Master GAQM CPEH-001 Exam with Reliable Practice Questions
Upgrade to Premium
Basically, there are two approaches to network intrusion detection: signature detection, and anomaly detection. The signature detection approach utilizes well-known signatures for network traffic to identify potentially malicious traffic. The anomaly detection approach utilizes a previous history of network traffic to search for patterns that are abnormal, which would indicate an intrusion. How can an attacker disguise his buffer overflow attack signature such that there is a greater probability of his attack going undetected by the IDS?
Correct : D
ADMmutate is using a polymorphic technique designed to circumvent certain forms of signature based intrusion detection. All network based remote buffer overflow exploits have similarities in how they function. ADMmutate has the ability to emulate the protocol of the service the attacker is attempting to exploit. The data payload (sometimes referred to as an egg) contains the instructions the attacker wants to execute on the target machine. These eggs are generally interchangeable and can be utilized in many different buffer overflow exploits. ADMmutate uses several techniques to randomize the contents of the egg in any given buffer overflow exploit. This randomization effectively changes the content or 'signature' of the exploit without changing the functionality of the exploit.
Start a Discussions
John has a proxy server on his network which caches and filters web access. He shuts down all unnecessary ports and services. Additionally, he has installed a firewall (Cisco PIX) that will not allow users to connect to any outbound ports. Jack, a network user has successfully connected to a remote server on port 80 using netcat. He could in turn drop a shell from the remote machine. Assuming an attacker wants to penetrate John's network, which of the following options is he likely to choose?
Correct : D
As long as you allow http or https traffic attacks can be tunneled over those protocols with Stunnel or HTTPTunnel.
Start a Discussions
A program that defends against a port scanner will attempt to:
Correct : D
Start a Discussions
Exhibit:
Given the following extract from the snort log on a honeypot, what do you infer from the attack?
Correct : D
The attacker submits a PASS to the honeypot and receives a login incorrect before disconnecting.
Start a Discussions
A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) then it was intended to hold.What is the most common cause of buffer overflow in software today?
Correct : D
Technically, a buffer overflow is a problem with the program's internal implementation.
Start a Discussions