GIAC Security Essentials (GSEC)

You are doing some analysis of malware on a Unix computer in a closed test network. The IP address of the computer is 192.168.1.120. From a packet capture, you see the malware is attempting to do a DNS query for a server called iamabadserver.com so that it can connect to it. There is no DNS server on the test network to do name resolution. You have another computer, whose IP is 192.168.1.115, available on the test network that you would like for the malware connect to it instead.

How do you get the malware to connect to that computer on the test network?

What is SSL primarily used to protect you against?

What is a security feature available with Windows Vista and Windows 7 that was not present in previous Windows operating systems?

You are examining a packet capture session in Wire shark and see the packet shown in the accompanying image.
Based on what you see, what is the appropriate protection against this type of attempted attack?

Which of the following is the reason of using Faraday cage?

Which of the following processes Is used to prove a user Is who they claim to be based upon something they know, have, are, and/or their physical location?

Which of the below choices should an organization start with when implementing an effective risk management process?

Included below is the output from a resource kit utility run against local host.

Which command could have produced this output?

What is achieved with the development of a communication flow baseline?

Which of the following is a Layer 3 device that will typically drop directed broadcast traffic?

Mark works as a Network Administrator for NetTech Inc. The company has a Windows 2003 domain-based network. The network contains ten Windows 2003 member servers, 150 Windows XP Professional client computers. According to the company's security policy, Mark needs to check whether all the computers in the network have all available security updates and shared folders. He also needs to check the file system type on each computer's hard disk. Mark installs and runs MBSACLI.EXE with the appropriate switches on a server.

Which of the following tasks will he accomplish?

Against policy, employees have installed Peer-to-Peer applications on their workstations and they are using them over TCP port 80 to download files via the company network from other Peer-to-Peer users on the Internet.

Which of the following describes this threat?

Your system has been infected by malware. Upon investigation, you discover that the malware propagated primarily via email. The malware attacked known vulnerabilities for which patches are available, but due to problems with your configuration management system you have no way to know which systems have been patched and which haven't, slowing your progress in patching your network.
Of the following, which solution would you use to protect against this propagation vector?

What is the first thing that should be done during the containment step of incident handling?

A simple cryptosystem that keeps the same letters and shuffles the order is an example of what?

How many clients Is a single WSUS server designed to support when the minimum system requirements are met?

What database can provide contact information for Internet domains?

Use Wireshark to analyze Desktop;PCAP FILES/charile.pcap

What is the destination IP address in packet #3?

Which of the following items are examples of preventive physical controls? Each correct answer represents a complete solution. Choose three.

What security advantage does the utilization of a switch as opposed to a hub offer for a secure network design?