GIAC GIAC Information Security GSNA Questions & Answers

• Question 401:

  HOTSPOT

  John works as an office assistance in an office. The office uses Windows Vista operating system. He wants to disable a program from running on a computer. He opens the Windows Defender window and clicks on the Tools link. He clicks on a link to view the list of programs running on the computer, selects a program and then clicks on the Disable button to disable it. Mark the option that John had chosen to view the list of programs running on the computer.

  Hot Area:

  

  Correct Answer:

  

  The Software Explorer link will open a list of programs running on the computer.

• Question 402:

  HOTSPOT

  You work as a Network Administrator for uCertify Inc. The company's Windows 2000-based network is configured with Internet Security and Acceleration (ISA) Server 2000. All clients on the network run Windows 2000 Professional. The

  company policy prevents you from installing the Firewall Client software or configuring the Web Proxy service on any client computer. You configure access policy rules to allow all the users to use the HTTP protocol for accessing all Internet

  sites. However, users on the network report that they are unable to do so.

  Mark the option that is configured incorrectly.

  Hot Area:

  

  Correct Answer:

  

  The company policy states that you cannot install the Firewall Client software or configure the Web Proxy service on any client computer. Therefore, you will have to configure all client computers as SecureNAT clients. The users are unable to

  access Internet Web sites because you have enabled the Ask unauthenticated users for identification check box. SecureNAT clients do not provide user name or computer name information to ISA Server when making requests. Hence, all

  SecureNAT client requests are denied.

  To resolve the issue, you will have to disable the Ask unauthenticated users for identification check box.

• Question 403:

  HOTSPOT

  Sam works as a network administrator in Bluewell Inc. The company uses Windows Vista operating system. He wants to restore a program that is blocked by Windows Defender. He opens the Windows Defender window and clicks on the Tools link. He clicks on a link to view the list of programs blocked by Windows Defender, selects a program and then clicks on the Restore button to restore it. Mark the option that Sam had chosen to view the list of programs blocked by Windows Defender.

  Hot Area:

  

  Correct Answer:

  

  The user can then select a program and restore it.

• Question 404:

  HOTSPOT

  The network infrastructure of a company consists of a perimeter network. For security purposes, the network zones have been created and divided into a firewall-based Border network and a DMZ. The enterprise internal network is attacked

  by a latest Internet worm.

  Which of the following devices in the enterprise network should be upgraded or reconfigured to counter this type of attack?

  Hot Area:

  

  Correct Answer:

  

  The firewall in the enterprise network should be reconfigured or upgraded to detect and filter an Internet worm. Firewall is used to protect the network from external attacks by hackers. Firewall prevents direct communication between computers in the network and the external computers, through the Internet. Instead, all communication is done through a proxy server, outside the organization's network, which decides whether or not it is safe to let a file pass through.

• Question 405:

  HOTSPOT

  George works as an Office Assistance in TechSoft Inc. All client computers in the company run Windows Vista operating system. He has turned on the Windows Firewall for security purposes. He prepares a document and wants to share it with other users of the company. When he tries to share the document, he gets a message that firewall has blocked the sharing of the files on his computer. He wants to ensure that that the firewall does not block sharing of the document. He opens Windows Firewall dialog box.

  What actions will he perform in the dialog box to accomplish the task?

  Hot Area:

  

  Correct Answer:

  

  

  George will click on the Allow a program through Windows Firewall link to open the Windows Firewall Settings dialog box. He will then insert a check mark in the File and Printer Sharing checkbox in the Exceptions tab of the Windows Firewall Settings dialog box.

• Question 406:

  HOTSPOT

  You work as a Network Administrator for McRobert Inc. The company has a Windows Active Directory-based single domain single forest network. The network includes fifty client computers running different Windows client operating systems.

  A member server named MRIFS is configured as a file server on the network. You are required to implement the following:

  The data communication must be encrypted whenever possible.

  Each client computer must be able to access the server.

  Configure the required options in the dialog box given below in order to accomplish the task.

  Hot Area:

  

  Correct Answer:

  

  In order to accomplish the task, you will have to select the Allow unsecured communication with non-IPSec -aware computers check box.

  By enabling this option, IPSec will allow unsecured communication, if necessary. Disabling the option blocks communication with computers that cannot initiate IPSec, such as legacy systems. This option should be disabled to secure

  computers connected to the Internet.

• Question 407:

  HOTSPOT

  You work as a Network Administrator of a Windows 2000 Active Directory-based single domain network. You have configured your Windows XP Professional computer at home to have a static IP address assigned by your Internet service

  provider (ISP). It is always connected to the Internet through a modem. You have enabled the Internet Connection Firewall for the Internet connection. You use the PING command to check the connectivity of your home computer from office,

  but you receive the following error message:

  Request timed out.

  On examining the log file of the Internet Connection Firewall on your home computer, you find DROP ICMP messages. You want to ping your home computer without compromising on security.

  Select the option in the Internet Connection Firewall Advanced Settings dialog box, which will be required to be checked to accomplish the task.

  Hot Area:

  

  Correct Answer:

  

  The Internet Connection Firewall setting on your home computer is preventing PING from echoing messages. Selecting the Allow incoming echo request check box on the ICMP tab of the Internet Connection Firewall Advanced Settings dialog box will enable your computer to echo messages back to the sender.

  

• Question 408:

  HOTSPOT

  In the image of the Screened Host Firewall Architecture given below, select the element that is commonly known as the access router.

  Hot Area:

  

  Correct Answer:

  

  An access router is the common name of the exterior router present in the screened host firewall architecture. It is attached to the perimeter network and the Internet. An access router is used to protect both the perimeter network and the

  internal network from the Internet. It allows anything that is outbound from the perimeter network. Access routers seldom do packet filtering. The rules for packet filtering regarding the protection of internal machines are always the same on

  both the interior router and the exterior router.

  A Screened Host Firewall Architecture is used to provide services from a host that is attached only to the internal network by using a separate router. In this type of firewall architecture, the key security is provided by packet filtering.

  The host exists in the internal network. The packet filtering on the screening router is configured in such a way that the bastion host is the only system in the internal network that is open to the Internet connections. If any external system tries

  to access internal systems or services, then it will connect only to this host. The bastion host therefore needs to be at a high level of security.

  

• Question 409:

  SIMULATION

  Fill in the blank with the command to complete the statement below. Do not enter the full path of the command.

  The ________ command supports system logging and kernel message trapping.

  Correct Answer: sysklogd

  The sysklogd command is used to support system logging and kernel message trapping. Sysklogd includes two system utilities: syslogd and klogd, which support system logging and kernel message trapping. Since, this utility supports both internet and UNIX domain sockets, it also supports both local and remote logging. Every logged message contains at least a time and a hostname field and sometimes a program name field as well.

• Question 410:

  SIMULATION

  Fill in the blank with the appropriate term.

  When two routers are used in a firewall configuration, the internal router is known as a ______ router.

  Correct Answer: choke

  When two routers are used in a firewall configuration, the internal router is known as a choke router. A choke router is an interior router present in the screened host firewall architecture. It is attached to the perimeter network and protects the

  internal network from the Internet and the perimeter net.

  A choke router is basically employed for the job of packet filtering for the firewall. It is also used to provide access to selected services that are outbound from the internal net to the Internet. These services may include outgoing Telnet, FTP,

  WAIS, Archie, Gopher, etc.