PrepAway - Latest Free Exam Questions & Answers

Author: seenagape

How would you overcome the Firewall restriction on ICMP ECHO packets?

The traditional traceroute sends out ICMP ECHO packets with a TTL of one, and increments the
TTL until the destination has been reached. By printing the gateways that generate ICMP time
exceeded messages along the way, it is able to determine the path packets take to reach the
destination.
The problem is that with the widespread use of firewalls on the Internet today, many of the packets
that traceroute sends out end up being filtered, making it impossible to completely trace the path
to the destination.

How would you overcome the Firewall restriction on ICMP ECHO packets?

what will Snort look for in the payload of the suspected packets?

Simon is security analyst writing signatures for a Snort node he placed internally that captures all
mirrored traffic from his border firewall. From the following signature, what will Snort look for in the
payload of the suspected packets?
alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG. “BACKDOOR SIG – SubSseven
22″;flags: A+; content: “|0d0a5b52504c5d3030320d0a|”; reference:arachnids, 485;) alert


Page 133 of 555« First...102030...131132133134135...140150160...Last »