A digital signature is simply a message that is encrypted with the public key instead of the private
key.

Blane is a network security analyst for his company. From an outside IP, Blane performs an XMAS
scan using Nmap. Almost every port scanned does not illicit a response. What can he infer from
this kind of response?

In TCP communications there are 8 flags; FIN, SYN, RST, PSH, ACK, URG, ECE, CWR. These
flags have decimal numbers assigned to them:
FIN = 1
SYN = 2
RST = 4
PSH = 8
ACK = 16
URG = 32
ECE = 64
CWR =128
ExamplE. To calculate SYN/ACK flag decimal value, add 2 (which is the decimal value of the SYN
flag) to 16 (which is the decimal value of the ACK flag), so the result would be 18.

Based on the above calculation, what is the decimal value for XMAS scan?

A simple compiler technique used by programmers is to add a terminator ‘canary word’ containing
four letters NULL (0x00), CR (0x0d), LF (0x0a) and EOF (0xff) so that most string operations are
terminated. If the canary word has been altered when the function returns, and the program
responds by emitting an intruder alert into syslog, and then halts what does it indicate?

This is an example of whois record.

Sometimes a company shares a little too much information on their organization through public
domain records. Based on the above whois record, what can an attacker do? (Select 2 answers)

Neil is closely monitoring his firewall rules and logs on a regular basis. Some of the users have
complained to Neil that there are a few employees who are visiting offensive web site during work
hours, without any consideration for others. Neil knows that he has an up-to-date content filtering
system and such access should not be authorized. What type of technique might be used by these
offenders to access the Internet without restriction?

In this attack, a victim receives an e-mail claiming from PayPal stating that their account has been
disabled and confirmation is required before activation. The attackers then scam to collect not one
but two credit card numbers, ATM PIN number and other personal details.

Ignorant users usually fall prey to this scam. Which of the following statement is incorrect related
to this attack?

Bob is going to perform an active session hijack against Brownies Inc. He has found a target that
allows session oriented connections (Telnet) and performs the sequence prediction on the target
operating system. He manages to find an active session due to the high level of traffic on the
network. What is Bob supposed to do next?

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus
code mutates while keeping the original algorithm intact, the code changes itself each time it runs,
but the function of the code (its semantics) will not change at all.

Here is a section of the Virus code:

What is this technique called?

“Testing the network using the same methodologies and tools employed by attackers” Identify the
correct terminology that defines the above statement.