Which one of the following Snort logger mode commands is associated to run a binary log file through Snort in sniffer mode to dump the packets to the screen?
Answer(s): C
The SnortMain () function begins by associating a set of handlers for the signals, Snort receives. It does this using the signal () function. Which one of the following functions is used as a program specific signal and the handler for this calls the DropStats() function to output the current Snort statistics?
Answer(s): A
Due to illegal inputs, various types of TCP stacks respond in a different manner. SomeIDSs do not take into account the TCP protocol's urgency feature, which could allow testers to evade the IDS.Penetration tester needs to try different combinations of TCP flags (e.g. none, SYN/FIN, SYN/RST, SYN/FIN/ACK, SYN/RST/ACK, and All Flags) to test the IDS.Which of the following TCP flag combinations combines the problem of initiation, midstream, and termination flags with the PSH and URG?
Answer(s): D
http://books.google.com.pk/books?id=tUCumJot0ocC&pg=PA63&lpg=PA63&dq=TCP+flag+combinations+combines+the+problem+of+initiation,+midstream,+and+termination+flags+with+the+PSH+and+URG&source=bl&ots=mIGSXBIi15&sig=WMnXlEChVSU4RhK65W_V3tzNjns&hl=en&sa=X&ei=H7AfVJCtLaufygO1v4DQDg&ved=0CBsQ6AEwAA#v=onepage&q=TCP%20flag%20combinations%20combines%20the%20problem%20of%20initiation%2C%20midstream%2C%20and%20termination%20flags%20with%20the%20PSH%20and%20URG&f=false (see the highlighted sentence in Table 3-1 at the end of the page)
Which one of the following scans starts, but does not complete the TCP handshake sequence for each port selected, and it works well for direct scanning and often works well through firewalls?
Which of the following is an application alert returned by a web application that helps an attacker guess a valid username?
Post your Comments and Discuss EC-Council ECSAV8 exam prep with other Community members: