New Year Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: best70

GCIA GCIA – GIAC Certified Intrusion Analyst Practice Test Questions and Answers

Questions 4

Which of the following organizations is dedicated to computer security research and information sharing?

Options:

A.

FBI

B.

NIPC

C.

Honeynet Project

D.

IEEE

Buy Now
Questions 5

You are concerned about outside attackers penetrating your network via your company Web server. You wish to place your Web server between two firewalls. One firewall between the Web server and the outside world. The other between the Web server and your network. What is this called?

Options:

A.

DMZ

B.

SPI firewall

C.

IDS

D.

Application Gateway firewall

Buy Now
Questions 6

Which of the following files in LILO booting process of Linux operating system stores the location of Kernel on the hard drive?

Options:

A.

/boot/boot.b

B.

/boot/map

C.

/sbin/lilo

D.

/etc/lilo.conf

Buy Now
Questions 7

You work as a Network Administrator for Infonet Inc. The company has a Windows Server 2008 domain-based network. The network has three Windows Server 2008 member servers and 150 Windows Vista client computers. According to the company's security policy, you apply Windows firewall setting to the computers on the network. Now, you are troubleshooting a connectivity problem that might be caused by Windows firewall. What will you do to identify connections that Windows firewall allows or blocks?

Options:

A.

Configure Internet Protocol Security (IPSec).

B.

Configure Network address translation (NAT).

C.

Disable Windows firewall logging.

D.

Enable Windows firewall logging.

Buy Now
Questions 8

Mark works as the Network Administrator of a Windows 2000 based network. The network has a DNS server installed. He experiences host name resolution problems on the network. In order to rectify the situation, he wants to troubleshoot DNS name resolution problems on the network.

Which of the following tools will he use to do this?

Options:

A.

NSLOOKUP

B.

IPCONFIG

C.

NBTSTAT

D.

NETSTAT

Buy Now
Questions 9

Sasha wants to add an entry to your DNS database for your mail server. Which of the following types of resource records will she use to accomplish this?

Options:

A.

ANAME

B.

SOA

C.

MX

D.

CNAME

Buy Now
Questions 10

Which of the following is the default port for DNS zone transfer?

Options:

A.

Port 21

B.

Port 80

C.

Port 23

D.

Port 53

Buy Now
Questions 11

You work as a Network Administrator for McRobert Inc. You want to know the NetBIOS name of your computer. Which of the following commands will you use?

Options:

A.

NBTSTAT -s

B.

NETSTAT -s

C.

NETSTAT -n

D.

NBTSTAT -n

Buy Now
Questions 12

Which of the following is a signature-based intrusion detection system (IDS) ?

Options:

A.

Snort

B.

StealthWatch

C.

RealSecure

D.

Tripwire

Buy Now
Questions 13

You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below:

What is the IP address of the sender of this email?

Options:

A.

216.168.54.25

B.

141.1.1.1

C.

172.16.10.90

D.

209.191.91.180

Buy Now
Questions 14

A firewall is a combination of hardware and software, used to provide security to a network. It is used to protect an internal network or intranet against unauthorized access from the Internet or other outside networks. It restricts inbound and outbound access and can analyze all traffic between an internal network and the Internet. Users can configure a firewall to pass or block packets from specific IP addresses and ports. Which of the following tools works as a firewall for the Linux 2.4 kernel?

Options:

A.

IPTables

B.

OpenSSH

C.

IPChains

D.

Stunnel

Buy Now
Questions 15

Adam works as a Computer Hacking Forensic Investigator in a law firm. He has been assigned with his first project. Adam collected all required evidences and clues. He is now required to write an investigative report to present before court for further prosecution of the case. He needs guidelines to write an investigative report for expressing an opinion. Which of the following are the guidelines to write an investigative report in an efficient way?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

All ideas present in the investigative report should flow logically from facts to conclusions.

B.

Opinion of a lay witness should be included in the investigative report.

C.

The investigative report should be understandable by any reader.

D.

There should not be any assumptions made about any facts while writing the investigative report.

Buy Now
Questions 16

Which of the following IDs is used to reassemble the fragments of a datagram at the destination point?

Options:

A.

MAK ID

B.

IP address

C.

IP identification number

D.

SSID

Buy Now
Questions 17

Which of the following tools is used to detect spam email without checking the content?

Options:

A.

Kismet

B.

EtherApe

C.

DCC

D.

Sniffer

Buy Now
Questions 18

You work as a Desktop Support Technician for umbrella Inc. The company uses a Windows-based network. An employee of the production department is facing the problem in the IP configuration of the network connection.

He called you to resolve the issue. You suspect that the IP configuration is not configured properly. You want to use the ping command to ensure that IPv4 protocol is working on a computer. While running the ping command from the command prompt, you find that Windows Firewall is blocking the ping command. You enter the following command in the elevated command prompt on the computer:

netsh advfirewall firewall add rule name="ICMPv4" protocol=icmpv4:any,any dir=in action=allow

Which of the following actions will this command perform?

Options:

A.

Permit ICMPv4 packet to pass through the firewall.

B.

Permit ICMPv4 Echo Request.

C.

Enable packet filtering by Windows Firewall.

D.

Disable Firewall temporarily.

Buy Now
Questions 19

Adam works as a professional Computer Hacking Forensic Investigator. He has been called by the FBI to examine data of the hard disk, which is seized from the house of a suspected terrorist.

Adam decided to acquire an image of the suspected hard drive. He uses a forensic hardware tool, which is capable of capturing data from IDE, Serial ATA, SCSI devices, and flash cards. This tool can also produce MD5 and CRC32 hash while capturing the data. Which of the following tools is Adam using?

Options:

A.

ImageMASSter Solo-3

B.

ImageMASSter 4002i

C.

FireWire DriveDock

D.

Wipe MASSter

Buy Now
Questions 20

Which of the following is allowed by a company to be addressed directly from the public network and is hardened to screen the rest of its network from security exposure?

Options:

A.

Intrusion detection system

B.

A computer installed in the network and configured with sender reputation

C.

bastion host

D.

Exchange ActiveSync

Buy Now
Questions 21

Victor wants to send an encrypted message to his friend. He is using certain steganography technique to accomplish this task. He takes a cover object and changes it accordingly to hide information. This secret information is recovered only when the algorithm compares the changed cover with the original cover. Which of the following Steganography methods is Victor using to accomplish the task?

Options:

A.

The distortion technique

B.

The spread spectrum technique

C.

The cover generation technique

D.

The substitution technique

Buy Now
Questions 22

Which of the following is a form of cheating or copying someone else's work or idea without acknowledging the source?

Options:

A.

Patent

B.

Turnitin

C.

Copyright

D.

Plagiarism

Buy Now
Questions 23

Web applications are accessed by communicating over TCP ports via an IP address. Choose the two most common Web Application TCP ports and their respective protocol names.

Each correct answer represents a complete solution. Choose two.

Options:

A.

TCP Port 443 / S-HTTP or SSL

B.

TCP Port 443 / HTTPS or SSL

C.

TCP Port 80 / HTTP

D.

TCP Port 80 / HTTPS or SSL

Buy Now
Questions 24

Which of the following is the default port used by Simple Mail Transfer Protocol (SMTP)?

Options:

A.

80

B.

25

C.

20

D.

21

Buy Now
Questions 25

Which of the following is a valid IP address for class B Networks?

Options:

A.

225.128.98.7

B.

80.33.5.7

C.

212.136.45.8

D.

172.157.88.3

Buy Now
Questions 26

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

Options:

A.

Signature-based

B.

Network-based

C.

File-based

D.

Anomaly-based

Buy Now
Questions 27

Which of the following is a reason to implement security logging on a DNS server?

Options:

A.

For recording the number of queries resolved

B.

For preventing malware attacks on a DNS server

C.

For measuring a DNS server's performance

D.

For monitoring unauthorized zone transfer

Buy Now
Questions 28

The National Shoes Inc. has an SNMP enabled router installed on its network. IT Manager wants to monitor all SNMP traffic generated by the router. So, he installs a Network Monitor on a Windows2000 Server computer on the network. The router is configured to send traps to an SNMP manager installed on another server. He wants to get a notification whenever the network router raises an SNMP trap. What will he do to achieve this?

(Click the Exhibit button on the toolbar to see the case study.)

Each correct answer represents a part of the solution. Choose two.

Options:

A.

Install an SNMP manager on the router.

B.

Start the Windows 2000 Alert Service on the server.

C.

Create a TCP/IP filter on the server.

D.

Create a Network Monitor filter that has a pattern match for SNMP traffic.

E.

Create a Network Monitor trigger to run the NET SEND command.

F.

Configure the network router to trap the IP address of the server.

Buy Now
Questions 29

Which of the following is a hardware/software platform that is designed to analyze, detect, and report on security related events. NIPS is designed to inspect traffic and based on its configuration or security policy, it can drop the malicious traffic?

Options:

A.

NIPS

B.

HIPS

C.

NIDS

D.

HIDS

Buy Now
Questions 30

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

Options:

A.

DriveSpy

B.

Ontrack

C.

Device Seizure

D.

Forensic Sorter

Buy Now
Questions 31

Peter works as a professional Computer Hacking Forensic Investigator for eLaw-Suit law firm. He is working on a case of a cyber crime. Peter knows that the good investigative report should not only communicate the relevant facts, but also present expert opinion. This report should not include the cases in which the expert acted as a lay witness. Which of the following type of witnesses is a lay witness?

Options:

A.

One who can give a firsthand account of something seen, heard, or experienced.

B.

One with special knowledge of the subject about which he or she is testifying.

C.

One who observes an event.

D.

One who is not qualified as an expert witness.

Buy Now
Questions 32

Which of the following utilities is used to display the current TCP/IP configuration of a Windows NT computer?

Options:

A.

NBTSTAT

B.

IPCONFIG

C.

CONFIG.SYS

D.

FTP

Buy Now
Questions 33

You work as a Network Security Administrator for NetPerfect Inc. The company has a Windowsbased network. You are incharge of the data and network security of the company. While performing a threat log analysis, you observe that one of the database administrators is pilfering confidential data. What type of threat is this?

Options:

A.

Zombie

B.

External threat

C.

Internal threat

D.

Malware

Buy Now
Questions 34

Which of the following is the correct order of loading system files into the main memory of the system, when the computer is running on Microsoft's Windows XP operating system?

Options:

A.

NTLDR, BOOT.ini, HAL.dll, NTDETECT.com, NTOSKRNL.exe

B.

BOOT.ini, HAL.dll, NTDETECT.com, NTLDR, NTOSKRNL.exe

C.

NTLDR, BOOT.ini, HAL.dll, NTDETECT.com, NTOSKRNL.exe

D.

NTLDR, BOOT.ini, NTDETECT.com, HAL.dll, NTOSKRNL.exe

Buy Now
Questions 35

What is the order of the extension headers that is followed by IPv6?

Options:

A.

Destination Options (first), Routing, IPv6 header, Hop-by-Hop, Fragment, Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

B.

Routing, Hop-by-Hop, Destination Options (first), Fragment, Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

C.

Fragment, Routing, Hop-by-Hop, Destination Options (first), Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

D.

IPv6 header, Hop-by-Hop, Destination Options (first), Routing, Fragment, Authentication, Encrypted Security Payload, Destination Options (second), followed by an Upper-layer header, indicating payload.

Buy Now
Questions 36

Which of the following are not functions of the SNORT application?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Packet logging

B.

Virus detection

C.

Hard disk drive scanning

D.

Packet sniffing

E.

Intrusion detection

Buy Now
Questions 37

Fill in the blank with the appropriate term.

___________ is a technique used to make sure that incoming packets are actually from the networks that they claim to be from.

Options:

Buy Now
Questions 38

In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?

Options:

A.

Fragmentation overlap attack

B.

Evasion attack

C.

Fragmentation overwrite attack

D.

Insertion attack

Buy Now
Questions 39

You work as a Network Administrator for McNeil Inc. The company's Windows 2000-based network is configured with Internet Security and Acceleration (ISA) Server 2000. You want to configure intrusion detection on the server. You find that the different types of attacks on the Intrusion Detection tab page of the IP Packet Filters Properties dialog box are disabled. What is the most likely cause?

Options:

A.

The PPTP through ISA firewall check box on the PPTP tab page of the IP Packet Filters Properties dialog box is not enabled.

B.

The Enable IP routing check box on the General tab page of the IP Packet Filters Properties dialog box is not selected.

C.

The Log packets from Allow filters check box on the Packet Filters tab page of the IP Packet Filters Properties dialog box is not enabled.

D.

The Enable Intrusion detection check box on the General tab page of the IP Packet Filters

Properties dialog box is not selected.

Buy Now
Questions 40

What is the name of the group of blocks which contains information used by the operating system in Linux system?

Options:

A.

logblock

B.

Bootblock

C.

Superblock

D.

Systemblock

Buy Now
Questions 41

Which of the following is the process of categorizing attack alerts produced from IDS?

Options:

A.

Site policy implementation

B.

Blocking

C.

Intrusion classify

D.

Alarm filtering

Buy Now
Questions 42

Which of the following partitions contains the system files that are used to start the operating system?

Options:

A.

Secondary partition

B.

Boot partition

C.

Primary partition

D.

System partition

Buy Now
Questions 43

Which of the following Windows XP system files handles memory management, I/O operations, and interrupts?

Options:

A.

Ntoskrnl.exe

B.

Advapi32.dll

C.

Kernel32.dll

D.

Win32k.sys

Buy Now
Questions 44

You work as a Network Administrator for Tech Perfect Inc. The office network is configured as an IPv6 network. You have to configure a computer with the IPv6 address, which is equivalent to an IPv4 publicly routable address. Which of the following types of addresses will you choose?

Options:

A.

Site-local

B.

Global unicast

C.

Local-link

D.

Loopback

Buy Now
Questions 45

Which of the following attacks is designed to deduce the brand and/or version of an operating system or application?

Options:

A.

Vulnerability assessment

B.

Banner grabbing

C.

OS fingerprinting

D.

Port scanning

Buy Now
Questions 46

Which of the following attacks is used to hack simple alphabetical passwords?

Options:

A.

Dictionary-based attack

B.

Sniffing

C.

Man-in-the-middle attack

D.

Black hat attack

Buy Now
Questions 47

Which of the following ports is used for DNS services?

Options:

A.

Port 7

B.

Port 53

C.

Port 80

D.

Port 23

Buy Now
Questions 48

Sandra, a novice computer user, works on Windows environment. She experiences some problem regarding bad sectors formed in a hard disk of her computer. She wants to run CHKDSK command to check the hard disk for bad sectors and to fix the errors, if any, occurred. Which of the following switches will she use with CHKDSK command to accomplish the task?

Options:

A.

CHKDSK /I

B.

CHKDSK /R /F

C.

CHKDSK /C /L

D.

CHKDSK /V /X

Buy Now
Questions 49

Which of the following is an automated vulnerability assessment tool?

Options:

A.

Kismet

B.

Nessus

C.

Sniffer

D.

Snort

Buy Now
Questions 50

Which of the following DOS commands is used to configure network protocols?

Options:

A.

netsh

B.

netsvc

C.

netstat

D.

ipconfig

Buy Now
Questions 51

Which of the following types of attacks uses ICMP to consume bandwidth and crash sites?

Options:

A.

MITM attack

B.

SYN flood attack

C.

TFN attack

D.

XSS attack

Buy Now
Questions 52

Which of the following forensic tool suite is developed for Linux operating system?

Options:

A.

Wetstone

B.

MForensicsLab

C.

ProDiscover

D.

S.M.A.R.T.

Buy Now
Questions 53

Which of the following proxy servers can be used for spamming?

Options:

A.

Caching proxy server

B.

Web proxy server

C.

Open proxy server

D.

Anonymizing proxy server

Buy Now
Questions 54

Which of the following is an exact duplicate of computer's hard drive?

Options:

A.

system image

B.

bit-stream image

C.

data image

D.

drive image

Buy Now
Questions 55

Which of the following statements are true about an IPv6 network?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

For interoperability, IPv4 addresses use the last 32 bits of IPv6 addresses.

B.

It increases the number of available IP addresses.

C.

It provides improved authentication and security.

D.

It uses 128-bit addresses.

E.

It uses longer subnet masks than those used in IPv4.

Buy Now
Questions 56

Which of the following can be applied as countermeasures against DDoS attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Limiting the amount of network bandwidth

B.

Blocking IP address

C.

Using LM hashes for passwords

D.

Using Intrusion detection systems

E.

Using the network-ingress filtering

Buy Now
Questions 57

Which of the following utilities allows to view all files including invisible files and folders on a Macintosh OS X?

Options:

A.

Directory Scan

B.

Folder Scan

C.

File Scan

D.

System Scan

Buy Now
Questions 58

Which of the following is used over the Internet for better security?

Options:

A.

SOCKS

B.

S-HTTP

C.

Wingate

D.

IMAP Server

Buy Now
Questions 59

Which of the following is an expression of interference that triggers a false positive signal during an intrusion detection process performed by IDS?

Options:

A.

Confidence value

B.

Handshake

C.

Site policy

D.

Noise

Buy Now
Questions 60

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small-sized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Nessus

B.

Whisker

C.

Y.A.T.

D.

Fragroute

Buy Now
Questions 61

Which of the following statements is NOT true about the file slack spaces in Windows operating system?

Options:

A.

File slack is the space, which exists between the end of the file and the end of the last clust er.

B.

Large cluster size will decrease the volume of the file slack.

C.

File slack may contain data from the memory of the system.

D.

It is possible to find user names, passwords, and other important information in slack.

Buy Now
Questions 62

You work as a Network Administrator for McRobert Inc. Your company has a TCP/IP-based network.

You want to know the statistics of each protocol installed on your computer. Which of the following commands will you use?

Options:

A.

NBTSTAT -r

B.

NETSTAT -s

C.

NETSTAT -r

D.

NBTSTAT -s

Buy Now
Questions 63

Which of the following image file formats uses a lossy data compression technique?

Options:

A.

GIF

B.

JPG

C.

PNG

D.

TIF

Buy Now
Questions 64

A firewall is a combination of hardware and software, used to provide security to a network. It is used to protect an internal network or intranet against unauthorized access from the Internet or other outside networks. It restricts inbound and outbound access and can analyze all traffic between an internal network and the Internet. Users can configure a firewall to pass or block packets from specific IP addresses and ports. Which of the following tools works as a firewall for the Linux 2.4 kernel?

Options:

A.

Stunnel

B.

IPTables

C.

IPChains

D.

OpenSSH

Buy Now
Questions 65

Which of the following is not a valid Failed Logon EventID?

Options:

A.

535

B.

536

C.

534

D.

533

Buy Now
Questions 66

Which of the following can be monitored by using the host-based intrusion detection system (HIDS)?

Options:

A.

Computer performance

B.

File system integrity

C.

Computer storage space

D.

DoS attack

Buy Now
Questions 67

Which of the following is used to hash the information in Netcat?

Options:

A.

MD5

B.

SHA-256

C.

MD5deep

D.

SHA-1

Buy Now
Questions 68

You work as a Network Administrator for Net Perfect Inc. The company has a TCP/IP-based network. You are configuring an Internet connection on a server. Which of the following servers filters outbound Web traffic on the network?

Options:

A.

Proxy server

B.

DNS server

C.

WINS server

D.

DHCP server

Buy Now
Questions 69

John works as a Network Security Administrator for NetPerfect Inc. The manager of the company has told John that the company's phone bill has increased drastically. John suspects that the company's phone system has been cracked by a malicious hacker. Which attack is used by malicious hackers to crack the phone system?

Options:

A.

Sequence++ attack

B.

Phreaking

C.

Man-in-the-middle attack

D.

War dialing

Buy Now
Questions 70

Which of the following protocols uses only User Datagram Protocol (UDP)?

Options:

A.

FTP

B.

ICMP

C.

TFTP

D.

POP3

Buy Now
Questions 71

Which of the following tools is used to locate lost files and partitions to restore data from a formatted, damaged, or lost partition in Windows and Apple Macintosh computers?

Options:

A.

Easy-Undelete

B.

VirtualLab

C.

File Scavenger

D.

Recover4all Professional

Buy Now
Questions 72

You work as a Network Administrator for Infonet Inc. The company has a Windows Server 2008 domain-based network. The network has three Windows Server 2008 member servers and 150 Windows Vista client computers. The network contains a Windows Server 2008 Core computer.

You want to install the DNS server role on the Windows Server 2008 Core computer. Which of the following commands will you use to accomplish the task?

Options:

A.

start /w ocsetup DNS-Server-Core-Role

B.

start /w ocsetup DnsServer

C.

start /w ocsetup DnsServercorerole

D.

net start "dns server"

Buy Now
Questions 73

Which of the following is a hardware/software platform that is designed to analyze, detect, and report on security related events. NIPS is designed to inspect traffic and based on its configuration or security policy, it can drop the malicious traffic?

Options:

A.

NIPS

B.

HIDS

C.

NIDS

D.

HIPS

Buy Now
Questions 74

Which of the following information must the fragments carry for the destination host to reassemble them back to the original unfragmented state?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

MF flag

B.

Offset field

C.

MAC address

D.

Length of the data

E.

IP address

F.

IP identification number

Buy Now
Questions 75

Which of the following IP packet elements is responsible for authentication while using IPSec?

Options:

A.

Authentication Header (AH)

B.

Layer 2 Tunneling Protocol (L2TP)

C.

Internet Key Exchange (IKE)

D.

Encapsulating Security Payload (ESP)

Buy Now
Questions 76

You work as a Network Administrator for Net Perfect Inc. The company has a TCP/IP-based network. The network is connected to the Internet through a firewall. A user complains that he is unable to access the abc.com site. However, he can access all other sites. Which of the following tools will help you diagnose the problem?

Options:

A.

IPCONFIG

B.

ROUTE

C.

TELNET

D.

TRACERT

Buy Now
Exam Code: GCIA
Exam Name: GCIA – GIAC Certified Intrusion Analyst Practice Test
Last Update: Dec 22, 2024
Questions: 508

PDF + Testing Engine

$134.99

Testing Engine

$99.99

PDF (Q&A)

$84.99