GISF GIAC Information Security Fundamentals Questions and Answers

You work as a Computer Hacking Forensic Investigator for SecureNet Inc. You want to investigate Cross-Site Scripting attack on your company's Website. Which of the following methods of investigation can you use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Under the SMART scheme, the Predictive Failure Analysis Technology is used to determine the failure or crash for which of the following parts of a computer system?

Which of the following firewalls operates at three layers- Layer3, Layer4, and Layer5?

John works as a professional Ethical Hacker. He is assigned a project to test the security of www.we-are-secure.com. He enters a single quote in the input field of the login page of the Weare- secure Web site and receives the following error message:

Microsoft OLE DB Provider for ODBC Drivers error '0x80040E14'

This error message shows that the We-are-secure Website is vulnerable to __________.

The method used to encrypt messages by transposing or scrambling the characters in a certain manner is known as ______.

Which of the following types of firewall functions at the Session layer of OSI model?

Which of the following firewalls inspects the actual contents of packets?

In packet filtering types of firewalls, which of the following specifies what traffic can and cannot traverse the firewall?

You work as a Network Administrator for ABC Inc. The company uses a secure wireless network.

John complains to you that his computer is not working properly. What type of security audit do you need to conduct to resolve the problem?

You work as a Network Administrator for NetTech Inc. The company wants to encrypt its e-mails.

Which of the following will you use to accomplish this?

Which of the following cryptographic system services ensures that information will not be disclosed to any unauthorized person on a local network?

You have successfully installed an IRM server into your environment. This IRM server will be utilized to protect the company's videos, which are available to all employees but contain sensitive data. You log on to the WSS 3.0 server with administrator permissions and navigate to the Operations section. What option should you now choose so that you can input the RMS server name for the WSS 3.0 server to use?

Kelly is the project manager of the NNQ Project for her company. This project will last for one year and has a budget of $350,000. Kelly is working with her project team and subject matter experts to begin the risk response planning process. When the project manager begins the plan risk response process, what two inputs will she need?

Which of the following is a remote access protocol that supports encryption?

You are the Security Consultant and have been contacted by a client regarding their encryption and hashing algorithms. Their in-house network administrator tells you that their current hashing algorithm is an older one with known weaknesses and is not collision resistant. Which algorithm are they most likely using for hashing?

Based on the information given in the case study, which two authentication methods should you use to allow customers to access their photos on the Web site?

(Click the Exhibit button on the toolbar to see the case study.)

Each correct answer represents a part of the solution. Choose two.

The security of a computer against the unauthorized usage largely depends upon the efficiency of the applied access control method. Which of the following statements are true about a computer access control method?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following tools is an open source network intrusion prevention and detection system that operates as a network sniffer?

Which of the following statements are TRUE regarding asymmetric encryption and symmetric encryption? Each correct answer represents a complete solution. Choose all that apply.

Which of the following statements are true about UDP?

Each correct answer represents a complete solution. Choose all that apply.

Which of the following protocols can help you get notified in case a router on a network fails?

You work as a Network Administrator for Marioxnet Inc. You have the responsibility of handling two routers with BGP protocol for the enterprise's network. One of the two routers gets flooded with an unexpected number of data packets, while the other router starves with no packets reaching it. Which of the following attacks can be a potential cause of this?

You switch on your mobile Bluetooth device to transfer data to another Bluetooth device. Which of the following Information assurance pillars ensures that the data transfer is being performed with the targeted authorized Bluetooth device and not with any other or unauthorized device?

You work in an enterprise as a Network Engineer. Your enterprise has a secure internal network.

You want to apply an additional network packet filtering device that is intermediate to your enterprise's internal network and the outer network (internet). Which of the following network zones will you create to accomplish this task?

Your company is covered under a liability insurance policy, which provides various liability coverage for information security risks, including any physical damage of assets, hacking attacks, etc. Which of the following risk management techniques is your company using?

Andrew works as a Network Administrator for NetTech Inc. The company has a Windows Server 2008 domain-based network. The network contains five Windows 2008 member servers and 120 Windows XP Professional client computers. Andrew is concerned about the member servers that are not meeting the security requirements as mentioned in the security policy of the company. Andrew wants to compare the current security settings of the member servers with the security template that is configured according to the security policy of the company. Which of the following tools will Andrew use to accomplish this?

Which of the following types of attack can guess a hashed password?

The IT Director of the company is very concerned about the security of the network. Which audit policy should he implement to detect possible intrusions into the network? (Click the Exhibit button on the toolbar to see the case study.)

You are the project manager for BlueWell Inc. You are reviewing the risk register for your project. The risk register provides much information to you, the project manager and to the project team during the risk response planning. All of the following are included in the risk register except for which item?

Which of the following wireless security features provides the best wireless security mechanism?

Rick works as a Network Administrator for Fimbry Hardware Inc. Based on the case study, which network routing strategy will he implement for the company? (Click the Exhibit button on the toolbar to see the case study.)

You work as a Software Developer for uCertify Inc. The company has several branches worldwide. The company uses Visual Studio.NET 2005 as its application development platform. You have recently finished the development of an application using .NET Framework 2.0. The application can be used only for cryptography. Therefore, you have implemented the application on a computer. What will you call the computer that implemented cryptography?

Which of the following logs contains events pertaining to security as defined in the Audit policy?

Which of the following devices or hardware parts employs SMART model system as a monitoring system?

Which of the following Windows Security Center features is implemented to give a logical layer protection between computers in a networked environment?

Which of the following protocols is used to prevent switching loops in networks with redundant switched paths?

Configuration Management (CM) is an Information Technology Infrastructure Library (ITIL) IT Service Management (ITSM) process. Configuration Management is used for which of the following?

1. To account for all IT assets

2. To provide precise information support to other ITIL disciplines

3. To provide a solid base only for Incident and Problem Management

4. To verify configuration records and correct any exceptions

Bluetooth uses the _________ specification in the ________ band with FHSS technology.

Firekiller 2000 is an example of a __________.

John is a merchant. He has set up a LAN in his office. Some important files are deleted as a result of virus attack. John wants to ensure that it does not happen again. What will he use to protect his data from virus?

Which of the following statements about a brute force attack is true?

You are responsible for virus protection for a large college campus. You are very concerned that your antivirus solution must be able to capture the latest virus threats. What sort of virus protection should you implement?

Which of the following are the types of Intrusion detection system?

Which of the following is used in asymmetric encryption?

Which of the following statements are true about Public-key cryptography? Each correct answer represents a complete solution. Choose two.

You work as the project manager for Bluewell Inc. Your project has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?