GIAC GIAC Information Security GCFA Questions & Answers

• Question 1:

  Victor is a novice Ethical Hacker. He is learning the hacking process, i.e., the steps taken by malicious hackers to perform hacking. Which of the following steps is NOT included in the hacking process?

  A. Reconnaissance

  B. gaining access

  C. Scanning

  D. Preparation

  Correct Answer: D

• Question 2:

  Adrian, the Network Administrator for Peach Tree Inc., wants to install a new computer on the company's network. He asks his assistant to make a boot disk with minimum files. The boot disk will be used to boot the computer, which does not have an operating system installed, yet. Which of the following files will he include on the disk?

  A. IO.SYS, MSDOS.SYS, COMMAND.COM, and AUTOEXEC.BAT.

  B. IO.SYS, MSDOS.SYS, and COMMAND.COM.

  C. IO.SYS, MSDOS.SYS, COMMAND.COM, and CONFIG.SYS.

  D. IO.SYS, MSDOS.SYS, COMMAND.COM, and FDISK.

  Correct Answer: B

• Question 3:

  Which of the following types of attacks cannot be prevented by technical measures only?

  A. Ping flood attack

  B. Brute force

  C. Smurf DoS

  D. Social engineering

  Correct Answer: D

• Question 4:

  John works as a contract Ethical Hacker. He has recently got a project to do security checking for www.we-are-secure.com. He wants to find out the operating system of the we-are-secure server in the information gathering step. Which of the following commands will he use to accomplish the task?

  Each correct answer represents a complete solution. Choose two.

  A. nc 208.100.2.25 23

  B. nmap -v -O www.we-are-secure.com

  C. nc -v -n 208.100.2.25 80

  D. nmap -v -O 208.100.2.25

  Correct Answer: BD

• Question 5:

  A customer comes to you stating that his hard drive has crashed. He had backed up the hard drive, but some files on it were encrypted with Windows Encrypted File System (EFS). What do you need to do to be able to give him access to those restored encrypted files?

  A. Nothing, they are unrecoverable.

  B. You need the encryption key. If that was not saved/backed up, then there is no chance of recovery.

  C. Nothing, when you restore, he will have access.

  D. You need to make sure that when you restore, you give the new machine the same user account so that he can open the encrypted files.

  Correct Answer: B

• Question 6:

  Which of the following registry hives contains information about all users who have logged on to the system?

  A. HKEY_CLASSES_ROOT

  B. HKEY_CURRENT_USERS

  C. HKEY_USERS

  D. HKEY_CURRENT_CONFIG

  Correct Answer: C

• Question 7:

  Which of the following steps should be performed in order to optimize a system performance? Each correct answer represents a complete solution. Choose three.

  A. Run anti-spyware program regularly

  B. Defragment the hard disk drive

  C. Edit registry regularly

  D. Delete the temporary files

  Correct Answer: ABD

• Question 8:

  In a Windows 98 computer, which of the following utilities is used to convert a FAT16 partition to FAT32?

  A. CVT16.EXE

  B. CVT1.EXE

  C. CONVERT16.EXE

  D. CONVERT.EXE

  Correct Answer: B

• Question 9:

  Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate an iphone, which is being seized from a criminal. The local police suspect that this iphone contains some sensitive information. Adam knows that the storage partition of the iphone is divided into two partitions. The first partition is used for the operating system. Other data of iphone is stored in the second partition. Which of the following is the name with which the second partition is mounted on the iphone?

  A. /private/var

  B. /var/data

  C. /var/private

  D. /data/var

  Correct Answer: A

• Question 10:

  John works as a Network Administrator for DigiNet Inc. He wants to investigate failed logon attempts to a network. He uses Log Parser to detail out the failed logons over a specific time frame. He uses the following commands and query to

  list all failed logons on a specific date:

  logparser.exe file:FailedLogons.sql -i:EVT -o:datagrid

  SELECT

  timegenerated AS LogonTime,

  extract_token(strings, 0, '|') AS UserName

  FROM Security

  WHERE EventID IN (529;

  530;

  531;

  532;

  533;

  534;

  535;

  537;

  539)

  AND to_string(timegenerated,'yyyy-MM-dd HH:mm:ss') like '2004-09%'

  After investigation, John concludes that two logon attempts were made by using an expired account.

  Which of the following EventID refers to this failed logon?

  A. 529

  B. 534

  C. 531

  D. 532

  Correct Answer: D