Weekend Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: Board70

SEC504 Exam Dumps - SANS Certified Incident Handler Questions and Answers

Question # 14

Which of the following is spy software that records activity on Macintosh systems via snapshots, keystrokes, and Web site logging?

Options:

A.

Spector

B.

Magic Lantern

C.

eblaster

D.

NetBus

Buy Now
Question # 15

Which of the following statements are true about Dsniff?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It contains Trojans.

B.

It is a virus.

C.

It is antivirus.

D.

It is a collection of various hacking tools.

Buy Now
Question # 16

Which of the following are the automated tools that are used to perform penetration testing?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Pwdump

B.

Nessus

C.

EtherApe

D.

GFI LANguard

Buy Now
Question # 17

James works as a Database Administrator for Techsoft Inc. The company has a SQL Server 2005 computer. The computer has a database named Sales. Users complain that the performance of the database has deteriorated. James opens the System Monitor tool and finds that there is an increase in network traffic. What kind of attack might be the cause of the performance deterioration?

Options:

A.

Denial-of-Service

B.

Injection

C.

Internal attack

D.

Virus

Buy Now
Question # 18

In which of the following steps of the incident handling processes does the Incident Handler make sure that all business processes and functions are back to normal and then also wants to monitor the system or processes to ensure that the system is not compromised again?

Options:

A.

Eradication

B.

Lesson Learned

C.

Recovery

D.

Containment

Buy Now
Question # 19

Which of the following is a technique for creating Internet maps?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Active Probing

B.

AS PATH Inference

C.

Object Relational Mapping

D.

Network Quota

Buy Now
Question # 20

Which of the following statements are true about session hijacking?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Use of a long random number or string as the session key reduces session hijacking.

B.

It is used to slow the working of victim's network resources.

C.

TCP session hijacking is when a hacker takes over a TCP session between two machines.

D.

It is the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system.

Buy Now
Question # 21

Which of the following types of attacks is often performed by looking surreptitiously at the keyboard or monitor of an employee's computer?

Options:

A.

Buffer-overflow attack

B.

Shoulder surfing attack

C.

Man-in-the-middle attack

D.

Denial-of-Service (DoS) attack

Buy Now
Question # 22

Which of the following netcat parameters makes netcat a listener that automatically restarts itself when a connection is dropped?

Options:

A.

-u

B.

-l

C.

-p

D.

-L

Buy Now
Question # 23

You are an Incident manager in Orangesect.Inc. You have been tasked to set up a new extension of your enterprise. The networking, to be done in the new extension, requires different types of cables and an appropriate policy that will be decided by you. Which of the following stages in the Incident handling process involves your decision making?

Options:

A.

Identification

B.

Containment

C.

Eradication

D.

Preparation

Buy Now
Exam Code: SEC504
Exam Name: Hacker Tools, Techniques, Exploits and Incident Handling
Last Update: Aug 24, 2025
Questions: 328
SEC504 pdf

SEC504 PDF

$25.5  $84.99
SEC504 Engine

SEC504 Testing Engine

$28.5  $94.99
SEC504 PDF + Engine

SEC504 PDF + Testing Engine

$40.5  $134.99