Ethical 11 Flashcards
When a DDoS attack starts, which forensic tool can be used to stop the system from being flooded by packets?
Zombie Zapper tool
A client has asked you for assistance with deploying DDoS countermeasures. What recommendations are valid?
- Egress filtering should be used to scan IP packets going out of a network, and should only be forwarded if packets meet predefined specifications.
- Handlers should be quickly detected and disabled to disrupt DDoS attacks.
A client’s web host is currently experiencing a massive DoS attack from a specific source IP. What countermeasure(s) could be used to mitigate the effects of the DoS attack while minimizing the inconvenience to end users?
- Routers can be configured to drop packets with a specific destination address.
- ISPs can drop the transmission of falsely addressed packets within their controlled networks.
Which tool used to create a DoS attack targets a vulnerability in Windows networking code that allows remote attackers to consume 100% of the CPU time?
Jolt2
Your client has asked you to implement a decoy network with the intent to steer attacks away from more sensitive networks. What type of honeypot system is this?
High-interaction honeypot
In which type of attack does an attacker typically use a botnet to send a large number of queries to open DNS servers?
Reflective DNS attack
Once Agobot is in the system directory, where does it place autorun entries in the registry?
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
A SYN flood is an example of what mode of DoS attack?
Network Connectivity
In which attack does an attacker deliberately sends an ICMP echo packet of more than the 65,536 bytes?
Ping of death
In the second step of an Agobot attack, the Agobots can use network shares to infect other systems. Which method is the Agobot employing in this spreading stage?
Via the network
Which of the following are software applications that run automated tasks over the internet?
Bots
What two DDoS utilities are IRC based, and both provide the ability to use SYN attacks?
Knight
Kaiten
Regarding an IRC based DDoS model versus an agent/handler model, what statements are accurate?
The IRC method enables simple file sharing capabilities for agent code allotment.
Legitimate IRC ports can be utilized for communication with agents.
Which method can be an effective countermeasure against SYN attacks?
Decreasing the SYN RECEIVED time-out period
A computer on your client’s network has been detected as running listening services on port 6667 and 33270. What DDoS tool is being utilized?
Trinity
Which type of attack uses the TCP three-way handshake to create incomplete connections?
SYN
What DoS tool can be used to generate random packets with spoofed source IPs?
Nemesy
You are attempting to perform a DDoS attack utilizing forged UDP packets to link the echo service on one target machine with the character generator on another machine. What type of DDoS attack is this?
Fraggle attack
What are the “secondary victims” of a DDoS attack called?
Zombies
Which registry entry can be used to automatically start a program when Windows boots?
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
