GSEC GIAC Security Essentials Exam Questions Complete Solutions

GSEC GIAC Security Essentials Exam Questions Complete Solutions What class is the address 170.19.82.45? - Answer -B In the address ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, what does the /23 indicate? - Answer -The number of bits in the network portion of the address How many bits are in the NETWORK portion of the following address block: Address: 10.1.0.0 Subnet: 255.255.255.224 - Answer -27 Question 4 What can you say about the following packet capture? 14:18:25.906002 .1000 : S :(0) win 4096 14:18:26.094731 .1000: S :(0) ack win 4096 14:18:26.172394 .1000 : R :(0) win 0 14:18:26.507560 .999 : S :(0) win 4096 14:18:26.694691 .999: S :(0) ack win 4096 14:18:26.775037 .999 : R :(0) win 0 14:18:26.775395 .999 : R :(0) win 0 14:18:27.174846 .998: S :(0) ack win 4096 - Answer -This is a sequence number prediction attack. In the network 192.168.5.0/23, what would be the broadcast address? - Answer -192.168.5.255 If you see the IP address fe80::0050:8790:4554:2300/16, the :: indicates what? - Answer -There are 0s between the ::. With the following IP header, what is the destination IP address: 45 00 03 3D 1E EB D E8 C0 A8 01 16 AD C2 4B 67 - Answer -173.194.75.103 What is the order of messages in a three-way handshake? - Answer -SYN, SYN/ACK, ACK Which utility makes use of ICMP to function? - Answer -traceroute Which of the following is a private address (RFC1918)? - Answer -10.45.60.10 When you are deploying an intrusion prevention system on your network, what is the most important criterion? - Answer -It has a low latency A good example of a network using a mesh topology is: - Answer -The Internet A border router would implement the following security control: - Answer -Access control lists to block broad categories of traffic. You are implementing a star topology on your local network. What cabling are you most likely to use? - Answer -Twisted pair Your IDS sends an alert about an incident on your network. The alert indicated that there was a packet that had the same source and destination. This might normally indicate an attempt at a Land attack, which is a very old attack. After investigating, you see that the source address is 0.0.0.0 and the destination is 224.0.0.1. What would you consider this alert to be? - Answer -A false positive