Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

GIAC GISP GIAC Information Security Professional Exam Practice Test

Page: 1 / 66
Total 659 questions

GIAC Information Security Professional Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$43.75  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$38.5  $109.99
Question 1

Which of the following statements about Microsoft hotfix are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It is the term used by Microsoft for major service pack releases.

B.

It is generally related to security problems.

C.

It is a collection of files used by Microsoft for software updates released between major service pack releases.

D.

It is generally related to the problems of a Web server's performance.

Question 2

Which of the following is a process of monitoring data packets that travel across a network?

Options:

A.

Packet sniffing

B.

Packet filtering

C.

Shielding

D.

Password guessing

Question 3

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of He is using the TFN and Trin00 tools to test the security of the We-aresecure server, so that he can check whether the server is vulnerable or not. Using these tools, which of the following attacks can John perform to test the security of the We-are-secure server?

Options:

A.

Reply attack

B.

Cross site scripting attack

C.

DDoS attack

D.

Brute force attack

Question 4

Which of the following protocols provides maintenance and error reporting function?

Options:

A.

ICMP

B.

IGMP

C.

PPP

D.

UDP

Question 5

Which of the following are considered Bluetooth security violations?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Social engineering

B.

Bluesnarfing

C.

SQL injection attack

D.

Bluebug attack

E.

Cross site scripting attack

Question 6

Which of the following viruses masks itself from applications or utilities to hide itself by detection of anti-virus software?

Options:

A.

Macro virus

B.

E-mail virus

C.

Stealth virus

D.

Polymorphic virus

Question 7

What are the benefits of using a proxy server on a network?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It enhances network security.

B.

It cuts down dial-up charges.

C.

It is used for automated assignment of IP addresses to a TCP/IP client in the domain.

D.

It uses a single registered IP address for multiple connections to the Internet.

Question 8

Which of the following are intrusion detection device?

Options:

A.

Fingerprint reader

B.

Smart card reader

C.

Retinal scanner

D.

CCTV

Question 9

Fill in the blanks with the appropriate values.

International Data Encryption Algorithm (IDEA) is a _____ -bit block cipher that uses a ________-bit key.

Options:

A.

64,128

Question 10

Which of the following is the most secure policy for a firewall?

Options:

A.

Passing all packets unless they are explicitly rejected.

B.

Enabling all internal interfaces.

C.

Blocking all packets unless they are explicitly permitted.

D.

Disabling all external interfaces.

Question 11

Which of the following protocols implements VPN using IPSec?

Options:

A.

PPP

B.

L2TP

C.

PPTP

D.

SLIP

Question 12

Which of the following ensures that a sender cannot deny sending a message?

Options:

A.

Authentication

B.

Snooping

C.

Spoofing

D.

Non repudiation

Question 13

Which of the following statements about IEEE 802.1X standard are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It uses the Point-to-Point Tunneling Protocol (PPTP) that works on Ethernet, Token Ring, or wireless LANs to exchange messages for the authentication process.

B.

It uses the Extensible Authentication Protocol (EAP) that works on Ethernet, Token Ring, or wireless LANs to exchange messages for the authentication process.

C.

It provides an authentication framework for wireless LANs.

D.

It provides the highest level of VPN security.

Question 14

Which of the following protocols work at the Application layer of an OSI model?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Secure Hypertext Transfer Protocol (S-HTTP)

B.

Address Resolution Protocol (ARP)

C.

Post Office Protocol version 3 (POP3)

D.

Trivial File Transfer Protocol (TFTP)

Question 15

Which of the following is used as a transmission media by the fiber-optic cables?

Options:

A.

Light

B.

Infrared

C.

Electrical current

D.

Radio wave

Question 16

Which of the following classes of IP addresses allows a maximum of 2,097,152 networks?

Options:

A.

Class C

B.

Class B

C.

Class D

D.

Class A

Question 17

Which of the following refers to a condition in which a computer repeatedly sends ICMP echo requests to another host?

Options:

A.

Broadcast storm

B.

SYN attack

C.

Spoofing

D.

PING attack

Question 18

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of In order to do so, he performs the following steps of the preattack phase successfully:

•Information gathering

•Determination of network range

•Identification of active systems

•Location of open ports and applications

Now, which of the following tasks should he perform next?

Options:

A.

Install a backdoor to log in remotely on the We-are-secure server.

B.

Map the network of We-are-secure Inc.

C.

Fingerprint the services running on the we-are-secure network.

D.

Perform OS fingerprinting on the We-are-secure network.

Question 19

Fill in the blank with the appropriate value.

SHA-1 produces a _________ -bit message digest.

Options:

A.

160

Question 20

Peter works as a Network Administrator for Net World Inc. The company wants to allow remote users to connect and access its private network through a dial-up connection via the Internet. All the data will be sent across a public network. For security reasons, the management wants the data sent through the Internet to be encrypted. The company plans to use a Layer 2 Tunneling Protocol (L2TP) connection. Which communication protocol will Peter use to accomplish the task?

Options:

A.

Microsoft Point-to-Point Encryption (MPPE)

B.

Pretty Good Privacy (PGP)

C.

Data Encryption Standard (DES)

D.

IP Security (IPSec)

Question 21

Which of the following are examples of passive attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Shoulder surfing

B.

Dumpster diving

C.

Placing a backdoor

D.

Eavesdropping

Question 22

Which of the following groups represents the most likely source of an asset loss through the inappropriate use of computers?

Options:

A.

Visitors

B.

Customers

C.

Employees

D.

Hackers

Question 23

Which of the following needs to be documented to preserve evidences for presentation in court?

Options:

A.

Chain of custody

B.

Incident response policy

C.

Account lockout policy

D.

Separation of duties

Question 24

Which of the following task force was formed to examine the impact of Electronic Publishing on the intellectual property rights?

Options:

A.

The IIPTF (International Intellectual Property Task Force)

B.

The EPTF (Electronic Publishing Task Force)

C.

The LATF (Langham Act Task Force)

D.

The IITF (Information Infrastructure Task Force)

Question 25

Which of the following is the most secure method of authentication?

Options:

A.

Biometrics

B.

Username and password

C.

Smart card

D.

Anonymous

Question 26

Which of the following authentication protocols provides support for a wide range of authentication methods, such as smart cards and certificates?

Options:

A.

CHAP

B.

PAP

C.

EAP

D.

MS-CHAP v2

Question 27

Which of the following terms is used for a router that filters traffic before it is passed to the firewall?

Options:

A.

Screened host

B.

Demilitarized zone (DMZ)

C.

Bastion host

D.

Honey pot

Question 28

Which of the following rated systems of the Orange book has mandatory protection of the TCB?

Options:

A.

B-rated

B.

A-rated

C.

D-rated

D.

C-rated

Question 29

Which of the following is used to prevent the electronic emissions of a computer from being used by unauthorized users?

Options:

A.

Spoofing

B.

System hardening

C.

Shielding

D.

Auditing

Question 30

A ________ attack occurs when an attacker successfully inserts an intermediary software or program between two communicating hosts.

Options:

A.

Man-in-the-middle

B.

Brute force

C.

Denial of Service (DoS)

D.

Dictionary

Question 31

Which of the following can be prevented by an organization using job rotation and separation of duties policies?

Options:

A.

Collusion

B.

Eavesdropping

C.

Phishing

D.

Buffer overflow

Question 32

Which of the following should propose applicable and effective security controls for managing the risks?

Options:

A.

Risk assessment

B.

Risk treatment plan

C.

Risk communication

D.

Risk management plan

Question 33

Which of the following terms describes an attempt to transfer DNS zone data?

Options:

A.

Reconnaissance

B.

Dumpster diving

C.

Encapsulation

D.

Spam

Question 34

Which of the following are the ways of sending secure e-mail messages over the Internet?

Each correct answer represents a complete solution. Choose two.

Options:

A.

PGP

B.

TLS

C.

IPSec

D.

S/MIME

Question 35

Which of the following is a process of monitoring data packets that travel across a network?

Options:

A.

Packet sniffing

B.

Packet filtering

C.

Shielding

D.

Password guessing

Question 36

Which of the following user authentications are supported by the SSH-1 protocol but not by the SSH-2 protocol?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Password-based authentication

B.

Rhosts (rsh-style) authentication

C.

TIS authentication

D.

Kerberos authentication

Question 37

Which of the following law does not protect intellectual property?

Options:

A.

Murphy's law

B.

Patent law

C.

Trademark

D.

Copyright

Question 38

Which of the following law does not protect intellectual property?

Options:

A.

Murphy's law

B.

Patent law

C.

Trademark

D.

Copyright

Question 39

Which term best describes an e-mail that contains incorrect and misleading information or warnings about viruses?

Options:

A.

Hoax

B.

Spam

C.

Trojan horse

D.

Virus

E.

Rlogin

F.

Blowfish

Question 40

Which of the following protocols work at the network layer?

Each correct answer represents a complete solution. Choose three.

Options:

A.

RIP

B.

OSPF

C.

SPX

D.

IGMP

Question 41

At which of the following OSI model layers does the IPSec protocol work?

Options:

A.

Network layer

B.

Application layer

C.

Physical layer

D.

Data-link layer

Question 42

Which of the following protocols is used to send e-mails on the Internet?

Options:

A.

HTTP

B.

POP3

C.

IMAP4

D.

SMTP

Question 43

Which of the following ports is assigned by Internet Assigned Number Authority (IANA) for RADIUS authentication?

Options:

A.

TCP/UDP port 751

B.

TCP port 443

C.

TCP/UDP port 1812

D.

TCP/UDP port 5060

Question 44

Which of the following allows an attacker to enter malicious data into a Website?

Options:

A.

Cross site scripting

B.

Inline scripting

C.

Windows PowerShell scripting

D.

Client-side scripting

Question 45

Where are user accounts and passwords stored in a decentralized privilege management environment?

Options:

A.

On each server.

B.

On a central authentication server.

C.

On more than one server.

D.

On a server configured for decentralized privilege management.

Question 46

Which of the following statements about the availability concept of Information security management is true?

Options:

A.

It ensures that modifications are not made to data by unauthorized personnel or processes.

B.

It determines actions and behaviors of a single individual within a system.

C.

It ensures reliable and timely access to resources.

D.

It ensures that unauthorized modifications are not made to data by authorized personnel or processes.

Question 47

How many keys are used to encrypt data in symmetric encryption?

Options:

A.

Two

B.

Three

C.

Four

D.

One

Question 48

Which of the following key sizes is used by International Data Encryption Algorithm (IDEA)?

Options:

A.

64-bit

B.

16-bit

C.

32-bit

D.

128-bit

Question 49

Which of the following protects against unauthorized access to confidential information via encryption and works at the network layer?

Options:

A.

IPSec

B.

NAT

C.

Firewall

D.

MAC address

Question 50

Which of the following provides protection against network eavesdropping and signal interference and works at the physical layer?

Options:

A.

IPSec protocol

B.

Router

C.

Switch

D.

Shielded twisted pair (STP)

Question 51

Which of the following are the basic architectures of microprocessors used in modern computers?

Each correct answer represents a complete solution. Choose two.

Options:

A.

ASCII

B.

RISC

C.

CISC

D.

PCIe

Question 52

John works as a professional Ethical Hacker. He has been assigned a project to test the security of John wants to redirect all TCP port 80 traffic to UDP port 40, so that he can bypass the firewall of the We-are-secure server. Which of the following tools will John use to accomplish his task?

Options:

A.

PsList

B.

Cain

C.

Fpipe

D.

PsExec

Question 53

Which of the following types of safes can be chosen by an organization to store data backups or other types of valuables?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Depositaries

B.

Chests

C.

Bottle safe

D.

Wall safe

Question 54

Which of the following techniques allows an attacker to take network traffic coming towards a host at one port and redirect it from that host to another host.

Options:

A.

Blackbox testing

B.

Port redirection

C.

Firewalking

D.

Brainstorming

Question 55

You are installing Windows 2000 Server. You decide to use RAID-5 volume disk configuration for fault tolerance. What is the minimum number of disk drives required for implementing RAID-5 volumes?

Options:

A.

Thirty-two

B.

Two

C.

Three

D.

One

Question 56

Which of the following books is used to examine integrity and availability?

Options:

A.

Brown Book

B.

Purple Book

C.

Orange Book

D.

Red Book

Question 57

Which of the following is used to prevent the electronic emissions of a computer from being used by unauthorized users?

Options:

A.

Spoofing

B.

System hardening

C.

Shielding

D.

Auditing

Question 58

Which of the following statements about buffer overflow is true?

Options:

A.

It is a condition in which an application receives more data than it is configured to accept.

B.

It is a collection of files used by Microsoft for software updates released between major service pack releases.

C.

It is a false warning about a virus.

D.

It manages security credentials and public keys for message encryption.

Question 59

In which type of access control do user ID and password system come under?

Options:

A.

Power

B.

Physical

C.

Technical

D.

Administrative

Question 60

Which of the following is the most secure method of authentication?

Options:

A.

Biometrics

B.

Smart card

C.

Anonymous

D.

Username and password

Question 61

Which of the following protocols is used with a tunneling protocol to provide security?

Options:

A.

EAP

B.

IPSec

C.

FTP

D.

IPX/SPX

Question 62

Which of the following ports is the default port for Layer 2 Tunneling Protocol (L2TP) ?

Options:

A.

TCP port 110

B.

UDP port 161

C.

UDP port 1701

D.

TCP port 443

Question 63

You work as a Network Administrator for Web World Inc. You want to host an e-commerce Web site on your network. You want to ensure that storage of credit card information is secure. Which of the following conditions should be met to accomplish this?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

NT authentication should be required for all customers before they provide their credit card numbers.

B.

Strong encryption software should be used to store credit card information.

C.

The NTFS file system should be implemented on a client computer.

D.

Limited and authorized access should be allowed on the stored credit card information.

Question 64

Which of the following tools was developed by the FBI and is used for keystroke logging in order to capture encryption keys and other information useful for deciphering transmissions?

Options:

A.

Alchemy Remote Executor

B.

Stealth Voice Recorder

C.

KeyGhost USB keylogger

D.

KeyGhost keylogger

E.

Magic Lantern

Question 65

Which of the following are the major tasks of risk management?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Building Risk free systems

B.

Risk control

C.

Risk identification

D.

Assuring the integrity of organizational data

Question 66

Which of the following methods is a behavior-based IDS detection method?

Options:

A.

Knowledge-based detection

B.

Statistical anomaly detection

C.

Pattern matching detection

D.

Protocol detection

Question 67

Which of the following types of virus is capable of changing its signature to avoid detection?

Options:

A.

Macro virus

B.

Polymorphic virus

C.

Stealth virus

D.

Boot sector virus

Question 68

Which of the following technologies are forms of single sign-on (SSO)?

Each correct answer represents a complete solution. Choose three.

Options:

A.

CoSign

B.

Kerberos

C.

RADIUS

D.

SESAME

Question 69

Which of the following are the ways of sending secure e-mail messages over the Internet?

Each correct answer represents a complete solution. Choose two.

Options:

A.

IPSec

B.

S/MIME

C.

PGP

D.

TLS

Question 70

Which of the following protocols is used to send e-mails on the Internet?

Options:

A.

HTTP

B.

IMAP4

C.

SMTP

D.

POP3

Question 71

Which of the following protocols work at the session layer of the OSI model?

Each correct answer represents a complete solution. Choose two.

Options:

A.

File Transfer Protocol (FTP)

B.

Remote Procedure Call (RPC)

C.

Network File System (NFS)

D.

Transmission Control Protocol (TCP)

Question 72

Which of the following defines the communication link between a Web server and Web applications?

Options:

A.

Firewall

B.

IETF

C.

CGI

D.

PGP

Question 73

Which of the following acts as an intermediary between a user on the internal network and a service on the external network such as the Internet?

Options:

A.

DNS server

B.

Firewall

C.

Proxy server

D.

WINS server

Question 74

Routers and firewalls use _______ to determine which packets should be forwarded or dropped.

Options:

A.

Encryption

B.

Security audit log

C.

Access control list

D.

Ciphering

Question 75

Which of the following statements about the bridge are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It filters traffic based on IP addresses.

B.

It filters traffic based on MAC addresses.

C.

It assigns a different network address per port.

D.

It forwards broadcast packets.

Question 76

Which of the following statements about packet filtering is true?

Options:

A.

It allows or restricts the flow of encrypted packets to provide security.

B.

It is used to send confidential data on the public network.

C.

It allows or restricts the flow of specific types of packets to provide security.

D.

It is used to store information about confidential data.

Question 77

Which of the following statements about certification authority (CA) are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It is an entity in a network, which manages security credentials and public keys for message encryption.

B.

It issues certificates that confirm the identity and other attributes of a certificate in relation to other entities.

C.

It is an entity in a network, which manages files and objects.

D.

It issues private keys that confirm the identity and other attributes of a certificate in relation to other entities.

Question 78

Which of the following two components does Kerberos Key Distribution Center (KDC) consist of?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Data service

B.

Account service

C.

Authentication service

D.

Ticket-granting service

Question 79

You work as a Network Administrator for Net Perfect Inc. The company has a TCP/IP-based Windows NT network. You are configuring a computer that will be used as a file server on the network. You have to decide the disk configuration for the computer to obtain better performance.

A fault tolerant disk configuration is not a requirement. Which of the following RAID levels will you choose to fulfil the requirement?

Options:

A.

RAID-1

B.

RAID-4

C.

RAID-3

D.

RAID-0

E.

RAID-5

Question 80

Which of the following can be done over telephone lines, e-mail, instant messaging, and any other method of communication considered private.

Options:

A.

Shielding

B.

Eavesdropping

C.

Spoofing

D.

Packaging

Question 81

Which of the following statements about Digest authentication are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

In Digest authentication, passwords are sent across a network as clear text, rather than as a has value.

B.

Digest authentication is used by wireless LANs, which follow the IEEE 802.11 standard.

C.

In Digest authentication, passwords are sent across a network as a hash value, rather than as clear text.

D.

Digest authentication is a more secure authentication method as compared to Basic authentication.

Question 82

Which of the following statements about role-based access control (RBAC) model is true?

Options:

A.

In this model, a user can access resources according to his role in the organization.

B.

In this model, the permissions are uniquely assigned to each user account.

C.

In this model, the same permission is assigned to each user account.

D.

In this model, the users can access resources according to their seniority.

Question 83

Which of the following statements about the bridge are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It filters traffic based on IP addresses.

B.

It forwards broadcast packets.

C.

It assigns a different network address per port.

D.

It filters traffic based on MAC addresses.

Question 84

Which of the following can be prevented by an organization using job rotation and separation of duties policies?

Options:

A.

Collusion

B.

Eavesdropping

C.

Buffer overflow

D.

Phishing

Question 85

Which of the following statements about Due Care policy is true?

Options:

A.

It provides information about new viruses.

B.

It is a method used to authenticate users on a network.

C.

It identifies the level of confidentiality of information.

D.

It is a method for securing database servers.

Question 86

Which of the following refers to going through someone's trash to find out useful or confidential information?

Options:

A.

Dumpster diving

B.

Hacking

C.

Phishing

D.

Spoofing

Question 87

Which of the following encryption methods comes under symmetric encryption algorithm?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Blowfish

B.

DES

C.

Diffie-Hellman

D.

RC5

Question 88

Which of the following statements about service pack are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It is a medium by which product updates are distributed.

B.

It is a term used for securing an operating system.

C.

It is a term generally related to security problems in a software.

D.

It is a collection of Fixes and Patches in a single product.

Question 89

Which of the following is a process of monitoring data packets that travel across a network?

Options:

A.

Packet sniffing

B.

Authentication

C.

Network binding

D.

Encryption

Question 90

At which of the following layers Structured Query Language (SQL) works?

Options:

A.

Physical

B.

Network

C.

Transport

D.

Session

Question 91

Which of the following rated systems of the Orange book has mandatory protection of the TCB?

Options:

A.

B-rated

B.

A-rated

C.

D-rated

D.

C-rated

Question 92

Which of the following statements about DMZ is true?

Options:

A.

DMZ is a corporate network used as the Internet.

B.

DMZ is a firewall that lies in between two corporate networks.

C.

DMZ is a network that is not connected to the Internet.

D.

DMZ is a network that lies in between a corporate network and the Internet.

Question 93

Which of the following is a name, symbol, or slogan with which a product is identified?

Options:

A.

Trademark

B.

Patent

C.

Trade secret

D.

Copyright

Question 94

Which of the following statements about DMZ are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It is an anti-virus software that scans the incoming traffic on an internal network.

B.

It is the boundary between the Internet and a private network.

C.

It contains company resources that are available on the Internet, such as Web servers and FTP servers.

D.

It contains an access control list (ACL).

Question 95

Which of the following entities is used by Routers and firewalls to determine which packets should be forwarded or dropped?

Options:

A.

Rainbow table

B.

Rootkit

C.

Access control list

D.

Backdoor

Question 96

Fill in the blank with the appropriate layer name of the OSI model.

Secure Socket Layer (SSL) operates at the _______ layer of the OSI model.

Options:

A.

transport

Question 97

John works as a Network Administrator for We-are-secure Inc. The We-are-secure server is based on Windows Server 2003. One day, while analyzing the network security, he receives an error message that Kernel32.exe is encountering a problem. Which of the following steps should John take as a countermeasure to this situation?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

He should upgrade his antivirus program.

B.

He should download the latest patches for Windows Server 2003 from the Microsoft site, so that he can repair the kernel.

C.

He should observe the process viewer (Task Manager) to see whether any new process is running on the computer or not. If any new malicious process is running, he should kill that process.

D.

He should restore his Windows settings.

Question 98

Which of the following terms is used for securing an operating system from an attack?

Options:

A.

System hacking

B.

System hardening

C.

System mirroring

D.

System indexing

Page: 1 / 66
Total 659 questions