GIAC GIAC Information Security GCED Questions & Answers

• Question 81:

  Analyze the screenshot below. Which of the following attacks can be mitigated by these configuration settings?

  

  A. A Denial-of-Service attack using network broadcasts

  B. A Replay attack

  C. An IP masquerading attack

  D. A MAC Flood attack

  Correct Answer: D

  Explanation: Both BPDU Guard and Root Guard are used to prevent a new switch from becoming the Root Bridge. They are very similar but use different mechanisms. Rootguard allows devices to use STP, but if they send superior BDPUs (i.e. they attempt to become the Root Bridge), Root Guard disables the port until the offending BPDUs cease. Recovery is automatic. If Portfast is enabled on a port, BPDU Guard will disable the port if a BPDU is received. The port stays disabled until it is manually re-enabled. Devices behind such ports cannot use STP, as the port would be disabled as soon as they send BPDUs (which is the default behavior of switches).

• Question 82:

  A company estimates a loss of $2,374 per hour in sales if their website goes down. Their webserver hosting site's documented downtime was 7 hours each quarter over the last two years. Using the information, what can the analyst determine?

  A. Annualized loss expectancy

  B. CVSS risk score

  C. Total cost of ownership

  D. Qualitative risk posture

  Correct Answer: A

  Explanation: The annualized loss expectancy (ALE) is deduced by multiplying the single loss expectancy (SLE) by the annual rate of occurrence (ARO); in this example $2, 374 ?(7 ?4), respectively. This is a form of Quantitative risk analysis. Qualitative risk posture is deduced by measuring and contrasting the likelihood (probability of occurrence) with the level of impact and by definition does not address risk using monetary figures. Total cost of ownership (TCO) is the sum of all costs (technical, administrative, environmental, et al) that are involved for a specific system, service, etc. CVSS risk scoring is not based off of this type of loss data.

• Question 83:

  Which tool uses a Snort rules file for input and by design triggers Snort alerts?

  A. snot

  B. stick

  C. Nidsbench

  D. ftester

  Correct Answer: C

• Question 84:

  Network administrators are often hesitant to patch the operating systems on CISCO router and switch operating systems, due to the possibility of causing network instability, mainly because of which of the following?

  A. Having to rebuild all ACLs

  B. Having to replace the kernel

  C. Having to re-IP the device

  D. Having to rebuild ARP tables

  E. Having to rebuild the routing tables

  Correct Answer: B

  Explanation: Many administrators are hesitant to upgrade the IOS on routers based on past experience with the code introducing instability into the network. It is often difficult to completely test an IOS software upgrade in a production environment because the monolithic kernel requires that the IOS be replaced before the device can be tested. Because of these reasons, IOS upgrades to resolve security flaws are often left undone in many organizations.

• Question 85:

  A security device processes the first packet from 10.62.34.12 destined to 10.23.10.7 and recognizes a malicious anomaly. The first packet makes it to 10.23.10.7 before the security devices sends a TCP RST to 10.62.34.12. What type of security device is this?

  A. Host IDS

  B. Active response

  C. Intrusion prevention

  D. Network access control

  Correct Answer: B

  An active response device dynamically reconfigures or alters network or system access controls, session streams, or individual packets based on triggers from packet inspection and other detection devices. Active response happens after the event has occurred, thus a single packet attack will be successful on the first attempt and blocked in future attempts. Network intrusion prevention devices are typically inline devices on the network that inspect packets and make decisions before forwarding them on to the destination. This type of device has the capability to defend against single packet attacks on the first attempt by blocking or modifying the attack inline.

• Question 86:

  Why would an incident handler acquire memory on a system being investigated?

  A. To determine whether a malicious DLL has been injected into an application

  B. To identify whether a program is set to auto-run through a registry hook

  C. To list which services are installed on they system

  D. To verify which user accounts have root or admin privileges on the system

  Correct Answer: C

• Question 87:

  Which could be described as a Threat Vector?

  A. A web server left6 unpatched and vulnerable to XSS

  B. A coding error allowing remote code execution

  C. A botnet that has infiltrated perimeter defenses

  D. A wireless network left open for anonymous use

  Correct Answer: A

  A threat vector is the method (crafted packet) that would be used to exercise a vulnerability (fragmentation to bypass IDS signature). An unpatched web server that is susceptible to XSS simply describes a vulnerability (unpatched) paired with a specific threat (XSS) and does not touch on the method to activate the threat. Similarly, the coding error that allows remote code execution is simply describing the pairing of a vulnerability with a threat, respectively. The botnet is an unspecified threat; there is no indication of how the threat was activated (or it's intention/capabilities; the threat).

• Question 88:

  When an IDS system looks for a pattern indicating a known worm, what type of detection method is it using?

  A. Signature-based

  B. Anomaly-based

  C. Statistical

  D. Monitored

  Correct Answer: A