New Year Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: best70

GCFW GIAC Certified Firewall Analyst Questions and Answers

Questions 4

You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based network. A Cisco switch is configured on the network. You change the original host name of the switch through the hostname command. The prompt displays the changed host name. After some time, power of the switch went off due to some reason. When power restored, you find that the prompt is displaying the old host name. What is the most likely cause?

Options:

A.

The changes were saved in running-config file.

B.

The startup-config file got corrupted.

C.

The running-config file got corrupted.

D.

Host name cannot be changed permanently once switch is configured.

Buy Now
Questions 5

Which of the following techniques allows probing firewall rule-sets and finding entry points into the targeted system or network?

Options:

A.

Packet collision

B.

Network enumerating

C.

Packet crafting

D.

Distributed Checksum Clearinghouse

Buy Now
Questions 6

What is the easiest way to verify that name resolution is functioning properly on a TCP/IP network?

Options:

A.

Use the TRACERT command with the /pingname parameter.

B.

Ping the source host with its computer name.

C.

Ping the source host with its IP address.

D.

Check the IP statistics on the file server.

Buy Now
Questions 7

Which of the following is a Cisco IOS management term described in the statement below?

"It is the fourth digit in the configuration register and contains a hexadecimal value. The bootstrap program uses its value to choose which operating system to load into RAM."

Options:

A.

Boot check

B.

Boot field

C.

Boot value

D.

Boot

Buy Now
Questions 8

Which of the following tools is described below?

It is a set of tools that are used for sniffing passwords, e-mail, and HTTP traffic. Some of its tools include arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf. It is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools for switching across switched networks. It can also be used to capture authentication information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP, etc.

Options:

A.

Cain

B.

Libnids

C.

Dsniff

D.

LIDS

Buy Now
Questions 9

Which of the following statements are true about an IPv6 network?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It uses longer subnet masks than those used in IPv4.

B.

It increases the number of available IP addresses.

C.

For interoperability, IPv4 addresses use the last 32 bits of IPv6 addresses.

D.

It provides improved authentication and security.

E.

It uses 128-bit addresses.

Buy Now
Questions 10

Which of the following protocols is used by TFTP as a file transfer protocol?

Options:

A.

TCP

B.

SNMP

C.

UDP

D.

SMTP

Buy Now
Questions 11

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to secure access to the network of the company from all possible entry points. He segmented the network into several subnets and installed firewalls all over the network. He has placed very stringent rules on all the firewalls, blocking everything in and out except the ports that must be used. He does need to have port 80 open since his company hosts a website that must be accessed from the Internet. Adam is still worried about the programs like Hping2 that can get into a network through covert channels.

Which of the following is the most effective way to protect the network of the company from an attacker using Hping2 to scan his internal network?

Options:

A.

Block ICMP type 13 messages

B.

Block ICMP type 3 messages

C.

Block all outgoing traffic on port 21

D.

Block all outgoing traffic on port 53

Buy Now
Questions 12

A company named Tech Perfect Inc. has a TCP/IP based network. An IPS sensor is deployed in the network and configured to operate in promiscuous mode. IP blocking functionality works there in order to stop traffic from an attacking host and it helps in analyzing what happens in the network.

The management wants to initiate a persistent connection with the managed devices until the block is removed. Which of the following will you configure in the network to accomplish the task?

Options:

A.

Access Control List

B.

Firewall

C.

Network Admission Control

D.

Virtual LAN

Buy Now
Questions 13

Which of the following are the types of intrusion detection systems?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Client-based intrusion detection system (CIDS)

B.

Network intrusion detection system (NIDS)

C.

Server-based intrusion detection system (SIDS)

D.

Host-based intrusion detection system (HIDS)

Buy Now
Questions 14

Which of the following tools is used to detect wireless LANs using the 802.11b, 802.11a, and 802.11g WLAN standards on the Windows platform?

Options:

A.

Snort

B.

Cain

C.

NetStumbler

D.

AiroPeek

Buy Now
Questions 15

Which of the following devices is used to identify out-of-date software versions, applicable patches, system upgrades, etc?

Options:

A.

Retinal scanner

B.

Fingerprint reader

C.

Smart card reader

D.

Vulnerability scanner

Buy Now
Questions 16

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint. Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Options:

A.

nmap -O -p

B.

nmap -sT

C.

nmap -sU -p

D.

nmap -sS

Buy Now
Questions 17

Which of the following tools is an open source network intrusion prevention and detection system that operates as a network sniffer and logs activities of the network that is matched with the predefined signatures?

Options:

A.

KisMAC

B.

Dsniff

C.

Snort

D.

Kismet

Buy Now
Questions 18

Which of the following algorithms is used as a default algorithm for ESP extension header in IPv6?

Options:

A.

Electronic Codebook (ECB) Mode

B.

Cipher Block Chaining (CBC) Mode

C.

Propagating Cipher Block Chaining (PCBC) Mode

D.

Cipher Feedback (CFB) Mode

Buy Now
Questions 19

You work as a Network Administrator for Net Perfect Inc. The company has a TCP/IP network. You have been assigned a task to configure security mechanisms for the network of the company. You have decided to configure a packet filtering firewall. Which of the following may be the reasons that made you choose a packet filtering firewall as a security mechanism?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It makes security transparent to end-users which provide easy use of the client application s.

B.

It prevents application-layer attacks.

C.

It is easy to install packet filtering firewalls in comparison to the other network security sol utions.

D.

It easily matches most of the fields in Layer 3 packets and Layer 4 segment headers, and thus, provides a lot of flexibility in implementing security policies.

Buy Now
Questions 20

You work as a Network Administrator for NetTech Inc. You want to prevent your network from Ping flood attacks. Which of the following protocols will you block to accomplish this task?

Options:

A.

IP

B.

PPP

C.

ICMP

D.

FTP

Buy Now
Questions 21

Which of the following Intrusion Detection Systems (IDS) is used to monitor rogue access points and the use of wireless attack tools?

Options:

A.

LogIDS 1.0

B.

WIDS

C.

Snort 2.1.0

D.

NFR security

Buy Now
Questions 22

Which of the following parts of IP header is used to specify the correct place of the fragment in the original un-fragmented datagram?

Options:

A.

Fragment offset

B.

Source address

C.

TTL

D.

Fragment ID

Buy Now
Questions 23

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He is using a tool to crack the wireless encryption keys. The description of the tool is as follows:

Which of the following tools is John using to crack the wireless encryption keys?

Options:

A.

Kismet

B.

PsPasswd

C.

AirSnort

D.

Cain

Buy Now
Questions 24

Which of the following number ranges is used for the IP Standard ACL?

Options:

A.

100-199

B.

1000-1099

C.

600-699

D.

1-99

Buy Now
Questions 25

Which of the following wireless security features provides the best wireless security mechanism?

Options:

A.

WPA with 802.1X authentication

B.

WPA with Pre Shared Key

C.

WEP

D.

WPA

Buy Now
Questions 26

Which of the following types of IP actions are supported by an IDP rulebase?

Options:

A.

Initiate rules of the rulebase

B.

Drop/block session

C.

Close connection

D.

Notify

Buy Now
Questions 27

Which of the following monitors program activities and modifies malicious activities on a system?

Options:

A.

Back door

B.

NIDS

C.

HIDS

D.

RADIUS

Buy Now
Questions 28

Which of the following proxy servers is placed anonymously between the client and remote server and handles all of the traffic from the client?

Options:

A.

Web proxy server

B.

Open proxy server

C.

Forced proxy server

D.

Caching proxy server

Buy Now
Questions 29

Which of the following is an attack with IP fragments that cannot be reassembled?

Options:

A.

Dictionary attack

B.

Smurf attack

C.

Teardrop attack

D.

Password guessing attack

Buy Now
Questions 30

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

Options:

A.

Signature-based

B.

Network-based

C.

Anomaly-based

D.

File-based

Buy Now
Questions 31

Secure Shell (SSH) is a network protocol that allows data to be exchanged using a secure channel between two networked devices. Which of the following features are supported by Secure Shell?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

SSH can transfer files using the associated HTTP or FTP protocols.

B.

SSH is typically used to log into a remote machine and execute commands, but it also supports tunneling, forwarding TCP ports and X11 connections.

C.

SSH uses public-key cryptography to authenticate the remote computer and allow the remote computer to authenticate the user, if necessary.

D.

SSH uses the client-server model.

Buy Now
Questions 32

Which of the following is a version of netcat with integrated transport encryption capabilities?

Options:

A.

Encat

B.

Nikto

C.

Cryptcat

D.

Socat

Buy Now
Questions 33

Audit trail or audit log is a chronological sequence of audit records, each of which contains evidence directly pertaining to and resulting from the execution of a business process or system function. Under which of the following controls does audit control come?

Options:

A.

Protective controls

B.

Preventive controls

C.

Detective controls

D.

Reactive controls

Buy Now
Questions 34

Which of the following is the module of OpenSER?

Options:

A.

Sipsak

B.

TShark

C.

WireShark

D.

SipTrace

Buy Now
Questions 35

You work as a Firewall Analyst in the Tech Perfect Inc. The company has a Linux-based environment. You have installed and configured netfilter/iptables on all computer systems. What are the main features of netfilter/iptables?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It includes many plug-ins or modules in 'patch-o-matic' repository.

B.

It includes a number of layers of API's for third party extensions.

C.

It offers stateless and stateful packet filtering with both IPv4 and IPv6 addressing schemes

D.

It provides network address and port address translations with both IPv4 and IPv6 addressing schemes.

Buy Now
Questions 36

Which of the following parts of IP header is used to specify the correct place of the fragment in the original un-fragmented datagram?

Options:

A.

Fragment ID

B.

Fragment offset

C.

TTL

D.

Source address

Buy Now
Questions 37

Your customer is concerned about security. He wants to make certain no one in the outside world can see the IP addresses inside his network. What feature of a router would accomplish this?

Options:

A.

NAT

B.

Firewall

C.

Port forwarding

D.

MAC filtering

Buy Now
Questions 38

Which of the following files is a Cisco IOS configuration files that resides in RAM?

Options:

A.

running-config

B.

startup-config

C.

temp-config

D.

ram-config

Buy Now
Questions 39

Which of the following tools can be used as a Linux vulnerability scanner that is capable of identifying operating systems and network services?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Cheops-ng

B.

Fport

C.

Elsave

D.

Cheops

Buy Now
Questions 40

Which of the following components are used in the implementation of a wireless intrusion prevention system?

Each correct answer represents a part of the solution. Choose three.

Options:

A.

Server

B.

Console

C.

Sensor

D.

Analyzer

Buy Now
Questions 41

Andrew works as a Forensic Investigator for PassGuide Inc. The company has a Windows-based environment. The company's employees use Microsoft Outlook Express as their e-mail client program. E-mails of some employees have been deleted due to a virus attack on the network.

Andrew is therefore assigned the task to recover the deleted mails. Which of the following tools can Andrew use to accomplish the task?

Each correct answer represents a complete solution. Choose two.

Options:

A.

FINALeMAIL

B.

R-mail

C.

EventCombMT

D.

eMailTrackerPro

Buy Now
Questions 42

Which of the following programs can be used to detect stealth port scans performed by a malicious hacker?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

nmap

B.

libnids

C.

portsentry

D.

scanlogd

Buy Now
Questions 43

David works as the Security Manager for PassGuide Inc. He has been assigned a project to detect the attacks over multiple connections and sessions and to count the number of scanned ports in a defined time period. Which of the following rulebases will he use to accomplish the task?

Options:

A.

Traffic Anomalies rulebase

B.

Exempt rulebase

C.

SYN Protector rulebase

D.

Network Honeypot rulebase

Buy Now
Questions 44

John works as a contract Ethical Hacker. He has recently got a project to do security checking for www.we-are-secure.com. He wants to find out the operating system of the we-are-secure server in the information gathering step. Which of the following commands will he use to accomplish the task?

Each correct answer represents a complete solution. Choose two.

Options:

A.

nc -v -n 208.100.2.25 80

B.

nc 208.100.2.25 23

C.

nmap -v -O www.we-are-secure.com

D.

nmap -v -O 208.100.2.25

Buy Now
Questions 45

Which of the following is known as DNS spoofing?

Options:

A.

Trojan horse

B.

Social engineering

C.

Malicious cache poisoning

D.

Smurf attack

Buy Now
Questions 46

Which of the following tools is used to detect spam email without checking the content?

Options:

A.

Sniffer

B.

DCC

C.

EtherApe

D.

Kismet

Buy Now
Questions 47

Which of the following wireless security policies helps to prevent the wireless enabled laptops from peer-topeer attacks when the laptops are used in public access network?

Options:

A.

Use protocol analyzer

B.

Use Port Address Translation

C.

Use security protocols

D.

Use firewall

Buy Now
Questions 48

Fill in the blank with the appropriate utility.

________ is a table-based system or structure that defines the rulesets needed to transform or filter network packets.

Options:

Buy Now
Questions 49

Which of the following is a version of netcat with integrated transport encryption capabilities?

Options:

A.

Nikto

B.

Encat

C.

Cryptcat

D.

Socat

Buy Now
Questions 50

John works as a professional Ethical Hacker. He is assigned a project to test the security of www.we-are-secure.com. You have searched all open ports of the we-are-secure server. Now, you want to perform the next information-gathering step, i.e., passive OS fingerprinting. Which of the following tools can you use to accomplish the task?

Options:

A.

NBTscan

B.

Nmap

C.

P0f

D.

Superscan

Buy Now
Questions 51

You work as a System Administrator for McNeil Inc. The company has a Linux-based network. You are a root user on the Red Hat operating system. Your network is configured for IPv6 IP addressing. Which of the following commands will you use to test TCP/IP connectivity?

Options:

A.

ping

B.

traceroute

C.

ifconfig

D.

ping6

Buy Now
Questions 52

You work as a Forensic Investigator. Which of the following rules will you follow while working on a case?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Follow the rules of evidence and never temper with the evidence.

B.

Examine original evidence and never rely on the duplicate evidence.

C.

Never exceed the knowledge base of the forensic investigation.

D.

Prepare a chain of custody and handle the evidence carefully.

Buy Now
Questions 53

Which of the following honeypots is a low-interaction honeypot and is used by companies or corporations for capturing limited information about malicious hackers?

Options:

A.

Honeynet

B.

Research honeypot

C.

Honeyfarm

D.

Production honeypot

Buy Now
Questions 54

An IDS is a group of processes working together in a network. These processes work on different computers and devices across the network. Which of the following processes does an IDS perform?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Monitoring and analysis of user and system activity

B.

Event log analysis

C.

Network traffic analysis

D.

Statistical analysis of abnormal traffic patterns

Buy Now
Questions 55

Which of the following methods will allow data to be sent on the Internet in a secure format?

Options:

A.

Browsing

B.

Virtual Private Networks

C.

Serial Line Interface Protocol

D.

Point-to-Point Protocol

Buy Now
Questions 56

Which of the following attacks generates falsified information within an IP header?

Options:

A.

DNS spoofing attack

B.

IP spoofing attack

C.

Web spoofing attack

D.

ARP spoofing attack

Buy Now
Questions 57

Mark has been assigned a project to configure a wireless network for a company. The network should contain a Windows 2003 server and 30 Windows XP client computers. Mark has a single dedicated Internet connection that has to be shared among all the client computers and the server. The configuration needs to be done in a manner that the server should act as a proxy server for the client computers. Which of the following programs can Mark use to fulfill this requirement?

Options:

A.

Microsoft Internet Security & Acceleration Server (ISA)

B.

Sniffer

C.

Wingate

D.

SOCKS

Buy Now
Questions 58

You are the Administrator for a corporate network. You are concerned about denial of service attacks.

Which of the following would be most helpful against Denial of Service (DOS) attacks?

Options:

A.

Stateful Packet Inspection (SPI) firewall

B.

Packet filtering firewall

C.

Honey pot

D.

Network surveys.

Buy Now
Exam Code: GCFW
Exam Name: GIAC Certified Firewall Analyst
Last Update: Dec 22, 2024
Questions: 391

PDF + Testing Engine

$134.99

Testing Engine

$99.99

PDF (Q&A)

$84.99