Exhibit

Study the log given in the exhibit,
Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall
rules, which among the following would be appropriate?

You are attempting to map out the firewall policy for an organization. You discover your target
system is one hop beyond the firewall. Using hping2, you send SYN packets with the exact TTL of
the target system starting at port 1 and going up to port 1024. What is this process known as?

Once an intruder has gained access to a remote system with a valid username and password, the
attacker will attempt to increase his privileges by escalating the used account to one that has
increased privileges. such as that of an administrator. What would be the best countermeasure to
protect against escalation of priveges?

Which one of the following attacks will pass through a network layer intrusion detection system
undetected?

Why would an ethical hacker use the technique of firewalking?

What makes web application vulnerabilities so aggravating? (Choose two)

An employee wants to defeat detection by a network-based IDS application. He does not want to
attack the system containing the IDS application.

Which of the following strategies can be used to defeat detection by a network-based IDS
application? (Choose the best answer)

Carl has successfully compromised a web server from behind a firewall by exploiting a
vulnerability in the web server program. He wants to proceed by installing a backdoor program.
However, he is aware that not all inbound ports on the firewall are in the open state.
From the list given below, identify the port that is most likely to be open and allowed to reach the
server that Carl has just compromised.

While scanning a network you observe that all of the web servers in the DMZ are responding to
ACK packets on port 80.
What can you infer from this observation?

You are the security administrator for a large network. You want to prevent attackers from running
any sort of traceroute into your DMZ and discover the internal structure of publicly accessible
areas of the network.
How can you achieve this?