Exam 212-82 topic 1 question 34 discussion

Actual exam question from ECCouncil's 212-82

Question #: 34
Topic #: 1

Anderson, a security engineer, was Instructed to monitor all incoming and outgoing traffic on the organization's network to identify any suspicious traffic. For this purpose, he employed an analysis technique using which he analyzed packet header fields such as IP options, IP protocols, IP fragmentation flags, offset, and identification to check whether any fields are altered in transit.
Identify the type of attack signature analysis performed by Anderson in the above scenario.

A. Context-based signature analysis
B. Atomic-signature-based analysis
C. Composite-signature-based analysis
D. Content-based signature analysis

Show Suggested Answer

Suggested Answer: A 🗳️

by kanchantanwani at July 18, 2023, 2:25 p.m.

Comments

Submit Cancel

kanchantanwani

Highly Voted 11 months, 2 weeks ago

Selected Answer: A

Answer is A: Context-based Signature Analysis : Attack signatures are contained in packet headers Inspect packets for unusual/suspicious header information such as the following:  Source and destination IP addresses  IP options, protocols, and checksums  Source and destination port numbers  IP fragmentation flags, offset, or identification

upvoted 5 times

...

044f354

Most Recent 4 months ago

Selected Answer: A

EC-Council Official Curricula Certified Cybersecurity Technician v1 https://online.vitalsource.com/reader/books/9781635679533/ Module 17 Page 2037 Context-based signature analysis: Packets are usually altered using the header information. Suspicious signatures in the header can include malicious data that can affect the following: o Source and destination IP addresses o Source and destination port numbers o IP options o IP protocols o IP, TCP, and UDP checksums o IP fragmentation flags, offset, or identification

upvoted 1 times

...