GSEC GIAC Security Essentials
\What class is the address 170.19.82.45? - answerB
In the address ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, what does the /23
indicate? - answerThe number of bits in the network portion of the address
How many bits are in the NETWORK portion of the following address block:
Address: 10.1.0.0
Subnet: 255.255.255.224 - answer27
Question 4
What can you say about the following packet capture?
14:18:25.906002 apollo.it.luc.edu.1000 > x-terminal. Shell: S
1382726990:1382726990(0) win 4096
14:18:26.094731 x-terminal.shell > apollo.it.luc.edu.1000: S
2021824000:2021824000(0) ack 1382726991 win 4096
14:18:26.172394 apollo.it.luc.edu.1000 > x-terminal.shell: R
1382726991:1382726991(0) win 0
14:18:26.507560 apollo.it.luc.edu.999 > x-terminal.shell: S
1382726991:1382726991(0) win 4096
14:18:26.694691 x-terminal.shell > apollo.it.luc.edu.999: S
2021952000:2021952000(0) ack 1382726992 win 4096
14:18:26.775037 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:26.775395 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:27.174846 x-terminal.shell > apollo.it.luc.edu.998: S
2022080000:2022080000(0) ack 1382726993 win 4096 - answerThis is a sequence
number prediction attack.
In the network 192.168.5.0/23, what would be the broadcast address? -
answer192.168.5.255
If you see the IP address fe80::0050:8790:4554:2300/16, the :: indicates what? -
answerThere are 0s between the ::.
With the following IP header, what is the destination IP address:
45 00 03 3D 1E EB 40 00 40 06 5D E8 C0 A8 01 16 AD C2 4B 67 -
answer173.194.75.103
What is the order of messages in a three-way handshake? - answerSYN, SYN/ACK,
ACK
, Which utility makes use of ICMP to function? - answertraceroute
Which of the following is a private address (RFC1918)? - answer10.45.60.10
When you are deploying an intrusion prevention system on your network, what
is the most important criterion? - answerIt has a low latency
A good example of a network using a mesh topology is: - answerThe Internet
A border router would implement the following security control: - answerAccess control
lists to block broad categories of traffic.
You are implementing a star topology on your local network. What cabling are you most
likely to use? - answerTwisted pair
Your IDS sends an alert about an incident on your network. The alert indicated that
there was a packet that had the same source and destination. This might normally
indicate an attempt at a Land attack, which is a very old attack. After investigating, you
see that the source address is 0.0.0.0 and the destination is 224.0.0.1. What would you
consider this alert to be? - answerA false positive
These can be big challenges for intrusion detection systems. - answerCompression and
encryption
This type of routing protocol uses the same algorithm as the navigation system in your
car. - answerLink-state
You would implement an intrusion detection system to perform the following: -
answerDetect intrusions.
You are seeing a lot of ARP responses with no corresponding ARP request. What are
you most likely seeing? - answerARP spoofing
You have been asked to implement a security solution on your network to protect
against employees browsing Facebook during the work day. What would you
implement? - answerA proxy server
What is the principle of least privilege implemented in? - answerThe sudo utility
Authentication is the process of doing what? - answerProving you are who you say you
are
What can John the Ripper be used for? - answerCracking Windows passwords
Microsoft Windows file security permissions are an example of what? - answerDAC
\What class is the address 170.19.82.45? - answerB
In the address ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, what does the /23
indicate? - answerThe number of bits in the network portion of the address
How many bits are in the NETWORK portion of the following address block:
Address: 10.1.0.0
Subnet: 255.255.255.224 - answer27
Question 4
What can you say about the following packet capture?
14:18:25.906002 apollo.it.luc.edu.1000 > x-terminal. Shell: S
1382726990:1382726990(0) win 4096
14:18:26.094731 x-terminal.shell > apollo.it.luc.edu.1000: S
2021824000:2021824000(0) ack 1382726991 win 4096
14:18:26.172394 apollo.it.luc.edu.1000 > x-terminal.shell: R
1382726991:1382726991(0) win 0
14:18:26.507560 apollo.it.luc.edu.999 > x-terminal.shell: S
1382726991:1382726991(0) win 4096
14:18:26.694691 x-terminal.shell > apollo.it.luc.edu.999: S
2021952000:2021952000(0) ack 1382726992 win 4096
14:18:26.775037 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:26.775395 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:27.174846 x-terminal.shell > apollo.it.luc.edu.998: S
2022080000:2022080000(0) ack 1382726993 win 4096 - answerThis is a sequence
number prediction attack.
In the network 192.168.5.0/23, what would be the broadcast address? -
answer192.168.5.255
If you see the IP address fe80::0050:8790:4554:2300/16, the :: indicates what? -
answerThere are 0s between the ::.
With the following IP header, what is the destination IP address:
45 00 03 3D 1E EB 40 00 40 06 5D E8 C0 A8 01 16 AD C2 4B 67 -
answer173.194.75.103
What is the order of messages in a three-way handshake? - answerSYN, SYN/ACK,
ACK
, Which utility makes use of ICMP to function? - answertraceroute
Which of the following is a private address (RFC1918)? - answer10.45.60.10
When you are deploying an intrusion prevention system on your network, what
is the most important criterion? - answerIt has a low latency
A good example of a network using a mesh topology is: - answerThe Internet
A border router would implement the following security control: - answerAccess control
lists to block broad categories of traffic.
You are implementing a star topology on your local network. What cabling are you most
likely to use? - answerTwisted pair
Your IDS sends an alert about an incident on your network. The alert indicated that
there was a packet that had the same source and destination. This might normally
indicate an attempt at a Land attack, which is a very old attack. After investigating, you
see that the source address is 0.0.0.0 and the destination is 224.0.0.1. What would you
consider this alert to be? - answerA false positive
These can be big challenges for intrusion detection systems. - answerCompression and
encryption
This type of routing protocol uses the same algorithm as the navigation system in your
car. - answerLink-state
You would implement an intrusion detection system to perform the following: -
answerDetect intrusions.
You are seeing a lot of ARP responses with no corresponding ARP request. What are
you most likely seeing? - answerARP spoofing
You have been asked to implement a security solution on your network to protect
against employees browsing Facebook during the work day. What would you
implement? - answerA proxy server
What is the principle of least privilege implemented in? - answerThe sudo utility
Authentication is the process of doing what? - answerProving you are who you say you
are
What can John the Ripper be used for? - answerCracking Windows passwords
Microsoft Windows file security permissions are an example of what? - answerDAC
