March Geekness March 9, 2010

Only one team will prevail. Who will be the winner?

7DA

How March Geekness Works• On Tuesday March 9, 12-1:30 PM in the Vendor Expo, pick up your entry

card, it has ten questions similar to the ones we will be asking in the contest. Submit your answers by end of lunch session in drop box at entry table.

• SANS reviews all entries. Tuesday March 9, 5 PM: the name of everyone who qualifies will be posted in the Vendor Expo. From the qualifiers, form your teams. A max of five persons on a team, a min of three.

• Space is Limited. We can accommodate a max of sixteen teams first come, first served

• No debate is allowed about whether the answer is right, however the *source* of the question is displayed on the slide and lifelines are allowed

• Short elimination rounds to develop the F1nal F0urF1nal F0ur

Elimination RoundsRULES:• 10 Questions• 2 Teams compete• Question is displayed• Team has to raise a flag to answer• Referee calls on the team: five seconds to begin answer, time delay = wrong answer• If no one knows the answer, the question remains in play until the last question is

answered. Teams can send a runner, or use a lifeline to find the answer. Do NOT interrupt someone speaking, but use CSMA/CD and raise your flag during any period of silence

• Right answer = 1 point• Wrong answer deducts 1 point• Partial credit is possible .5 point• Tiebreaker question in case of tie at the end of 10 questions

Elimination Rounds (2)

• In the case of an odd number of teams, referee may elect to advance to next round by presenting 10 questions, requiring an answer in five seconds, and 6 out of 10 is a pass

• Referee’s choice as to which team is selected as odd team out.

F1nal F0urSANS

7DA

F1nal F0ur Elimination Rounds

• All elimination rules apply• 20 Questions instead of 10• Repeat questions are allowed

Geeks Know How to Have Fun

• March “Geekness” is all about fun. Participation will be limited, but even the casual observer can learn and benefit

• Hosted by Stephen Northcutt and special guests

• Food & Drink brought to you by SANS and Sponsoring Exhibitors

• Prizes!

Prizes!

A big pile of snow (just kidding)

Prize for each Team member(8) Elimination Round Survivors

I survived an elimination round

at SANS 2010

March Geekness

Commemorative T shirt, different color for each team

Prize for each Team member - First Runner Up -

Each member of the First Runner Up team will receive a 5.11 Tactical Ready Bag, a practical carry-all with water bottle pocket, thermos/flashlight pockets, and an internal organizer panel in the lid.

Prize for each Team member - Winning Team -

AIRVIEW2-EXT 2.4GHz Spectrum Analyzer

QuestionsHint: Answers to many "March Geekness” questions can be found by engaging with exhibitors at the Expo. We encourage you to meet them!

What is the name of Palo Alto Networks centralized management capability for managing policies across distributed firewalls?

Sample Question

March Geekness 7DA

v14s5

By what percent have malware threats increased between 2006 and 2008?

Sample Question

March Geekness 7DA

v3s6

Why does LogRhythm keep metadata in a separate database from raw log data?

Sample Question

March Geekness 7DA

v11s4

Does Sunbelt Software CWSandbox require or use virtualization?

Sample Question

March Geekness 7DA

v21s1

What is the name of the company that Cisco acquired that is the market leader in SaaS Web security?

Sample Question

March Geekness 7DA

v8s2

Name an agent used by the Web Application testing vector.

Sample Question

March Geekness 7DA

v9s7

From Screen MMLS output:

A) dd if=disk1.dd bs=512 skip=63 count=1028097 of=windows.disk1.ddB) dd if=disk1.dd of=windows.disk1.dd start=1028159 count=1028097C) dd if=disk1.dd bs=512 skip=1028159 count=1028097 of=windows.disk1.ddD) dd if=disk1.dd start=62 count=1028097 of=windows.disk1.dd

g.147.

Sample Question

March Geekness 7DA

What is the largest number of events currently being captured by LogCenter on a daily basis?

Sample Question

March Geekness 7DA

v10s3

GPEN

You are pen testing a Windows system remotely via a raw netcat shell. You want to get a listing of all the local users on the system, what command would you use?

A) net name B) net userC) net accountD) net localuser

Sample Question

March Geekness 7DA

g.95.

Do all SecureDoc users have the same privileges?

Sample Question

March Geekness 7DA

v23s2

What are two architectural requirements of supporting content awareness in SIEM?

Sample Question

March Geekness 7DA

v12s2

What is Norman best known for worldwide?

Sample Question

March Geekness 7DA

v13s1

Why is recovering the content of a deleted file from a FAT file system difficult?

A) The first letter of the file name is overwritten with the character 0xE5B) The contents of the file are overwrittenC) The entries in the file allocation table are overwrittenD) The directory entry is overwritten

Sample Question

March Geekness 7DA

g.159.

Can Splunk searches support real-time streamed data?

Sample Question

March Geekness 7DA

v20s3

Is QualysGuard host-based or network-based?

Sample Question

March Geekness 7DA

v15s4

GPEN

What is the reason that Cain cannot crack Linux MD5 passwords?

A) Cain does not support salted Unix password representations B) Unix MD5 hashes are not the same as Windows MD5 hashes C) Cain cannot crack MD5 passwords D) Cain only runs on Windows and cannot read a Unix password file

g.47.

Sample Question

March Geekness 7DA

How does CDI know its unit in the field is alive and working?

Sample Question

March Geekness 7DA

v6s7

Sourcefire can help you reduce the number of actionable events you have to pursue by what percentage?

Sample Question

March Geekness 7DA

v19s7

In case of a security violation, what are the response mechanisms available on the Barracuda WAF?

Sample Question

March Geekness 7DA

v2s3

In which Firefox version did the SQLite format begin to be used for storing browser artifacts?

A) Firefox 3.0B) Firefox 1.5C) Firefox 2.0D) Firefox 3.5

g.135.

Sample Question

March Geekness 7DA

According to McAfee what percentage of power plant operators reported that their networks had been infiltrated?

Sample Question

March Geekness 7DA

v5s1

What is Websense Security Labs?

Sample Question

March Geekness 7DA

v22s3

What is Solera Networks’ unique approach to full packet capture?

Sample Question

March Geekness 7DA

v18s5

You are responding to a Windows Vista SP2 32-bit operating system. The machine has 4-GB of RAM installed. You are asked to acquire memory following the order of volatility while maintaining the most forensically sound process. What is the least invasive way to image memory and what is the resultant size of your memory image?

A) Use a memory imaging tool from a CDROM and image to a plugged in USB key:Total memory image = 4 GBB) Use a memory imaging tool from a USB key and image to the same USB key: Total memory image = 3 GBC) Use a memory imaging tool from a USB key and image to a network share:Total memory image = 4 GBD) Use a memory imaging tool from a CDROM and image to a networ'k share: Total memory image = 3 GB

g.144. Sample

Question

March Geekness 7DA