SANS GICSP
COMPLETE QUESTION SET WITH VERIFIED
SOLUTIONS GRADED A+
Question 1.
Heirarchical Storage Management (HSM)
ANSWER
Manages the storage and recovery of files, which are copied to storage media devices that vary
in speed and cost. The faster media holds the data that is accessed more often and seldom
used files are stored on slower devices.
Question 2.
Bluetooth (1998)
ANSWER
- No line of sight requirement
- Supports data, voice, content-centric applications with Bluetooth Profiles
- Up to 7 simultaneous connections
Question 3.
Zone Characteristics
ANSWER
- Security policies
- Asset Inventory (Physical, Logical, S/W, data)
- Access Requirements and Controls
- Threats & Vulnerabilities
- Consequences of Security Breach
- Authorized Technology
- Change Management Process
,Question 4.
Crypto - MD5 Weakness
ANSWER
MD5 weak but there is little opportunity for an attacker to generate a matching MD5 has for an
arbitrary file; however, if an attacker can influence the initial file content (M) then it is possible
for them to create a second file (M') that will produce an identical MD5 hash. (Day 4, Page 181)
Question 5.
Crypto - Stream Cipher
ANSWER
- Encrypts one bit of data at a time
- Plaintext length = Ciphertext length (minus headers and checksum)
- RC4 is most common (also A5/1, E0)
- Very fast, becommin less popular due to management overhead and security concerns
Question 6.
IPSec - What is Security Association (SA) in IPSec
ANSWER
A one-way connection. You need a minimum of two for two-way communications. (Dummies)
Question 7.
RF Mesh/Microwave/ISM Band
ANSWER
- Don't expect security at PHY/MAC layer
- PHY/MAC security not often included with proprietery wireless comms
- Give preference to solutions that leverage encryption and authentication in upper layer
protocols.
- Frequency hopping and licensed RF bands should NOT be considered security defenses
,Question 8.
Means of sanitizing media
ANSWER
- Overwrite (Orange Book = formatted 7 times before discard or reuse) (Krutz)
- Degaussing
- Destruction / Shredding
Question 9.
900 mHz (33 cm band)
ANSWER
- UHF Radio Spectrum
- 902 MHz to 928 MHz
- Unique to ITU Region 2 (Americas, Greenland, Pacific Islands)
- One of newest radio bands
- Propagation dependent upon line of sight (put repeaters on top of large hills)
- Excellent building penetration (small wavelength)
Question 10.
Configuration Item (CI)
ANSWER
An aggregation of Information System components that is designated for configuration
management and treated as a single entity in the configuration management process.
Question 11.
Crypto - HMAC Hashing
ANSWER
Transmitter creates a hash with the assistance of a secret value known to the transmitter and
the recipient. Attacker does not know secret so they cannot create a valid hash. (Defense
against MITM attack)
Any hashing function can also be used as an HMAC hash. (Day 4, Page 180)
, Question 12.
IPSec - Protocols Used
ANSWER
- Authentication Header (AH) - Provides integrity, authentication and non-repudiation
- Encapsulating Security Protocol (ESP) - Provides confidentiality/encryption and limited
authentication
Question 13.
SIEM - Security Information and Event Management System
ANSWER
Used for centralized logging from various systems and devices on a network (e.g., Syslog from
Linux)
Question 14.
OPC-Aware Firewalls
ANSWER
- Use deep packet inspection
- Validates OPC connection request message
- Momentarily opens TCP Port specified by sender
COMPLETE QUESTION SET WITH VERIFIED
SOLUTIONS GRADED A+
Question 1.
Heirarchical Storage Management (HSM)
ANSWER
Manages the storage and recovery of files, which are copied to storage media devices that vary
in speed and cost. The faster media holds the data that is accessed more often and seldom
used files are stored on slower devices.
Question 2.
Bluetooth (1998)
ANSWER
- No line of sight requirement
- Supports data, voice, content-centric applications with Bluetooth Profiles
- Up to 7 simultaneous connections
Question 3.
Zone Characteristics
ANSWER
- Security policies
- Asset Inventory (Physical, Logical, S/W, data)
- Access Requirements and Controls
- Threats & Vulnerabilities
- Consequences of Security Breach
- Authorized Technology
- Change Management Process
,Question 4.
Crypto - MD5 Weakness
ANSWER
MD5 weak but there is little opportunity for an attacker to generate a matching MD5 has for an
arbitrary file; however, if an attacker can influence the initial file content (M) then it is possible
for them to create a second file (M') that will produce an identical MD5 hash. (Day 4, Page 181)
Question 5.
Crypto - Stream Cipher
ANSWER
- Encrypts one bit of data at a time
- Plaintext length = Ciphertext length (minus headers and checksum)
- RC4 is most common (also A5/1, E0)
- Very fast, becommin less popular due to management overhead and security concerns
Question 6.
IPSec - What is Security Association (SA) in IPSec
ANSWER
A one-way connection. You need a minimum of two for two-way communications. (Dummies)
Question 7.
RF Mesh/Microwave/ISM Band
ANSWER
- Don't expect security at PHY/MAC layer
- PHY/MAC security not often included with proprietery wireless comms
- Give preference to solutions that leverage encryption and authentication in upper layer
protocols.
- Frequency hopping and licensed RF bands should NOT be considered security defenses
,Question 8.
Means of sanitizing media
ANSWER
- Overwrite (Orange Book = formatted 7 times before discard or reuse) (Krutz)
- Degaussing
- Destruction / Shredding
Question 9.
900 mHz (33 cm band)
ANSWER
- UHF Radio Spectrum
- 902 MHz to 928 MHz
- Unique to ITU Region 2 (Americas, Greenland, Pacific Islands)
- One of newest radio bands
- Propagation dependent upon line of sight (put repeaters on top of large hills)
- Excellent building penetration (small wavelength)
Question 10.
Configuration Item (CI)
ANSWER
An aggregation of Information System components that is designated for configuration
management and treated as a single entity in the configuration management process.
Question 11.
Crypto - HMAC Hashing
ANSWER
Transmitter creates a hash with the assistance of a secret value known to the transmitter and
the recipient. Attacker does not know secret so they cannot create a valid hash. (Defense
against MITM attack)
Any hashing function can also be used as an HMAC hash. (Day 4, Page 180)
, Question 12.
IPSec - Protocols Used
ANSWER
- Authentication Header (AH) - Provides integrity, authentication and non-repudiation
- Encapsulating Security Protocol (ESP) - Provides confidentiality/encryption and limited
authentication
Question 13.
SIEM - Security Information and Event Management System
ANSWER
Used for centralized logging from various systems and devices on a network (e.g., Syslog from
Linux)
Question 14.
OPC-Aware Firewalls
ANSWER
- Use deep packet inspection
- Validates OPC connection request message
- Momentarily opens TCP Port specified by sender
