GSEC questions and answers

One of your Linux systems was compromised last night. According to change management history and a recent vulnerability scan, the system's patches were up-to-date at the time of the attack.

Which of the following statements is the Most Likely explanation?

Which of the following is the key point to consider in the recovery phase of incident handling?

Which of the following is a signature-based intrusion detection system (IDS) ?

Which of the following is generally practiced by the police or any other recognized governmental authority?

During a scheduled evacuation training session the following events took place in this order:

1. Evacuation process began by triggering the building fire alarm.

2a. The meeting point leader arrived first at the designated meeting point and immediately began making note of who was and was not accounted for.

2b. Stairwell and door monitors made it to their designated position to leave behind a box of flashlights and prop the stairway doors open with a garbage can so employees can find exits and dispose of food and beverages.

2c. Special needs assistants performed their assigned responsibility to help employees out that require special assistance.

3. The safety warden communicated with the meeting point leader via walkie talkie to collect a list of missing personnel and communicated this information back to the searchers.

4. Searchers began checking each room and placing stick-it notes on the bottom of searched doors to designate which areas were cleared.

5. All special need assistants and their designated wards exited the building.

6. Searchers complete their assigned search pattern and exit with the Stairwell/door monitors.

Given this sequence of events, which role is in violation of its expected evacuation tasks?

Your CIO has found out that it is possible for an attacker to clone your company's RFID (Radio Frequency ID) based key cards. The CIO has tasked you with finding a way to ensure that anyone entering the building is an employee.

Which of the following authentication types would be the appropriate solution to this problem?

In PKI, when someone wants to verify that the certificate is valid, what do they use to decrypt the signature?

Which of the following languages enable programmers to store cookies on client computers? Each correct answer represents a complete solution. Choose two.

What is the purpose of notifying stakeholders prior to a scheduled vulnerability scan?

Which of the following files contains the shadowed password entries in Linux?

Analyze the screenshot below.
In what order should the vulnerabilities be remediated?

Which of the following services resolves host name to IP Address?

Which command would allow an administrator to determine if a RPM package was already installed?

Which of the following tasks is the responsibility of a Linux systems administrator who is deploying hardening scripts to his systems?

Which of the following is TRUE regarding the ability of attackers to eavesdrop on wireless communications?

What advantage does a Client-to-Client VPN have over other types of VPNs?

You are examining a packet capture session in Wire shark and see the packet shown in the accompanying image.
Based on what you see, what is the appropriate protection against this type of attempted attack?

Which of the following statements would describe the term "incident" when used in the branch of security known as Incident Handling?

What protocol is a WAN technology?

How many bytes does it take to represent the hexadecimal value OxFEDCBA?

What is the term for the software that allows a single physical server to run multiple virtual servers?

Which of the following terms refers to the process in which headers and trailers are added around user data?

What does PowerShell remoting use to authenticate to another host in a domain environment?

Which of the following systems acts as a NAT device when utilizing VMware in NAT mode?

SSL session keys are available in which of the following lengths?

What is the following sequence of packets demonstrating?

Which of the following is the FIRST step in performing an Operational Security (OP5EC) Vulnerabilities Assessment?

To update from a Windows Server Update Services (WSUS) server, users of the machine must have what rights, If any?

Which of the following items are examples of preventive physical controls? Each correct answer represents a complete solution. Choose three.

You are reviewing a packet capture file from your network intrusion detection system. In the packet stream, you come across a long series of "no operation" (NOP) commands. In addition to the NOP commands, there appears to be a malicious payload.
Of the following, which is the most appropriate preventative measure for this type of attack?

While building multiple virtual machines on a single host operating system, you have determined that each virtual machine needs to work on the network as a separate entity with its own unique IP address on the same logical subnet. You also need to limit each guest operating system to how much system resources it has access to.

Which of the following correctly identifies steps that must be taken towards setting up these virtual environments?

What type of malware is a self-contained program that has the ability to copy itself without parasitically infecting other host code?

If a Linux administrator wanted to quickly filter out extraneous data and find a running process named RootKit, which command could he use?

You have set up a local area network for your company. Your firewall separates your network into several sections: a DMZ with semi-public servers (web, dns, email) and an intranet with private servers. A penetration tester gains access to both sections and installs sniffers in each. He is able to capture network traffic for all the devices in the private section but only for one device (the device with the sniffer) in the DMZ.

What can be inferred about the design of the system?

What type of formal document would include the following statement?

Employees are responsible for exercising good judgment regarding the reasonableness of personal use.
Individual departments are responsible for creating guidelines concerning personal application of Internet/
Intranet/Extranet systems. In the absence of such policies, employees should be guided by departmental policies, and if there is any uncertainty, employees should consult their supervisor or manager.

What is a limitation of deploying HIPS on a workstation?

Which access control mechanism requires a high amount of maintenance since all data must be classified, and all users granted appropriate clearance?

You are implementing wireless access at a defense contractor. Specifications say, you must implement the AES Encryption algorithm.

Which encryption standard should you choose?

Mark works as a Network Administrator for NetTech Inc. The company has a Windows 2003 domain-based network. The network contains ten Windows 2003 member servers, 150 Windows XP Professional client computers. According to the company's security policy, Mark needs to check whether all the computers in the network have all available security updates and shared folders. He also needs to check the file system type on each computer's hard disk. Mark installs and runs MBSACLI.EXE with the appropriate switches on a server.

Which of the following tasks will he accomplish?

Which of the following correctly describes a stateless packet filter?

You work as a Network Administrator for Tech Perfect Inc. The company has a Linux-based network. You want to kill a process running on a Linux server.

Which of the following commands will you use to know the process identification number (PID) of the process?

The Return on Investment (ROI) measurement used in Information Technology and Information Security fields is typically calculated with which formula?

Which of the following commands is used to change file access permissions in Linux?

Which of the following is Azure's version of a superuser?

Which of the following are the types of intrusion detection systems? Each correct answer represents a complete solution. Choose all that apply.

Which layer of the TCP/IP Protocol Stack Is responsible for port numbers?

Which of the following areas of a network contains DNS servers and Web servers for Internet users?

You work as a Network Administrator for Net World Inc. The company has a Linux-based network. For testing purposes, you have configured a default IP-table with several filtering rules. You want to reconfigure the table. For this, you decide to remove the rules from all the chains in the table.

Which of the following commands will you use?

In addition to securing the operating system of production honey pot hosts, what is recommended to prevent the honey pots from assuming the identities of production systems that could result in the denial of service for legitimate users?

Which practice can help protect secrets in a cloud environment?

An employee is currently logged into the corporate web server, without permission. You log into the web server as 'admin" and look for the employee's username: "dmaul" using the "who" command. This is what you get back:

If an attacker compromised a host on a site's internal network and wanted to trick other machines into using that host as the default gateway, which type of attack would he use?

Which of the following describes software technologies that improve portability, manageability, and compatibility of applications by encapsulating them from the underlying operating system on which they are executed?

The TTL can be found in which protocol header?

Which port category does the port 110 fall into?

There is not universal agreement on the names of the layers in the TCP/IP networking model.

Which of the following is one of the functions of the bottom layer, which is sometimes called the Network Access or Link Layer?

Which of the following statements about Microsoft's VPN client software is FALSE?

When designing wireless networks, one strategy to consider is implementing security mechanisms at all layers of the OSI model.

Which of the following protection mechanisms would protect layer 1?