Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home GIAC GCED

GIAC GCED Exam Practice Questions (P. 2)

  • Full Access (88 questions)
  • Six months of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #6
Which of the following attacks would use ".." notation as part of a web request to access restricted files and directories, and possibly execute code on the web server?
  1. A
    URL directory
  2. B
    HTTP header attack
  3. C
    SQL injection
  4. D
    IDS evasion
  5. E
    Cross site scripting

Correct Answer:
A

Question #7
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt
  1. A
    To create a file on the USB drive that contains a listing of the C: drive
  2. B
    To show hidden and archived files on the C: drive and copy them to the USB drive
  3. C
    To copy a forensic image of the local C: drive onto the USB drive
  4. D
    To compare a list of known good hashes on the USB drive to files on the local C: drive

Correct Answer:
C
This command will create a text file on the collection media (in this case you would probably be using a USB flash drive) named IRCD.txt that should contain a recursive directory listing of all files on the desk.

Question #8
Why might an administrator not be able to delete a file using the Windows del command without specifying additional command line switches?
  1. A
    Because it has the read-only attribute set
  2. B
    Because it is encrypted
  3. C
    Because it has the nodel attribute set
  4. D
    Because it is an executable file

Correct Answer:
A

Question #9
Why would the pass action be used in a Snort configuration file?
  1. A
    The pass action simplifies some filtering by specifying what to ignore.
  2. B
    The pass action passes the packet onto further rules for immediate analysis.
  3. C
    The pass action serves as a placeholder in the snort configuration file for future rule updates.
  4. D
    Using the pass action allows a packet to be passed to an external process.
  5. E
    The pass action increases the number of false positives, better testing the rules.

Correct Answer:
A
The pass action is defined because it is sometimes easier to specify the class of data to ignore rather than the data you want to see. This can cut down the number of false positives and help keep down the size of log data.
False positives occur because rules failed and indicated a threat that is really not one. They should be minimized whenever possible.
The pass action causes the packet to be ignored, not passed on further. It is an active command, not a placeholder.

Question #10
On which layer of the OSI Reference Model does the FWSnort utility function?
  1. A
    Physical Layer
  2. B
    Data Link Layer
  3. C
    Transport Layer
  4. D
    Session Layer
  5. E
    Application Layer

Correct Answer:
C
The FWSnort utility functions as a transport layer inline IPS.

Previous Questions Next Questions

All Pages