler for Umbrella Inc. He is informed by the senior authorities that the server of themarketing department has been affected by a malicious hacking attack. Supervisors are also claiming that some sensitivedata are also stolen.Adam immediately arrived to the server room of the marketing department and identified the event as an incident. Heisolated the infected network from the remaining part of the network and started preparing to image the entire system. Hecaptures volatile data, such as running process, ram, and network connections.Which of the following steps of the incident handling process is being performed by Adam?

Which of the following steps of incident response is steady in nature?  

Which of the following Trojans is used by attackers to modify the Web browser settings?