GSEC Exam Study Questions And
Answers.
What are the layers of the OSI Model from top to bottom? - Answer Application,
Presentation, Session, Transport, Network, Data Link and Physical
What are the layers of the TCP/IP Model from top to bottom? - Answer Application,
Transport, Internet and Link Layer
What is the address space used for loopback addressing? - Answer 127.0.0.0 -
127.255.255.255
What is the address space used when a DHCP server is not available? - Answer
169.254.0.1 - 169.254.255.255
What are the private IP ranges? - Answer 10.0.0.0 - 10.255.255.255, 172.16.0.0 -
172.31.255.255, 192.168.0.0 - 192.168.255.255
What protocols are used in the Data Link Layer? - Answer Ethernet, Point to Point
Protocol (PPP) and ADCCP (Advanced Data Communication Control Protocol)
What protocols is utilized in the Network Layer? - Answer Internet Protocol (IP)
What protocols are utilized in the Transport Layer? - Answer UDP and TCP
What protocols are utilized on the Session Layer? - Answer NetBIOS
What types of formats are used at the presentation layer? - Answer XML and JPEG
What layer of the OSI model does encrypting and decrypting take place? - Answer
Presentation Layer
What protocols are utilized at the Application Layer? - Answer SMTP, IMAP, POP,
NTP and HTTP
What protocols are utilized inside the Link Layer? - Answer Ethernet
What layers does the Link layer correspond to in the OSI Model? - Answer Physical
and Data Link
What protocols are utilized inside the Internet layer? - Answer Internet Protocol (IP)
What protocols are utilized inside the Transport layer of the TCP/IP Model?? -
Answer TCP and UDP
What protocols are utilized within the Application Layer of the TCP/IP model? -
Answer Telnet, Simple Network Management Protocol (SNMP), HTML, LDAP, FTP,
SSH
What layers of the OSI Model comprise the TCP/IP layers Application Layer? -
Answer Session, Presentation and Application
,GSEC Exam Study Questions And
Answers.
What protocol is a support protocol within the TCP/IP Suite? - Answer Internet
Control Message Protocol (ICMP)
What range is the Class A IP Range? - Answer 0.0.0.0-127.255.255.255
What range is the Class B IP Range? - Answer 128.0.0.0-191.255.255.255
What range is the Class C IP Range? - Answer 192.0.0.0-223.255.255.255
What range is the Class D IP Range? - Answer 224.0.0.0-239.255.255.255
What range is the Class E IP Range? - Answer 240.0.0.0 - 254.255.255.255
Name some physical network topologies. - Answer Bus, Star, Rings, Star-Bus
Hybrid, Mesh
What network model uses a lot of cable because you need to use home runs back to
the switch or hub? - Answer Star
In general peer-to-peer networks are often? - Answer Mesh Networks
TOR is a peer-to-peer network that provides anonymity for its users by doing what? -
Answer Masking the original source IP address from the destination
What makes a Full Mesh topology different than a Mesh topology? - Answer A full
mesh topology does not have have nodes that are minimally connected to the rest of
the network. In a full mesh topology every node is connected to every other node
A Token Ring network topology makes use of what device to make the network
behave like a ring in spite of being labeled like a star? - Answer Multistation Access
Unit (MAU)
What device allows messages to move around on layer 2 of the OSI model? -
Answer Switch
What messages are limited to the local area network only and would never be used
to look up information outside of the local network? - Answer ARP
What "transfer mode" is utilized primarily in large-scale networks to facilitate getting
messages to destination quickly? - Answer Asynchronous Transfer Mode (ATM)
What are the two types of virtual circuits? - Answer Permanent Virtual Circuit (PVC)
and Switched Virtual Circuit (SVC)
What makes PVC's different than SVC's? - Answer Permanent Virtual Circuits
(PVC's) are permanent and need to be configure manually, while Switched Virtual
,GSEC Exam Study Questions And
Answers.
Circuits (SVC's) are dynamic in nature and a device in the network would have to
request one to be configured
How do switches make packet sniffing harder? - Answer You cannot plug into a
switch port and see all of the traffic passing through it like you can on a hub
What does the CIA triad stand for? - Answer Confidentiality, Integrity and Availability
This router is often used to do a broad level of filtering of traffic that just shouldn't be
hitting your network, like that sourced from private addresses. - Answer Border
Router
What does a router base its routing decisions off of? - Answer Destination IP
Address aka the Destination Address in the network or the layer 3 header
A first match firewall will perform the action specified based on what? - Answer The
rule that is matched first
A best match firewall will perform the action specified based on what? - Answer It will
find the best or most specific match in the rules to perform its action
What two modes does the File Transfer Protocol utilize? - Answer Active and
Passive
A firewall that does deep packet inspection is consider to be? - Answer Protocol
Aware
What are examples of Application Layer Gateways? - Answer Proxy Server or Web
Proxy
Firewalls often perform what function? - Answer Network Address Translation (NAT)
What are some protocols Network Address Translation (NAT) can cause problems
for? - Answer VoIP protocols like SIP and FTP
What is a true positive? - Answer An alert that happens that is real and accurate
What is a True negative? - Answer A case where an alert didn't get triggered
because nothing happened
What is a False Positive? - Answer A case where an alert happens that isn't real or
accurate
What is a False Negative? - Answer A case where an alert didn't happen but an
intrusion did happen
IDS's cannot detect any malicious behavior on encrypted traffic without sitting in the
middle of what? - Answer Encryption Session
, GSEC Exam Study Questions And
Answers.
What can cause problems for intrusion detection systems (IDS)? - Answer
Compression and Encryption
You are implementing a star topology on your local network. What cabling are you
most likely to use? - Answer Fiber Optic
When you are deploying an intrusion prevention system on your network, what is the
most important criterion? - Answer Low Latency
Your IDS sends an alert about an incident on your network. The alert indicated that
there was a packet that had the same source and destination. This might normally
indicate an attempt at a Land attack, which is a very old attack. After investigating,
you see that the source address is 0.0.0.0 and the destination is 224.0.0.1. What
would you consider this alert to be? - Answer False Positive
You have been asked to implement a security solution on your network to protect
against employees browsing facebook during the work day. What would you
implement? - Answer Proxy Server
You are seeing a lot of ARP responses with no corresponding ARP request. What
are you most likely seeing? - Answer ARP Spoofing
You would implement an intrusion detection system to perform the following: -
Answer Detect Intrusions
A border router would implement the following security control? - Answer Access
control lists to block broad categories of traffic
This type of routing protocol uses the same algorithm as the navigation system in
your car. - Answer Distance vector
A good example of a network using a mesh topology is? - Answer The internet
These can be challenges for intrusion detection systems? - Answer Compression
and Encryption
Authentication is the act of? - Answer Proving you are who you say you are
Lowering the false acceptance rate is a critical aspect of maintaining what form of
authentication? - Answer Biometric systems
RADIUS is a way of performing? - Answer Authentication across a network with a
centralized approach
RADIUS uses what protocol to send authentication requests and responses between
the client and the server? - Answer UDP
Answers.
What are the layers of the OSI Model from top to bottom? - Answer Application,
Presentation, Session, Transport, Network, Data Link and Physical
What are the layers of the TCP/IP Model from top to bottom? - Answer Application,
Transport, Internet and Link Layer
What is the address space used for loopback addressing? - Answer 127.0.0.0 -
127.255.255.255
What is the address space used when a DHCP server is not available? - Answer
169.254.0.1 - 169.254.255.255
What are the private IP ranges? - Answer 10.0.0.0 - 10.255.255.255, 172.16.0.0 -
172.31.255.255, 192.168.0.0 - 192.168.255.255
What protocols are used in the Data Link Layer? - Answer Ethernet, Point to Point
Protocol (PPP) and ADCCP (Advanced Data Communication Control Protocol)
What protocols is utilized in the Network Layer? - Answer Internet Protocol (IP)
What protocols are utilized in the Transport Layer? - Answer UDP and TCP
What protocols are utilized on the Session Layer? - Answer NetBIOS
What types of formats are used at the presentation layer? - Answer XML and JPEG
What layer of the OSI model does encrypting and decrypting take place? - Answer
Presentation Layer
What protocols are utilized at the Application Layer? - Answer SMTP, IMAP, POP,
NTP and HTTP
What protocols are utilized inside the Link Layer? - Answer Ethernet
What layers does the Link layer correspond to in the OSI Model? - Answer Physical
and Data Link
What protocols are utilized inside the Internet layer? - Answer Internet Protocol (IP)
What protocols are utilized inside the Transport layer of the TCP/IP Model?? -
Answer TCP and UDP
What protocols are utilized within the Application Layer of the TCP/IP model? -
Answer Telnet, Simple Network Management Protocol (SNMP), HTML, LDAP, FTP,
SSH
What layers of the OSI Model comprise the TCP/IP layers Application Layer? -
Answer Session, Presentation and Application
,GSEC Exam Study Questions And
Answers.
What protocol is a support protocol within the TCP/IP Suite? - Answer Internet
Control Message Protocol (ICMP)
What range is the Class A IP Range? - Answer 0.0.0.0-127.255.255.255
What range is the Class B IP Range? - Answer 128.0.0.0-191.255.255.255
What range is the Class C IP Range? - Answer 192.0.0.0-223.255.255.255
What range is the Class D IP Range? - Answer 224.0.0.0-239.255.255.255
What range is the Class E IP Range? - Answer 240.0.0.0 - 254.255.255.255
Name some physical network topologies. - Answer Bus, Star, Rings, Star-Bus
Hybrid, Mesh
What network model uses a lot of cable because you need to use home runs back to
the switch or hub? - Answer Star
In general peer-to-peer networks are often? - Answer Mesh Networks
TOR is a peer-to-peer network that provides anonymity for its users by doing what? -
Answer Masking the original source IP address from the destination
What makes a Full Mesh topology different than a Mesh topology? - Answer A full
mesh topology does not have have nodes that are minimally connected to the rest of
the network. In a full mesh topology every node is connected to every other node
A Token Ring network topology makes use of what device to make the network
behave like a ring in spite of being labeled like a star? - Answer Multistation Access
Unit (MAU)
What device allows messages to move around on layer 2 of the OSI model? -
Answer Switch
What messages are limited to the local area network only and would never be used
to look up information outside of the local network? - Answer ARP
What "transfer mode" is utilized primarily in large-scale networks to facilitate getting
messages to destination quickly? - Answer Asynchronous Transfer Mode (ATM)
What are the two types of virtual circuits? - Answer Permanent Virtual Circuit (PVC)
and Switched Virtual Circuit (SVC)
What makes PVC's different than SVC's? - Answer Permanent Virtual Circuits
(PVC's) are permanent and need to be configure manually, while Switched Virtual
,GSEC Exam Study Questions And
Answers.
Circuits (SVC's) are dynamic in nature and a device in the network would have to
request one to be configured
How do switches make packet sniffing harder? - Answer You cannot plug into a
switch port and see all of the traffic passing through it like you can on a hub
What does the CIA triad stand for? - Answer Confidentiality, Integrity and Availability
This router is often used to do a broad level of filtering of traffic that just shouldn't be
hitting your network, like that sourced from private addresses. - Answer Border
Router
What does a router base its routing decisions off of? - Answer Destination IP
Address aka the Destination Address in the network or the layer 3 header
A first match firewall will perform the action specified based on what? - Answer The
rule that is matched first
A best match firewall will perform the action specified based on what? - Answer It will
find the best or most specific match in the rules to perform its action
What two modes does the File Transfer Protocol utilize? - Answer Active and
Passive
A firewall that does deep packet inspection is consider to be? - Answer Protocol
Aware
What are examples of Application Layer Gateways? - Answer Proxy Server or Web
Proxy
Firewalls often perform what function? - Answer Network Address Translation (NAT)
What are some protocols Network Address Translation (NAT) can cause problems
for? - Answer VoIP protocols like SIP and FTP
What is a true positive? - Answer An alert that happens that is real and accurate
What is a True negative? - Answer A case where an alert didn't get triggered
because nothing happened
What is a False Positive? - Answer A case where an alert happens that isn't real or
accurate
What is a False Negative? - Answer A case where an alert didn't happen but an
intrusion did happen
IDS's cannot detect any malicious behavior on encrypted traffic without sitting in the
middle of what? - Answer Encryption Session
, GSEC Exam Study Questions And
Answers.
What can cause problems for intrusion detection systems (IDS)? - Answer
Compression and Encryption
You are implementing a star topology on your local network. What cabling are you
most likely to use? - Answer Fiber Optic
When you are deploying an intrusion prevention system on your network, what is the
most important criterion? - Answer Low Latency
Your IDS sends an alert about an incident on your network. The alert indicated that
there was a packet that had the same source and destination. This might normally
indicate an attempt at a Land attack, which is a very old attack. After investigating,
you see that the source address is 0.0.0.0 and the destination is 224.0.0.1. What
would you consider this alert to be? - Answer False Positive
You have been asked to implement a security solution on your network to protect
against employees browsing facebook during the work day. What would you
implement? - Answer Proxy Server
You are seeing a lot of ARP responses with no corresponding ARP request. What
are you most likely seeing? - Answer ARP Spoofing
You would implement an intrusion detection system to perform the following: -
Answer Detect Intrusions
A border router would implement the following security control? - Answer Access
control lists to block broad categories of traffic
This type of routing protocol uses the same algorithm as the navigation system in
your car. - Answer Distance vector
A good example of a network using a mesh topology is? - Answer The internet
These can be challenges for intrusion detection systems? - Answer Compression
and Encryption
Authentication is the act of? - Answer Proving you are who you say you are
Lowering the false acceptance rate is a critical aspect of maintaining what form of
authentication? - Answer Biometric systems
RADIUS is a way of performing? - Answer Authentication across a network with a
centralized approach
RADIUS uses what protocol to send authentication requests and responses between
the client and the server? - Answer UDP
