GIAC Cyber Security GCCC Questions & Answers

• Question 81:

  An organization has implemented a control for Controlled Use of Administrative Privilege. The control requires users to enter a password from their own user account before being allowed elevated privileges, and that no client applications (e.g. web browsers, e-mail clients) can be run with elevated privileges. Which of the following actions will validate this control is implemented properly?

  A. Check the log entries to match privilege use with access from authorized users.

  B. Run a script at intervals to identify processes running with administrative privilege.

  C. Force the root account to only be accessible from the system console.

  Correct Answer: B

• Question 82:

  Which of the following is a responsibility of a change management board?

  A. Reviewing log files for unapproved changes

  B. Approving system baseline configurations.

  C. Providing recommendations for the changes

  D. Reviewing configuration of the documents

  Correct Answer: B

• Question 83:

  John a network administrator at Northeast High School. Faculty have been complaining that although they can detect and authenticate to the faculty wireless network, they are unable to connect. While troubleshooting, John discovers that the wireless network server is out of DHCP addresses due to a large number of unauthorized student devices connecting to the network. Which course of action would be an effective temporary stopgap to secure the network until a permanent solution can be found?

  A. Limit access to allowed MAC addresses

  B. Increase the size of the DHCP pool

  C. Change the password immediately

  D. Shorten the DHCP lease time

  Correct Answer: C

• Question 84:

  An administrator looking at a web application's log file found login attempts by the same host over several seconds. Each user ID was attempted with three different passwords. The event took place over 5 seconds.

  ROOT TEST ADMIN SQL USER NAGIOSGUEST

  What is the most likely source of this event?

  A. An IT administrator attempting to use outdated credentials to enter the site

  B. An attempted Denial of Service attack by locking out administrative accounts

  C. An automated tool that attempts to use a dictionary attack to infiltrate a website

  D. An attempt to use SQL Injection to gain information from a web-connected database

  Correct Answer: C

• Question 85:

  An organization is implementing a control for the Account Monitoring and Control CIS Control, and have set the Account Lockout Policy as shown below. What is the risk presented by these settings?

  

  A. Brute-force password attacks could be more effective.

  B. Legitimate users could be unable to access resources.

  C. Password length and complexity will be automatically reduced.

  D. Once accounts are locked, they cannot be unlocked.

  Correct Answer: B

• Question 86:

  Scan 1 was taken on Monday. Scan 2 was taken of the same network on Wednesday. Which of the following findings is accurate based on the information contained in the scans?

  

  A. The host located at 192.168.177.7 is no longer on the network

  B. The host with MAC Address D8:50:E6:9F:EE:60 is no longer on the network

  C. The host located at 192.168.177.21 is a new host on the network

  D. The host with MAC Address D8:50:E6:9F:EE:60 had an IP address change

  Correct Answer: D

• Question 87:

  Which of the following actions would best mitigate against phishing attempts such as the example below?

  

  A. Establishing email filters to block no-reply address emails

  B. Making web filters to prevent accessing Google Docs

  C. Having employee's complete user awareness training

  D. Recommending against the use of Google Docs

  Correct Answer: C

• Question 88:

  An attacker is able to successfully access a web application as root using ` or 1 = 1 . as the password. The successful access indicates a failure of what process?

  A. Input Validation

  B. Output Sanitization

  C. URL Encoding

  D. Account Management

  Correct Answer: A

• Question 89:

  Implementing which of the following will decrease spoofed e-mail messages?

  A. Finger Protocol

  B. Sender Policy Framework

  C. Network Address Translation

  D. Internet Message Access Protocol

  Correct Answer: B

• Question 90:

  An organization is implementing an application software security control their custom-written code that provides web--based database access to sales partners. Which action will help mitigate the risk of the application being compromised?

  A. Providing the source code for their web application to existing sales partners

  B. Identifying high-risk assets that are on the same network as the web application server

  C. Creating signatures for their IDS to detect attacks specific to their web application

  D. Logging the connection requests to the web application server from outside hosts

  Correct Answer: C