首页
外语
计算机
考研
公务员
职业资格
财经
工程
司法
医学
专升本
自考
实用职业技能
登录
计算机
The following scenario will be used for questions 29 and 30. John is a network administrator and has been told by one of his net
The following scenario will be used for questions 29 and 30. John is a network administrator and has been told by one of his net
admin
2013-12-19
82
问题
The following scenario will be used for questions 29 and 30.
John is a network administrator and has been told by one of his network staff members that two servers on the network have recently had suspicious traffic traveling to them and then from them in a sporadic manner. The traffic has been mainly ICMP, but the patterns were unusual compared to other servers over the last 30 days. John lists the directories and subdirectories on the systems and finds nothing unusual. He inspects the running processes and again finds nothing suspicious. He sees that the systems’ NICs are not in promiscuous mode, so he is assured that sniffers have not been planted.
Which of the following best explains why John does not see anything suspicious on the reported systems?
选项
A、The systems have not yet been infected.
B、He is not running the correct tools. He needs to carry out a penetration test on the two systems.
C、Trojaned files have been loaded and executed.
D、A back door has been installed and the attacker enters the system sporadically.
答案
C
解析
C正确。rootkit中的其他工具可能会不同,但通常都会包含用于掩盖攻击者行踪的实用程序。例如,每个操作系统都会包含一些供根用户或管理员用户用来检测rootki的基本实用程序、已安装的监听器和后门。黑客会使用名称相同的新的实用程序来替换这些默认的实用程序。它们就叫“特洛伊程序”,因为它们将执行预期的功能,在后台进行一些恶意行为。
A不正确。因为这不是最佳答案。因为系统很有可能没有被病毒感染,而这个问题问的是最可能的情况是什么。
B不正确。因为绝大多数rootkit都具有替换这些实用程序的特洛伊程序,因为根用户可以运行ps或top查看是否有后门服务在运行,进而检测出某个攻击。绝大多数rootkit也包含嗅探器,所以攻击者可以捕获并检查数据。要想嗅探器工作,系统的NIC必须被设置为混杂模式,这意味着NIC可以“听到”网络连接上的所有流量。默认的ipconfig实用程序允许根用户使用特定的参数查看NIC是否运行在混杂模式。所以rootkit也会包含一个ipconfig程序,它可以掩盖。NIC处于混杂模式的事实。
D不正确。因为这些服务器上很有可能不只是被安装了后门。rootkit包含允许攻击者远程控制被破坏系统的后门程序,但是rootkit中还包括许多其他工具。
转载请注明原文地址:https://kaotiyun.com/show/MAhZ777K
0
CISSP认证
相关试题推荐
TheTreasurycouldpocket20millionayearinextrafinesoncethecountry’sspeedcameranetworkisexpanded.Motoringorgani
Thetranslatormusthaveanexcellent,up-to-dateknowledgeofhis【C1】______languages,fullfacilityinthehandlingofhistarg
Climatechangeissupposedtounfoldslowly,overdecades.Butthatisnottrueupinthegreatwhitenorth,asthoseattending
[A]Thefirststepinpreparingamarketingplanisthatofproducingtheinformationnecessaryfordecision-making.Usually,a
Menandwomendothinkdifferently,atleastwheretheanatomyofthebrainisconcerned,accordingtoanewstudy.Thebrainis
[A]Ontheotherhandaretwocompellingargumentsagainstplacingadutyonhumanstoprotectendangeredspecies.Thefirstis
WhentheresidentsofBuenosAireswanttochangethepesostheydonottrustintothedollarstheydo,theygotoacueva,or"
DespiteincreasedairportsecuritysinceSeptember11th,2001,thetechnologytoscanbothpassengersandbaggageforweaponsan
BarackObamaspentmuchtimeonthecampaigntrailproposingadramaticvisiontochangenotonlytheUnitedStatesforthebett
Twentyyearsagoadebateeruptedaboutwhethertherewerespecific"Asianvalues".Butamoreintriguing,iflessnoticed,arg
随机试题
1944年,英国政府通过了以巴特勒为主席的教育委员会提出的教育改革方案,即《1944年教育法》,又称《()法》。加强()对教育的控制和领导;实施()岁的义务教育。
在血管内结合珠蛋白能与血红蛋白结合而运输,结合珠蛋白的化学本质是
女性,35岁,反复发热在37.5℃~38.0℃左右1个月,伴关节、肌肉酸痛就诊。体检:轻度贫血,心界不大,心率90次/分,心尖有收缩期吹风样杂音3/6级,并有收缩中期喀喇音。诊断为风湿性心脏病,二尖瓣关闭不全,发热待查。入院后首先处理是
曲线线路轨距加宽限度为300m≤半径
()是一种岗位评价方法,适合于规模较小、生产单一、岗位设置较少的企业。
作为一名中小学教师,必须学习的教育理论知识主要包括()
()是教师处理其与国家社会的关系时所应遵循的原则要求。
甲有个人财产30万元,死后未立遗嘱,甲的妻子乙和甲的哥哥丙仍在世。甲还有一女儿,15年前与丁结婚后不久即去世,未留有子女,丁在其妻子死后对甲乙仍然尽了主要赡养义务。问该遗产该如何继承?()
求助者有两种求助动机:执行性求助和工具性求助。前者是自己不做任何尝试或努力,只想知道答案或让他人代自己完成任务;后者是借助其他人的力量以达到自己解决问题或实现目标的目的。根据上述定义,下列属于工具性求助的是:
使用直线内插法计算阈限的方法是()。
最新回复
(
0
)