Winter Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: geek65

GCIA GCIA – GIAC Certified Intrusion Analyst Practice Test Questions and Answers

Questions 4

Which of the following tools is used to detect wireless LANs using the 802.11b, 802.11a, and 802.11g WLAN standards on the Windows platform?

Options:

A.

Cain

B.

AiroPeek

C.

NetStumbler

D.

Snort

Buy Now
Questions 5

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Options:

A.

Linux Live CD

B.

DOS boot disk

C.

Secure Authentication for EnCase (SAFE)

D.

EnCase with a hardware write blocker

Buy Now
Questions 6

You work as a Desktop Support Technician for umbrella Inc. The company uses a Windows-based network. An employee of the production department is facing the problem in the IP configuration of the network connection.

He called you to resolve the issue. You suspect that the IP configuration is not configured properly. You want to use the ping command to ensure that IPv4 protocol is working on a computer. While running the ping command from the command prompt, you find that Windows Firewall is blocking the ping command. You enter the following command in the elevated command prompt on the computer:

netsh advfirewall firewall add rule name="ICMPv4" protocol=icmpv4:any,any dir=in action=allow

Which of the following actions will this command perform?

Options:

A.

Permit ICMPv4 packet to pass through the firewall.

B.

Permit ICMPv4 Echo Request.

C.

Enable packet filtering by Windows Firewall.

D.

Disable Firewall temporarily.

Buy Now
Questions 7

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a multimedia enabled mobile phone, which is suspected to be used in a cyber crime. Adam uses a tool, with the help of which he can recover deleted text messages, photos, and call logs of the mobile phone. Which of the following tools is Adam using?

Options:

A.

FAU

B.

FTK Imager

C.

Galleta

D.

Device Seizure

Buy Now
Questions 8

In which of the following IKE phases the IPsec endpoints establish parameters for a secure ISAKMP session?

Options:

A.

IKE Phase 2.5

B.

IKE Phase 2

C.

IKE Phase 1

D.

IKE Phase 1.5

Buy Now
Questions 9

Which of the following types of firewall functions at the Session layer of OSI model?

Options:

A.

Circuit-level firewall

B.

Switch-level firewall

C.

Packet filtering firewall

D.

Application-level firewall

Buy Now
Questions 10

You are the Administrator for a Windows 2000 based network that uses DHCP to dynamically assign IP addresses to the clients and DNS servers. You want to ensure that the DNS servers can communicate with another DNS server. Which type of query will you run to achieve this?

Options:

A.

PATHPING

B.

NSLOOKUP

C.

PING

D.

Recursive

Buy Now
Questions 11

Sasha wants to add an entry to your DNS database for your mail server. Which of the following types of resource records will she use to accomplish this?

Options:

A.

ANAME

B.

SOA

C.

MX

D.

CNAME

Buy Now
Questions 12

Which of the following is the default port for File Transport Protocol (FTP)?

Options:

A.

21

B.

25

C.

23

D.

80

Buy Now
Questions 13

Which of the following is the default port for Simple Network Management Protocol (SNMP)?

Options:

A.

TCP port 110

B.

TCP port 25

C.

TCP port 80

D.

UDP port 161

Buy Now
Questions 14

You work as a Network Administrator for McRobert Inc. You want to know the NetBIOS name of your computer. Which of the following commands will you use?

Options:

A.

NBTSTAT -s

B.

NETSTAT -s

C.

NETSTAT -n

D.

NBTSTAT -n

Buy Now
Questions 15

Which of the following attacks is also known as the bucket-brigade attack?

Options:

A.

Rainbow attack

B.

ARP spoofing attack

C.

Man-in-the-middle attack

D.

DoS attack

Buy Now
Questions 16

Which of the following ICMPv6 neighbor discovery messages is sent by hosts to request an immediate router advertisement, instead of waiting for the next scheduled advertisement?

Options:

A.

Neighbor Solicitation

B.

Router Solicitation

C.

Neighbor Advertisement

D.

Router Advertisement

Buy Now
Questions 17

Which of the following sectors on a hard disk contains codes that the computer uses to start the system?

Options:

A.

Sector 256

B.

Sector 0

C.

Sector 1

D.

Sector 128

Buy Now
Questions 18

Which of the following user authentications are supported by the SSH-1 protocol but not by the SSH-2 protocol?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

TIS authentication

B.

Rhosts (rsh-style) authentication

C.

Kerberos authentication

D.

Password-based authentication

Buy Now
Questions 19

Which of the following is not a valid Failed Logon EventID?

Options:

A.

535

B.

536

C.

534

D.

533

Buy Now
Questions 20

Which of the following is a correct sequence of different layers of Open System Interconnection (OSI) model?

Options:

A.

Physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer

B.

Physical layer, network layer, transport layer, data link layer, session layer, presentation layer, and application layer

C.

application layer, presentation layer, network layer, transport layer, session layer, data link layer, and physical layer

D.

Physical layer, data link layer, network layer, transport layer, presentation layer, session layer, and application layer

Buy Now
Questions 21

Which of the following protocols is used to translate IP addresses to Ethernet addresses?

Options:

A.

Border Gateway Protocol (BGP)

B.

Routing Information Protocol (RIP)

C.

Address Resolution Protocol (ARP)

D.

Internet Control Message Protocol (ICMP)

Buy Now
Questions 22

Which of the following commands displays the IPX routing table entries?

Options:

A.

sh ipx traffic

B.

sh ipx int e0

C.

sh ipx route

D.

sho ipx servers

Buy Now
Questions 23

Which of the following tools is used to locate lost files and partitions to restore data from a formatted, damaged, or lost partition in Windows and Apple Macintosh computers?

Options:

A.

Easy-Undelete

B.

VirtualLab

C.

File Scavenger

D.

Recover4all Professional

Buy Now
Questions 24

You work as a Network Administrator for McRobert Inc. You want to know the NetBIOS name of your computer. Which of the following commands will you use?

Options:

A.

NETSTAT -n

B.

NETSTAT -s

C.

NBTSTAT -n

D.

NBTSTAT -s

Buy Now
Questions 25

Which of the following processes is used to convert plain text into cipher text?

Options:

A.

Encryption

B.

Decryption

C.

Encapsulation

D.

Steganography

Buy Now
Questions 26

What is the maximum size of an IP datagram for Ethernet?

Options:

A.

4500 bytes

B.

1024 bytes

C.

1200 bytes

D.

1500 bytes

Buy Now
Questions 27

Which of the following commands used in Linux to create bit-stream images?

Options:

A.

ss

B.

xcopy

C.

dd

D.

img

Buy Now
Questions 28

John works as a Network Security Professional. He is assigned a project to test the security of www.we-are-secure.com. He is working on the Linux operating system and wants to install an Intrusion Detection System on the We-are-secure server so that he can receive alerts about any hacking attempts. Which of the following tools can John use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

SARA

B.

Snort

C.

Samhain

D.

Tripwire

Buy Now
Questions 29

Which of the following terms is used to represent IPv6 addresses?

Options:

A.

Hexadecimal-dot notation

B.

Colon-dot

C.

Dot notation

D.

Colon-hexadecimal

Buy Now
Questions 30

With reference to the given case study, one of the security goals requires to configure a secure connection between the Boston distribution center and the headquarters. You want to implement IP filter to fulfill the security requirements. How should you implement IP filters at the headquarters?

(Click the Exhibit button on the toolbar to see the case study.)

Options:

A.

Add source filters for the headquarters for UDP port 80 and IP protocol 50.

Add destination filters for the Boston distribution center for UDP port 80 and IP protocol 50.

B.

Add source filters for the Boston distribution center for UDP port 80 and IP protocol 50.

Add destination filters for headquarters for UDP port 80 and IP protocol 50.

C.

Add source filters for the Boston distribution center for UDP port 1701 and IP protocol 50.

Add destination filters for the headquarters for UDP port 1701 and IP protocol 50.

D.

Add source filters for the headquarters for UDP port 1701 and IP protocol 50.

Add destination filters for the Boston distribution center for UDP port 1701 and IP protocol 50.

Buy Now
Questions 31

John enters a URL http://www.cisco.com/web/learning in the web browser. A web page appears after he enters the URL. Which of the following protocols is used to resolve www.cisco.com into the correct IP address?

Options:

A.

DNS

B.

SMTP

C.

DHCP

D.

ARP

Buy Now
Questions 32

Which of the following files in LILO booting process of Linux operating system stores the location of Kernel on the hard drive?

Options:

A.

/boot/boot.b

B.

/boot/map

C.

/sbin/lilo

D.

/etc/lilo.conf

Buy Now
Questions 33

Which of the following statements about a host-based intrusion prevention system (HIPS) are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It can detect events scattered over the network.

B.

It can handle encrypted and unencrypted traffic equally.

C.

It cannot detect events scattered over the network.

D.

It is a technique that allows multiple computers to share one or more IP addresses.

Buy Now
Questions 34

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

Options:

A.

Signature-based

B.

Network-based

C.

File-based

D.

Anomaly-based

Buy Now
Questions 35

Andrew works as an Administrator for a Windows 2000 based network. The network has a primary external DNS server, and a secondary DNS server located on the ISP's UNIX server, in order to provide fault tolerance. Users complain that they are unable to connect to the URL when using the secondary server. What should Andrew do to resolve the problem?

Options:

A.

He should disable the fast zone transfer in the Advanced tab of the Properties window on the secondary server.

B.

He should select the BIND secondaries check box in the Zone Transfer tab of the Properties window on the primary server.

C.

He should select the BIND secondaries check box in the Advanced tab of the Properties window on the primary server.

D.

He should enable the fast zone transfer in the Advanced tab of the Properties window on the primary server.

Buy Now
Questions 36

What is the easiest way to verify that name resolution is functioning properly on a TCP/IP network?

Options:

A.

Use the TRACERT command with the /pingname parameter.

B.

Ping the source host with its computer name.

C.

Ping the source host with its IP address.

D.

Check the IP statistics on the file server.

Buy Now
Questions 37

Which of the following types of firewall ensures that the packets are part of the established session?

Options:

A.

Switch-level firewall

B.

Application-level firewall

C.

Stateful inspection firewall

D.

Circuit-level firewall

Buy Now
Questions 38

Which of the following statements about Secure Shell (SSH) are true?

Each correct answer represents a complete solution. Choose three.

Options:

A.

It is the core routing protocol of the Internet.

B.

It allows data to be exchanged using a secure channel between two networked devices.

C.

It was designed as a replacement for TELNET and other insecure shells.

D.

It is a network protocol used primarily on Linux and Unix based systems.

Buy Now
Questions 39

Which of the following technologies is used to detect unauthorized attempts to access and manipulate computer systems locally or through the Internet or an intranet?

Options:

A.

Demilitarized zone (DMZ)

B.

Intrusion detection system (IDS)

C.

Firewall

D.

Packet filtering

Buy Now
Questions 40

Which of the following is the primary TCP/IP protocol used to transfer text and binary files over the Internet?

Options:

A.

PPTP

B.

SNMP

C.

FTP

D.

SMTP

Buy Now
Questions 41

Which of the following programs is used to add words to spam e-mails so that the e-mail is not considered spam and therefore is delivered as if it were a normal message?

Options:

A.

Adler-32

B.

Hash filtrer

C.

Hash buster

D.

Checksum

Buy Now
Questions 42

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

Options:

A.

DriveSpy

B.

Ontrack

C.

Device Seizure

D.

Forensic Sorter

Buy Now
Questions 43

Adam, a malicious hacker is running a scan. Statistics of the scan is as follows:

Which of the following types of port scan is Adam running?

Options:

A.

XMAS scan

B.

ACK scan

C.

Idle scan

D.

FIN scan

Buy Now
Questions 44

Peter works as a professional Computer Hacking Forensic Investigator for eLaw-Suit law firm. He is working on a case of a cyber crime. Peter knows that the good investigative report should not only communicate the relevant facts, but also present expert opinion. This report should not include the cases in which the expert acted as a lay witness. Which of the following type of witnesses is a lay witness?

Options:

A.

One who can give a firsthand account of something seen, heard, or experienced.

B.

One with special knowledge of the subject about which he or she is testifying.

C.

One who observes an event.

D.

One who is not qualified as an expert witness.

Buy Now
Questions 45

Which of the following is allowed by a company to be addressed directly from the public network and is hardened to screen the rest of its network from security exposure?

Options:

A.

Intrusion detection system

B.

A computer installed in the network and configured with sender reputation

C.

bastion host

D.

Exchange ActiveSync

Buy Now
Questions 46

Which of the following Denial-of-Service (DoS) attacks employ IP fragmentation mechanism?

Each correct answer represents a complete solution. Choose two.

Options:

A.

SYN flood attack

B.

Teardrop attack

C.

Land attack

D.

Ping of Death attack

Buy Now
Questions 47

Adam works as a professional Computer Hacking Forensic Investigator. He has been assigned with a project to investigate a computer in the network of SecureEnet Inc. The compromised system runs on Windows operating system. Adam decides to use Helix Live for Windows to gather data and electronic evidences starting with retrieving volatile data and transferring it to server component via TCP/IP. Which of the following application software in Helix Windows Live will he use to retrieve volatile data and transfer it to the server component via TCP/IP?

Options:

A.

FAU

B.

FTK imager

C.

Drive Manager

D.

FSP

Buy Now
Questions 48

You are using a Windows-based sniffer named ASniffer to record the data traffic of a network. You have extracted the following IP Header information of a randomly chosen packet from the sniffer's log:

45 00 00 28 00 00 40 00 29 06 43 CB D2 D3 82 5A 3B 5E AA 72

Which of the following TTL decimal values and protocols are being carried by the IP Header of this packet?

Options:

A.

41, UDP

B.

16, ICMP

C.

41, TCP

D.

16, UDP

Buy Now
Questions 49

Which of the following encryption methods are used by the BlackBerry to provide security to the data stored in it?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Triple DES

B.

Blowfish

C.

AES

D.

RSA

Buy Now
Questions 50

You are using the TRACERT utility to trace the route to passguide.com. You receive the following output:

Which of the following conclusions can you draw from viewing the output?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Everything is fine.

B.

One of the routers on the path to the destination is not functional.

C.

The destination computer is not operational.

D.

The IP address of the destination computer is not resolved.

Buy Now
Questions 51

Trinity wants to send an email to her friend. She uses the MD5 generator to calculate cryptographic hash of her email to ensure the security and integrity of the email. MD5 generator, which Trinity is using operates in two steps:

Creates check file

Verifies the check file

Which of the following MD5 generators is Trinity using?

Options:

A.

Secure Hash Signature Generator

B.

Mat-MD5

C.

Chaos MD5

D.

MD5 Checksum Verifier

Buy Now
Questions 52

Which of the following is the default port for Hypertext Transfer Protocol (HTTP)?

Options:

A.

23

B.

21

C.

80

D.

25

Buy Now
Questions 53

Which of the following ports can be used for IP spoofing?

Options:

A.

Whois 43

B.

POP 110

C.

NNTP 119

D.

Rlogin 513

Buy Now
Questions 54

Which of the following software is used for Steganography?

Options:

A.

CryptoForge

B.

Fort Knox

C.

Dsniff

D.

Ethreal

Buy Now
Questions 55

What netsh command should be run to enable IPv6 routing?

Each correct answer represents a part of the solution. Choose two.

Options:

A.

netsh interface IPv6 show interface

B.

netsh interface IPv6 add routes

C.

netsh interface IPv6 set interface

D.

netsh interface IPv6 add address

Buy Now
Questions 56

Which of the following tools is used to recover data and partitions, and can run on Windows, Linux, SunOS, and Macintosh OS X operating systems?

Options:

A.

GetDataBack

B.

Acronis Recovery Expert

C.

Active@ Disk Image

D.

TestDisk

Buy Now
Questions 57

Which of the following is a correct sequence of different layers of Open System Interconnection (OSI) model?

Options:

A.

Physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer

B.

Physical layer, data link layer, network layer, transport layer, presentation layer, session layer, and application layer

C.

application layer, presentation layer, network layer, transport layer, session layer, data link layer, and physical layer

D.

Physical layer, network layer, transport layer, data link layer, session layer, presentation layer, and application layer

Buy Now
Questions 58

This tool is known as __________.

Options:

A.

Kismet

B.

Absinthe

C.

NetStumbler

D.

THC-Scan

Buy Now
Questions 59

Which of the following tools are used to determine the hop counts of an IP packet?

Each correct answer represents a complete solution. Choose two.

Options:

A.

TRACERT

B.

Ping

C.

IPCONFIG

D.

Netstat

Buy Now
Questions 60

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. John wants to redirect all TCP port 80 traffic to UDP port 40, so that he can bypass the firewall of the We-are-secure server. Which of the following tools will John use to accomplish his task?

Options:

A.

PsExec

B.

PsList

C.

Fpipe

D.

Cain

Buy Now
Questions 61

How many bits does IPv6 use in IP addresses?

Options:

A.

40 bits

B.

32 bits

C.

64 bits

D.

128 bits

Buy Now
Questions 62

Which of the following types of attacks uses ICMP to consume bandwidth and crash sites?

Options:

A.

MITM attack

B.

SYN flood attack

C.

TFN attack

D.

XSS attack

Buy Now
Questions 63

Which of the following is the default port for Simple Network Management Protocol (SNMP)?

Options:

A.

TCP port 110

B.

TCP port 25

C.

TCP port 80

D.

UDP port 161

Buy Now
Questions 64

Which of the following file systems is designed by Sun Microsystems?

Options:

A.

NTFS

B.

CIFS

C.

ZFS

D.

ext2

Buy Now
Questions 65

Sandra, a novice computer user, works on Windows environment. She experiences some problem regarding bad sectors formed in a hard disk of her computer. She wants to run CHKDSK command to check the hard disk for bad sectors and to fix the errors, if any, occurred. Which of the following switches will she use with CHKDSK command to accomplish the task?

Options:

A.

CHKDSK /I

B.

CHKDSK /R /F

C.

CHKDSK /C /L

D.

CHKDSK /V /X

Buy Now
Questions 66

Routers work at which layer of the OSI reference model?

Options:

A.

Transport

B.

Physical

C.

Presentation

D.

Network

Buy Now
Questions 67

Which of the following is NOT the functional area of a forensic laboratory?

Options:

A.

Network facilities

B.

Evidence storage

C.

Administrative area

D.

Research area

Buy Now
Questions 68

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Options:

A.

Linux Live CD

B.

DOS boot disk

C.

Secure Authentication for EnCase (SAFE)

D.

EnCase with a hardware write blocker

Buy Now
Questions 69

In which of the following attacks does a hacker imitate a DNS server and obtain the entire DNS database?

Options:

A.

Illicit zone transfer attack

B.

DNS poisoning attack

C.

Illicit poisoning attack

D.

DNS transfer attack

Buy Now
Questions 70

Which of the following tools performs comprehensive tests against web servers for multiple items, including over 6100 potentially dangerous files/CGIs?

Options:

A.

Dsniff

B.

Snort

C.

Nikto

D.

Sniffer

Buy Now
Questions 71

What is the name of the first computer virus that infected the boot sector of the MS-DOS operating system?

Options:

A.

Sircam

B.

Stoner

C.

Code Red

D.

Brain

Buy Now
Questions 72

Which of the following ports is used for DNS services?

Options:

A.

Port 7

B.

Port 53

C.

Port 80

D.

Port 23

Buy Now
Questions 73

Which of the following is the process of categorizing attack alerts produced from IDS?

Options:

A.

Site policy implementation

B.

Blocking

C.

Intrusion classify

D.

Alarm filtering

Buy Now
Questions 74

Which of the following statements are true about an IPv6 network?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

For interoperability, IPv4 addresses use the last 32 bits of IPv6 addresses.

B.

It increases the number of available IP addresses.

C.

It provides improved authentication and security.

D.

It uses 128-bit addresses.

E.

It uses longer subnet masks than those used in IPv4.

Buy Now
Questions 75

Which of the following attacks is designed to deduce the brand and/or version of an operating system or application?

Options:

A.

Vulnerability assessment

B.

Banner grabbing

C.

OS fingerprinting

D.

Port scanning

Buy Now
Questions 76

Mark works as a Network Security Administrator for BlueWells Inc. The company has a Windowsbased network. Mark is giving a presentation on Network security threats to the newly recruited employees of the company. His presentation is about the External threats that the company recently faced in the past. Which of the following statements are true about external threats?

Each correct answer represents a complete solution. Choose three.

Options:

A.

These are the threats that originate from outside an organization in which the attacker attempts to gain unauthorized access.

B.

These are the threats that originate from within the organization.

C.

These are the threats intended to flood a network with large volumes of access requests.

D.

These threats can be countered by implementing security controls on the perimeters of the network, such as firewalls, which limit user access to the Internet.

Buy Now
Exam Code: GCIA
Exam Name: GCIA – GIAC Certified Intrusion Analyst Practice Test
Last Update: Nov 21, 2024
Questions: 508
GCIA pdf

GCIA PDF

$28  $80
GCIA Engine

GCIA Testing Engine

$33.25  $95
GCIA PDF + Engine

GCIA PDF + Testing Engine

$45.5  $130