Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

GIAC GCIA Exam - Topic 5 Question 45 Discussion

Posted by Adelle on May 13, 2024 at 10:53 AM

An attacker changes the address of a sub-routine in such a manner that it begins to point to the address of the malicious code. As a result, when the function has been exited, the application can be forced to shift to the malicious code. The image given below explains this phenomenon:

Which of the following tools can be used as a countermeasure to such an attack?

Suggested Answer: D

Get Premium GCIA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test
42 comments · newest first
SH
Shaunna 10 months ago
Totally agree, SmashGuard is the way to go!
ST
Stephanie 11 months ago
Definitely not Absinthe, that's not the right tool.
LI
Linsey 11 months ago
Wait, can Kismet really help with this?
JU
Juliana 11 months ago
I think Obiwan might be more effective.
DE
Derick 11 months ago
SmashGuard is a solid choice for this.
MA
Marleen 11 months ago
Absinthe sounds familiar, but I can't recall its specific use. I wonder if it relates to this type of attack or if it's more for something else.
RO
Royal 12 months ago
I practiced a similar question where we discussed tools for preventing code injection. I think SmashGuard was mentioned as a good countermeasure.
MA
Marti 12 months ago
I'm not entirely sure, but I feel like Kismet is more about network analysis rather than code execution protection. It doesn't seem relevant here.
LO
Lorean 12 months ago
I remember studying about buffer overflow attacks and how they can redirect execution flow. I think SmashGuard might be the right answer since it protects against such vulnerabilities.
VA
Valentine 12 months ago
I'm a bit confused by this question. Can someone explain the attack mechanism in more detail? I want to make sure I understand it before I try to pick the right countermeasure.
SH
Shawna 1 year ago
Obiwan is an interesting choice, but I'm not sure it's the best fit for this specific attack. I'd lean more towards SmashGuard since it's designed to protect against function pointer overwrites.
JO
Jolene 1 year ago
Hmm, I'm not too familiar with these tools. I'll need to think this through carefully. Maybe I should review my notes on common countermeasures for code injection attacks.
JE
Jenelle 1 year ago
This looks like a classic buffer overflow attack. I think the answer is probably SmashGuard, which is a tool designed to detect and prevent this type of attack.
CE
Ceola 1 year ago
This question seems straightforward, but I want to double-check my understanding before submitting. Let me review the LSA types one more time to be sure.
LO
Lonny 1 year ago
I think I've got this one. Azure Bastion is a service that provides secure RDP and SSH access to your VMs, so the answer must be the Azure portal.
KI
Kimberely 1 year ago
Option D sounds right to me, but I feel a bit unsure about the exact number of agents. I might have mixed it up with another feature.
HO
Hobert 1 year ago
Obiwan? Pff, I've got a better idea - let's just crash the whole system and start over. That'll show 'em!
EL
Elfrieda 1 year ago
↳ replying to Hobert
D) Absinthe
JU
Justa 1 year ago
↳ replying to Hobert
C) Kismet
MI
Millie 1 year ago
↳ replying to Hobert
B) SmashGuard
LE
Leatha 1 year ago
↳ replying to Hobert
A) Obiwan
GL
Glenn 1 year ago
Use the SmashGuard, Luke! It's the only way to protect your application from the dark side of the force.
GR
Gracia 1 year ago
↳ replying to Glenn
D) Absinthe
MO
Mollie 1 year ago
↳ replying to Glenn
C) Kismet
GA
Gaynell 1 year ago
↳ replying to Glenn
B) SmashGuard
JU
Jutta 1 year ago
↳ replying to Glenn
A) Obiwan
AN
Annice 1 year ago
I'm not sure about SmashGuard, I think Obiwan might also be a good choice.
GO
Goldie 1 year ago
I agree with Audra, SmashGuard seems like a good option to prevent such attacks.
JA
Jame 1 year ago
Absinthe, the hallucinogenic drink? I'm starting to think the exam writer is just messing with us at this point.
GL
Glory 1 year ago
↳ replying to Jame
I agree, using SmashGuard can help prevent the malicious code from being executed.
CH
Chu 1 year ago
↳ replying to Jame
B) SmashGuard would be a good countermeasure for this type of attack.
LA
Latrice 1 year ago
Kismet? Isn't that a wireless network detection tool? I don't think that's going to help much in this scenario.
LE
Leah 1 year ago
↳ replying to Latrice
Agreed. SmashGuard would be a better countermeasure in this situation.
WI
Winifred 1 year ago
↳ replying to Latrice
Definitely not. We need something like SmashGuard to prevent this kind of attack.
MA
Marsha 1 year ago
↳ replying to Latrice
Yeah, Kismet is not the right choice here.
SH
Sheldon 1 year ago
↳ replying to Latrice
D) Absinthe
EL
Elly 1 year ago
↳ replying to Latrice
C) Kismet
MI
Micaela 1 year ago
↳ replying to Latrice
B) SmashGuard
FR
Frank 1 year ago
↳ replying to Latrice
A) Obiwan
MI
Mireya 2 years ago
SmashGuard, huh? Sounds like a tool that would just end up smashing everything in sight, including the application.
KE
Kenny 2 years ago
Obiwan? Really? That's like using a lightsaber to fight off a hacker. Let's get serious here.
AU
Audra 2 years ago
I think SmashGuard can be used as a countermeasure.
0/2000 characters

Save Cancel