Weekend Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

GIAC GCFW GIAC Certified Firewall Analyst Exam Practice Test

Page: 1 / 39
Total 391 questions

GIAC Certified Firewall Analyst Questions and Answers

Question 1

Jacob is worried about sniffing attacks and wants to protect his SMTP transmissions from this attack. What can he do to accomplish this?

Options:

A.

Use an SSL certificate.

B.

Use a proxy server.

C.

Use a firewall.

D.

Use EFS.

Question 2

You work as a Network Troubleshooter for PassGuide Inc. You want to tunnel the IPv6 traffic across an IPv4 supporting portion of the company's network. You are using the interface configuration mode for the tunnel. Which of the following IP addresses will you enter after the tunnel source command?

Options:

A.

The IPv4 address assigned to the local interface on which the tunnel is built

B.

The IPv4 address assigned to the remote interface on which the tunnel is built

C.

The IPv6 address assigned to the local tunnel interface

D.

The IPv6 address assigned to the remote tunnel interface

Question 3

Which of the following monitors program activities and modifies malicious activities on a system?

Options:

A.

Back door

B.

NIDS

C.

HIDS

D.

RADIUS

Question 4

A scenario involves a pool of users with private IP addresses who need to access the Internet; however, the company has a limited number of IP addresses and needs to ensure users occupy only one public IP address.

Which technology is used to allow a pool of users to share one global IP address for Internet access?

Options:

A.

Port Address Translation

B.

Per-user Address Translation

C.

Pool Address Translation

D.

Private Address Translation

Question 5

Which of the following is a maintenance protocol that permits routers and host computers to swap basic control information when data is sent from one computer to another?

Options:

A.

ICMP

B.

SNMP

C.

IGMP

D.

BGP

Question 6

Fill in the blank with appropriate address translation type.

A______ performs translation of one IP address to a different one automatically. It requires manually defining two sets of addresses on the address translation device (probably a router). One set defines which inside addresses are allowed to be translated, and the other defines what these addresses are to be translated to.

Options:

Question 7

In which of the following IDS evasion techniques does an attacker deliver data in multiple small sized packets, which makes it very difficult for an IDS to detect the attack signatures of such attacks?

Options:

A.

Fragmentation overwrite

B.

Fragmentation overlap

C.

Insertion

D.

Session splicing

Question 8

Which of the following statements are true about an IPv6 network?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It uses longer subnet masks than those used in IPv4.

B.

It increases the number of available IP addresses.

C.

For interoperability, IPv4 addresses use the last 32 bits of IPv6 addresses.

D.

It provides improved authentication and security.

E.

It uses 128-bit addresses.

Question 9

You work as a Network Architect for Tech Perfect Inc. The company has a corporate LAN network. You will have to perform the following tasks:

l Limit events that occur from security threats such as viruses, worms, and spyware.

l Restrict access to the network based on identity or security posture.

Which of the following services will you deploy in the network to accomplish the tasks?

Options:

A.

NetFlow

B.

Protocol-Independent Multicast

C.

Network Admission Control

D.

Firewall Service Module

Question 10

Which of the following are the types of intrusion detection systems?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Client-based intrusion detection system (CIDS)

B.

Network intrusion detection system (NIDS)

C.

Server-based intrusion detection system (SIDS)

D.

Host-based intrusion detection system (HIDS)

Question 11

Which of the following are the countermeasures against a man-in-the-middle attack?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Using Secret keys for authentication.

B.

Using public key infrastructure authentication.

C.

Using Off-channel verification.

D.

Using basic authentication.

Question 12

Which of the following terms is used to represent IPv6 addresses?

Options:

A.

Colon-dot

B.

Hexadecimal-dot notation

C.

Colon-hexadecimal

D.

Dot notation

Question 13

You are implementing a host based intrusion detection system on your web server. You feel that the best way to monitor the web server is to find your baseline of activity (connections, traffic, etc.) and to monitor for conditions above that baseline. This type of IDS is called __________.

Options:

A.

Reactive IDS

B.

Signature Based

C.

Passive IDS

D.

Anomaly Based

Question 14

Which of the following statements are true about an IDP rule base notification?

Options:

A.

It can be defined as reusable logical entities that the user can apply to the rules.

B.

When an action is performed, a notification defines how to log information.

C.

It is used to specify the type of network traffic that has to be monitored for attacks.

D.

It directs an IDP to drop or close the connection.

Question 15

You are implementing passive OS fingerprinting in a network. Which of the following aspects are required to be configured there?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Edit signature vulnerable OS lists.

B.

Limit the attack relevance rating calculation to a specific IP address range.

C.

Define event action rules filters using the OS relevancy value of the target.

D.

Enable passive analysis.

E.

Define and import OS mappings.

Question 16

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to secure access to the network of the company from all possible entry points. He segmented the network into several subnets and installed firewalls all over the network. He has placed very stringent rules on all the firewalls, blocking everything in and out except the ports that must be used. He does need to have port 80 open since his company hosts a website that must be accessed from the Internet. Adam is still worried about the programs like Hping2 that can get into a network through covert channels.

Which of the following is the most effective way to protect the network of the company from an attacker using Hping2 to scan his internal network?

Options:

A.

Block ICMP type 13 messages

B.

Block ICMP type 3 messages

C.

Block all outgoing traffic on port 21

D.

Block all outgoing traffic on port 53

Question 17

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He has successfully completed the following steps of the preattack phase:

l Information gathering

l Determining network range

l Identifying active machines

l Finding open ports and applications

l OS fingerprinting

l Fingerprinting services

Now John wants to perform network mapping of the We-are-secure network. Which of the following tools can he use to accomplish his task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Ettercap

B.

Traceroute

C.

NeoTrace

D.

Cheops

Question 18

You work as a Network Administrator for Net Perfect Inc. The company has a TCP/IP network. You have been assigned a task to configure security mechanisms for the network of the company. You have decided to configure a packet filtering firewall. Which of the following may be the reasons that made you choose a packet filtering firewall as a security mechanism?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It makes security transparent to end-users which provide easy use of the client application s.

B.

It prevents application-layer attacks.

C.

It is easy to install packet filtering firewalls in comparison to the other network security sol utions.

D.

It easily matches most of the fields in Layer 3 packets and Layer 4 segment headers, and thus, provides a lot of flexibility in implementing security policies.

Question 19

Which of the following proxy servers is also referred to as transparent proxies or forced proxies?

Options:

A.

Reverse proxy server

B.

Intercepting proxy server

C.

Anonymous proxy server

D.

Tunneling proxy server

Question 20

Which of the following tools performs comprehensive tests against web servers for multiple items, including over 6100 potentially dangerous files/CGIs?

Options:

A.

Nikto

B.

Sniffer

C.

Snort

D.

Dsniff

Question 21

You work as a Firewall Analyst in the Tech Perfect Inc. The company has a Linux-based environment. You have installed and configured netfilter/iptables on all computer systems. What are the main features of netfilter/iptables?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It includes many plug-ins or modules in 'patch-o-matic' repository

B.

It includes a number of layers of API's for third party extensions

C.

It offers stateless and stateful packet filtering with both IPv4 and IPv6 addressing schemes

D.

It provides network address and port address translations with both IPv4 and IPv6 addressing schemes

Question 22

Adam works as a Security administrator for Umbrella Inc. He runs the following traceroute and notices that hops 19 and 20 both show the same IP address.

1 172.16.1.254 (172.16.1.254) 0.724 ms 3.285 ms 0.613 ms 2 ip68-98-176-

1.nv.nv.cox.net (68.98.176.1) 12.169 ms 14.958 ms 13.416 ms 3 ip68-98-176-

1.nv.nv.cox.net (68.98.176.1) 13.948 ms ip68-100-0-1.nv.nv. cox.net (68.100.0.1)

16.743 ms 16.207 ms 4 ip68-100-0-137.nv.nv.cox.net (68.100.0.137) 17.324 ms 13.933

ms 20.938 ms 5 68.1.1.4 (68.1.1.4) 12.439 ms 220.166 ms 204.170 ms

6 so-6-0-0.gar2.wdc1.Level3.net (67.29.170.1) 16.177 ms 25.943 ms 14.104 ms 7

unknown.Level3.net (209.247.9.173) 14.227 ms 17.553 ms 15.415 ms "PassGuide" -

8 so-0-1-0.bbr1.NewYork1.level3.net (64.159.1.41) 17.063 ms 20.960 ms 19.512 ms 9

so-7-0-0.gar1. NewYork1.Level3.net (64.159.1.182) 20.334 ms 19.440 ms 17.938 ms

10 so-4-0-0.edge1.NewYork1.Level3.

net (209.244.17.74) 27.526 ms 18.317 ms 21.202 ms 11 uunet-level3-

oc48.NewYork1.Level3.net

(209.244.160.12) 21.411 ms 19.133 ms 18.830 ms 12 0.so-6-0-0.XL1.NYC4.ALTER.NET

(152.63.21.78)

21.203 ms 22.670 ms 20.111 ms 13 0.so-2-0-0.TL1.NYC8.ALTER.NET (152.63.0.153)

30.929 ms 24.858 ms

23.108 ms 14 0.so-4-1-0.TL1.ATL5.ALTER.NET (152.63.10.129) 37.894 ms 33.244 ms

33.910 ms 15 0.so-7-0-0.XL1.MIA4.ALTER.NET (152.63.86.189) 51.165 ms 49.935 ms

49.466 ms 16 0.so-3-0-0.XR1.MIA4.ALTER.

NET (152.63.101.41) 50.937 ms 49.005 ms 51.055 ms 17 117.ATM6-

0.GW5.MIA1.ALTER.NET (152.63.82.73) 51.897 ms 50.280 ms 53.647 ms 18 PassGuidegw1.

customer.alter.net (65.195.239.14) 51.921 ms 51.571 ms 56.855 ms 19

www.PassGuide.com (65.195.239.22) 52.191 ms 52.571 ms 56.855 ms 20

www.PassGuide.com (65.195.239.22) 53.561 ms 54.121 ms 58.333 ms

Which of the following is the most like cause of this issue?

Options:

A.

A stateful inspection firewall

B.

An application firewall

C.

Network Intrusion system

D.

Intrusion Detection System

Question 23

A remote-access VPN offers secured and encrypted connections between mobile or remote users and their corporate network across public networks. Which of the following does the remote-access VPN use for offering these types of connections?

Each correct answer represents a complete solution. Choose two.

Options:

A.

SSL

B.

IPsec

C.

TLS

D.

SSH

Question 24

Which of the following forms on NAT maps multiple unregistered IP addresses to a single registered IP address by using different ports?

Options:

A.

Overloading

B.

Dynamic NAT

C.

Overclocking

D.

Static NAT

Question 25

John works as a Security Manager for Gentech Inc. He uses an IDP engine to detect the type of interactive traffic produced during an attack in which the attacker wants to install the mechanism on a host system that facilitates the unauthorized access and breaks the system confidentiality.

Which of the following rulebases will he use to accomplish the task?

Options:

A.

Backdoor rulebase

B.

Traffic Anomalies rulebase

C.

Exempt rulebase

D.

SYN Protector rulebase

Question 26

You have to ensure that your Cisco Router is only accessible via telnet and ssh from the following hosts and subnets:

10.10.2.103

10.10.0.0/24

Which of the following sets of commands will you use to accomplish the task?

Options:

A.

access-list 10 permit host 10.10.2.103

access-list 10 permit 10.10.0.0 0.0.0.255

access-list 10 deny any

line vty 0 4

access-class 10 in

B.

access-list 10 permit 10.10.2.103

access-list 10 permit 10.10.0.0 0.0.0.255

access-list 10 deny any

line vty 0 4

access-group 10 in

C.

access-list 10 permit host 10.10.2.103

access-list 10 permit 10.10.0.0 0.0.0.255

access-list 10 deny any

line vty 0 4

access-class 10 out

D.

access-list 10 permit host 10.10.2.103

access-list 11 permit host 10.10.0.0 255.255.255.0

access-list 12 deny any

line vty 0 4

access-group 10, 11, 12 in

Question 27

Which of the following firewall types operates at the Network layer of the OSI model and can filter data by port, interface address, source address, and destination address?

Options:

A.

Proxy server

B.

Application gateway

C.

Packet Filtering

D.

Circuit-level gateway

Question 28

You have just taken over as the Network Administrator for a medium sized company. You want to check to see what services are exposed to the outside world. What tool would you use to accomplish this?

Options:

A.

Protocol analyzer

B.

Network mapper

C.

Packet sniffer

D.

A port scanner

Question 29

Peter works as a Computer Hacking Forensic Investigator. He has been called by an organization to conduct a seminar to give necessary information related to sexual harassment within the work place. Peter started with the definition and types of sexual harassment. He then wants to convey that it is important that records of the sexual harassment incidents should be maintained, which helps in further legal prosecution. Which of the following data should be recorded in this documentation?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Names of the victims

B.

Location of each incident

C.

Date and time of incident

D.

Nature of harassment

Question 30

You work as a Network Administrator for Net World Inc. You have configured a few routers on the company's network. You are required to accomplish the following goals:

l Encrypt all service passwords immediately.

l Ensure that encryption is also applied on the passwords changed in the future.

You run the following commanD.

service password-encryption

Which of the goals will this action accomplish?

Options:

A.

The action will accomplish both the goals.

B.

The action will accomplish neither of the goals.

C.

The action will encrypt all passwords immediately.

D.

The action will ensure that encryption is also applied on the passwords changed in the future.

Question 31

John works as a Network Administrator for Web Perfect Inc. The company has a wireless LAN network. John has configured shared key authentication on a client. The client and the AP start exchanging the frames to enable authentication. Which of the following vulnerabilities may occur while the client and the AP exchange the challenge text over the wireless link?

Options:

A.

DoS attack

B.

Land attack

C.

Vulnerability attack

D.

Man-in-the-middle attack

Question 32

Which of the following address translation types only translates one (and only one) IP address to another without using ports?

Options:

A.

NAT

B.

Dynamic NAT

C.

PAT

D.

Static NAT

Question 33

Which of the following fields are specified when rules are created for the Network Honeypot

rulebase?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

A destination/service match condition

B.

Detection settings

C.

Operation mode

D.

Response options

Question 34

Which of the following IPv4 fields become obsolete while removing the hop-by-hop segmentation (fragmentation) procedure from the IP header?

Each correct answer represents a part of the solution. Choose three.

Options:

A.

Datagram Identification Number field

B.

Fragment Offset field

C.

Datagram Length field

D.

Flags field

Question 35

You work as a Network Administrator for Tech Perfect Inc. The company has a wireless LAN infrastructure. The management wants to prevent unauthorized network access to local area networks and other information assets by the wireless devices. What will you do?

Options:

A.

Implement a dynamic NAT.

B.

Implement a firewall.

C.

Implement an ACL.

D.

Implement a WIPS.

Question 36

Fill in the blank with the appropriate utility.

________ is a table-based system or structure that defines the rulesets needed to transform or filter network packets.

Options:

Question 37

You work as a Network Administrator for Rick International. The company has a TCP/IP-based network. A user named Kevin wants to set an SSH terminal at home to connect to the company's network. You have to configure your company's router for it. By default, which of the following standard ports does the SSH protocol use for connection?

Options:

A.

443

B.

80

C.

22

D.

21

Question 38

John, a malicious hacker, forces a router to stop forwarding packets by flooding it with many open connections simultaneously so that all hosts behind it are effectively disabled. Which of the following attacks is John performing?

Options:

A.

ARP spoofing

B.

DoS attack

C.

Rainbow attack

D.

Replay attack

Question 39

Which of the following hexadecimal values in the boot field in the configuration register loads the first IOS file found in Flash memory?

Options:

A.

0

B.

1

C.

F

D.

2

Question 40

You work as a Network Architect for Tech Perfect Inc. The company has a TCP/IP based network. You have established a remote-access VPN network between mobile users and the company's network. You want to implement the following features in the remote-access VPN network:

l Provide security for the web traffic.

l Browser clients can support the VPN connection to a host.

Which of the following will you configure to implement the given features in the network?

Options:

A.

IPsec

B.

SSL

C.

DACL

D.

SSH

Question 41

You are the Network Administrator and your company has recently implemented encryption for all emails. You want to check to make sure that the email packages are being encrypted. What tool would you use to accomplish this?

Options:

A.

Vulnerability analyzer

B.

Performance Monitor

C.

Password cracker

D.

Packet sniffer

Question 42

Which of the following tools is an open source network intrusion prevention and detection system that operates as a network sniffer and logs activities of the network that is matched with the predefined signatures?

Options:

A.

Snort

B.

KisMAC

C.

Dsniff

D.

Kismet

Question 43

You work as a Network Administrator for NetTech Inc. Your manager needs to access a particular server on the network from outside the company network. You have a registered IP address assigned to a router on the company network. Which of the following will be useful for accessing the server from outside the network?

Options:

A.

Overloading

B.

Dynamic VLAN

C.

Switch

D.

Static NAT

Question 44

Which of the following Linux file systems is a journaled file system?

Options:

A.

ext3

B.

ext2

C.

ext

D.

ext4

Question 45

Which of the following programs can be used to detect stealth port scans performed by a malicious hacker?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

portsentry

B.

libnids

C.

nmap

D.

scanlogd

Question 46

You work as a Forensic Investigator. Which of the following rules will you follow while working on a case?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Follow the rules of evidence and never temper with the evidence.

B.

Examine original evidence and never rely on the duplicate evidence.

C.

Never exceed the knowledge base of the forensic investigation.

D.

Prepare a chain of custody and handle the evidence carefully.

Question 47

Which of the following tools can be used for OS fingerprinting?

Options:

A.

nmap

B.

netstat

C.

DIG

D.

whois

Question 48

You work as a Network Administrator for NetTech Inc. Your manager needs to access a particular server on the network from outside the company network. You have a registered IP address assigned to a router on the company network. Which of the following will be useful for accessing the server from outside the network?

Options:

A.

Dynamic VLAN

B.

Overloading

C.

Switch

D.

Static NAT

Question 49

Distributed Checksum Clearinghouse (DCC) is a hash sharing method of spam email detection.

Which of the following protocols does the DCC use?

Options:

A.

TELNET

B.

UDP

C.

ICMP

D.

TCP

Question 50

You work as a technician for Tech Perfect Inc. You are troubleshooting an Internet name resolution issue. You ping your ISP's DNS server address and find that the server is down. You want to continuously ping the DNS address until you have stopped the command. Which of the following commands will you use?

Options:

A.

ping -a

B.

ping -l

C.

ping -n

D.

ping –t

Question 51

In which of the following locations can the Cisco IOS file reside?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

TFTP server

B.

ROM

C.

Flash memory

D.

NVRAM

Question 52

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system. Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Allocated cluster

B.

Swap files

C.

Unused and hidden partition

D.

Slack spaces

Question 53

Which of the following actions can be taken as the countermeasures against the ARP spoofing attack?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Placing static ARP entries on servers and routers

B.

Looking for large amount of ARP traffic on local subnets

C.

Using Private VLANs

D.

Using 8 digit passwords for authentication

Question 54

An organization has more than a couple of external business, and exchanges dynamic routing information with the external business partners. The organization wants to terminate all routing from a partner at an edge router, preferably receiving only summary routes from the partner. Which of the following will be used to change all partner addresses on traffic into a range of locally assigned addresses?

Options:

A.

Firewall

B.

IPsec

C.

ACL

D.

NAT

Question 55

You work as a Desktop Support Technician for umbrella Inc. The company uses a Windows-based network. An employee from the sales department is facing problem in the IP configuration of the network connection. He called you to resolve the issue. You suspect that the IP configuration is not configured properly. You want to use the ping command to ensure that IPv4 protocol is working on a computer. While running the ping command from the command prompt, you find that Windows Firewall is blocking the ping command. What is the cause of the issue?

Options:

A.

Windows Firewall blocks the command line tools.

B.

Core Networking Firewall rules do not allow ICMPv4 or ICMPv6 Echo Requests.

C.

Core Networking Firewall rules do not allow IPv4 or IPv6.

D.

Windows Firewall rules do not allow Core Networking Tools.

Question 56

Which of the following wireless security policies helps to prevent the wireless enabled laptops from peer-topeer attacks when the laptops are used in public access network?

Options:

A.

Use protocol analyzer

B.

Use firewall

C.

Use Port Address Translation

D.

Use security protocols

Question 57

A Proxy firewall, also known as Application Gateway Firewall, filters information at which of the following layers of the OSI reference model?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Transport layer

B.

Presentation layer

C.

Physical layer

D.

Application layer

Question 58

Which of the following types of Intrusion Detection Systems consists of an agent on a host that identifies intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability/acl databases) and other host activities and state?

Options:

A.

PIDS

B.

APIDS

C.

HIDS

D.

NIDS

Page: 1 / 39
Total 391 questions