Month End Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

GIAC GISF GIAC Information Security Fundamentals Exam Practice Test

Demo: 49 questions
Total 333 questions

GIAC Information Security Fundamentals Questions and Answers

Question 1

Which of the following monitors program activities and modifies malicious activities on a system?

Options:

A.

Back door

B.

HIDS

C.

RADIUS

D.

NIDS

Question 2

Which of the following is a pillar of Information Assurance CIA triad?

Options:

A.

Integrity

B.

Affiliation

C.

Accessibility

D.

Isolation

Question 3

You work as a Network Administrator for Marioxnet Inc. You have the responsibility of handling two routers with BGP protocol for the enterprise's network. One of the two routers gets flooded with an unexpected number of data packets, while the other router starves with no packets reaching it. Which of the following attacks can be a potential cause of this?

Options:

A.

Denial-of-Service

B.

Eavesdropping

C.

Spoofing

D.

Packet manipulation

Question 4

Which of the following are the examples of administrative controls?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Data Backup

B.

Security policy

C.

Security awareness training

D.

Auditing

Question 5

Which of the following statements is not true about a digital certificate?

Options:

A.

It is used with both public key encryption and private key encryption.

B.

It is used with private key encryption.

C.

It is neither used with public key encryption nor with private key encryption.

D.

It is used with public key encryption.

Question 6

Which of the following does an anti-virus program update regularly from its manufacturer's Web site?

Options:

A.

Hotfixes

B.

Definition

C.

Service packs

D.

Permissions

Question 7

You are the security manager of Microliss Inc. Your enterprise uses a wireless network infrastructure with access points ranging 150-350 feet. The employees using the network complain that their passwords and important official information have been traced. You discover the following clues:

The information has proved beneficial to another company.

The other company is located about 340 feet away from your office.

The other company is also using wireless network.

The bandwidth of your network has degraded to a great extent.

Which of the following methods of attack has been used?

Options:

A.

A piggybacking attack has been performed.

B.

The information is traced using Bluebugging.

C.

A DOS attack has been performed.

D.

A worm has exported the information.

Question 8

The MBR of a hard disk is a collection of boot records that contain disk information such as disk architecture, cluster size, and so on. The main work of the MBR is to locate and run necessary operating system files that are required to run a hard disk. In the context of the operating system, MBR is also known as the boot loader. Which of the following viruses can infect the MBR of a hard disk?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Boot sector

B.

Multipartite

C.

File

D.

Stealth

Question 9

Which of the following factors determine the strength of the encryption?

Options:

A.

Character-set encoding

B.

Length of the key

C.

Operating system

D.

Ease of use

Question 10

Which of the following statements about digital signature is true?

Options:

A.

Digital signature is required for an e-mail message to get through a firewall.

B.

Digital signature verifies the identity of the person who applies it to a document.

C.

Digital signature decrypts the contents of documents.

D.

Digital signature compresses the message to which it is applied.

Question 11

In a complex network, Router transfers data packets by observing some form of parameters or metrics provided in the routing table. Which of the following metrics is NOT included in the routing table?

Options:

A.

Bandwidth

B.

Load

C.

Delay

D.

Frequency

Question 12

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He wants to test the effect of a virus on the We-are-secure server. He injects the virus on the server and, as a result, the server becomes infected with the virus even though an established antivirus program is installed on the server. Which of the following do you think are the reasons why the antivirus installed on the server did not detect the virus injected by John?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

The virus, used by John, is not in the database of the antivirus program installed on the ser ver.

B.

The mutation engine of the virus is generating a new encrypted code.

C.

John has created a new virus.

D.

John has changed the signature of the virus.

Question 13

You are configuring the Terminal service. What Protocols are required with Terminal services? (Click the Exhibit button on the toolbar to see the case study.) Each correct answer represents a part of the solution. Choose two.

Options:

A.

L2TP

B.

TCP/IP

C.

RDP

D.

CHAP

E.

PPTP

Question 14

You have an antivirus program for your network. It is dependent upon using lists of known viruses. What is this type of scan called?

Options:

A.

Heuristic

B.

Fixed List

C.

Dictionary

D.

Host Based

Question 15

How long are cookies in effect if no expiration date is set?

Options:

A.

Fifteen days

B.

Until the session ends.

C.

Forever

D.

One year

Question 16

Which of the following protocols provides secured transaction of data between two computers?

Options:

A.

SSH

B.

FTP

C.

Telnet

D.

RSH

Question 17

Which of the following objects in an Active Directory serve as security principles?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

User accounts

B.

Organizational units (OUs)

C.

Computer accounts

D.

Groups

Question 18

Which of the following are the benefits of information classification for an organization?

Options:

A.

It helps identify which information is the most sensitive or vital to an organization.

B.

It ensures that modifications are not made to data by unauthorized personnel or processes

C.

It helps identify which protections apply to which information.

D.

It helps reduce the Total Cost of Ownership (TCO).

Question 19

Which of the following are parts of applying professional knowledge? Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Maintaining cordial relationship with project sponsors

B.

Reporting your project management appearance

C.

Staying up-to-date with project management practices

D.

Staying up-to-date with latest industry trends and new technology

Question 20

You have purchased a wireless router for your home network. What will you do first to enhance the security?

Options:

A.

Change the default password and administrator's username on the router

B.

Disable the network interface card on the computer

C.

Configure DMZ on the router

D.

Assign a static IP address to the computers

Question 21

Which of the following devices or hardware parts employs SMART model system as a monitoring system?

Options:

A.

Modem

B.

RAM

C.

Hard disk

D.

IDS

Question 22

The IT Director of the company is very concerned about the security of the network. Which audit policy should he implement to detect possible intrusions into the network? (Click the Exhibit button on the toolbar to see the case study.)

Options:

A.

The success and failure auditing for policy change.

B.

The success and failure auditing for process tracking.

C.

The success and failure auditing for logon events.

D.

The success and failure auditing for privilege use.

Question 23

You are the project manager for TTX project. You have to procure some electronics gadgets for the project. A relative of yours is in the retail business of those gadgets. He approaches you for your favor to get the order. This is the situation of ____.

Options:

A.

Bribery

B.

Irresponsible practice

C.

Illegal practice

D.

Conflict of interest

Question 24

Which of the following logs contains events pertaining to security as defined in the Audit policy?

Options:

A.

DNS server log

B.

Application log

C.

System log

D.

Directory Service log

E.

Security log

F.

File Replication Service log

Question 25

What is VeriSign?

Options:

A.

It is a data warehouse.

B.

It is an e-commerce portal.

C.

It is a search engine.

D.

It is a payment gateway.

Question 26

You are responsible for virus protection for a large college campus. You are very concerned that your antivirus solution must be able to capture the latest virus threats. What sort of virus protection should you implement?

Options:

A.

Network Based

B.

Dictionary

C.

Heuristic

D.

Host based

Question 27

Peter, a malicious hacker, wants to perform an attack. He first compromises computers distributed across the internet and then installs specialized software on these computers. He then instructs the compromised hosts to execute the attack. Every host can then be used to launch its own attack on the target computers. Which of the following attacks is Peter performing?

Options:

A.

Teardrop attack

B.

SYN flood attack

C.

Ping of Death attack

D.

DDoS attack

Question 28

The Intrusion Detection System (IDS) instructs the firewall to reject any request from a particular IP address if the network is repeatedly attacked from this address. What is this action known as?

Options:

A.

Sending deceptive e-mails

B.

Sending notifications

C.

Shunning

D.

Logging

E.

Spoofing

F.

Network Configuration Changes

Question 29

Which of the following types of attack can guess a hashed password?

Options:

A.

Teardrop attack

B.

Evasion attack

C.

Denial of Service attack

D.

Brute force attack

Question 30

You are the project manager for BlueWell Inc. You are reviewing the risk register for your project. The risk register provides much information to you, the project manager and to the project team during the risk response planning. All of the following are included in the risk register except for which item?

Options:

A.

Trends in qualitative risk analysis results

B.

Symptoms and warning signs of risks

C.

List of potential risk responses

D.

Network diagram analysis of critical path activities

Question 31

Which of the following wireless security features provides the best wireless security mechanism?

Options:

A.

WPA with 802.1X authentication

B.

WPA with Pre Shared Key

C.

WPA

D.

WEP

Question 32

You work as the Security Administrator for Prodotxiss Inc. You want to ensure the security of your Wi-Fi enterprise network against the wireless snooping attacks. Which of the following measures will you take over the site network devices of the network?

Options:

A.

Apply firewalls at appropriate spots.

B.

Download and install new firmware patch for the router.

C.

Disable the SSID broadcast feature of the router.

D.

Apply a standard ACL on the router.

Question 33

John is a merchant. He has set up a LAN in his office. Some important files are deleted as a result of virus attack. John wants to ensure that it does not happen again. What will he use to protect his data from virus?

Options:

A.

Antivirus

B.

Backup

C.

Symmetric encryption

D.

Firewall

Question 34

Which of the following statements are true about Public-key cryptography? Each correct answer represents a complete solution. Choose two.

Options:

A.

Data encrypted with the secret key can only be decrypted by another secret key.

B.

The secret key can encrypt a message, and anyone with the public key can decrypt it.

C.

Data encrypted by the public key can only be decrypted by the secret key.

D.

The distinguishing technique used in public key-private key cryptography is the use of symmetric key algorithms.

Question 35

John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Dictionary attack

B.

Rule based attack

C.

Brute Force attack

D.

Hybrid attack

Question 36

You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Cookies folder

B.

Temporary Internet Folder

C.

Download folder

D.

History folder

Question 37

You have created a Web site, which will be used for e-commerce. You want to ensure that the transactions are highly secured. For this purpose, you have to create a system to verify the identity of a potential customer. Which of the following security techniques will you use?

Options:

A.

Asymmetric encryption

B.

Symmetric encryption

C.

Spoofing

D.

Digital certificate

Question 38

Which of the following techniques can be used by an administrator while working with the symmetric encryption cryptography? Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Transposition cipher

B.

Message Authentication Code

C.

Stream cipher

D.

Block cipher

Question 39

Tom and Gary are in a debate over which software should be purchased as part of their project. Gary tells Tom that because he's the senior software developer and has been with the company for 12 years, he'll be making the decision on the software. What type of conflict resolution has happened in this instance?

Options:

A.

Avoiding

B.

Forcing

C.

Compromising

D.

Smoothing

Question 40

Which of the following security applications is used to secure a database from unauthorized accesses in a network infrastructure?

Options:

A.

Antivirus

B.

Anti-Malware

C.

Anti-Spoofing

D.

Firewall

Question 41

Which of the following refers to the process of verifying the identity of a person, network host, or system process?

Options:

A.

Hacking

B.

Authentication

C.

Packet filtering

D.

Auditing

Question 42

Peter is a merchant. He uses symmetric encryption to send confidential messages to different users of his Web site. Which of the following is the other name for asymmetric encryption?

Options:

A.

Session key encryption

B.

Public key encryption

C.

Secret key encryption

D.

Shared key encryption

Question 43

Web applications play a vital role in deploying different databases with user accessibility on the Internet. Which of the following allows an attacker to get unauthorized access to the database of a Web application by sending (attacking) user-supplied data to an interpreter as part of a command or query?

Options:

A.

Cross Site Scripting

B.

Injection flaw

C.

Cross Site Request Forgery (CSRF)

D.

Malicious File Execution

Question 44

You work as a Security manager for Orangesect Inc. The enterprise is using the OODA loop strategy to counter the security issues in the enterprise. Some of the IP addresses of the enterprise have been hacked. You match up the present hacking issue and condition with the past hacking experiences to find a solution. Which of the following phases of the OODA loop involves the procedure followed by you?

Options:

A.

The decide phase

B.

The orient phase

C.

The observe phase

D.

The act phase

Question 45

Which of the following refers to the ability to ensure that the data is not modified or tampered with?

Options:

A.

Availability

B.

Integrity

C.

Confidentiality

D.

Non-repudiation

Question 46

Which of the following components are usually found in an Intrusion detection system (IDS)?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Console

B.

Sensor

C.

Firewall

D.

Modem

E.

Gateway

Question 47

The workstations on your network utilize Windows XP (service pack 2 or later). Many users take their laptops on the road. You are very concerned about the security and want to have a robust firewall solution for mobile users. You have decided that all your firewalls to use the Stateful Packet Inspection (SPI) method. What must you do to provide SPI to your mobile users?

Options:

A.

You must purchase a third party firewall solution for your mobile users.

B.

Do nothing. Windows XP service pack 2 has a firewall turned on by default.

C.

Download the SPI template from Microsoft.

D.

Configure the Windows XP firewall to use SPI.

Question 48

Which of the following are used as primary technologies to create a layered defense for giving protection to a network?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Vulnerability

B.

Firewall

C.

Endpoint authentication

D.

IDS

Question 49

Which of the following methods of encryption uses a single key to encrypt and decrypt data?

Options:

A.

S/MIME

B.

Asymmetric

C.

PGP

D.

Symmetric

Demo: 49 questions
Total 333 questions