GSEC GIAC Security Essentials Exam Questions
With Correct Answers
What |class |is |the |address |170.19.82.45? |- |CORRECT |ANSWER✔✔-B
In |the |address |ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, |what |does |the |/23 |indicate? |- |
CORRECT |ANSWER✔✔-The |number |of |bits |in |the |network |portion |of |the |address
How |many |bits |are |in |the |NETWORK |portion |of |the |following |address |block:
Address: |10.1.0.0
Subnet: |255.255.255.224 |- |CORRECT |ANSWER✔✔-27
Question |4
What |can |you |say |about |the |following |packet |capture?
14:18:25.906002 |apollo.it.luc.edu.1000 |> |x-terminal.shell: |S
1382726990:1382726990(0) |win |4096
14:18:26.094731 |x-terminal.shell |> |apollo.it.luc.edu.1000: |S
2021824000:2021824000(0) |ack |1382726991 |win |4096
14:18:26.172394 |apollo.it.luc.edu.1000 |> |x-terminal.shell: |R
1382726991:1382726991(0) |win |0
14:18:26.507560 |apollo.it.luc.edu.999 |> |x-terminal.shell: |S
1382726991:1382726991(0) |win |4096
14:18:26.694691 |x-terminal.shell |> |apollo.it.luc.edu.999: |S
2021952000:2021952000(0) |ack |1382726992 |win |4096
14:18:26.775037 |apollo.it.luc.edu.999 |> |x-terminal.shell: |R
,1382726992:1382726992(0) |win |0
14:18:26.775395 |apollo.it.luc.edu.999 |> |x-terminal.shell: |R
1382726992:1382726992(0) |win |0
14:18:27.174846 |x-terminal.shell |> |apollo.it.luc.edu.998: |S
2022080000:2022080000(0) |ack |1382726993 |win |4096 |- |CORRECT |ANSWER✔✔-This |is |a |
sequence |number |prediction |attack.
In |the |network |192.168.5.0/23, |what |would |be |the |broadcast |address? |- |CORRECT |
ANSWER✔✔-192.168.5.255
If |you |see |the |IP |address |fe80::0050:8790:4554:2300/16, |the |:: |indicates |what? |- |CORRECT |
ANSWER✔✔-There |are |0s |between |the |::.
With |the |following |IP |header, |what |is |the |destination |IP |address: |
45 |00 |03 |3D |1E |EB |40 |00 |40 |06 |5D |E8 |C0 |A8 |01 |16 |AD |C2 |4B |67 |- |CORRECT |ANSWER✔✔-
173.194.75.103
What |is |the |order |of |messages |in |a |three-way |handshake? |- |CORRECT |ANSWER✔✔-SYN, |
SYN/ACK, |ACK
Which |utility |makes |use |of |ICMP |to |function? |- |CORRECT |ANSWER✔✔-traceroute
Which |of |the |following |is |a |private |address |(RFC1918)? |- |CORRECT |ANSWER✔✔-10.45.60.10
When |you |are |deploying |an |intrusion |prevention |system |on |your |network, |what
is |the |most |important |criterion? |- |CORRECT |ANSWER✔✔-It |has |a |low |latency
A |good |example |of |a |network |using |a |mesh |topology |is: |- |CORRECT |ANSWER✔✔-The |Internet
, A |border |router |would |implement |the |following |security |control: |- |CORRECT |ANSWER✔✔-
Access |control |lists |to |block |broad |categories |of |traffic.
You |are |implementing |a |star |topology |on |your |local |network. |What |cabling |are |you |most |likely
|to |use? |- |CORRECT |ANSWER✔✔-Twisted |pair
Your |IDS |sends |an |alert |about |an |incident |on |your |network. |The |alert |indicated |that |there |was
|a |packet |that |had |the |same |source |and |destination. |This |might |normally |indicate |an |attempt |
at |a |Land |attack, |which |is |a |very |old |attack. |After |investigating, |you |see |that |the |source |
address |is |0.0.0.0 |and |the |destination |is |224.0.0.1. |What |would |you |consider |this |alert |to |be? |-
|CORRECT |ANSWER✔✔-A |false |positive
These |can |be |big |challenges |for |intrusion |detection |systems. |- |CORRECT |ANSWER✔✔-
Compression |and |encryption
This |type |of |routing |protocol |uses |the |same |algorithm |as |the |navigation |system |in |your |car. |- |
CORRECT |ANSWER✔✔-Link-state
You |would |implement |an |intrusion |detection |system |to |perform |the |following: |- |CORRECT |
ANSWER✔✔-Detect |intrusions.
You |are |seeing |a |lot |of |ARP |responses |with |no |corresponding |ARP |request. |What |are |you |most
|likely |seeing? |- |CORRECT |ANSWER✔✔-ARP |spoofing
You |have |been |asked |to |implement |a |security |solution |on |your |network |to |protect |against |
employees |browsing |Facebook |during |the |work |day. |What |would |you |implement? |- |CORRECT |
ANSWER✔✔-A |proxy |server
With Correct Answers
What |class |is |the |address |170.19.82.45? |- |CORRECT |ANSWER✔✔-B
In |the |address |ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, |what |does |the |/23 |indicate? |- |
CORRECT |ANSWER✔✔-The |number |of |bits |in |the |network |portion |of |the |address
How |many |bits |are |in |the |NETWORK |portion |of |the |following |address |block:
Address: |10.1.0.0
Subnet: |255.255.255.224 |- |CORRECT |ANSWER✔✔-27
Question |4
What |can |you |say |about |the |following |packet |capture?
14:18:25.906002 |apollo.it.luc.edu.1000 |> |x-terminal.shell: |S
1382726990:1382726990(0) |win |4096
14:18:26.094731 |x-terminal.shell |> |apollo.it.luc.edu.1000: |S
2021824000:2021824000(0) |ack |1382726991 |win |4096
14:18:26.172394 |apollo.it.luc.edu.1000 |> |x-terminal.shell: |R
1382726991:1382726991(0) |win |0
14:18:26.507560 |apollo.it.luc.edu.999 |> |x-terminal.shell: |S
1382726991:1382726991(0) |win |4096
14:18:26.694691 |x-terminal.shell |> |apollo.it.luc.edu.999: |S
2021952000:2021952000(0) |ack |1382726992 |win |4096
14:18:26.775037 |apollo.it.luc.edu.999 |> |x-terminal.shell: |R
,1382726992:1382726992(0) |win |0
14:18:26.775395 |apollo.it.luc.edu.999 |> |x-terminal.shell: |R
1382726992:1382726992(0) |win |0
14:18:27.174846 |x-terminal.shell |> |apollo.it.luc.edu.998: |S
2022080000:2022080000(0) |ack |1382726993 |win |4096 |- |CORRECT |ANSWER✔✔-This |is |a |
sequence |number |prediction |attack.
In |the |network |192.168.5.0/23, |what |would |be |the |broadcast |address? |- |CORRECT |
ANSWER✔✔-192.168.5.255
If |you |see |the |IP |address |fe80::0050:8790:4554:2300/16, |the |:: |indicates |what? |- |CORRECT |
ANSWER✔✔-There |are |0s |between |the |::.
With |the |following |IP |header, |what |is |the |destination |IP |address: |
45 |00 |03 |3D |1E |EB |40 |00 |40 |06 |5D |E8 |C0 |A8 |01 |16 |AD |C2 |4B |67 |- |CORRECT |ANSWER✔✔-
173.194.75.103
What |is |the |order |of |messages |in |a |three-way |handshake? |- |CORRECT |ANSWER✔✔-SYN, |
SYN/ACK, |ACK
Which |utility |makes |use |of |ICMP |to |function? |- |CORRECT |ANSWER✔✔-traceroute
Which |of |the |following |is |a |private |address |(RFC1918)? |- |CORRECT |ANSWER✔✔-10.45.60.10
When |you |are |deploying |an |intrusion |prevention |system |on |your |network, |what
is |the |most |important |criterion? |- |CORRECT |ANSWER✔✔-It |has |a |low |latency
A |good |example |of |a |network |using |a |mesh |topology |is: |- |CORRECT |ANSWER✔✔-The |Internet
, A |border |router |would |implement |the |following |security |control: |- |CORRECT |ANSWER✔✔-
Access |control |lists |to |block |broad |categories |of |traffic.
You |are |implementing |a |star |topology |on |your |local |network. |What |cabling |are |you |most |likely
|to |use? |- |CORRECT |ANSWER✔✔-Twisted |pair
Your |IDS |sends |an |alert |about |an |incident |on |your |network. |The |alert |indicated |that |there |was
|a |packet |that |had |the |same |source |and |destination. |This |might |normally |indicate |an |attempt |
at |a |Land |attack, |which |is |a |very |old |attack. |After |investigating, |you |see |that |the |source |
address |is |0.0.0.0 |and |the |destination |is |224.0.0.1. |What |would |you |consider |this |alert |to |be? |-
|CORRECT |ANSWER✔✔-A |false |positive
These |can |be |big |challenges |for |intrusion |detection |systems. |- |CORRECT |ANSWER✔✔-
Compression |and |encryption
This |type |of |routing |protocol |uses |the |same |algorithm |as |the |navigation |system |in |your |car. |- |
CORRECT |ANSWER✔✔-Link-state
You |would |implement |an |intrusion |detection |system |to |perform |the |following: |- |CORRECT |
ANSWER✔✔-Detect |intrusions.
You |are |seeing |a |lot |of |ARP |responses |with |no |corresponding |ARP |request. |What |are |you |most
|likely |seeing? |- |CORRECT |ANSWER✔✔-ARP |spoofing
You |have |been |asked |to |implement |a |security |solution |on |your |network |to |protect |against |
employees |browsing |Facebook |during |the |work |day. |What |would |you |implement? |- |CORRECT |
ANSWER✔✔-A |proxy |server
