Correct Answer A

The attacker registers a domain, such as badsite.com. The domain’s name server points to the attacker’s server, where a tunneling malware program is installed.

The attacker infects a computer, which often sits behind a company’s firewall, with malware. Because DNS requests are always allowed to move in and out of the firewall, the infected computer is allowed to send a query to the DNS resolver. The DNS resolver is a server that relays requests for IP addresses to root and top-level domain servers.

The DNS resolver routes the query to the attacker’s command-and-control server, where the tunneling program is installed. A connection is now established between the victim and the attacker through the DNS resolver. This tunnel can be used to exfiltrate data or for other malicious purposes. Because there is no direct connection between the attacker and victim, it is more difficult to trace the attacker’s computer.

Answer is A.

Slowloris use a single machine to hold as many connections, The question is asking multi machine.

https://en.wikipedia.org/wiki/Slowloris_(computer_security)

While disabling scripts in general and enabling them on a per-doman basis, it does have some drawbacks for functionality. Users would be forced to enable scripting to have the site fully functional, which would make the user vulnerable to XXS attack again. Selectively disabling scripts is a good alternative, but is not in the question list of answers. That makes BD the better answer.

From https://en.wikipedia.org/wiki/Cross-site_scripting

-The most significant problem with blocking all scripts on all websites by default is substantial reduction in functionality andresponsiveness . Another problem with script blocking is that many users do not understand it, and do not know how to properly secure their browsers. Yet another drawback is that many sites do not work without client-side scripting, forcing users to disable protection for that site and opening their systems to vulnerabilities.

https://docs.oasis-open.org/cti/taxii/v1.1.1/taxii-v1.1.1-part1-overview.html

"There are three Capabilities that the current version of TAXII supports: push messaging, pull messaging, and discovery." "Discovery does, however, allow for the automated exchange of information..."

The correct answer is A and B.

Key word:

Prevention = Next generation intrusion prevention system

Protect = Advanced Malware Protection

Application Layer = Application control and URL filtering

Combined integrated = Cisco web security Appliance

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

Reference : https://en.wikipedia.org/wiki/Advanced_Encryption_Standard