Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

GIAC GCFW GIAC Certified Firewall Analyst Exam Practice Test

Page: 1 / 39
Total 391 questions

GIAC Certified Firewall Analyst Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$43.75  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$38.5  $109.99
Question 1

You work as the Security Administrator for Prodotxiss Inc. You want to ensure the security of your Wi- Fi enterprise network against the wireless snooping attacks. Which of the following measures will you take over the site network devices of the network?

Options:

A.

Download and install new firmware patch for the router.

B.

Apply firewalls at appropriate spots.

C.

Apply a standard ACL on the router.

D.

Disable the SSID broadcast feature of the router.

Question 2

Which of the following types of firewall functions by creating two different communications, one between the client and the firewall, and the other between the firewall and the end server?

Options:

A.

Stateful firewall

B.

Proxy-based firewall

C.

Packet filter firewall

D.

Endian firewall

Question 3

Which of the following modes is also referred to as client mode?

Options:

A.

Ad-hoc mode

B.

Master mode

C.

Manage mode

D.

Monitor mode

Question 4

You are a professional Computer Hacking forensic investigator. You have been called to collect the evidences of Buffer Overflows or Cookie snooping attack. Which of the following logs will you review to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Event logs

B.

Program logs

C.

System logs

D.

Web server logs

Question 5

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of He wants to send malicious data packets in such a manner that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the We-are-secure server and execute malicious data. Which of the following tools can he use to accomplish the task?

Options:

A.

Hunt

B.

Ettercap

C.

Alchemy Remote Executor

D.

Mendax

Question 6

An organization has more than a couple of external business, and exchanges dynamic routing information with the external business partners. The organization wants to terminate all routing from a partner at an edge router, preferably receiving only summary routes from the partner. Which of the following will be used to change all partner addresses on traffic into a range of locally assigned addresses?

Options:

A.

IPsec

B.

Firewall

C.

ACL

D.

NAT

Question 7

Which of the following IPv6 transition technologies is used by the DirectAccess if a user is in a remote location and a public IPv4 address, instead of public IPv6 address, has been assigned to the computer?

Options:

A.

Teredo

B.

PortProxy

C.

6to4

D.

ISATAP

Question 8

Sam works as a Security Manager for Gentech Inc. The company has a Windows-based network. Sam wants to prevent specific traffic from IDP processing in order to reduce false positives. Which of the following rulebases will he use to accomplish the task?

Options:

A.

SYN Protector rulebase

B.

Network Honeypot rulebase

C.

Exempt rulebase

D.

Backdoor rulebase

Question 9

Distributed Checksum Clearinghouse (DCC) is a hash sharing method of spam email detection.

Which of the following protocols does the DCC use?

Options:

A.

ICMP

B.

TELNET

C.

UDP

D.

TCP

Question 10

You work as a Security Administrator for Tech Perfect Inc. The company has a switched network. You have configured tcpdump in the network which can only see traffic addressed to itself and broadcast traffic. What will you do when you are required to see all traffic of the network?

Options:

A.

Connect the sniffer device to a Remote Switched Port Analyzer (RSPAN) port.

B.

Configure VLAN Access Control List (VACL).

C.

Configure Network Access Control (NAC).

D.

Connect the sniffer device to a Switched Port Analyzer (SPAN) port.

Question 11

Adam, a malicious hacker purposely sends fragmented ICMP packets to a remote target. The total size of this ICMP packet once reconstructed is over 65,536 bytes.

On the basis of above information, which of the following types of attack is Adam attempting to perform?

Options:

A.

Fraggle attack

B.

SYN Flood attack

C.

Ping of death attack

D.

Land attack

Question 12

Which of the following actions can be taken as the countermeasures against the ARP spoofing attack?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Placing static ARP entries on servers and routers

B.

Looking for large amount of ARP traffic on local subnets

C.

Using Private VLANs

D.

Using 8 digit passwords for authentication

Question 13

Which of the following programs can be used to detect stealth port scans performed by a malicious hacker?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

portsentry

B.

libnids

C.

nmap

D.

scanlogd

Question 14

Which of the following IPv6 address types is a single address that can be assigned to multiple interfaces?

Options:

A.

Loopback

B.

Unicast

C.

Multicast

D.

Anycast

Question 15

You work as a Network Administrator for SmartCert Inc. The company's network contains five Windows 2003 servers and ninety Windows XP Professional client computers. You want to view all the incoming requests to an Internet Information Services (IIS) server and allow only requests that comply with a rule set, created by you, to be processed. You also want to detect the intrusion attempts by recognizing the strange characters in a URL on a Web server. What will you do to accomplish the task?

Options:

A.

Configure a connection to the SQL database by using the RELOG command-line utility.

B.

Use the URLScan tool.

C.

Use the Remote Desktop Protocol (RDP).

D.

Use the HFNETCHK utility.

Question 16

You work as a Desktop Support Technician for umbrella Inc. The company uses a Windows-based network. An employee from the sales department is facing problem in the IP configuration of the network connection. He called you to resolve the issue. You suspect that the IP configuration is not configured properly. You want to use the ping command to ensure that IPv4 protocol is working on a computer. While running the ping command from the command prompt, you find that Windows Firewall is blocking the ping command. What is the cause of the issue?

Options:

A.

Windows Firewall blocks the command line tools.

B.

Core Networking Firewall rules do not allow IPv4 or IPv6.

C.

Core Networking Firewall rules do not allow ICMPv4 or ICMPv6 Echo Requests.

D.

Windows Firewall rules do not allow Core Networking Tools.

Question 17

David works as the Security Manager for PassGuide Inc. He has been assigned a project to detect the attacks over multiple connections and sessions and to count the number of scanned ports in a defined time period. Which of the following rulebases will he use to accomplish the task?

Options:

A.

Traffic Anomalies rulebase

B.

Exempt rulebase

C.

SYN Protector rulebase

D.

Network Honeypot rulebase

Question 18

You work as a Network Administrator for NetTech Inc. Your manager needs to access a particular server on the network from outside the company network. You have a registered IP address assigned to a router on the company network. Which of the following will be useful for accessing the server from outside the network?

Options:

A.

Overloading

B.

Dynamic VLAN

C.

Switch

D.

Static NAT

Question 19

A scenario involves a pool of users with private IP addresses who need to access the Internet; however, the company has a limited number of IP addresses and needs to ensure users occupy only one public IP address.

Which technology is used to allow a pool of users to share one global IP address for Internet access?

Options:

A.

Port Address Translation

B.

Pool Address Translation

C.

Private Address Translation

D.

Per-user Address Translation

Question 20

An organization has more than a couple of external business, and exchanges dynamic routing information with the external business partners. The organization wants to terminate all routing from a partner at an edge router, preferably receiving only summary routes from the partner. Which of the following will be used to change all partner addresses on traffic into a range of locally assigned addresses?

Options:

A.

Firewall

B.

IPsec

C.

ACL

D.

NAT

Question 21

When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as __________.

Options:

A.

True negative

B.

False negative

C.

False positive

D.

True positive

Question 22

Which of the following tools uses PDA and barcode technologies in order to enable effective identification, control, and reporting of items in a site?

Options:

A.

Smart card

B.

Vulnerability scanner

C.

Baseline audit

D.

Biometric device

Question 23

Which of the following fields is NOT included in packet fragmentation?

Options:

A.

Flag

B.

Fragment Offset

C.

Identification

D.

Time to Live

Question 24

Which of the following is a version of netcat with integrated transport encryption capabilities?

Options:

A.

Encat

B.

Nikto

C.

Cryptcat

D.

Socat

Question 25

Which of the following techniques correlates information found on multiple hard drives?

Options:

A.

Cross-drive analysis

B.

Data analysis

C.

Live analysis

D.

Gap analysis

Question 26

You work as a Network Adminstrator at PassGuide Inc. You want to implement a solution that will automatically disallow connections if an attack is suspected. Which of the following technologies will you choose to accomplish the task?

Options:

A.

ACL

B.

IPS

C.

SRTP

D.

IIS

Question 27

Fill in the blank with the appropriate tool name.

__________ consists of flexible system architecture that provides a proper way for conducting industrial audits when it is required to identify unique positions of items.

Options:

Question 28

You work as a Network Administrator for Tech Perfect Inc. The company has a wireless LAN infrastructure. The management wants to prevent unauthorized network access to local area networks and other information assets by the wireless devices. What will you do?

Options:

A.

Implement an ACL.

B.

Implement a firewall.

C.

Implement a dynamic NAT.

D.

Implement a WIPS.

Question 29

Which of the following is used for debugging the network setup itself by determining whether all necessary routing is occurring properly, allowing the user to further isolate the source of a problem?

Options:

A.

WinPcap

B.

Netfilter

C.

tcpdump

D.

iptables

Question 30

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

Options:

A.

Network-based

B.

File-based

C.

Signature-based

D.

Anomaly-based

Question 31

An IDS is a group of processes working together in a network. These processes work on different computers and devices across the network. Which of the following processes does an IDS perform?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Event log analysis

B.

Monitoring and analysis of user and system activity

C.

Statistical analysis of abnormal traffic patterns

D.

Network traffic analysis

Question 32

You work as a Network Administrator for BlueTech Inc. You want to configure Snort as an IDS for your company's wireless network, but you are concerned that Snort does not support all types of traffic. What traffic does Snort support?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

UDP

B.

TCP

C.

IP

D.

ICMP

Question 33

Which of the following is a maintenance protocol that permits routers and host computers to swap basic control information when data is sent from one computer to another?

Options:

A.

ICMP

B.

SNMP

C.

IGMP

D.

BGP

Question 34

Which of the following tools allows an attacker to intentionally craft the packets to gain unauthorized access?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Mendax

B.

Fragroute

C.

Tcpdump

D.

Ettercap

Question 35

Which of the following forms on NAT maps multiple unregistered IP addresses to a single registered IP address by using different ports?

Options:

A.

Overloading

B.

Dynamic NAT

C.

Overclocking

D.

Static NAT

Question 36

A scenario involves a pool of users with private IP addresses who need to access the Internet; however, the company has a limited number of IP addresses and needs to ensure users occupy only one public IP address.

Which technology is used to allow a pool of users to share one global IP address for Internet access?

Options:

A.

Port Address Translation

B.

Per-user Address Translation

C.

Pool Address Translation

D.

Private Address Translation

Question 37

You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based routed network. Two routers have been configured on the network. A router receives a packet. Which of the following actions will the router take to route the incoming packet?

Each correct answer represents a part of the solution. Choose two.

Options:

A.

Use the routing table to determine the best path to the destination network address.

B.

Read the destination IP address.

C.

Add the path covered by the packet to the routing table.

D.

Read the source IP address.

E.

Use the routing table to determine the best path to the source network address.

Question 38

An organization has more than a couple of external business, and exchanges dynamic routing information with the external business partners. The organization wants to terminate all routing from a partner at an edge router, preferably receiving only summary routes from the partner. Which of the following will be used to change all partner addresses on traffic into a range of locally assigned addresses?

Options:

A.

ACL

B.

IPsec

C.

Firewall

D.

NAT

Question 39

Which of the following limits the number of packets seen by tcpdump?

Options:

A.

BPF-based filter

B.

Recipient filtering

C.

Sender filtering

D.

IFilters

Question 40

You work as a Network Administrator for Net Perfect Inc. The company has a Windows Server 2008- based network. You have created a test domain for testing IPv6 addressing. Which of the following types of addresses are supported by IPv6?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Multicast

B.

Anycast

C.

Broadcast

D.

Unicast

Question 41

You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based network. A Cisco switch is configured on the network. You change the original host name of the switch through the hostname command. The prompt displays the changed host name. After some time, power of the switch went off due to some reason. When power restored, you find that the prompt is displaying the old host name. What is the most likely cause?

Options:

A.

The changes were saved in running-config file.

B.

The startup-config file got corrupted.

C.

The running-config file got corrupted.

D.

Host name cannot be changed permanently once switch is configured.

Question 42

You are implementing a host based intrusion detection system on your web server. You feel that the best way to monitor the web server is to find your baseline of activity (connections, traffic, etc.) and to monitor for conditions above that baseline. This type of IDS is called __________.

Options:

A.

Reactive IDS

B.

Signature Based

C.

Passive IDS

D.

Anomaly Based

Question 43

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of In order to do so, he performs the following steps of the preattack phase successfully:

l Information gathering

l Determination of network range

l Identification of active systems

l Location of open ports and applications

Now, which of the following tasks should he perform next?

Options:

A.

Install a backdoor to log in remotely on the We-are-secure server.

B.

Map the network of We-are-secure Inc.

C.

Perform OS fingerprinting on the We-are-secure network.

D.

Fingerprint the services running on the we-are-secure network.

Question 44

Which of the following tools performs comprehensive tests against web servers for multiple items, including over 6100 potentially dangerous files/CGIs?

Options:

A.

Nikto

B.

Sniffer

C.

Snort

D.

Dsniff

Question 45

Which of the following can be monitored by using the host intrusion detection system (HIDS)?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Computer performance

B.

File system integrity

C.

Storage space on computers

D.

System files

Question 46

Adam works as a Security administrator for Umbrella Inc. He runs the following traceroute and notices that hops 19 and 20 both show the same IP address.

1 172.16.1.254 (172.16.1.254) 0.724 ms 3.285 ms 0.613 ms 2 ip68-98-176-

1.nv.nv.cox.net (68.98.176.1) 12.169 ms 14.958 ms 13.416 ms 3 ip68-98-176-

1.nv.nv.cox.net (68.98.176.1) 13.948 ms ip68-100-0-1.nv.nv. cox.net (68.100.0.1)

16.743 ms 16.207 ms 4 ip68-100-0-137.nv.nv.cox.net (68.100.0.137) 17.324 ms 13.933

ms 20.938 ms 5 68.1.1.4 (68.1.1.4) 12.439 ms 220.166 ms 204.170 ms

6 so-6-0-0.gar2.wdc1.Level3.net (67.29.170.1) 16.177 ms 25.943 ms 14.104 ms 7

unknown.Level3.net (209.247.9.173) 14.227 ms 17.553 ms 15.415 ms "PassGuide" -

8 so-0-1-0.bbr1.NewYork1.level3.net (64.159.1.41) 17.063 ms 20.960 ms 19.512 ms 9

so-7-0-0.gar1. NewYork1.Level3.net (64.159.1.182) 20.334 ms 19.440 ms 17.938 ms

10 so-4-0-0.edge1.NewYork1.Level3.

net (209.244.17.74) 27.526 ms 18.317 ms 21.202 ms 11 uunet-level3-

oc48.NewYork1.Level3.net

(209.244.160.12) 21.411 ms 19.133 ms 18.830 ms 12 0.so-6-0-0.XL1.NYC4.ALTER.NET

(152.63.21.78)

21.203 ms 22.670 ms 20.111 ms 13 0.so-2-0-0.TL1.NYC8.ALTER.NET (152.63.0.153)

30.929 ms 24.858 ms

23.108 ms 14 0.so-4-1-0.TL1.ATL5.ALTER.NET (152.63.10.129) 37.894 ms 33.244 ms

33.910 ms 15 0.so-7-0-0.XL1.MIA4.ALTER.NET (152.63.86.189) 51.165 ms 49.935 ms

49.466 ms 16 0.so-3-0-0.XR1.MIA4.ALTER.

NET (152.63.101.41) 50.937 ms 49.005 ms 51.055 ms 17 117.ATM6-

0.GW5.MIA1.ALTER.NET (152.63.82.73) 51.897 ms 50.280 ms 53.647 ms 18 PassGuidegw1.

customer.alter.net (65.195.239.14) 51.921 ms 51.571 ms 56.855 ms 19

(65.195.239.22) 52.191 ms 52.571 ms 56.855 ms 20

(65.195.239.22) 53.561 ms 54.121 ms 58.333 ms

Which of the following is the most like cause of this issue?

Options:

A.

A stateful inspection firewall

B.

An application firewall

C.

Network Intrusion system

D.

Intrusion Detection System

Question 47

Which of the following terms is used to represent IPv6 addresses?

Options:

A.

Colon-dot

B.

Hexadecimal-dot notation

C.

Colon-hexadecimal

D.

Dot notation

Question 48

Which of the following components are usually found in an Intrusion detection system (IDS)?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Firewall

B.

Console

C.

Gateway

D.

Modem

E.

Sensor

Question 49

John works as the Security Manager for PassGuide Inc. He wants to create the Profiler database that stores information about the network activity at Layer 3, Layer 4, and Layer 7. Which of the following will he use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Ignore connection

B.

Session creation

C.

Protocol contexts

D.

Session teardown

Question 50

Which of the following commands configures a router to encrypt all passwords entered after the command has been executed, as well as all passwords already on the running configuration?

Options:

A.

no service password-encryption

B.

enable password-encryption

C.

no enable password-encryption

D.

service password-encryption

Question 51

What is the easiest way to verify that name resolution is functioning properly on a TCP/IP network?

Options:

A.

Use the TRACERT command with the /pingname parameter.

B.

Ping the source host with its computer name.

C.

Ping the source host with its IP address.

D.

Check the IP statistics on the file server.

Question 52

Which of the following proxy servers is also referred to as transparent proxies or forced proxies?

Options:

A.

Reverse proxy server

B.

Intercepting proxy server

C.

Anonymous proxy server

D.

Tunneling proxy server

Question 53

Sam works as a Network Administrator for Gentech Inc. He has been assigned a project to develop the rules that define the IDP policy in the rulebase. Which of the following will he define as the components of the IDP policy rule?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

IDP Profiler

B.

IDP rule IP actions

C.

IDP appliance deployment mode

D.

IDP rule notifications

Question 54

You work as a Network Administrator for Tech Perfect Inc. The office network is configured as an IPv6 network. You have to configure a computer with the IPv6 address, which is equivalent to an IPv4 publicly routable address. Which of the following types of addresses will you choose?

Options:

A.

Local-link

B.

Global unicast

C.

Site-local

D.

Loopback

Question 55

When client data is encapsulated into an LWAPP header, the wireless LAN controller improves the coverage areas. Which information does the wireless LAN controller check?

Each correct answer represents a part of the solution. Choose two.

Options:

A.

CCA

B.

SNR

C.

WCS

D.

RSSI

Question 56

Which of the following ICMPv6 neighbor discovery messages is sent by hosts to request an immediate router advertisement, instead of waiting for the next scheduled advertisement?

Options:

A.

Router Advertisement

B.

Neighbor Advertisement

C.

Router Solicitation

D.

Neighbor Solicitation

Question 57

A company named Tech Perfect Inc. has a TCP/IP based network. An IPS sensor is deployed in the network and configured to operate in promiscuous mode. IP blocking functionality works there in order to stop traffic from an attacking host and it helps in analyzing what happens in the network.

The management wants to initiate a persistent connection with the managed devices until the block is removed. Which of the following will you configure in the network to accomplish the task?

Options:

A.

Access Control List

B.

Firewall

C.

Network Admission Control

D.

Virtual LAN

Question 58

On which of the following interfaces of the router is the clock rate command used?

Options:

A.

DCE

B.

ETHERNET

C.

VIRTUAL LINE VTY

D.

DTE

Page: 1 / 39
Total 391 questions