EC0-350 · Question #789
Basically, there are two approaches to network intrusion detection: signature detection, and anomaly detection. The signature detection approach utilizes well-known signatures for network traffic to…
Sign in or unlock EC0-350 to reveal the answer and full explanation for question #789. The question stem and answer options stay visible for context.
Question
Basically, there are two approaches to network intrusion detection: signature detection, and anomaly detection. The signature detection approach utilizes well-known signatures for network traffic to identify potentially malicious traffic. The anomaly detection approach utilizes a previous history of network traffic to search for patterns that are abnormal, which would indicate an intrusion. How can an attacker disguise his buffer overflow attack signature such that there is a greater probability of his attack going undetected by the IDS?
Options
- AHe can use a shellcode that will perform a reverse telnet back to his machine
- BHe can use a dynamic return address to overwrite the correct value in the target machine computer memory
- CHe can chain NOOP instructions into a NOOP "sled" that advances the processor's instruction pointer
- DHe can use polymorphic shell code-with a tool such as ADMmutate - to change the signature of his
Unlock EC0-350 to see the answer
You've previewed enough free EC0-350 questions. Unlock EC0-350 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.