GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ783

Web Application Injection Attacks

Mark is a Network Administrator at Net Perfect Inc. The company operates a Windows-based network and uses Check Point SmartDefense to secure it. Mark uses SmartDefense on the company’s HTTP servers to set a limit for the maximum response-header length.

Which of the following attacks can be blocked by defining this limit?

  • A HTR Overflow worms and mutations
  • B Ramen worm attack
  • C Melissa virus attack
  • D Shoulder surfing attack
Explanation

Maximum HTTP header-size enforcement reduces the opportunity for buffer-overrun attacks by restricting the amount of data that can be inserted in HTTP headers. Check Point identifies Microsoft IIS HTR Request Buffer Overflow as an HTTP protection, so this limitation applies to HTR Overflow worms and their variants.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!