GCED GIAC Certified Enterprise Defender Questions and Answers

Encrypt the original media to protect the data

Create a one-way hash of the original media

Decompress files on the original media

Decrypt the original media

A Worm gets instructions from an external control channel like an IRC server.

A Worm, unlike a Bot, is installed silently as an add-on to a legitimate program.

A Bot, unlike a Worm, is frequently spread through email attachments.

A Bot gets instructions from an external control channel like an IRC server.

private

mib

open

public

Copies of log files

System serial number

List of system directories

Hash of each hard drive

Using vendors other than Cisco for switching equipment as they don’t offer port security

Spoofed MAC addresses from being used to cause a Denial of Service condition

Legitimate MAC addresses from being used to cause a Denial of Service condition

Network Access Control systems from functioning properly

VNC server session on the target

A netcat listener on the target

A meterpreter prompt on the target

A command prompt on the target

Signature-based

Anomaly-based

Statistical

Monitored

Manually selected and defined by the network architect or engineer.

Defined by selecting the highest Bridge ID to be the root bridge.

Automatically selected by the Spanning Tree Protocol (STP).

All switch interfaces become root bridges in an STP environment.

The port may be open on the system or blocked by a firewall

The router in front of the host accepted the request and sent a reply

An ICMP unreachable message was received indicating an open port

An ACK was received in response to the initial probe packet

Physical Layer

Data Link Layer

Transport Layer

Session Layer

Application Layer