SANS SEC504 Dumps – The Sure Way To Pass Exam [Q112-Q127]

5/5 - (1 vote)

SANS SEC504 Dumps – The Sure Way To Pass Exam

SEC504 Exam Questions (Updated 2022) 100% Real Question Answers

NEW QUESTION 112
Adam works as a Network administrator for Umbrella Inc. He noticed that an ICMP ECHO requests is coming from some suspected outside sources. Adam suspects that some malicious hacker is trying to perform ping sweep attack on the network of the company. To stop this malicious activity, Adam blocks the ICMP ECHO request from any outside sources.
What will be the effect of the action taken by Adam?

Network turns completely immune from the ping sweep attacks.

Network is still vulnerable to ping sweep attack.

Network is protected from the ping sweep attack until the next reboot of the server.

Network is now vulnerable to Ping of death attack.

NEW QUESTION 113
You are responsible for security at a company that uses a lot of Web applications. You are most concerned about flaws in those applications allowing some attacker to get into your network. What method would be best for finding such flaws?

Manual penetration testing

Code review

Automated penetration testing

Vulnerability scanning

Explanation

NEW QUESTION 114
You work as a System Administrator for Happy World Inc. Your company has a server named uC1 that runs Windows Server 2008. The Windows Server virtualization role service is installed on the uC1 server which hosts one virtual machine that also runs Windows Server 2008. You are required to install a new application on the virtual machine. You need to ensure that in case of a failure of the application installation, you are able to quickly restore the virtual machine to its original state. Which of the following actions will you perform to accomplish the task?

Use the Virtualization Management Console to save the state of the virtual machine.

Log on to the virtual host and create a new dynamically expanding virtual hard disk.

Use the Virtualization Management Console to create a snapshot of the virtual machine.

Use the Edit Virtual Hard Disk Wizard to copy the virtual hard disk of the virtual machine.

NEW QUESTION 115
Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether. The principle of ARP spoofing is to send fake ARP messages to an Ethernet LAN. What steps can be used as a countermeasure of ARP spoofing?
Each correct answer represents a complete solution. Choose all that apply.

Using smash guard utility

Using ARP Guard utility

Using static ARP entries on servers, workstation and routers

Using ARP watch utility

Using IDS Sensors to check continually for large amount of ARP traffic on local subnets

NEW QUESTION 116
Which of the following attacks is specially used for cracking a password?

PING attack

Dictionary attack

Vulnerability attack

DoS attack

NEW QUESTION 117
Adam works as an Incident Handler for Umbrella Inc. His recent actions towards the incident are not up to the standard norms of the company. He always forgets some steps and procedures while handling responses as they are very hectic to perform.
Which of the following steps should Adam take to overcome this problem with the least administrative effort?

Create incident manual read it every time incident occurs.

Appoint someone else to check the procedures.

Create incident checklists.

Create new sub-team to keep check.

NEW QUESTION 118
In which of the following attacking methods does an attacker distribute incorrect IP address?

IP spoofing

Mac flooding

DNS poisoning

Man-in-the-middle

NEW QUESTION 119
Which of the following actions is performed by the netcat command given below?
nc 55555 < /etc/passwd

It changes the /etc/passwd file when connected to the UDP port 55555.

It resets the /etc/passwd file to the UDP port 55555.

It fills the incoming connections to /etc/passwd file.

It grabs the /etc/passwd file when connected to UDP port 55555.

NEW QUESTION 120
Which of the following tools can be used for network sniffing as well as for intercepting conversations through session hijacking?

Ethercap

Tripwire

IPChains

Hunt

NEW QUESTION 121
Which of the following malicious code can have more than one type of trigger, multiple task capabilities, and can replicate itself in more than one manner?

Macro virus

Blended threat

Trojan

Boot sector virus

NEW QUESTION 122
Which of the following describes network traffic that originates from the inside of a network perimeter and progresses towards the outside?

Ingress network

Inwards network

Egress network

Outwards network

NEW QUESTION 123
Which of the following refers to a condition in which a hacker sends a bunch of packets that leave TCP ports half open?

Spoofing

Hacking

SYN attack

PING attack

NEW QUESTION 124
Peter works as a Network Administrator for the PassGuide Inc. The company has a Windows-based network. All client computers run the Windows XP operating system. The employees of the company complain that suddenly all of the client computers have started working slowly. Peter finds that a malicious hacker is attempting to slow down the computers by flooding the network with a large number of requests. Which of the following attacks is being implemented by the malicious hacker?

SQL injection attack

Denial-of-Service (DoS) attack

Man-in-the-middle attack

Buffer overflow attack

NEW QUESTION 125
In which of the following methods does an hacker use packet sniffing to read network traffic between two parties to steal the session cookies?

Cross-site scripting

Physical accessing

Session fixation

Session sidejacking

NEW QUESTION 126
Which of the following tools is described in the statement given below?
“It has a database containing signatures to be able to detect hundreds of vulnerabilities in UNIX, Windows, and commonly used web CGI scripts. Moreover, the database detects DdoS zombies and Trojans as well.”

SARA

Nessus

Anti-x

Nmap

NEW QUESTION 127
Your company has been hired to provide consultancy, development, and integration services for a company named Brainbridge International. You have prepared a case study to plan the upgrade for the company. Based on the case study, which of the following steps will you suggest for configuring WebStore1?
Each correct answer represents a part of the solution. Choose two.

Customize IIS 6.0 to display a legal warning page on the generation of the 404.2 and 404.3 errors.

Move the WebStore1 server to the internal network.

Configure IIS 6.0 on WebStore1 to scan the URL for known buffer overflow attacks.

Move the computer account of WebStore1 to the Remote organizational unit (OU).

Loading …

SANS SEC504 Exam Syllabus Topics:

Topic	Details
Topic 1	Choosing a target protocol for password guessing attacks Basic approaches for investigating malware
Topic 2	Monitoring the environment using snapshot and continuous recording tools Best practices for working with malware
Topic 3	Understanding Windows hashing function through Windows Server 2019 Taking notes and writing reports
Topic 4	Using Kibana to identify password attack events Recommendations for password cracking in your organization
Topic 5	Attacker evolution and the network for tool, technique, and practice (TTP) mapping How to collect digital evidence