Weekend Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

GIAC GCED GIAC Certified Enterprise Defender Exam Practice Test

Page: 1 / 9
Total 88 questions

GIAC Certified Enterprise Defender Questions and Answers

Question 1

How does the Cisco IOS IP Source Guard feature help prevent spoofing attacks?

Options:

A.

Filters traffic based on IP address once a DHCP address has been assigned

B.

Prevents unauthorized MAC addresses from receiving an IP address on the network

C.

Blocks unsolicited ARP packets after a client has received an IP address

D.

Rate limits client traffic to prevent CAM table flooding

Question 2

Which control would BEST help detect a potential insider threat?

Options:

A.

Mandatory approval process for executive and administrative access requests.

B.

Providing the same access to all employees and monitoring sensitive file access.

C.

Multiple scheduled log reviews of all employee access levels throughout the year

D.

Requiring more than one employee to be trained on each task or job duty.

Question 3

Which tool uses a Snort rules file for input and by design triggers Snort alerts?

Options:

A.

snot

B.

stick

C.

Nidsbench

D.

ftester

Question 4

Which of the following is an operational security control that is used as a prevention mechanism?

Options:

A.

Labeling of assets

B.

Heat detectors

C.

Vibration alarms

D.

Voltage regulators

Question 5

Which command tool can be used to change the read-only or hidden setting of the file in the screenshot?

Question # 5

Options:

A.

attrib

B.

type

C.

tasklist

D.

dir

Question 6

Which of the following applies to newer versions of IOS that decrease their attack surface?

Options:

A.

Telnet cannot be enabled or used

B.

The Cisco Discovery Protocol has been removed

C.

More services are disabled by default

D.

Two-factor authentication is default required

Question 7

If a Cisco router is configured with the “service config” configuration statement, which of the following tools could be used by an attacker to apply a new router configuration?

Options:

A.

TFTPD

B.

Hydra

C.

Ettercap

D.

Yersinia

Question 8

At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

Options:

A.

To create a file on the USB drive that contains a listing of the C: drive

B.

To show hidden and archived files on the C: drive and copy them to the USB drive

C.

To copy a forensic image of the local C: drive onto the USB drive

D.

To compare a list of known good hashes on the USB drive to files on the local C: drive

Question 9

Although the packet listed below contained malware, it freely passed through a layer 3 switch. Why didn’t the switch detect the malware in this packet?

Question # 9

Options:

A.

The packet was part of a fragmentation attack

B.

The data portion of the packet was encrypted

C.

The entire packet was corrupted by the malware

D.

It didn’t look deeply enough into the packet

Question 10

How would an attacker use the following configuration settings?

Question # 10

Options:

A.

A client based HIDS evasion attack

B.

A firewall based DDoS attack

C.

A router based MITM attack

D.

A switch based VLAN hopping attack

Question 11

Michael, a software engineer, added a module to a banking customer’s code. The new module deposits small amounts of money into his personal bank account. Michael has access to edit the code, but only code reviewers have the ability to commit modules to production. The code reviewers have a backlog of work, and are often willing to trust the software developers’ testing and confidence in the code.

Which technique is Michael most likely to engage to implement the malicious code?

Options:

A.

Denial of Service

B.

Race Condition

C.

Phishing

D.

Social Engineering

Question 12

Which Windows tool would use the following command to view a process:

process where name=’suspect_malware.exe’list statistics

Options:

A.

TCPView

B.

Tasklist

C.

WMIC

D.

Netstat

Question 13

Which action would be the responsibility of the First Responder once arriving at the scene of a suspected incident as part of a Computer Security Incident Response Plan (CSIRP)?

Options:

A.

Making the decision of whether or not to notify law enforcement on behalf of the organization.

B.

Performing timeline creation on the system files in order to identify and remove discovered malware.

C.

Copying critical data from suspected systems to known good systems so productivity is not affected by the investigation.

D.

Conducting initial interviews and identifying the systems involved in the suspected incident.

Page: 1 / 9
Total 88 questions