SANS SEC401 EVALUATIONS EXAM QUESTIONS AND
SOLUTIONS MARKED A+
✔✔What Nmap option enables you to write results in XML format? - ✔✔-oX
✔✔Which Nmap scan type performs a Stealth Scan? - ✔✔-sS
✔✔In what language are NSE scripts written? - ✔✔Lua
✔✔What is the name of the tool we used to display text from the program? - ✔✔strings
✔✔What message did we get during the buffer overflow? - ✔✔Segmentation fault
✔✔What do we prepend to a program to ensure it runs from the current folder? - ✔✔./
✔✔What is the name of the function enabling this command injection bug? - ✔✔system
✔✔True or False? You need to use the | symbol to append on an additional command?
- ✔✔False
✔✔What command did you use to go to the restricted shell? - ✔✔rbash
✔✔Which hping3 option performs IP source address spoofing? - ✔✔-a
✔✔True or False? hping3 can transfer files covertly? - ✔✔True
✔✔Using the "-t" flag with hping3, what can we set the value for? - ✔✔TTL
✔✔Using the Pre-Scale option increases the host size by how many times? - ✔✔4
✔✔What is the name of the GUI you can use to manage GPG? - ✔✔GNU Privacy
Assistant
✔✔What encrypts the hash used in a digital signature? - ✔✔Sender's private key
✔✔True or False? Snort can read existing tcpdump PCAP files? - ✔✔True
✔✔Sourcefire was acquired by what well-known company? - ✔✔Cisco Systems
✔✔What is the Snort signature syntax to examine application layer data? - ✔✔content
✔✔What is it called when two different files produce the same hash? - ✔✔Collision
, ✔✔What is the name of the commercial integrity checking tool mentioned? - ✔✔Tripwire
✔✔Network Topology - ✔✔The Physical/Logical shape of a network
✔✔Logical Topology - ✔✔Gives the description for the physical layout, shows VLAN's
and where they are placed on the physical topology
✔✔Trunk Port - ✔✔Connects packets that travel to all VLAN's on a switch
✔✔Baseband Systems - ✔✔Transmits one signal on the medium (fiber, copper, etc)
✔✔Broadband - ✔✔Form of multiplexing to join multiple signals on a medium
✔✔Ethernet - ✔✔Designed as baseband system that can be used in multiplexing
✔✔CSMA/CD - ✔✔Carrier Sense Multiple Access/ Collision Detection
✔✔Unicast - ✔✔Broadcast for a single device
✔✔Multicast - ✔✔Broadcast for a specific group or multiple devices
✔✔Broadcast - ✔✔Message for everyone to receive and process
✔✔Hub - ✔✔Broadcasts packets to every single port
✔✔Switch - ✔✔Broadcasts packets to device found on a singular port
✔✔Content Addressable Memory (CAM) - ✔✔Is a table that contains the MAC address
and port associated to that MAC Address
✔✔Virtual LAN (VLAN) - ✔✔Splitting a switch in which certain ports can only talk to
certain ports (Segment networks within a switch)
✔✔Multiprotocol Label Switching (MPLS) - ✔✔A different way of switching packets that
can be used on a dedicated line
✔✔802.1x - ✔✔Network Access Control that is a layer 2 authentication (Credentialed
Question of 2FA)
✔✔A security appliance should be set in place when - ✔✔There is a change in trust
level in the network
SOLUTIONS MARKED A+
✔✔What Nmap option enables you to write results in XML format? - ✔✔-oX
✔✔Which Nmap scan type performs a Stealth Scan? - ✔✔-sS
✔✔In what language are NSE scripts written? - ✔✔Lua
✔✔What is the name of the tool we used to display text from the program? - ✔✔strings
✔✔What message did we get during the buffer overflow? - ✔✔Segmentation fault
✔✔What do we prepend to a program to ensure it runs from the current folder? - ✔✔./
✔✔What is the name of the function enabling this command injection bug? - ✔✔system
✔✔True or False? You need to use the | symbol to append on an additional command?
- ✔✔False
✔✔What command did you use to go to the restricted shell? - ✔✔rbash
✔✔Which hping3 option performs IP source address spoofing? - ✔✔-a
✔✔True or False? hping3 can transfer files covertly? - ✔✔True
✔✔Using the "-t" flag with hping3, what can we set the value for? - ✔✔TTL
✔✔Using the Pre-Scale option increases the host size by how many times? - ✔✔4
✔✔What is the name of the GUI you can use to manage GPG? - ✔✔GNU Privacy
Assistant
✔✔What encrypts the hash used in a digital signature? - ✔✔Sender's private key
✔✔True or False? Snort can read existing tcpdump PCAP files? - ✔✔True
✔✔Sourcefire was acquired by what well-known company? - ✔✔Cisco Systems
✔✔What is the Snort signature syntax to examine application layer data? - ✔✔content
✔✔What is it called when two different files produce the same hash? - ✔✔Collision
, ✔✔What is the name of the commercial integrity checking tool mentioned? - ✔✔Tripwire
✔✔Network Topology - ✔✔The Physical/Logical shape of a network
✔✔Logical Topology - ✔✔Gives the description for the physical layout, shows VLAN's
and where they are placed on the physical topology
✔✔Trunk Port - ✔✔Connects packets that travel to all VLAN's on a switch
✔✔Baseband Systems - ✔✔Transmits one signal on the medium (fiber, copper, etc)
✔✔Broadband - ✔✔Form of multiplexing to join multiple signals on a medium
✔✔Ethernet - ✔✔Designed as baseband system that can be used in multiplexing
✔✔CSMA/CD - ✔✔Carrier Sense Multiple Access/ Collision Detection
✔✔Unicast - ✔✔Broadcast for a single device
✔✔Multicast - ✔✔Broadcast for a specific group or multiple devices
✔✔Broadcast - ✔✔Message for everyone to receive and process
✔✔Hub - ✔✔Broadcasts packets to every single port
✔✔Switch - ✔✔Broadcasts packets to device found on a singular port
✔✔Content Addressable Memory (CAM) - ✔✔Is a table that contains the MAC address
and port associated to that MAC Address
✔✔Virtual LAN (VLAN) - ✔✔Splitting a switch in which certain ports can only talk to
certain ports (Segment networks within a switch)
✔✔Multiprotocol Label Switching (MPLS) - ✔✔A different way of switching packets that
can be used on a dedicated line
✔✔802.1x - ✔✔Network Access Control that is a layer 2 authentication (Credentialed
Question of 2FA)
✔✔A security appliance should be set in place when - ✔✔There is a change in trust
level in the network
