GIAC GIAC Certification GPPA Questions & Answers

• Question 1:

  Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small-sized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks.

  Which of the following tools can be used to perform session splicing attacks?

  Each correct answer represents a complete solution. (Choose all that apply.)

  A. Y.A.T.

  B. Fragroute

  C. Whisker

  D. Nessus

  Correct Answer: CD

• Question 2:

  Which of the following ICMPv6 neighbor discovery messages is sent by hosts to request an immediate router advertisement, instead of waiting for the next scheduled advertisement?

  A. Neighbor Advertisement

  B. Neighbor Solicitation

  C. Router Solicitation

  D. Router Advertisement

  Correct Answer: C

• Question 3:

  You work as the Security Administrator for Prodotxiss Inc. You want to ensure the security of your Wi-Fi enterprise network against the wireless snooping attacks.

  Which of the following measures will you take over the site network devices of the network?

  A. Disable the SSID broadcast feature of the router.

  B. Apply firewalls at appropriate spots.

  C. Download and install new firmware patch for the router.

  D. Apply a standard ACL on the router.

  Correct Answer: A

• Question 4:

  Which of the following statements is true about ICMP packets?

  Each correct answer represents a complete solution. (Choose all that apply.)

  A. They guarantee the delivery of datagrams.

  B. They are used to report errors if a problem in IP processing occurs.

  C. The PING utility uses them to verify connectivity between two hosts.

  D. They are encapsulated within IP datagrams.

  E. They use UDP datagrams.

  Correct Answer: BCD

• Question 5:

  Which of the following describes the term inside global in NAT configuration?

  A. It is a local MAC address assigned to a host in a private network.

  B. It is the data that comes inside a local network from an external host.

  C. It is a local IP address assigned to a host in a private network.

  D. It is the registered (public) IP address that represents the inside hosts in private network to the outside network.

  Correct Answer: D

• Question 6:

  Which of the following IPv6 transition technologies is used by the DirectAccess if a user is in a remote location and a public IPv4 address, instead of public IPv6 address, has been assigned to the computer?

  A. 6to4

  B. PortProxy

  C. Teredo

  D. ISATAP

  Correct Answer: A

• Question 7:

  An organization has a TCP/IP based network. It uses IPv6 addressing in its network. IPv6 tackles addressing and routing-table problems, and improves the protocol as well.

  Which of the following statements is true about IPv6?

  A. It implements broadcasting.

  B. It eliminates the primary need for Network Address Translation (NAT).

  C. It uses symmetric key encryption.

  D. Its address is 32 bits in length.

  Correct Answer: B

• Question 8:

  Jony works as the Security Manager in ABC Inc. He wants to protect his network from a variant of the Denial-of-Service (DoS) attack. When the rulebase is enabled for protection, the IDP engine checks the traffic that exceeds the traffic thresholds.

  Which of the following rulebases is used for this purpose?

  A. Traffic Anomalies rulebase

  B. Backdoor rulebase

  C. Exempt rulebase

  D. SYN Protector rulebase

  Correct Answer: D

• Question 9:

  Which of the following methods is a behavior-based IDS detection method?

  A. Pattern matching detection

  B. Protocol detection

  C. Knowledge-based detection

  D. Statistical anomaly detection

  Correct Answer: D

• Question 10:

  You run the tcpdump command line utility and get a report produced by tcpdump.

  What information does this report include?

  Each correct answer represents a complete solution. (Choose three.)

  A. Packets captured

  B. Packets dropped by kernel

  C. Packets discarded

  D. Packets received by filter

  Correct Answer: ABD