Skip to main content

GCED Online Exam

GIAC Certified Enterprise Defender (GCED)

88 questions available ยท Page 1 of 9

View study plans
Question 1 Single choice

Which statement below is the MOST accurate about insider threat controls?

  1. A

    Classification of information assets helps identify data to protect.

  2. B

    Security awareness programs have a minimal impact on reducing the insider threat.

  3. C

    Both detective and preventative controls prevent insider attacks.

  4. D

    Rotation of duties makes an insider threat more likely.

  5. E

    Separation of duties encourages one employee to control a great deal of information.

Show answer and explanation

Correct answer: A

Explanation

A company needs to classify its information as a key step in valuing it and knowing where to focus its protection.
Rotation of duties and separation of duties are both key elements in reducing the scope of information access and the ability to conceal malicious behavior. Separation of duties helps minimize "empire building" within a company, keeping one individual from controlling a great deal of information, reducing the insider threat. Security awareness programs can help other employees notice the signs of an insider attack and thus reduce the insider threat. Detection is a reactive method and only occurs after an attack occurs. Only preventative methods can stop or limit an attack.

Question 2 Single choice

Which tool keeps a backup of all deleted items, so that they can be restored later if need be?

  1. A

    ListDLLs

  2. B

    Yersinia

  3. C

    Ettercap

  4. D

    ProcessExplorer

  5. E

    Hijack This

Show answer and explanation

Correct answer: E

Explanation

Explanation: After selecting "fix it!" with Hijack This you can always restore deleted items, because Hijack
This keeps a backup of them.

Question 3 Single choice

A compromised router is reconfigured by an attacker to redirect SMTP email traffic to the attacker's server before sending packets on to their intended destinations.

Which IP header value would help expose anomalies in the path outbound SMTP/Port 25 traffic takes compared to outbound packets sent to other ports?

  1. A

    Checksum

  2. B

    Acknowledgement number

  3. C

    Time to live

  4. D

    Fragment offset

Show answer and explanation

Correct answer: C

Explanation

Explanation: In a case study of a redirect tunnel set up on a router, some anomalies were noticed while watching network traffic with the TCPdump packet sniffer. Packets going to port 25 (Simple Mail Transfer Protocol [SMTP] used by mail servers and other Mail Transfer Agents [MTAs] to send and receive e-mail) were apparently taking a different network path. The TLs were consistently three less than other destination ports, indicating another three network hops were taken.

Other IP header values listed, such as fragment offset. The acknowledgement number is a TCP, not IP, header field.

Question 4 Single choice

What is needed to be able to use taskkill to end a process on remote system?

  1. A

    Svchost.exe running on the remote system

  2. B

    Domain login credentials

  3. C

    Port 445 open

  4. D

    Windows 7 or higher on both systems

Show answer and explanation

Correct answer: B

Explanation

Explanation: Domain login credentials are needed to kill a process on a remote system using taskkill.

Question 5 Single choice

What are Browser Helper Objects (BHO)s used for?

  1. A

    To provide multi-factor authentication support for Firefox

  2. B

    To provide a more feature-rich interface for Internet Explorer

  3. C

    To allow Internet Explorer to process multi-part URLs

  4. D

    To allow Firefox to process JavaScript in a sandbox

Show answer and explanation

Correct answer: B

Explanation

Explanation: When scanning your system, you may notice many BHOs since they are widely used by software developers to provide a more feature rich interface for Microsoft Internet Explorer.

Question 6 Single choice

What information would the Wireshark filter in the screenshot list within the display window?

  1. A

    Only HTTP traffic to or from IP address 192.168.1.12 that is also destined for port 80

  2. B

    Only traffic to or from IP address 192.168.1.12 and destined for port 80

  3. C

    Only traffic with a source address of 192.168.1.12 to or from port 80

  4. D

    Only traffic with a destination address of 192.168.1.12 to or from port 80

Show answer and explanation

Correct answer: B

Question 7 Single choice

What would the output of the following command help an incident handler determine?
cscript manage-bde . wsf -status

  1. A

    Whether scripts can be run from the command line

  2. B

    Which processes are running on the system

  3. C

    When the most recent system reboot occurred

  4. D

    Whether the drive has encryption enabled

Show answer and explanation

Correct answer: D

Question 8 Single choice

Which of the following is a major problem that attackers often encounter when attempting to develop or use a kernel mode rootkit?

  1. A

    Their effectiveness depends on the specific applications used on the target system.

  2. B

    They tend to corrupt the kernel of the target system, causing it to crash.

  3. C

    They are unstable and are easy to identify after installation

  4. D

    They are highly dependent on the target OS.

Show answer and explanation

Correct answer: B

Question 9 Single choice

Which of the following is an SNMPv3 security feature that was not provided by earlier versions of the protocol?

  1. A

    Authentication based on RSA key pairs

  2. B

    The ability to change default community strings

  3. C

    AES encryption for SNMP network traffic

  4. D

    The ability to send SNMP traffic over TCP ports

Show answer and explanation

Correct answer: C

Question 10 Single choice

What is the BEST sequence of steps to remove a bot from a system?

  1. A

    Terminate the process, remove autoloading traces, delete any malicious files

  2. B

    Delete any malicious files, remove autoloading traces, terminate the process

  3. C

    Remove autoloading traces, delete any malicious files, terminate the process

  4. D

    Delete any malicious files, terminate the process, remove autoloading traces

Show answer and explanation

Correct answer: A