Summer Sale - Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dpm65

GCFW GIAC Certified Firewall Analyst Questions and Answers

Questions 4

Which of the following is a Windows-based tool used for packet analysis?

Options:

A.

WinPcap

B.

AirPcap

C.

Tcpdump

D.

WinDump

Buy Now
Questions 5

Which of the following number ranges is used for the IPX Standard ACL?

Options:

A.

800-899

B.

1000-1099

C.

900-999

D.

1200-1299

Buy Now
Questions 6

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Options:

A.

DOS boot disk

B.

Linux Live CD

C.

Secure Authentication for EnCase (SAFE)

D.

EnCase with a hardware write blocker

Buy Now
Questions 7

Which of the following configuration schemes in IPv6 allows a client to automatically configure its own IP address with or without IPv6 routers?

Options:

A.

Stateless configuration

B.

Stateful configuration

C.

Stateful autoconfiguration

D.

Stateless autoconfiguration

Buy Now
Questions 8

You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based network.

You have configured an 802.11g Wireless LAN (WLAN) on your network. Which of the following factors can deteriorate the performance and range of the WLAN?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Concrete walls

B.

Fiberglass partitions

C.

Metal ceilings

D.

Cordless phones

Buy Now
Questions 9

A Proxy firewall, also known as Application Gateway Firewall, filters information at which of the following layers of the OSI reference model?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Transport layer

B.

Presentation layer

C.

Physical layer

D.

Application layer

Buy Now
Questions 10

Which of the following commands will you use with the tcpdump command to capture the traffic from a filter stored in a file?

Options:

A.

tcpdump -F file_name

B.

tcpdump -A file_name

C.

tcpdump -D file_name

D.

tcpdump -X file_name

Buy Now
Questions 11

You are the Network Administrator and your company has recently implemented encryption for all emails. You want to check to make sure that the email packages are being encrypted. What tool would you use to accomplish this?

Options:

A.

Vulnerability analyzer

B.

Performance Monitor

C.

Password cracker

D.

Packet sniffer

Buy Now
Questions 12

Which of the following devices are used to implement Network Address Translation (NAT)?

Options:

A.

Routers and firewalls

B.

Firewalls and file servers

C.

Switches and firewalls

D.

Routers and switches

Buy Now
Questions 13

In which of the following conditions is the SYN Protector rule base activated in passive mode?

Options:

A.

When the number of SYN packets per second is equal to 13,425 (default)

B.

Only when the number of SYN packets per second is equal to the sum of the lower SYNs-persecond threshold and the upper SYNs-per-second threshold

C.

When the number of SYN packets per second is smaller than the sum of the lower SYNs-persecond threshold and the upper SYNs-per-second threshold

D.

When the number of SYN packets per second is greater than the sum of the lower SYNs-persecond threshold and the upper SYNs-per-second threshold

Buy Now
Questions 14

Which of the following attacking methods allows the bypassing of access control lists on servers or routers, either hiding a computer on a network or allowing it to impersonate another computer by changing the Media Access Control address?

Options:

A.

IP address spoofing

B.

ARP spoofing

C.

MAC spoofing

D.

VLAN hoping

Buy Now
Questions 15

An organization has a TCP/IP based network. It uses IPv6 addressing in its network. IPv6 tackles addressing and routing-table problems, and improves the protocol as well. Which of the following statements is true about IPv6?

Options:

A.

It uses symmetric key encryption.

B.

Its address is 32 bits in length.

C.

It eliminates the primary need for Network Address Translation (NAT).

D.

It implements broadcasting.

Buy Now
Questions 16

In which of the following steps of firewall log analysis process is aggregation for nodes defined?

Options:

A.

View transformation

B.

Assess available data

C.

Visual transformation

D.

Process information

Buy Now
Questions 17

An organization has more than a couple of external business, and exchanges dynamic routing information with the external business partners. The organization wants to terminate all routing from a partner at an edge router, preferably receiving only summary routes from the partner. Which of the following will be used to change all partner addresses on traffic into a range of locally assigned addresses?

Options:

A.

IPsec

B.

Firewall

C.

ACL

D.

NAT

Buy Now
Questions 18

Which of the following statements about segmentation of a network using router is true?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Filtering can be done based on layer 3 information.

B.

Segmenting of a network using router will increase latency.

C.

Number of broadcast domains will be decreased.

D.

Broadcast will not be forwarded to other segment through the router.

Buy Now
Questions 19

Which of the following can be configured so that when an alarm is activated, all doors lock and the suspect or intruder is caught between the doors in the dead-space?

Options:

A.

Man trap

B.

Network Intrusion Detection System (NIDS)

C.

Biometric device

D.

Host Intrusion Detection System (HIDS)

Buy Now
Questions 20

David works as the Security Manager for PassGuide Inc. He has been assigned a project to detect the attacks over multiple connections and sessions and to count the number of scanned ports in a defined time period. Which of the following rulebases will he use to accomplish the task?

Options:

A.

Traffic Anomalies rulebase

B.

Exempt rulebase

C.

SYN Protector rulebase

D.

Network Honeypot rulebase

Buy Now
Questions 21

Which of the following tools can be used for OS fingerprinting?

Options:

A.

nmap

B.

netstat

C.

DIG

D.

whois

Buy Now
Questions 22

You work as a Network Administrator for Net World Inc. You have configured a few routers on the company's network. You are required to accomplish the following goals:

l Encrypt all service passwords immediately.

l Ensure that encryption is also applied on the passwords changed in the future.

You run the following command.

Service password-encryption

Which of the goals will this action accomplish?

Options:

A.

The action will ensure that encryption is also applied on the passwords changed in the future.

B.

The action will accomplish neither of the goals.

C.

The action will accomplish both the goals.

D.

The action will encrypt all passwords immediately.

Buy Now
Questions 23

You work as a technician for Tech Perfect Inc. You are troubleshooting an Internet name resolution issue. You ping your ISP's DNS server address and find that the server is down. You want to continuously ping the DNS address until you have stopped the command. Which of the following commands will you use?

Options:

A.

ping -a

B.

ping -l

C.

ping -n

D.

ping –t

Buy Now
Questions 24

Which of the following command-line utilities is used to show the state of current TCP/IP connections?

Options:

A.

PING

B.

NSLOOKUP

C.

NETSTAT

D.

TRACERT

Buy Now
Questions 25

Which of the following ports cannot be used to access the router from a computer?

Options:

A.

Serial port

B.

Vty

C.

Aux port

D.

Console port

Buy Now
Questions 26

Which of the following Wireless LAN standard devices is least affected by interference from domestic appliances such as microwave ovens?

Options:

A.

802.11b

B.

802.11

C.

802.11a

D.

802.11g

Buy Now
Questions 27

You are implementing passive OS fingerprinting in a network. Which of the following aspects are required to be configured there?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Edit signature vulnerable OS lists.

B.

Limit the attack relevance rating calculation to a specific IP address range.

C.

Define event action rules filters using the OS relevancy value of the target.

D.

Enable passive analysis.

E.

Define and import OS mappings.

Buy Now
Questions 28

You have to ensure that your Cisco Router is only accessible via telnet and ssh from the following hosts and subnets:

10.10.2.103

10.10.0.0/24

Which of the following sets of commands will you use to accomplish the task?

Options:

A.

access-list 10 permit host 10.10.2.103

access-list 10 permit 10.10.0.0 0.0.0.255

access-list 10 deny any

line vty 0 4

access-class 10 in

B.

access-list 10 permit 10.10.2.103

access-list 10 permit 10.10.0.0 0.0.0.255

access-list 10 deny any

line vty 0 4

access-group 10 in

C.

access-list 10 permit host 10.10.2.103

access-list 10 permit 10.10.0.0 0.0.0.255

access-list 10 deny any

line vty 0 4

access-class 10 out

D.

access-list 10 permit host 10.10.2.103

access-list 11 permit host 10.10.0.0 255.255.255.0

access-list 12 deny any

line vty 0 4

access-group 10, 11, 12 in

Buy Now
Questions 29

You work as a Network Administrator for Tech Perfect Inc. You are required to verify security policies configured in the company's networks. Which of the following applications will you use to accomplish the task?

Options:

A.

Network enumerator

B.

Web application security scanner

C.

Computer worm

D.

Port scanner

Buy Now
Questions 30

Which of the following IDs is used to reassemble the fragments of a datagram at the destination point?

Options:

A.

IP identification number

B.

SSID

C.

MAK ID

D.

IP address

Buy Now
Questions 31

Which of the following actions can be taken as the countermeasures against the ARP spoofing attack?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Using Private VLANs

B.

Looking for large amount of ARP traffic on local subnets

C.

Placing static ARP entries on servers and routers

D.

Using 8 digit passwords for authentication

Buy Now
Questions 32

Which of the following firewalls operates at three layers- Layer3, Layer4, and Layer5?

Options:

A.

Application layer firewall

B.

Proxy firewall

C.

Dynamic packet-filtering firewall

D.

Circuit-level firewall

Buy Now
Questions 33

Which of the following is a maintenance protocol that permits routers and host computers to swap basic control information when data is sent from one computer to another?

Options:

A.

ICMP

B.

SNMP

C.

IGMP

D.

BGP

Buy Now
Questions 34

Which of the following tools can be used as a Linux vulnerability scanner that is capable of identifying operating systems and network services?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Cheops-ng

B.

Fport

C.

Cheops

D.

Elsave

Buy Now
Questions 35

Which of the following is used for debugging the network setup itself by determining whether all necessary routing is occurring properly, allowing the user to further isolate the source of a problem?

Options:

A.

iptables

B.

WinPcap

C.

Netfilter

D.

tcpdump

Buy Now
Questions 36

Sandra, a novice computer user, works on Windows environment. She experiences some problem regarding bad sectors formed in a hard disk of her computer. She wants to run CHKDSK command to check the hard disk for bad sectors and to fix the errors, if any, occurred. Which of the following switches will she use with CHKDSK command to accomplish the task?

Options:

A.

CHKDSK /R /F

B.

CHKDSK /C /L

C.

CHKDSK /V /X

D.

CHKDSK /I

Buy Now
Questions 37

Fill in the blank with appropriate address translation type.

A______ performs translation of one IP address to a different one automatically. It requires manually defining two sets of addresses on the address translation device (probably a router). One set defines which inside addresses are allowed to be translated, and the other defines what these addresses are to be translated to.

Options:

Buy Now
Questions 38

You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Temporary Internet Folder

B.

History folder

C.

Download folder

D.

Cookies folder

Buy Now
Questions 39

When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as __________.

Options:

A.

False negative

B.

False positive

C.

True negative

D.

True positive

Buy Now
Questions 40

What are the advantages of stateless autoconfiguration in IPv6?

Each correct answer represents a part of the solution. Choose three.

Options:

A.

Ease of use.

B.

No server is needed for stateless autoconfiguration.

C.

It provides basic authentication to determine which systems can receive configuration data

D.

No host configuration is necessary.

Buy Now
Questions 41

Which of the following types of firewalls increases the security of data packets by remembering the state of connection at the network and the session layers as they pass through the filter?

Options:

A.

Stateful packet filter firewall

B.

Stateless packet filter firewall

C.

Virtual firewall

D.

PIX firewall

Buy Now
Questions 42

Which of the following firewalls inspects the actual contents of packets?

Options:

A.

Application-level firewall

B.

Stateful inspection firewall

C.

Circuit-level firewall

D.

Packet filtering firewall

Buy Now
Questions 43

Which of the following describes the term inside global in NAT configuration?

Options:

A.

It is a local MAC address assigned to a host in a private network.

B.

It is the data that comes inside a local network from an external host.

C.

It is a local IP address assigned to a host in a private network.

D.

It is the registered (public) IP address that represents the inside hosts in private network to the outside network.

Buy Now
Questions 44

You are a professional Computer Hacking forensic investigator. You have been called to collect the evidences of Buffer Overflows or Cookie snooping attack. Which of the following logs will you review to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Event logs

B.

Program logs

C.

System logs

D.

Web server logs

Buy Now
Questions 45

Which of the following techniques is used to identify attacks originating from a botnet?

Options:

A.

BPF-based filter

B.

Recipient filtering

C.

IFilter

D.

Passive OS fingerprinting

Buy Now
Questions 46

You are implementing a host based intrusion detection system on your web server. You feel that the best way to monitor the web server is to find your baseline of activity (connections, traffic, etc.) and to monitor for conditions above that baseline. This type of IDS is called __________.

Options:

A.

Reactive IDS

B.

Signature Based

C.

Passive IDS

D.

Anomaly Based

Buy Now
Questions 47

Which of the following is a chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event?

Options:

A.

Security audit

B.

Corrective controls

C.

Audit trail

D.

Detective controls

Buy Now
Questions 48

You work as a Network Troubleshooter for PassGuide Inc. You want to tunnel the IPv6 traffic across an IPv4 supporting portion of the company's network. You are using the interface configuration mode for the tunnel. Which of the following IP addresses will you enter after the tunnel source command?

Options:

A.

The IPv4 address assigned to the local interface on which the tunnel is built

B.

The IPv4 address assigned to the remote interface on which the tunnel is built

C.

The IPv6 address assigned to the local tunnel interface

D.

The IPv6 address assigned to the remote tunnel interface

Buy Now
Questions 49

Sam works as a Network Administrator for Gentech Inc. He has been assigned a project to develop the rules that define the IDP policy in the rulebase. Which of the following will he define as the components of the IDP policy rule?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

IDP Profiler

B.

IDP rule IP actions

C.

IDP appliance deployment mode

D.

IDP rule notifications

Buy Now
Questions 50

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

Options:

A.

Network-based

B.

File-based

C.

Signature-based

D.

Anomaly-based

Buy Now
Questions 51

John works as a professional Ethical Hacker. He has been assigned a project for testing the security of www.we-are-secure.com. He wants to corrupt an IDS signature database so that performing attacks on the server is made easy and he can observe the flaws in the We-are-secure server. To perform his task, he first of all sends a virus that continuously changes its signature to avoid detection from IDS. Since the new signature of the virus does not match the old signature, which is entered in the IDS signature database, IDS becomes unable to point out the malicious virus. Which of the following IDS evasion attacks is John performing?

Options:

A.

Session splicing attack

B.

Evasion attack

C.

Polymorphic shell code attack

D.

Insertion attack

Buy Now
Questions 52

At which of the following layers of the Open System Interconnection (OSI) model the Internet Control Message Protocol (ICMP) and the Internet Group Management Protocol (IGMP) work?

Options:

A.

The Physical layer

B.

The Presentation layer

C.

The Network layer

D.

The Data-Link layer

Buy Now
Questions 53

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police.

A project has been assigned to him to investigate an iPod, which was seized from a student of the high school. It is suspected that the explicit child pornography contents are stored in the iPod. Adam wants to investigate the iPod extensively. Which of the following operating systems will Adam use to carry out his investigations in more extensive and elaborate manner?

Options:

A.

Mac OS

B.

Linux

C.

Windows XP

D.

MINIX 3

Buy Now
Questions 54

Which of the following protocols is used by voice over IP (VoIP) applications?

Options:

A.

ICMP

B.

IPv6

C.

UDP

D.

TCP

Buy Now
Questions 55

Which of the following statements about the traceroute utility are true?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It generates a buffer overflow exploit by transforming an attack shell code so that the new attack shell code cannot be recognized by any Intrusion Detection Systems.

B.

It uses ICMP echo packets to display the Fully Qualified Domain Name (FQDN) and the IP address of each gateway along the route to the remote host.

C.

It records the time taken for a round trip for each packet at each router.

D.

It is an online tool that performs polymorphic shell code attacks.

Buy Now
Questions 56

Windump is a Windows port of the famous TCPDump packet sniffer available on a variety of platforms. In order to use this tool on the Windows platform a user must install a packet capture library.

What is the name of this library?

Options:

A.

PCAP

B.

WinPCap

C.

libpcap

D.

SysPCap

Buy Now
Questions 57

You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based routed network. You have recently come to know about the Slammer worm, which attacked computers in 2003 and doubled the number of infected hosts every 9 seconds or so. Slammer infected 75000 hosts in the first 10 minutes of the attack. To mitigate such security threats, you want to configure security tools on the network. Which of the following tools will you use?

Options:

A.

Intrusion Prevention Systems

B.

Firewall

C.

Anti-x

D.

Intrusion Detection Systems

Buy Now
Questions 58

Which of the following wireless security features provides the best wireless security mechanism?

Options:

A.

WPA with 802.1X authentication

B.

WPA with Pre Shared Key

C.

WEP

D.

WPA

Buy Now
Exam Code: GCFW
Exam Name: GIAC Certified Firewall Analyst
Last Update: Jun 30, 2025
Questions: 391

PDF + Testing Engine

$57.75  $164.99

Testing Engine

$43.75  $124.99
buy now GCFW testing engine

PDF (Q&A)

$36.75  $104.99
buy now GCFW pdf
dumpsmate guaranteed to pass
24/7 Customer Support

DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.

Site Secure

mcafee secure

TESTED 03 Jul 2025