Weekend Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

GIAC GPPA GIAC Certified Perimeter Protection Analyst Exam Practice Test

Page: 1 / 29
Total 285 questions

GIAC Certified Perimeter Protection Analyst Questions and Answers

Question 1

Jain works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.abc.com.

He has successfully completed the following steps of the preattack phase:

>> Information gathering

>> Determining network range

>> Identifying active machines

>> Finding open ports and applications

>> OS fingerprinting

>> Fingerprinting services

Now Jain wants to perform network mapping of the ABC network.

Which of the following tools can he use to accomplish his task?

Each correct answer represents a complete solution. (Choose all that apply.)

Options:

A.

Traceroute

B.

Cheops

C.

NeoTrace

D.

Ettercap

Question 2

Which of the following has a set of system-independent functions for packet capture and network analysis?

Options:

A.

WinDump

B.

WinPcap

C.

libpcap

D.

tcpdump

Question 3

Which of the following fields are specified when rules are created for the Network Honeypot rulebase?

Each correct answer represents a complete solution. (Choose all that apply.)

Options:

A.

A destination/service match condition

B.

Detection settings

C.

Response options

D.

Operation mode

Question 4

You run the tcpdump command line utility and get a report produced by tcpdump.

What information does this report include?

Each correct answer represents a complete solution. (Choose three.)

Options:

A.

Packets captured

B.

Packets dropped by kernel

C.

Packets discarded

D.

Packets received by filter

Question 5

When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as __________.

Options:

A.

True positive

B.

False negative

C.

False positive

D.

True negative

Question 6

Which of the following proxy servers is placed anonymously between the client and remote server and handles all of the traffic from the client?

Options:

A.

Web proxy server

B.

Forced proxy server

C.

Open proxy server

D.

Caching proxy server

Question 7

Which of the following protocols does IPsec use to perform various security functions in the network?

Each correct answer represents a complete solution. (Choose all that apply.)

Options:

A.

Internet Key Exchange

B.

Authentication Header

C.

Encapsulating Security Payload

D.

Skinny Client Control Protocol

Question 8

Which of the following IPv6 address types is a single address that can be assigned to multiple interfaces?

Options:

A.

Multicast

B.

Anycast

C.

Unicast

D.

Loopback

Question 9

Which of the following modules registers DNAT-based and SNAT-based transformations?

Options:

A.

iptable_raw

B.

iptable_nat

C.

iptable_mangle

D.

iptable_filter

Question 10

Which of the following can provide security against man-in-the-middle attack?

Options:

A.

Anti-virus programs

B.

Strong data encryption during travel

C.

Strong authentication method

D.

Firewall

Question 11

Which of the following ports cannot be used to access the router from a computer?

Options:

A.

Console port

B.

Vty

C.

Aux port

D.

Serial port

Question 12

Which of the following are open-source vulnerability scanners? (Choose three.)

Options:

A.

Nessus

B.

Hackbot

C.

Nikto

D.

NetRecon

Question 13

Which of the following is used as a default port by the TELNET utility?

Options:

A.

21

B.

80

C.

20

D.

23

Question 14

The general form of the Cisco IOS is a.b.c.de.

Which of the following indicates the major version number of the Cisco IOS?

Options:

A.

b

B.

a

C.

e

D.

d

Question 15

You work as a Network Administrator for ABC Inc. The company has a TCP/IP-based network. A Cisco switch is configured on the network. You change the original host name of the switch through the hostname command. The prompt displays the changed host name. After some time, power of the switch went off due to some reason. When power restored, you find that the prompt is displaying the old host name.

What is the most likely cause?

Options:

A.

The running-config file got corrupted.

B.

The changes were saved in running-config file.

C.

The startup-config file got corrupted.

D.

Host name cannot be changed permanently once switch is configured.

Question 16

Which of the following hexadecimal values in the boot field in the configuration register loads the first IOS file found in Flash memory?

Options:

A.

2

B.

0

C.

1

D.

F

Question 17

Which of the following is a Windows-based tool used for packet analysis?

Options:

A.

AirPcap

B.

WinPcap

C.

Tcpdump

D.

WinDump

Question 18

Which of the following devices is used to identify out-of-date software versions, applicable patches, system upgrades, etc?

Options:

A.

Retinal scanner

B.

Vulnerability scanner

C.

Fingerprint reader

D.

Smart card reader

Question 19

On which of the following interfaces of the router is the clock rate command used?

Options:

A.

DCE

B.

ETHERNET

C.

DTE

D.

VIRTUAL LINE VTY

Question 20

In which of the following steps of firewall log analysis process is aggregation for nodes defined?

Options:

A.

Assess available data

B.

Visual transformation

C.

View transformation

D.

Process information

Question 21

Which of the following types of IP actions are supported by an IDP rulebase? (Choose three.)

Options:

A.

Initiate rules of the rulebase

B.

Notify

C.

Drop/block session

D.

Close connection

Question 22

Which of the following tools can be used for OS fingerprinting?

Options:

A.

whois

B.

DIG

C.

netstat

D.

nmap

Question 23

Which of the following wireless security policies helps to prevent the wireless enabled laptops from peer-to-peer attacks when the laptops are used in public access network? (Choose two.)

Options:

A.

Use protocol analyzer

B.

Use security protocols

C.

Use firewall

D.

Use Port Address Translation

Question 24

Andrew works as a Forensic Investigator for PassGuide Inc. The company has a Windows-based environment. The company's employees use Microsoft Outlook Express as their e-mail client program. E-mails of some employees have been deleted due to a virus attack on the network. Andrew is therefore assigned the task to recover the deleted mails.

Which of the following tools can Andrew use to accomplish the task?

Each correct answer represents a complete solution. (Choose two.)

Options:

A.

FINALeMAIL

B.

EventCombMT

C.

R-mail

D.

eMailTrackerPro

Question 25

You are a professional Computer Hacking forensic investigator. You have been called to collect the evidences of Buffer Overflows or Cookie snooping attack.

Which of the following logs will you review to accomplish the task?

Each correct answer represents a complete solution. (Choose all that apply.)

Options:

A.

Event logs

B.

System logs

C.

Web server logs

D.

Program logs

Question 26

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint.

Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Options:

A.

nmap -O -p

B.

nmap -sS

C.

nmap -sU -p

D.

nmap -sT

Question 27

Which of the following is a Cisco IOS management term described in the statement below?

"It is the fourth digit in the configuration register and contains a hexadecimal value. The bootstrap program uses its value to choose which operating system to load into RAM".

Options:

A.

Boot value

B.

Boot field

C.

Boot

D.

Boot check

Question 28

Which of the following parts of IP header is used to specify the correct place of the fragment in the original un-fragmented datagram?

Options:

A.

Fragment offset

B.

TTL

C.

Source address

D.

Fragment ID

Question 29

Fill in the blank with the appropriate utility.

________ is a table-based system or structure that defines the rulesets needed to transform or filter network packets.

Options:

A.

Port Address Translation (PAT)

B.

Magic Lantern

C.

Static NAT

D.

iptables

Question 30

You work as a Network Administrator for ABC Inc. The company has a wireless LAN infrastructure. The management wants to prevent unauthorized network access to local area networks and other information assets by the wireless devices.

What will you do?

Options:

A.

Implement a WIPS.

B.

Implement a dynamic NAT.

C.

Implement a firewall.

D.

Implement an ACL.

Question 31

You work as a Network Administrator for NetTech Inc. You want to prevent your network from Ping flood attacks.

Which of the following protocols will you block to accomplish this task?

Options:

A.

IP

B.

FTP

C.

PPP

D.

ICMP

Question 32

Jain works as a contract Ethical Hacker. He has recently got a project to do security checking for www.abc.com. He wants to find out the operating system of the ABC server in the information gathering step.

Which of the following commands will he use to accomplish the task?

Each correct answer represents a complete solution. (Choose two.)

Options:

A.

nc -v -n 208.100.2.25 80

B.

nmap -v -O www.abc.com

C.

nmap -v -O 208.100.2.25

D.

nc 208.100.2.25 23

Question 33

Which of the following steps are generally followed in computer forensic examinations?

Each correct answer represents a complete solution. (Choose three.)

Options:

A.

Analyze

B.

Acquire

C.

Authenticate

D.

Encrypt

Question 34

Which of the following firewalls filters the traffic based on the header of the datagram?

Options:

A.

Circuit-level firewall

B.

Application-level firewall

C.

Packet filtering firewall

D.

Stateful inspection firewall

Question 35

You work as a Network Administrator for ABC Inc. The company has a corporate intranet setup. A router is configured on your network to connect outside hosts to the internetworking. For security, you want to prevent outside hosts from pinging to the hosts on the internetwork.

Which of the following steps will you take to accomplish the task?

Options:

A.

Block the UDP protocol through ACL.

B.

Block the IPv6 protocol through ACL.

C.

Block the TCP protocol through ACL.

D.

Block the ICMP protocol through ACL.

Question 36

You work as a Network Architect for ABC Inc. The company has a TCP/IP based network. You have established a remote-access VPN network between mobile users and the company's network. You want to implement the following features in the remote-access VPN network:

>> Provide security for the web traffic.

>> Browser clients can support the VPN connection to a host.

Which of the following will you configure to implement the given features in the network?

Options:

A.

DACL

B.

SSL

C.

SSH

D.

IPsec

Question 37

Which of the following tools is used to detect spam email without checking the content?

Options:

A.

DCC

B.

Sniffer

C.

EtherApe

D.

Kismet

Question 38

You are the Network Administrator and your company has recently implemented encryption for all emails. You want to check to make sure that the email packages are being encrypted.

What tool would you use to accomplish this?

Options:

A.

Password cracker

B.

Performance Monitor

C.

Packet sniffer

D.

Vulnerability analyzer

Question 39

You work as a Network Administrator for NetTech Inc. Your manager needs to access a particular server on the network from outside the company network. You have a registered IP address assigned to a router on the company network.

Which of the following will be useful for accessing the server from outside the network?

Options:

A.

Overloading

B.

Switch

C.

Static NAT

D.

Dynamic VLAN

Question 40

Sam works as a Security Manager for ABC Inc. The company has a Windows-based network. Sam wants to prevent specific traffic from IDP processing in order to reduce false positives.

Which of the following rulebases will he use to accomplish the task?

Options:

A.

Network Honeypot rulebase

B.

Backdoor rulebase

C.

SYN Protector rulebase

D.

Exempt rulebase

Question 41

Which of the following is an attack with IP fragments that cannot be reassembled?

Options:

A.

Password guessing attack

B.

Smurf attack

C.

Teardrop attack

D.

Dictionary attack

Question 42

Which of the following TShark options is used to set capture buffer size in MB?

Options:

A.

-F

B.

-B

C.

-G

D.

-C

Page: 1 / 29
Total 285 questions