CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. ECSAV8

Free ECSAV8 Exam Braindumps (page: 7)

Page 6 of 51
PDF with 200 Questions

Which one of the following Snort logger mode commands is associated to run a binary log file through Snort in sniffer mode to dump the packets to the screen?

  1. ./snort -dvr packet.log icmp
  2. ./snort -dev -l ./log
  3. ./snort -dv -r packet.log
  4. ./snort -l ./log –b

Answer(s): C



The SnortMain () function begins by associating a set of handlers for the signals, Snort receives. It does this using the signal () function. Which one of the following functions is used as a program specific signal and the handler for this calls the DropStats() function to output the current Snort statistics?

  1. SIGUSR1
  2. SIGTERM
  3. SIGINT
  4. SIGHUP

Answer(s): A



Due to illegal inputs, various types of TCP stacks respond in a different manner. Some
IDSs do not take into account the TCP protocol's urgency feature, which could allow testers to evade the IDS.


Penetration tester needs to try different combinations of TCP flags (e.g. none, SYN/FIN, SYN/RST, SYN/FIN/ACK, SYN/RST/ACK, and All Flags) to test the IDS.

Which of the following TCP flag combinations combines the problem of initiation, midstream, and termination flags with the PSH and URG?

  1. SYN/RST/ACK
  2. SYN/FIN/ACK
  3. SYN/FIN
  4. All Flags

Answer(s): D


Reference:

http://books.google.com.pk/books?id=tUCumJot0ocC&pg=PA63&lpg=PA63&dq=TCP+flag+combinations+combines+the+problem+of+initiation,+midstream,+and+termination+flags+with+the+PSH+and+URG&source=bl&ots=mIGSXBIi15&sig=WMnXlEChVSU4RhK65W_V3tzNjns&hl=en&sa=X&ei=H7AfVJCtLaufygO1v4DQDg&ved=0CBsQ6AEwAA#v=onepage&q=TCP%20flag%20combinations%20combines%20the%20problem%20of%20initiation%2C%20midstream%2C%20and%20termination%20flags%20with%20the%20PSH%20and%20URG&f=false (see the highlighted sentence in Table 3-1 at the end of the page)



Which one of the following scans starts, but does not complete the TCP handshake sequence for each port selected, and it works well for direct scanning and often works well through firewalls?

  1. SYN Scan
  2. Connect() scan
  3. XMAS Scan
  4. Null Scan

Answer(s): A






Post your Comments and Discuss EC-Council ECSAV8 exam with other Community members:

ECSAV8 Discussions & Posts