1. Midterm 2 Exam Review
Release questions via webcourse “assignment” around 2pm, Wednesday Mar. 28th, due via webcourse at 2pm, next day
Submit format:
Word file, PDF file
Scanned answer sheets
Make sure your writing is large and readable, file names show page number
Photos of your answer sheets if you have no scanner
Make sure it is readable, file names show page number
You can resubmit, so submit first version early!
Don’t wait until the last one hour to submit!
No excuse of not being able to submit! (unless webcourse is down for the all day on Mar. 29th)
From 2pm to 3:45pm on Mar. 28th, you can call me for any questions related to exam problems
Office number: (HEC 243)

2. Exam Coverage
All questions in previous three homework and the spam assignment
All questions in mid-term 1 exam
All examples given in this review lecture
Try to go over my lecture notes after mid-term 1 exam
Use textbook as reference

3. Question Types Knowledge questions
True or false statement (explain why)
Protocols
Calculations

4. Knowledge Question Examples
What port is used by SMTP protocol? By HTTP protocol? By HTTPS protocol?
When a user reads his/her , is the “From:” field shows the address from “Mail from:” command, or from the “from:” line in Data command?
What is RBL? (realtime blackhole list)
What are the two sender verification techniques introduced in class? Which one use public key?
What is the biggest hurdle for “pwdHash” to be really implemented?
Why in KaZaA there are so many virus-infected files?
What is the major differences between polymorphic virus and metamorphic viruse?

5. Knowledge Question Examples
What is IRC?
Among Agobot, SDBot, SpyBot, GT Bot, which one has no malicious code in it?
Why centralized C&C botnets are very hard to shut down by defenders? Why peer-to-peer botnets are even harder to shut down?
What are the two running mode of rootkits?
Why rootkitrevealer can detect rootkits that hide malicious files on hard drive?
What is a Trojan horse? Adware? Spyware?