GCIA questions and answers

The promiscuous mode is a configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just packets addressed to it.

Which of the following tools works by placing the host system network card into the promiscuous mode?

John works as a professional Ethical Hacker. He has been assigned a project for testing the security of www.we-are-secure.com. He wants to corrupt an IDS signature database so that performing attacks on the server is made easy and he can observe the flaws in the We-are-secure server. To perform his task, he first of all sends a virus that continuously changes its signature to avoid detection from IDS. Since the new signature of the virus does not match the old signature, which is entered in the IDS signature database, IDS becomes unable to point out the malicious virus.

Which of the following IDS evasion attacks is John performing?

Which of the following distributes incorrect IP address to divert the traffic?

What netsh command should be run to enable IPv6 routing? Each correct answer represents a part of the solution. Choose two.

Smith works as a Network Administrator for HCP Inc. He sets up a DNS server on the network and enables DNS service on all computers. However, DNS is not working properly.

Which of the following commands should Smith use to verify the DNS configuration?

Which of the following programs in UNIX is used to identify and fix lost blocks or orphans?

Which of the following tools can be used to check whether the network interface is in promiscuous mode or not?

Mark works as a Network Security Administrator for BlueWells Inc. The company has a Windowsbased network. Mark is giving a presentation on Network security threats to the newly recruited employees of the company. His presentation is about the External threats that the company recently faced in the past.
Which of the following statements are true about external threats?
Each correct answer represents a complete solution. Choose three.

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small-sized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks?
Each correct answer represents a complete solution. Choose all that apply.

What is the order of the extension headers that is followed by IPv6?

You work as a Network Administrator for McRobert Inc. You want to know the NetBIOS name of your computer.

Which of the following commands will you use?

Which of the following terms is used to represent IPv6 addresses?

What is the size of a subnet in IPv6?

Which of the following Web attacks is performed by manipulating codes of programming languages such as SQL, Perl, Java present in the Web pages?

Which of the following is an asymmetric encryption algorithm?

Victor works as a professional Ethical Hacker for SecureEnet Inc. He has been assigned a job to test an image, in which some secret information is hidden, using Steganography. Victor performs the following techniques to accomplish the task:
1. Smoothening and decreasing contrast by averaging the pixels of the area where significant color transitions occurs.
2. Reducing noise by adjusting color and averaging pixel value.
3. Sharpening, Rotating, Resampling, and Softening the image.

Which of the following Steganography attacks is Victor using?

Which of the following is the default port for File Transport Protocol (FTP)?

You are using the TRACERT utility to trace the route to passguide.com. You receive the following output:

Which of the following conclusions can you draw from viewing the output? Each correct answer represents a complete solution. Choose two.

Which of the following is a hardware/software platform that is designed to analyze, detect, and report on security related events.
NIPS is designed to inspect traffic and based on its configuration or security policy, it can drop the malicious traffic?

Which of the following ports can be used for IP spoofing?

Victor works as a network administrator for DataSecu Inc. He uses a dual firewall Demilitarized Zone (DMZ) to insulate the rest of the network from the portions that is available to the Internet.
Which of the following security threats may occur if DMZ protocol attacks are performed?
Each correct answer represents a complete solution. Choose all that apply.

Which of the following statements are true about snort? Each correct answer represents a complete solution. Choose all that apply.

Which of the following ICMPv6 neighbor discovery messages is sent by hosts to request an immediate router advertisement, instead of waiting for the next scheduled advertisement?

Which of the following ports is used by e-mail clients to send request to connect to the server?

Which of the following monitors program activities and modifies malicious activities on a system?

Which of the following is used over the Internet for better security?

________ is a command-line tool that can check the DNS registration of a domain controller.

Which of the following are open-source vulnerability scanners?

Which of the following commands prints out the headers of packets regarding the boolean expression?

Which of the following Linux/UNIX commands is used to delete files permanently so that the files cannot be recovered?

Fill in the blank with the appropriate term.
___________is the practice of monitoring and potentially restricting the flow of information outbound from one network to another

Adam, a malicious hacker is running a scan. Statistics of the scan is as follows:

Which of the following types of port scan is Adam running?

Which of the following tools allows an attacker to intentionally craft the packets to gain unauthorized access?
Each correct answer represents a complete solution. Choose two.

You work as a Network Administrator for Tech Perfect Inc. Your company has a Windows 2000- based network. You want to verify the connectivity of a host in the network.

Which of the following utilities will you use?

What is the process of detecting unauthorized access known as?

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system. Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences?
Each correct answer represents a complete solution. Choose all that apply.

Which of the following forensic tool suite is developed for Linux operating system?

Which of the following is a hardware/software platform that is designed to analyze, detect, and report on security related events.
NIPS is designed to inspect traffic and based on its configuration or security policy, it can drop the malicious traffic?

In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?

Which of the following types of write blocker device uses one interface for one side and a different one for the other?

Which of the following wireless network standards operates on the 5 GHz band and transfers data at a rate of 54 Mbps?

Which of the following fields of the IPv6 header is similar to the TTL field of IPv4?

Which of the following is the purpose of creating a Demilitarized zone (DMZ) in an enterprise network?

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple smallsized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks?
Each correct answer represents a complete solution. Choose all that apply.

You work as a Network Administrator for SmartCert Inc. The company's network contains five Windows 2003 servers and ninety Windows XP Professional client computers. You want to view all the incoming requests to an Internet Information Services (IIS) server and allow only requests that comply with a rule set, created by you, to be processed. You also want to detect the intrusion attempts by recognizing the strange characters in a URL on a Web server.

What will you do to accomplish the task?

You work as a professional Computer Hacking Forensic Investigator. A project has been assigned to you to investigate Plagiarism occurred in the source code files of C#.

Which of the following tools will you use to detect the software plagiarism?

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. John wants to redirect all TCP port 80 traffic to UDP port 40, so that he can bypass the firewall of the We-are-secure server.

Which of the following tools will John use to accomplish his task?

Which of the following IP packet elements is responsible for authentication while using IPSec?

Which of the following tools can be used for passive OS fingerprinting?

In which of the following IDS evasion techniques does an attacker deliver data in multiple small sized packets, which makes it very difficult for an IDS to detect the attack signatures of such attacks?

Which of the following honeypots is a low-interaction honeypot and is used by companies or corporations for capturing limited information about malicious hackers?

You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based network.
You have configured a firewall on the network. A filter has been applied to block all the ports. You want to enable sending and receiving of emails on the network. Which of the following ports will you open?
Each correct answer represents a complete solution. Choose two.

Ryan, a malicious hacker submits Cross-Site Scripting (XSS) exploit code to the Website of Internet forum for online discussion. When a user visits the infected Web page, code gets automatically executed and Ryan can easily perform acts like account hijacking, history theft etc.

Which of the following types of Cross- Site Scripting attack Ryan intends to do?

Which of the following ports can be used for IP spoofing?

You work as a Network Administrator for Net Perfect Inc. The company has a Windows Server 2008 network environment. The servers on the network run Windows Server 2008 R2. All client computers on the network run Windows 7 Ultimate. You have configured DirectAccess feature on the laptop of few sales managers so that they can access corporate network from remote locations. Their laptops run Windows 7 Ultimate.

Which of the following options does the DirectAccess use to keep data safer while traveling through travels public networks?

Which of the following ports is used by e-mail clients to send request to connect to the server?

Which of the following ports is used by NTP for communication?

Which of the following protocols is used to translate IP addresses to Ethernet addresses?

Which of the following DNS resource records is used to resolve a host name to an IPv6 address?

You work as a technician for Tech Perfect Inc. You are troubleshooting an Internet name resolution issue.
You ping your ISP's DNS server address and find that the server is down. You want to continuously ping the DNS address until you have stopped the command.

Which of the following commands will you use?

Which of the following is included in a memory dump file?

Which of the following IPv6 transition technologies is used by the DirectAccess if a user is in a remote location and a public IPv4 address, instead of public IPv6 address, has been assigned to the computer?

Allen works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a computer, which is used by the suspect to sexually harass the victim using instant messenger program. Suspect's computer runs on Windows operating system. Allen wants to recover password from instant messenger program, which suspect is using, to collect the evidence of the crime.
Allen is using Helix Live for this purpose.

Which of the following utilities of Helix will he use to accomplish the task?

Maria works as the Chief Security Officer for passguide Inc. She wants to send secret messages to the CEO of the company. To secure these messages, she uses a technique of hiding a secret message within an ordinary message. The technique provides 'security through obscurity'.

What technique is Maria using?

You work as a Network Administrator for TechPerfect Inc. The company has a corporate intranet setup. A router is configured on your network to connect outside hosts to the internetworking. For security, you want to prevent outside hosts from pinging to the hosts on the internetwork.

Which of the following steps will you take to accomplish the task?

Which of the following techniques allows probing firewall rule-sets and finding entry points into the targeted system or network?

Which of the following is the default port for DNS zone transfer?

Which of the following work as traffic monitoring tools in the Linux operating system? Each correct answer represents a complete solution. Choose all that apply.

John works as a Network Administrator for DigiNet Inc. He wants to investigate failed logon attempts to a network. He uses Log Parser to detail out the failed logons over a specific time frame. He uses the following commands and query to list all failed logons on a specific date:
logparser.exe file:FailedLogons.sql -i:EVT -o:datagrid
SELECT
timegenerated AS LogonTime,
extract_token(strings, 0, '|') AS UserName
FROM Security
WHERE EventID IN (529;
530;
531;
532;
533;
534;
535;
537;
539.
AND to_string(timegenerated,'yyyy-MM-dd HH:mm:ss') like '2004-09%' After investigation, John concludes that two logon attempts were made by using an expired account.

Which of the following EventID refers to this failed logon?

Which of the following is not a valid Failed Logon EventID?

Maria works as a professional Ethical Hacker. She is assigned a project to test the security of www.we-are-secure.com. She wants to test a DoS attack on the We-are-secure server. She finds that the firewall of the server is blocking the ICMP messages, but it is not checking the UDP packets. Therefore, she sends a large amount of UDP echo request traffic to the IP broadcast addresses. These UDP requests have a spoofed source address of the We-are-secure server.

Which of the following DoS attacks is Maria using to accomplish her task?

What is the easiest way to verify that name resolution is functioning properly on a TCP/IP network?

Which of the following snort keywords is used to match a defined payload value?

Host-based IDS (HIDS) is an Intrusion Detection System that runs on the system to be monitored. HIDS monitors only the data that it is directed to, or originates from the system on which HIDS is installed.

Besides monitoring network traffic for detecting attacks, it can also monitor other parameters of the system such as running processes, file system access and integrity, and user logins for identifying malicious activities.
Which of the following tools are examples of HIDS?
Each correct answer represents a complete solution. Choose all that apply.

What is the name of the first computer virus that infected the boot sector of the MS-DOS operating system?

For a host to have successful Internet communication, which of the following network protocols are required? You should assume that the users will not manually configure the computer in anyway and that the measure of success will be whether the user can access Web sites after powering the computer and logging on.
Each correct answer represents a complete solution. Choose all that apply.