Which definition of a fork in Linux is true? A.daemon to execute scheduled commandsB.parentdirectory name of a file path nameC.macros for manipulating CPU setsD.new process created by a parent process
Correct answer: D
Which identifier is used to describe the application or process that submitted a log message? A.actionB.selectorC.priorityD.facility
Correct answer: D
Which protocol is expected to have a user agent, host, and referrer header in a packet capture? A.NTPB.HTTPC.DNSD.SSH
Correct answer: B
Which evasion method involves performing actions slower than normal to prevent detection? A.traffic fragmentationB.tunnelingC.timing attackD.resource exhaustion
Correct answer: C
A security analyst is reviewing a packet capture from a suspected reconnaissance scan. The analyst observes a sequence of packets where the source sends a TCP SYN packet to a specific port, receives a SYN-ACK from the destination, and immediately sends a RST packet. Which type of network scanning technique is being executed?
Correct answer: B
In a TCP SYN (or Half-Open) scan, the attacker sends a SYN packet. If the port is open, the target responds with SYN-ACK. The attacker then sends a RST (Reset) instead of an ACK to tear down the connection before it is fully established. This is done to avoid logging the connection on the target application layer. A TCP Connect scan would complete the handshake with an ACK.
Which Cisco IOS command is used to configure a mirrored port on a switch to send a copy of network traffic to a sensor for analysis, such as an IDS or a packet capture device?
Correct answer: A
The 'monitor session' command set is used to configure Switched Port Analyzer (SPAN) on Cisco switches. The correct syntax to define the source is 'monitor session [id] source interface [interface]'. This copies traffic to the destination port for analysis.
While analyzing a PCAP file, an engineer observes an Ethernet frame with a Type field value of 0x0806. Which protocol is encapsulated within this frame?
Correct answer: C
The EtherType field 0x0806 identifies the payload as the Address Resolution Protocol (ARP). IPv4 uses 0x0800, and IPv6 uses 0x86DD.
An organization is designing a new security zone architecture. They require a zone that exposes public-facing services (Web, Email) to the internet while isolating them from the internal LAN. Which network design concept should be implemented?
Correct answer: A
A DMZ (Demilitarized Zone) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, usually the Internet, while keeping the internal LAN secure behind a firewall. If the DMZ is compromised, the internal network remains protected.
Register free to unlock 9 more sample questions
Create a free account to continue with the rest of the 210-250 sample set.
Own this practice test forever.
Any 2 exams per month.
Any 4 exams per month.
Any 12 exams over 3 months.
