GIAC GIAC Information Security GSEC Questions & Answers

• Question 261:

  Which of the following is TRUE regarding the ability of attackers to eavesdrop on wireless communications?

  A. Eavesdropping attacks cannot be performed through concrete walls.

  B. Eavesdropping attacks can take place from miles away.

  C. Eavesdropping attacks are easily detected on wireless networks.

  D. Eavesdropping attacks require expensive devices.

  Correct Answer: B

• Question 262:

  Which of the following is a valid password for a system with the default "Password must meet complexity requirements" setting enabled as part of the GPO Password policy requirements?

  A. The Cat Chased its Tail AII Night

  B. disk ACCESS failed

  C. SETI@HOME

  D. SaNS2006

  Correct Answer: D

• Question 263:

  At what point in the Incident Handling process should an organization determine its approach to notifying law enforcement?

  A. When performing analysis

  B. When preparing policy

  C. When recovering from the incident

  D. When reacting to an incident

  Correct Answer: B

• Question 264:

  When trace route fails to get a timely response for a packet after three tries, which action will it take?

  A. It will print '* * *' for the attempts and increase the maximum hop count by one.

  B. It will exit gracefully, and indicate to the user that the destination is unreachable.

  C. It will increase the timeout for the hop and resend the packets.

  D. It will print '* * *' for the attempts, increment the TTL and try again until the maximum hop count.

  Correct Answer: D

• Question 265:

  You are examining an IP packet with a header of 40 bytes in length and the value at byte 0 of the packet header is 6. Which of the following describes this packet?

  A. This is an IPv4 packet; the protocol encapsulated in the payload is unspecified.

  B. This is an IPv4 packet with a TCP payload.

  C. This is an IPv6 packet; the protocol encapsulated in the payload is unspecified.

  D. This is an IPv6 packet with a TCP payload.

  Correct Answer: C

• Question 266:

  When an IIS filename extension is mapped, what does this mean?

  A. Files with the mapped extensions cannot be interpreted by the web server.

  B. The file and all the data from the browser's request are handed off to the mapped interpreter.

  C. The files with the mapped extensions are interpreted by CMD.EXE.

  D. The files with the mapped extensions are interpreted by the web browser.

  Correct Answer: B

• Question 267:

  Which Linux file lists every process that starts at boot time?

  A. inetd

  B. netsrv

  C. initd

  D. inittab

  Correct Answer: D

• Question 268:

  Which of the following is a standard Unix command that would most likely be used to copy raw file system data for later forensic analysis?

  A. dd

  B. backup

  C. cp

  D. gzip

  Correct Answer: A

• Question 269:

  Which of the following is NOT a recommended best practice for securing Terminal Services and Remote Desktop?

  A. Require TLS authentication and data encryption whenever possible.

  B. Make sure to allow all TCP 3389 traffic through the external firewall.

  C. Group Policy should be used to lock down the virtual desktops of thin-client users.

  D. Consider using IPSec or a VPN in addition to the RDP encryption if you are concerned about future RDP vulnerabilities.

  Correct Answer: B

• Question 270:

  Two clients connecting from the same public IP address (for example - behind the same NAT firewall) can connect simultaneously to the same web server on the Internet, provided what condition is TRUE?

  A. The server is not using a well-known port.

  B. The server is on a different network.

  C. The client-side source ports are different.

  D. The clients are on different subnets.

  Correct Answer: C