- | P a g e
SANS 401 ACTUAL EXAM NEWEST 2025
COMPLETE 200 QUESTIONS AND CORRECT
DETAILED ANSWERS (VERIFIED ANSWERS)
|ALREADY GRADED A+ ||BRAND NEW
VERSION!!
What is the preferred method of setting up decoy ports on a server?
Set up the host to use a very small window size to manage flow control to the ports - Use software which makes ports appear to be open but is not related to the real services - Configure a host- based firewall to respond with RST packets when the decoy port is the destination port - Enable the actual services for the decoy ports and then keep them patched and up to date - ANSWER- Use software which makes ports appear to be open but is not related to the real services
- Explanation )
To set up decoy ports, the systems administrator should not enable the actual services. Even if fully patched, each additional service would make the system more vulnerable. Installing 1 / 4
- | P a g e
software which makes the ports appear to be open but are not running the actual services is a better option. Another recommended option is to set up a gateway device which would lead an outsider to believe more ports were open. Configuring a host based firewall to send reset packets for ports would not give the illusion the ports were open. Changing the window size to manage flow control could be used to tie up an attacker's resources, but would have nothing to do with decoy ports.
A system administrator thinks an attacker is sending malicious data to a router. Which tool will help show this?
Router configuration guide - Packet sniffer - Remote access tool
- NTP device - ANSWER-Packet sniffer
- Explanation )
Sniffers can be hardware devices that physically attach to the network, but more commonly, they are software programs that run on networked computers. The sniffers that come bundled with your operating system are designed as tools for the system administrator.
Which item, when created with default options, is ciphertext? 2 / 4
- | P a g e
An automobile license plate - An Apple Lossless audio file - A ZIP file - A Windows executable file - A digital signature - ANSWER-A digital signature
- Explanation )
- it is a sequence that passes no information and is loosely
To digitally sign a message (that is, give some type of "digital proof" as to the signer's identity), we might choose an asymmetric algorithm, such as RSA or ECC with a hashing algorithm.The .exe, .m4a, and .zip files are able to be encrypted, some by using options when the file is created and others by a separate program. However, by default they are all not encrypted and therefore plaintext. The automobile license plate is also plaintext
coupled to the auto.
Before deploying a web server in a production environment, what process could a systems administrator put in place to detect an attacker modifying data in the document root folder?
Set up an automated job that runs daily and determines if the web server's files have been altered - Set up an Intrusion 3 / 4
- | P a g e
Detection System to detect malicious packets coming into the web server - Configure a perimeter firewall to log attempted network connections from known bad IP addresses - Configure packet sniffers that detect if private data is being passed in the clear to the Internet - ANSWER-Set up an automated job that runs daily and determines if the web server's files have been altered
- Explanation )
The concept of integrity means determining if data has been altered or modified. Setting up a process that detects unauthorized changes to files is one step an administrator could take to determine this.Identifying private traffic that is passed in the clear is a step an administrator should take to ensure confidentiality. Determining if malicious packets are coming into the site, or if known bad sites are trying to connect to servers on the site's network, are good security practices, but they do not indicate the site's data has been altered.
Kevin wants to accomplish the following tasks:
1) Inventory all devices 2) Inventory all software
- / 4