GSEC Exam Questions with Verified Correct
Answers
conceptual design
high level design that includes core components of network architecture | 'black box' I/O |
legal, environmental safety | customer experience | multidisciplinary
logical design
depicts how data flows across different devices in network | detailed, rather than abstract
network diagram | services, application names | for developers and security architects | shows
servers workstations routers firewalls...
physical design
last before implementation | all known details | physical components and connections | OS
versions
communications flow
dictated by logical design, shows how data flows in and out of the network | informs threat
model; attack surface and vectors; estimate impact; determines defense
intellectual property (IP)
dictated by logical architecture | key is reduce number or locations where present; subject to
copyright
router
device that connects different networks together internal and external | forwards data packets
between computer networks | operates at OSI L3, handles packets
switch
,networking device that connects computers together to form physical and virtual networks |
handles frames at OSI L2
Kismet
Linux WLAN sniffer completely passive used for vulnerability assessment and intrusion
detection
threat enumeration
list threat agents | list attack methods | list system-level objectives
threat agents (3)
human or not | organized crime | espionage | hactivist
Advanced Persistent Threat (APT)
An organized group of attackers who are highly motivated, skilled, and patient. They are
often sponsored by a government, are focused on a specific target, and will continue attacking
for a very long time until they achieve their goal.
DoS
An availability attack, to consume resources to the point of exhaustion; Denial of Service;
flood of ICMP requests targets router takes down server
DDoS
Denial of service attack committed using many computers, usually zombies on a botnet.
packet sniffing
capture network traffic for analysis | no longer requires physical access to network due to
prevalence of wifi
,packet misroute
malware on router sends traffic to evil location or causes routing loops DoS or network
congestion
XSS
Cross-site scripting. Attacker redirects users to malicious websites, steal cookies. E-mail can
include an embedded HTML image object or a JavaScript image tag as part of a malicious
cross-site scripting attack. Prevent with input validation.
CSRF
Cross-Site Request Forgery--Third-party redirect of static content within the security context
of a trusted site.
SYN flood
A type of DoS where an attacker sends a large amount of SYN request packets to a server in
an attempt to deny service.
TCP reset
attacker sniffs target traffic the spoofs packet with RST flag set to end session
routing table poisoning
routers exchange data to build tables; attacker injects bad data
CDP
Cisco Discovery Protocol; transmits in the clear; manipulation attack; disable this protocol
MAC flood
, An attack that sends numerous packets to the switch, each of which has a different source
MAC address, in an attempt to use up the memory on the switch and switch can downgrade
to hub
DHCP spoofing attack
MitM attack listens for DHCP traffic then sends attacker IP address as default gateway
STP
Spanning Tree Protocol. Protocol enabled on most switches that protects against switching
loops. A switching loop can be caused if two ports of a switch are connected together, such as
those caused when two ports of a switch are connected together.
VLAN hop
spoof 802.1Q tags, attacker can frames to diff VLAN w/o router
physical topology
how a network is wired together; includes wifi
ethernet
a system for connecting a number of computer systems to form a local area network, with
protocols to control the passing of information and to avoid simultaneous transmission by
two or more systems.
full duplex
simultaneous send / receive for two nodes; Any device that can send and receive data
simultaneously.
CSMA / CD
Answers
conceptual design
high level design that includes core components of network architecture | 'black box' I/O |
legal, environmental safety | customer experience | multidisciplinary
logical design
depicts how data flows across different devices in network | detailed, rather than abstract
network diagram | services, application names | for developers and security architects | shows
servers workstations routers firewalls...
physical design
last before implementation | all known details | physical components and connections | OS
versions
communications flow
dictated by logical design, shows how data flows in and out of the network | informs threat
model; attack surface and vectors; estimate impact; determines defense
intellectual property (IP)
dictated by logical architecture | key is reduce number or locations where present; subject to
copyright
router
device that connects different networks together internal and external | forwards data packets
between computer networks | operates at OSI L3, handles packets
switch
,networking device that connects computers together to form physical and virtual networks |
handles frames at OSI L2
Kismet
Linux WLAN sniffer completely passive used for vulnerability assessment and intrusion
detection
threat enumeration
list threat agents | list attack methods | list system-level objectives
threat agents (3)
human or not | organized crime | espionage | hactivist
Advanced Persistent Threat (APT)
An organized group of attackers who are highly motivated, skilled, and patient. They are
often sponsored by a government, are focused on a specific target, and will continue attacking
for a very long time until they achieve their goal.
DoS
An availability attack, to consume resources to the point of exhaustion; Denial of Service;
flood of ICMP requests targets router takes down server
DDoS
Denial of service attack committed using many computers, usually zombies on a botnet.
packet sniffing
capture network traffic for analysis | no longer requires physical access to network due to
prevalence of wifi
,packet misroute
malware on router sends traffic to evil location or causes routing loops DoS or network
congestion
XSS
Cross-site scripting. Attacker redirects users to malicious websites, steal cookies. E-mail can
include an embedded HTML image object or a JavaScript image tag as part of a malicious
cross-site scripting attack. Prevent with input validation.
CSRF
Cross-Site Request Forgery--Third-party redirect of static content within the security context
of a trusted site.
SYN flood
A type of DoS where an attacker sends a large amount of SYN request packets to a server in
an attempt to deny service.
TCP reset
attacker sniffs target traffic the spoofs packet with RST flag set to end session
routing table poisoning
routers exchange data to build tables; attacker injects bad data
CDP
Cisco Discovery Protocol; transmits in the clear; manipulation attack; disable this protocol
MAC flood
, An attack that sends numerous packets to the switch, each of which has a different source
MAC address, in an attempt to use up the memory on the switch and switch can downgrade
to hub
DHCP spoofing attack
MitM attack listens for DHCP traffic then sends attacker IP address as default gateway
STP
Spanning Tree Protocol. Protocol enabled on most switches that protects against switching
loops. A switching loop can be caused if two ports of a switch are connected together, such as
those caused when two ports of a switch are connected together.
VLAN hop
spoof 802.1Q tags, attacker can frames to diff VLAN w/o router
physical topology
how a network is wired together; includes wifi
ethernet
a system for connecting a number of computer systems to form a local area network, with
protocols to control the passing of information and to avoid simultaneous transmission by
two or more systems.
full duplex
simultaneous send / receive for two nodes; Any device that can send and receive data
simultaneously.
CSMA / CD
