NO.193 Which of the following types of rootkits replaces regular application binaries with Trojan fakes and modifies the behavior of existing applications using hooks, patches, or injected code?

NO.194 You work as a Network Administrator in the SecureTech Inc. The SecureTech Inc. is using Linux-based server. Recently,
you have updated the password policy of the company in which the server will disable passwords after four trials.
What type of attack do you want to stop by enabling this policy?

NO.195 Which of the following threats is a combination of worm, virus, and Trojan horse characteristics?

NO.196 A Denial-of-Service (DoS) attack is mounted with the objective of causing a negative impact on the performance of a
computer or network. It is also known as network saturation attack or bandwidth consumption attack. Attackers
perform DoS attacks by sending a large number of protocol packets to a network. The problems caused by a DoS
attack are as follows:
* Saturation of network resources
* Disruption of connections between two computers, thereby preventing communications between services
* Disruption of services to a specific computer
* Failure to access a Web site
* Increase in the amount of spam
Which of the following can be used as countermeasures against DoS attacks?
Each correct answer represents a complete solution. Choose all that apply.

NO.197 You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing.
Recently, your company has assigned you a project to test the security of the we-aresecure.com Web site.
For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless whether the ports are open or close. Sometimes, IPID is being incremented by more than one value.
What may be the reason?

NO.198 Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether. The principle of ARP spoofing is to send fake ARP messages to an Ethernet LAN. What steps can be used as a countermeasure of ARP spoofing?
Each correct answer represents a complete solution. Choose all that apply.

NO.199 Which of the following statements are true about a keylogger?
Each correct answer represents a complete solution. Choose all that apply.

NO.200 You work as an Incident handler in Mariotrixt.Inc. You have followed the Incident handling process to handle the
events and incidents. You identify Denial of Service attack (DOS) from a network linked to your internal enterprise
network. Which of the following phases of the Incident handling process should you follow next to handle this
incident?

NO.201 Which of the following types of attacks come under the category of hacker attacks?
Each correct answer represents a complete solution. Choose all that apply.

NO.202 Firekiller 2000 is an example of a __________.

NO.203 Which of the following tools can be used as penetration tools in the Information system auditing process?
Each correct answer represents a complete solution. Choose two.

NO.204 Which of the following statements about reconnaissance is true?

NO.205 John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-
secure.com. On the We-are-secure login page, he enters =’or”=’ as a username and successfully logs in to the user
page of the Web site. The We-are-secure login page is vulnerable to a __________.

NO.206 Which of the following protocol loggers is used to detect ping sweep?

NO.207 Which of the following statements about buffer overflow is true?

NO.208 You work as a Network Administrator in the SecureTech Inc. The SecureTech Inc. is using Linux-based server.
Recently, you have updated the password policy of the company in which the server will disable passwords after four trials. What type of attack do you want to stop by enabling this policy?

NO.209 John works as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The
company uses Check Point SmartDefense to provide security to the network of the company. On the HTTP servers of
the company, John defines a rule for dropping any kind of userdefined URLs. Which of the following types of attacks
can be prevented by dropping the user-defined URLs?

NO.210 Which of the following attacks come under the category of layer 2 Denial-of-Service attacks?
Each correct answer represents a complete solution. Choose all that apply.

NO.211 Against which of the following does SSH provide protection?
Each correct answer represents a complete solution. Choose two.

NO.212 You work as a Network Penetration tester in the Secure Inc. Your company takes the projects to test the security of
various companies. Recently, Secure Inc. has assigned you a project to test the security of a Web site. You go to the
Web site login page and you run the following SQL query:
SELECT email, passwd, login_id, full_name
FROM members
WHERE email = ‘[email protected]’; DROP TABLE members; –‘
What task will the above SQL query perform?

NO.213 Which of the following is spy software that records activity on Macintosh systems via snapshots, keystrokes, and Web site logging?

NO.214 Which of the following refers to a condition in which a hacker sends a bunch of packets that leave TCP ports half open?

NO.215 Which of the following systems is used in the United States to coordinate emergency preparedness and incident management among various federal, state, and local agencies?

NO.216 Victor works as a professional Ethical Hacker for SecureEnet Inc. He has been assigned a job to test an image, in which
some secret information is hidden, using Steganography. Victor performs the following techniques to accomplish the
task:
1. Smoothening and decreasing contrast by averaging the pixels of the area where significant
color transitions occurs.
2. Reducing noise by adjusting color and averaging pixel value.
3. Sharpening, Rotating, Resampling, and Softening the image.
Which of the following Steganography attacks is Victor using?

NO.217 Which of the following tasks can be performed by using netcat utility?
Each correct answer represents a complete solution. Choose all that apply.