GSEC GIAC Security Essentials Question and
answer latest update
What class is the address 170.19.82.45?
B
In the address ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, what does the /23 indicate?
The number of bits in the network portion of the address
How many bits are in the NETWORK portion of the following address block:
Address: 10.1.0.0
Subnet: 255.255.255.224
27
Question 4
What can you say about the following packet capture?
14:18:25.906002 apollo.it.luc.edu.1000 > x-terminal.shell: S
1382726990:1382726990(0) win 4096
14:18:26.094731 x-terminal.shell > apollo.it.luc.edu.1000: S
2021824000:2021824000(0) ack 1382726991 win 4096
14:18:26.172394 apollo.it.luc.edu.1000 > x-terminal.shell: R
1382726991:1382726991(0) win 0
14:18:26.507560 apollo.it.luc.edu.999 > x-terminal.shell: S
1382726991:1382726991(0) win 4096
14:18:26.694691 x-terminal.shell > apollo.it.luc.edu.999: S
2021952000:2021952000(0) ack 1382726992 win 4096
14:18:26.775037 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:26.775395 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:27.174846 x-terminal.shell > apollo.it.luc.edu.998: S
2022080000:2022080000(0) ack 1382726993 win 4096
This is a sequence number prediction attack.
In the network 192.168.5.0/23, what would be the broadcast address?
192.168.5.255
If you see the IP address fe80::0050:8790:4554:2300/16, the :: indicates what?
There are 0s between the ::.
With the following IP header, what is the destination IP address:
45 00 03 3D 1E EB 40 00 40 06 5D E8 C0 A8 01 16 AD C2 4B 67
173.194.75.103
What is the order of messages in a three-way handshake?
SYN, SYN/ACK, ACK
Which utility makes use of ICMP to function?
traceroute
, Which of the following is a private address (RFC1918)?
10.45.60.10
When you are deploying an intrusion prevention system on your network, what
is the most important criterion?
It has a low latency
A good example of a network using a mesh topology is:
The Internet
A border router would implement the following security control:
Access control lists to block broad categories of traffic.
You are implementing a star topology on your local network. What cabling are you most likely to use?
Twisted pair
Your IDS sends an alert about an incident on your network. The alert indicated that there was a
packet that had the same source and destination. This might normally indicate an attempt at a Land
attack, which is a very old attack. After investigating, you see that the source address is 0.0.0.0 and
the destination is 224.0.0.1. What would you consider this alert to be?
A false positive
These can be big challenges for intrusion detection systems.
Compression and encryption
This type of routing protocol uses the same algorithm as the navigation system in your car.
Link-state
You would implement an intrusion detection system to perform the following:
Detect intrusions.
You are seeing a lot of ARP responses with no corresponding ARP request. What are you most likely
seeing?
ARP spoofing
You have been asked to implement a security solution on your network to protect against employees
browsing Facebook during the work day. What would you implement?
A proxy server
What is the principle of least privilege implemented in?
The sudo utility
Authentication is the process of doing what?
answer latest update
What class is the address 170.19.82.45?
B
In the address ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, what does the /23 indicate?
The number of bits in the network portion of the address
How many bits are in the NETWORK portion of the following address block:
Address: 10.1.0.0
Subnet: 255.255.255.224
27
Question 4
What can you say about the following packet capture?
14:18:25.906002 apollo.it.luc.edu.1000 > x-terminal.shell: S
1382726990:1382726990(0) win 4096
14:18:26.094731 x-terminal.shell > apollo.it.luc.edu.1000: S
2021824000:2021824000(0) ack 1382726991 win 4096
14:18:26.172394 apollo.it.luc.edu.1000 > x-terminal.shell: R
1382726991:1382726991(0) win 0
14:18:26.507560 apollo.it.luc.edu.999 > x-terminal.shell: S
1382726991:1382726991(0) win 4096
14:18:26.694691 x-terminal.shell > apollo.it.luc.edu.999: S
2021952000:2021952000(0) ack 1382726992 win 4096
14:18:26.775037 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:26.775395 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:27.174846 x-terminal.shell > apollo.it.luc.edu.998: S
2022080000:2022080000(0) ack 1382726993 win 4096
This is a sequence number prediction attack.
In the network 192.168.5.0/23, what would be the broadcast address?
192.168.5.255
If you see the IP address fe80::0050:8790:4554:2300/16, the :: indicates what?
There are 0s between the ::.
With the following IP header, what is the destination IP address:
45 00 03 3D 1E EB 40 00 40 06 5D E8 C0 A8 01 16 AD C2 4B 67
173.194.75.103
What is the order of messages in a three-way handshake?
SYN, SYN/ACK, ACK
Which utility makes use of ICMP to function?
traceroute
, Which of the following is a private address (RFC1918)?
10.45.60.10
When you are deploying an intrusion prevention system on your network, what
is the most important criterion?
It has a low latency
A good example of a network using a mesh topology is:
The Internet
A border router would implement the following security control:
Access control lists to block broad categories of traffic.
You are implementing a star topology on your local network. What cabling are you most likely to use?
Twisted pair
Your IDS sends an alert about an incident on your network. The alert indicated that there was a
packet that had the same source and destination. This might normally indicate an attempt at a Land
attack, which is a very old attack. After investigating, you see that the source address is 0.0.0.0 and
the destination is 224.0.0.1. What would you consider this alert to be?
A false positive
These can be big challenges for intrusion detection systems.
Compression and encryption
This type of routing protocol uses the same algorithm as the navigation system in your car.
Link-state
You would implement an intrusion detection system to perform the following:
Detect intrusions.
You are seeing a lot of ARP responses with no corresponding ARP request. What are you most likely
seeing?
ARP spoofing
You have been asked to implement a security solution on your network to protect against employees
browsing Facebook during the work day. What would you implement?
A proxy server
What is the principle of least privilege implemented in?
The sudo utility
Authentication is the process of doing what?
