Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

GIAC GCIA GCIA – GIAC Certified Intrusion Analyst Practice Test Exam Practice Test

Page: 1 / 51
Total 508 questions

GCIA – GIAC Certified Intrusion Analyst Practice Test Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$43.75  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$38.5  $109.99
Question 1

Which of the following tools is used to recover data and partitions, and can run on Windows, Linux, SunOS, and Macintosh OS X operating systems?

Options:

A.

GetDataBack

B.

Acronis Recovery Expert

C.

Active@ Disk Image

D.

TestDisk

Question 2

Which of the following image file formats uses a lossy data compression technique?

Options:

A.

GIF

B.

JPG

C.

PNG

D.

TIF

Question 3

Which of the following is the best method of accurately identifying the services running on a victim host?

Options:

A.

Use of hit and trial method to guess the services and ports of the victim host.

B.

Use of a port scanner to scan each port to confirm the services running.

C.

Use of a vulnerability scanner to try to probe each port to verify which service is running.

D.

Use of the manual method of telnet to each of the open ports.

Question 4

Which of the following is the purpose of creating a Demilitarized zone (DMZ) in an enterprise network?

Options:

A.

Performing Isolation

B.

Creating Autonomous Systems

C.

Intrusion Detection

D.

Military usage

Question 5

Drag and drop the appropriate protocols to their respective port numbers they use by default.

Options:

A.

Question 6

Which of the following ports is used by e-mail clients to send request to connect to the server?

Options:

A.

Port 23

B.

Port 21

C.

Port 25

D.

Port 20

Question 7

Which of the following sectors on a hard disk contains codes that the computer uses to start the system?

Options:

A.

Sector 256

B.

Sector 0

C.

Sector 1

D.

Sector 128

Question 8

Which of the following commands used in Linux to create bit-stream images?

Options:

A.

ss

B.

xcopy

C.

dd

D.

img

Question 9

Ryan, a malicious hacker submits Cross-Site Scripting (XSS) exploit code to the Website of Internet forum for online discussion. When a user visits the infected Web page, code gets automatically executed and Ryan can easily perform acts like account hijacking, history theft etc. Which of the following types of Cross-Site Scripting attack Ryan intends to do?

Options:

A.

SAX

B.

Persistent

C.

Document Object Model (DOM)

D.

Non persistent

Question 10

John works as a Network Administrator for Samtech Inc. He has configured CDP on each interface of the router. Which of the following commands should he use to list the number of CDP advertisements?

Options:

A.

show interfaces [type number]

B.

show cdp traffic

C.

show interfaces status

D.

show cdp

Question 11

Which of the following is computed from an arbitrary block of digital data for the purpose of detecting accidental errors?

Options:

A.

Hash buster

B.

Firewall

C.

Checksum

D.

Hash filter

Question 12

Adam works as a Senior Programmer for Umbrella Inc. A project has been assigned to him to write a short program to gather user input for a Web application. He wants to keep his program neat and simple. His chooses to use printf(str) where he should have ideally used printf("%s", str).

What attack will his program expose the Web application to?

Options:

A.

Sequence++ attack

B.

Cross Site Scripting attack

C.

Format string attack

D.

SQL injection attack

Question 13

You work as a Network Administrator for Net Perfect Inc. The company has a TCP/IP-based network. The network is connected to the Internet through a firewall. A user complains that he is unable to access the abc.com site. However, he can access all other sites. Which of the following tools will help you diagnose the problem?

Options:

A.

IPCONFIG

B.

ROUTE

C.

TELNET

D.

TRACERT

Question 14

Which of the following is used over the Internet for better security?

Options:

A.

SOCKS

B.

S-HTTP

C.

Wingate

D.

IMAP Server

Question 15

What is the maximum size of an IP datagram for Ethernet?

Options:

A.

4500 bytes

B.

1024 bytes

C.

1200 bytes

D.

1500 bytes

Question 16

The Intrusion Detection System (IDS) instructs the firewall to reject any request from a particular IP address if the network is repeatedly attacked from this address. What is this action known as?

Options:

A.

Spoofing

B.

Sending deceptive e-mails

C.

Network Configuration Changes

D.

Shunning

E.

Logging

F.

Sending notifications

Question 17

Which of the following types of write blocker device uses one interface for one side and a different one for the other?

Options:

A.

Pros

B.

Tailgate.

C.

Indiff

D.

Native

Question 18

Which of the following ports is used by NTP for communication?

Options:

A.

143

B.

123

C.

161

D.

53

Question 19

Which of the following firewalls inspects the actual contents of packets?

Options:

A.

Application-level firewall

B.

Stateful inspection firewall

C.

Packet filtering firewall

D.

Circuit-level firewall

Question 20

You work as a technician for Tech Perfect Inc. You are troubleshooting an Internet name resolution issue. You ping your ISP's DNS server address and find that the server is down. You want to continuously ping the DNS address until you have stopped the command. Which of the following commands will you use?

Options:

A.

ping -a

B.

ping -l

C.

ping -t

D.

ping –n

Question 21

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

Options:

A.

DriveSpy

B.

Ontrack

C.

Device Seizure

D.

Forensic Sorter

Question 22

Which of the following is a valid IP address for class B Networks?

Options:

A.

225.128.98.7

B.

80.33.5.7

C.

212.136.45.8

D.

172.157.88.3

Question 23

You work as a network administrator for Tech Perfect Inc. Rick, your assistant, requires information regarding his computer's IP address lease start date and expiry date. Which of the following commands will help him?

Options:

A.

Ipconfig /all

B.

Ping 127.0.0.1

C.

Ping /t

D.

Ipconfig /renew

Question 24

Which of the following is the default port used by Simple Mail Transfer Protocol (SMTP)?

Options:

A.

80

B.

25

C.

20

D.

21

Question 25

You work as a Network Security Administrator for NetPerfect Inc. The company has a Windowsbased network. You are incharge of the data and network security of the company. While performing a threat log analysis, you observe that one of the database administrators is pilfering confidential data. What type of threat is this?

Options:

A.

Zombie

B.

External threat

C.

Internal threat

D.

Malware

Question 26

Which of the following protocols is used by e-mail servers to send messages?

Options:

A.

SNMP

B.

FTP

C.

POP3

D.

SMTP

E.

HTTP

Question 27

Which of the following is allowed by a company to be addressed directly from the public network and is hardened to screen the rest of its network from security exposure?

Options:

A.

Intrusion detection system

B.

A computer installed in the network and configured with sender reputation

C.

bastion host

D.

Exchange ActiveSync

Question 28

Which of the following programs is used to add words to spam e-mails so that the e-mail is not considered spam and therefore is delivered as if it were a normal message?

Options:

A.

Adler-32

B.

Hash filtrer

C.

Hash buster

D.

Checksum

Question 29

Which of the following is used to detect the bad sectors in a hard disk under Linux environment?

Options:

A.

Badblocks

B.

CheckDisk

C.

ScanDisk

D.

CHKDSK

Question 30

Adam works as a Network Administrator for passguide Inc. He wants to prevent the network from

DOS attacks. Which of the following is most useful against DOS attacks?

Options:

A.

Internet bot

B.

Honey Pot

C.

SPI

D.

Distributive firewall

Question 31

What is the order of the extension headers that is followed by IPv6?

Options:

A.

Destination Options (first), Routing, IPv6 header, Hop-by-Hop, Fragment, Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

B.

Routing, Hop-by-Hop, Destination Options (first), Fragment, Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

C.

Fragment, Routing, Hop-by-Hop, Destination Options (first), Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

D.

IPv6 header, Hop-by-Hop, Destination Options (first), Routing, Fragment, Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

Question 32

Which of the following tools is used to store the contents of a TDB (Trivial Database) file to the standard output when debugging problems with TDB files?

Options:

A.

tcpdump

B.

pdbedit

C.

Winbindd

D.

tdbdump

Question 33

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system. Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Allocated cluster

B.

Swap files

C.

Slack spaces

D.

Unused and hidden partition

Question 34

Which of the following is used as a default port by the TELNET utility?

Options:

A.

21

B.

80

C.

23

D.

20

Question 35

Which of the following types of firewall ensures that the packets are part of the established session?

Options:

A.

Switch-level firewall

B.

Application-level firewall

C.

Stateful inspection firewall

D.

Circuit-level firewall

Question 36

Victor works as a professional Ethical Hacker for SecureEnet Inc. He has been assigned a job to test an image, in which some secret information is hidden, using Steganography. Victor performs the following techniques to accomplish the task:

1. Smoothening and decreasing contrast by averaging the pixels of the area where significant color transitions occurs.

2. Reducing noise by adjusting color and averaging pixel value.

3. Sharpening, Rotating, Resampling, and Softening the image.

Which of the following Steganography attacks is Victor using?

Options:

A.

Chosen-Stego Attack

B.

Active Attacks

C.

Stegdetect Attack

D.

Steg-Only Attack

Question 37

Peter works as a professional Computer Hacking Forensic Investigator for eLaw-Suit law firm. He is working on a case of a cyber crime. Peter knows that the good investigative report should not only communicate the relevant facts, but also present expert opinion. This report should not include the cases in which the expert acted as a lay witness. Which of the following type of witnesses is a lay witness?

Options:

A.

One who can give a firsthand account of something seen, heard, or experienced.

B.

One with special knowledge of the subject about which he or she is testifying.

C.

One who observes an event.

D.

One who is not qualified as an expert witness.

Question 38

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police.

A project has been assigned to him to investigate an iPod, which was seized from a student of the high school. It is suspected that the explicit child pornography contents are stored in the iPod. Adam wants to investigate the iPod extensively. Which of the following operating systems will Adam use to carry out his investigations in more extensive and elaborate manner?

Options:

A.

Linux

B.

Mac OS

C.

MINIX 3

D.

Windows XP

Question 39

Windump is a Windows port of the famous TCPDump packet sniffer available on a variety of platforms. In order to use this tool on the Windows platform a user must install a packet capture library.

What is the name of this library?

Options:

A.

libpcap

B.

WinPCap

C.

PCAP

D.

SysPCap

Question 40

Mark works as the Network Administrator of a Windows 2000 based network. The network has a DNS server installed. He experiences host name resolution problems on the network. In order to rectify the situation, he wants to troubleshoot DNS name resolution problems on the network.

Which of the following tools will he use to do this?

Options:

A.

NSLOOKUP

B.

IPCONFIG

C.

NBTSTAT

D.

NETSTAT

Question 41

You work as a Network Administrator for a bank. For securing the bank's network, you configure a firewall and an IDS. In spite of these security measures, intruders are able to attack the network.

After a close investigation, you find that your IDS is not configured properly and hence is unable to generate alarms when needed. What type of response is the IDS giving?

Options:

A.

False Positive

B.

True Negative

C.

False Negative

D.

True Positive

Question 42

In which of the following IKE phases the IPsec endpoints establish parameters for a secure ISAKMP session?

Options:

A.

IKE Phase 2.5

B.

IKE Phase 2

C.

IKE Phase 1

D.

IKE Phase 1.5

Question 43

Nathan works as a professional Ethical Hacker. He wants to see all open TCP/IP and UDP ports of his computer. Nathan uses the netstat command for this purpose but he is still unable to map open ports to the running process with PID, process name, and path. Which of the following commands will Nathan use to accomplish the task?

Options:

A.

ping

B.

Psloggedon

C.

Pslist

D.

fport

Question 44

Users on a TCP/IP network are able to ping resources using IP addresses. However, they are unable to connect to those resources through their host names. A malfunction or failure of which of the following servers may be the cause of the issue?

Options:

A.

Proxy

B.

DHCP

C.

DNS

D.

WINS

Question 45

Which of the following commands will you use to display ARP packets in the snort-output?

Options:

A.

snort -v -i eth 0

B.

snort -d -v -i eth 0

C.

snort -dev -i eth 0

D.

snort -deva -i eth 0

Question 46

John works as a Professional Ethical Hacker for NetPerfect Inc. The company has a Linux-based network. All client computers are running on Red Hat 7.0 Linux. The Sales Manager of the company complains to John that his system contains an unknown package named as tar.gz and his documents are exploited. To resolve the problem, John uses a Port scanner to enquire about the open ports and finds out that the HTTP server service port on 27374 is open. He suspects that the other computers on the network are also facing the same problem. John discovers that a malicious application is using the synscan tool to randomly generate IP addresses. Which of the following worms has attacked the computer?

Options:

A.

Ramen

B.

LoveLetter

C.

Code red

D.

Nimda

Question 47

Computer networks and the Internet are the prime mode of Information transfer today. Which of the following is a technique used for modifying messages, providing Information and Cyber security, and reducing the risk of hacking attacks during communications and message passing over the Internet?

Options:

A.

Risk analysis

B.

Cryptography

C.

Firewall security

D.

OODA loop

Question 48

What are the benefits of creating a new view using role-based CLI?

Options:

A.

Scalability

B.

Operational efficiency

C.

Security

D.

Availability

Question 49

Which of the following can be applied as countermeasures against DDoS attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Limiting the amount of network bandwidth.

B.

Blocking IP address.

C.

Using LM hashes for passwords.

D.

Using Intrusion detection systems.

E.

Using the network-ingress filtering.

Question 50

You work as a Network Administrator for Tech Perfect Inc. The office network is configured as an IPv6 network. You have to configure a computer with the IPv6 address, which is equivalent to an IPv4 publicly routable address. Which of the following types of addresses will you choose?

Options:

A.

Site-local

B.

Global unicast

C.

Local-link

D.

Loopback

Question 51

You are the Administrator for a Windows 2000 based network that uses DHCP to dynamically assign IP addresses to the clients and DNS servers. You want to ensure that the DNS servers can communicate with another DNS server. Which type of query will you run to achieve this?

Options:

A.

PATHPING

B.

NSLOOKUP

C.

PING

D.

Recursive

Question 52

A firewall is a combination of hardware and software, used to provide security to a network. It is used to protect an internal network or intranet against unauthorized access from the Internet or other outside networks. It restricts inbound and outbound access and can analyze all traffic between an internal network and the Internet. Users can configure a firewall to pass or block packets from specific IP addresses and ports. Which of the following tools works as a firewall for the Linux 2.4 kernel?

Options:

A.

IPTables

B.

OpenSSH

C.

IPChains

D.

Stunnel

Question 53

Adam works as a Security Analyst for Umbrella Inc. He is performing real-time traffic analysis on IP networks using Snort. Adam is facing problems in analyzing intrusion data. Which of the following software combined with Snort can Adam use to get a visual representation of intrusion data?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Basic Analysis and Security Engine (BASE)

B.

sguil

C.

KFSensor

D.

OSSIM

Question 54

Every network device contains a unique built in Media Access Control (MAC) address, which is used to identify the authentic device to limit the network access. Which of the following addresses is a valid MAC address?

Options:

A.

A3-07-B9-E3-BC-F9

B.

132.298.1.23

C.

F936.28A1.5BCD.DEFA

D.

1011-0011-1010-1110-1100-0001

Question 55

Which method would provide the highest level of protection for all data transmitted on the internal network only? (Click the Exhibit button on the toolbar to see the case study.)

Options:

A.

IPSec tunnel mode

B.

SSL

C.

PPTP

D.

SMB

E.

IPSec transport mode

Question 56

You work as a Network Administrator for Tech2tech Inc. You have configured a network-based IDS for your company.

You have physically installed sensors at all key positions throughout the network such that they all report to the command console.

What will be the key functions of the sensors in such a physical layout?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

To collect data from operating system logs

B.

To notify the console with an alert if any intrusion is detected

C.

To analyze for known signatures

D.

To collect data from Web servers

Question 57

John enters a URL in the web browser. A web page appears after he enters the URL. Which of the following protocols is used to resolve into the correct IP address?

Options:

A.

DNS

B.

SMTP

C.

DHCP

D.

ARP

Question 58

Which of the following is the process of categorizing attack alerts produced from IDS?

Options:

A.

Site policy implementation

B.

Blocking

C.

Intrusion classify

D.

Alarm filtering

Question 59

Which of the following hacking tools provides shell access over ICMP?

Options:

A.

John the Ripper

B.

Loki

C.

Nessus

D.

Nmap

Question 60

Mark works as a Network Security Administrator for BlueWells Inc. The company has a Windowsbased network. Mark is giving a presentation on Network security threats to the newly recruited employees of the company. His presentation is about the External threats that the company recently faced in the past. Which of the following statements are true about external threats?

Each correct answer represents a complete solution. Choose three.

Options:

A.

These are the threats that originate from outside an organization in which the attacker attempts to gain unauthorized access.

B.

These are the threats that originate from within the organization.

C.

These are the threats intended to flood a network with large volumes of access requests.

D.

These threats can be countered by implementing security controls on the perimeters of the network, such as firewalls, which limit user access to the Internet.

Question 61

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to secure access to the network of the company from all possible entry points. He segmented the network into several subnets and installed firewalls all over the network. He has placed very stringent rules on all the firewalls, blocking everything in and out except ports that must be used.

He does need to have port 80 open since his company hosts a website that must be accessed from the Internet. Adam is still worried about programs like Hping2 that can get into a network through covert channels.

Which of the following is the most effective way to protect the network of the company from an attacker using Hping2 to scan his internal network?

Options:

A.

Block ICMP type 13 messages

B.

Block all outgoing traffic on port 21

C.

Block all outgoing traffic on port 53

D.

Block ICMP type 3 messages

Question 62

Mark works as a Network administrator for SecureEnet Inc. His system runs on Mac OS X. He wants to boot his system from the Network Interface Controller (NIC). Which of the following snag keys will Mark use to perform the required function?

Options:

A.

D

B.

N

C.

Z

D.

C

Question 63

Which of the following DOS commands is used to configure network protocols?

Options:

A.

netsh

B.

netsvc

C.

netstat

D.

ipconfig

Question 64

You work as a Network Administrator for Tech Perfect Inc. Your company has a Windows 2000- based network. You want to verify the connectivity of a host in the network. Which of the following utilities will you use?

Options:

A.

PING

B.

TELNET

C.

NETSTAT

D.

TRACERT

Question 65

Which of the following are the two sub-layers present in Data Link layer of the OSI Reference model?

Options:

A.

Logical control and Link control

B.

Data control and Media Access control

C.

Machine Link control and Logical Link control

D.

Logical Link control and Media Access control

Question 66

Which of the following NETSH commands for interface Internet protocol version 4 (IPv4) is used to delete a DNS server or all DNS servers from a list of DNS servers for a specified interface or for all interfaces?

Options:

A.

alter dnsserver

B.

delete dnsserver

C.

disable dnsserver

D.

remove dnsserver

Question 67

Which of the following are the two sub-layers present in Data Link layer of the OSI Reference model?

Options:

A.

Data control and Media Access control

B.

Logical control and Link control

C.

Logical Link control and Media Access control

D.

Machine Link control and Logical Link control

Question 68

Which of the following parts of hard disk in Mac OS X File system stores information related to the files?

Options:

A.

Resource fork

B.

Data fork

C.

System fork

D.

Log fork

Question 69

Which of the following commands is used to flush the destination cache for IPv6 interface?

Options:

A.

netsh interface ipv6 reset cache

B.

netsh interface ipv6 delete destinationcache

C.

netsh interface ipv6 flush destinationcache

D.

netsh interface ipv6 remove destinationcache

Question 70

What is the name of the first computer virus that infected the boot sector of the MS-DOS operating system?

Options:

A.

Stoner

B.

Code Red

C.

Brain

D.

Sircam

Question 71

Which of the following statements are true about snort?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It develops a new signature to find vulnerabilities.

B.

It detects and alerts a computer user when it finds threats such as buffer overflows, stealth port scans, CGI attacks, SMB probes and NetBIOS queries, NMAP and other port scanners, well-known backdoors and system vulnerabilities, and DDoS clients.

C.

It encrypts the log file using the 256 bit AES encryption scheme algorithm.

D.

It is used as a passive trap to record the presence of traffic that should not be found on a network, such as NFS or Napster connections.

Question 72

Which of the following can be applied as countermeasures against DDoS attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Limiting the amount of network bandwidth

B.

Blocking IP address

C.

Using LM hashes for passwords

D.

Using Intrusion detection systems

E.

Using the network-ingress filtering

Question 73

Which of the following attacks is used to hack simple alphabetical passwords?

Options:

A.

Dictionary-based attack

B.

Sniffing

C.

Man-in-the-middle attack

D.

Black hat attack

Question 74

Which of the following attacks is designed to deduce the brand and/or version of an operating system or application?

Options:

A.

Vulnerability assessment

B.

Banner grabbing

C.

OS fingerprinting

D.

Port scanning

Question 75

Sandra, a novice computer user, works on Windows environment. She experiences some problem regarding bad sectors formed in a hard disk of her computer. She wants to run CHKDSK command to check the hard disk for bad sectors and to fix the errors, if any, occurred. Which of the following switches will she use with CHKDSK command to accomplish the task?

Options:

A.

CHKDSK /I

B.

CHKDSK /R /F

C.

CHKDSK /C /L

D.

CHKDSK /V /X

Question 76

What is the process of detecting unauthorized access known as?

Options:

A.

Intrusion detection

B.

Misuse detection

C.

Anomaly detection

D.

Integrity detection

Page: 1 / 51
Total 508 questions