Website defacement is an attack on a website that changes the visual appearance of the site. These are typically the work of system crackers, who break into a Web server and replace the hosted website with one of their own. Sometimes, the Defacer makes fun of the system administrator for failing to maintain server security. Most times, the defacement is harmless; however, it can sometimes be used as a distraction to cover up more sinister actions such as uploading malware.
A high-profile website defacement was carried out on the website of the company SCO Group following its assertion that Linux contained stolen code. The title of the page was changed from Red Hat vs. SCO to SCO vs. World with various satirical content.
Answer option D is incorrect. Buffer overflow is a condition in which an application receives more data than it is configured to accept. This usually occurs due to programming errors in the application. Buffer overflow can terminate or crash the application.
Answer option B is incorrect. A zero-day attack, also known as zero-hour attack, is a computer threat that tries to exploit computer application vulnerabilities which are unknown to others, undisclosed to the software vendor, or for which no security fix is available. Zero-day exploits (actual code that can use a security hole to carry out an attack) are used or shared by attackers before the software vendor knows about the vulnerability. User awareness training is the most effective technique to mitigate such attacks.
Answer option C is incorrect. Spoofing is a technique that makes a transmission appear to have come from an authentic source by forging the IP address, email address, caller ID, etc. In IP spoofing, a hacker modifies packet headers by using someone else's IP address to hide his identity. However, spoofing cannot be used while surfing the Internet, chatting on-line, etc. because forging the source IP address causes the responses to be misdirected.

Class addresses D and E are not allotted to hosts. Class D addresses are reserved for multicasting, and their
address range can extend from 224 to 239. Class E addresses are reserved for experimental purposes. Their
addresses range from 240 to 254.
Answer option C is incorrect. Class A addresses are specified for large networks. It consists of up to
16,777,214 client devices (hosts), and their address range can extend from 1 to 126.
Answer option D is incorrect. Class B addresses are specified for medium size networks. It consists of up to
65,534 client devices, and their address range can extend from 128 to 191.
Answer option A is incorrect. Class C addresses are specified for small local area networks (LANs). It consists
of up to 245 client devices, and their address range can extend from 192 to 223.

Updating the anti-virus software regularly is the best way of protecting important data against virus attack.

SIEM (Security Information and Event Management) solutions are designed to provide a comprehensive view of an organization's security status by collecting and analyzing security-related data from various sources. To enhance their capabilities, SIEM solutions consume threat intelligence feeds, which are streams of data that provide information about current and potential security threats. These feeds include details such as indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs) used by cybercriminals, and vulnerabilities in software or systems. By integrating threat intelligence feeds, SIEM solutions can improve real-time threat detection, reduce false positives, and support proactive, intelligence-driven defense strategies. This integration allows organizations to stay one step ahead of emerging threats and advisories, providing insights into the attacker's TTPs and associated IoCs that can accelerate investigation and response efforts1.
References: The explanation is based on the general knowledge of SIEM solutions and their use of threat intelligence feeds to enhance security operations. For detailed and specific references, please consult the latest Certified Network Defender (CND) study materials and documents provided by the EC-Council.

In a vanilla port scan, the scanner attempts to connect to all 65,535 ports.
Answer option B is incorrect. The scanner attempts to connect to only selected ports.
Answer option A is incorrect. The scanner scans for open User Datagram Protocol ports.
Answer option C is incorrect. The scanner goes through a File Transfer Protocol server to disguise the cracker's location.