首页
外语
计算机
考研
公务员
职业资格
财经
工程
司法
医学
专升本
自考
实用职业技能
登录
计算机
The following scenario will be used for questions 29 and 30. John is a network administrator and has been told by one of his net
The following scenario will be used for questions 29 and 30. John is a network administrator and has been told by one of his net
admin
2013-12-19
68
问题
The following scenario will be used for questions 29 and 30.
John is a network administrator and has been told by one of his network staff members that two servers on the network have recently had suspicious traffic traveling to them and then from them in a sporadic manner. The traffic has been mainly ICMP, but the patterns were unusual compared to other servers over the last 30 days. John lists the directories and subdirectories on the systems and finds nothing unusual. He inspects the running processes and again finds nothing suspicious. He sees that the systems’ NICs are not in promiscuous mode, so he is assured that sniffers have not been planted.
Which of the following describes the most likely situation as described in this scenario?
选项
A、Servers are not infected, but the traffic illustrates attack attempts.
B、Servers have been infected with rootkits.
C、Servers are vulnerable and need to be patched.
D、Servers have been infected by spyware.
答案
B
解析
B正确。一旦取得了某个访问等级,攻击者就可以上传一大堆工具,即rootkit。rootkit是实现了隐身能力,即为了隐藏某些进程或程序的存在性,而设计的程序。对rootkit进行检测非常困难,因为rootkit能够破坏打算找到该rootkit的软件。A不正确。因为从这个场景中描述的情况看,该系统很有可能被病毒感染了。ICMP流量可能是攻击者和被破坏的系统之间发送的命令和状态数据。
C不正确。因为这不是最佳答案。服务器可能很脆弱,需要打补丁,但这并不是本题所问。打补丁也不会根除受感染系统中的rootkit。
D不正确。因为这不是最佳答案。这个场景很好地描述了安装了rootkit的情况。间谍软件可能是rootkit的一个组成部分,但是特洛伊木马的文件很有可能已经被安装了,而这只可能使用rootkit实现,而不是恶意软件。
转载请注明原文地址:https://kaotiyun.com/show/0AhZ777K
0
CISSP认证
相关试题推荐
Historically,humansgetseriousaboutavoidingdisastersonlyafteronehasjuststruckthem.【C1】______thatlogic,2006shoul
Individualsandbusinesseshavelegalprotectionforintellectualpropertytheycreateandown.Intellectualproper【C1】______fro
TheU.S.spaceagency,NASA,isplanningtolaunchasatellitethatscientistshopewillanswerfundamentalquestionsaboutthe
Themoreparentstalktotheirchildren,thefasterthosechildren’svocabulariesgrowandthebettertheirintelligencedevelop
Climatechangeissupposedtounfoldslowly,overdecades.Butthatisnottrueupinthegreatwhitenorth,asthoseattending
About3billionpeoplelivewithin100milesofthesea,anumberthatcoulddoubleinthenextdecadeashumansflocktocoasta
Writeanessayof160-200wordsbasedonthefollowingdrawing.Inyouressay,youshould1)describethedrawingbriefly,
ManyAmericansregardthejurysystemasaconcreteexpressionofcrucialdemocraticvalues,includingtheprinciplesthatallc
Organizationsshouldkeepsystemdocumentationonhandtoensurethatthesystemisproperlycaredfor,thatchangesarecontrol
Thereareseveraldifferenttypesofauthenticationtechnologies.Whichtypeisbeingshowninthegraphicthatfollows?
随机试题
在Word2010的编辑状态下,对插入文档的图片不能进行的操作是________。
规定企业成员在共同的活动中应遵循的规章制度及行为准则的是()
患者,男性,62岁。慢性咳嗽、咳痰10余年。有冠心病病史5年,平时无症状。昨日因胃溃疡大出血急诊手术治疗,手术后第1天出现呼吸困难,伴发热。动脉血气分析(呼吸空气时):pH7.48,PaO250mmHg(6.7kPa),PaCO230mmHg(4.0kPa
A.20°~35°B.10°~15°C.20°~40°D.90°E.60°~90°手的休息位时腕关节背伸角度是
外盘大于内盘,通常股价会()
实现了新中国成立以来党的历史上具有深远意义的伟大转折的会议是()
列宁指出:“马克思的全部理论,就是运用最彻底、最完整、最周密、内容最丰富的发展论去考察现代资本主义。自然,他也就要运用这个理论去考察资本主义的即将到来的崩溃和未来共产主义的未来的发展。”在展望未来社会的问题上,马克思主义经典作家提出并自觉运用的方法论原则是
差异备份、增量备份、完全备份三种备份策略的备份速度由快到慢依次为()。
静态数据成员在()进行初始化。
Acarismadeupofmorethan30000parts.Eachpartinanewcarisasweakasababy.Soanewcarrequirespropercareands
最新回复
(
0
)