GPPA GIAC Certified Perimeter Protection Analyst Questions and Answers

Paul works as a Technical Representative in a CSIRT for ABC Inc. His team is called to investigate the computer of an employee, who is suspected for classified data theft. Suspect's computer runs on Windows operating system. Paul wants to collect data and evidences for further analysis. He knows that in Windows operating system, the data is searched in pre-defined steps for proper and efficient analysis.

Which of the following is the correct order for searching data on a Windows based system?

Which of the following types of firewall functions by creating two different communications, one between the client and the firewall, and the other between the firewall and the end server?

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He wants to send malicious data packets in such a manner that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the We-are-secure server and execute malicious data.

Which of the following tools can he use to accomplish the task?

Which of the following proxy servers is also referred to as transparent proxies or forced proxies?

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the high school. It is suspected that the explicit child pornography contents are stored in the iPod. Adam wants to investigate the iPod extensively.

Which of the following operating systems will Adam use to carry out his investigations in more extensive and elaborate manner?

You work as a Network Administrator for ABC Inc. The office network is configured as an IPv6 network. You have to configure a computer with the IPv6 address, which is equivalent to an IPv4 publicly routable address.

Which of the following types of addresses will you choose?

Which of the following algorithms is used as a default algorithm for ESP extension header in IPv6?

You are the Network Administrator for a large corporate network. You want to monitor all network traffic on your local network for suspicious activities and receive a notification when a possible attack is in process.

Which of the following actions will you take for this?

Which of the following describes the term inside global in NAT configuration?

The stateful firewalls combine the significant flows into conversations.

Which of the following properties is used to classify a flow?

Each correct answer represents a part of the solution. (Choose all that apply.)

You are the Network Administrator for a college. Wireless access is widely used at the college. You want the most secure wireless connections you can have.

Which of the following would you use?

Fill in the blank with the appropriate tool name.

______________ is a network protocol analyzer tool that is used to capture packet data from an existing network or examine packet data from a pre-saved file.

Which of the following tools is used to analyze the files produced by several popular packetcapture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

Which of the following fields are specified when rules are created for the Network Honeypot rulebase?

Each correct answer represents a complete solution. (Choose all that apply.)

John works as a professional Ethical Hacker. He is assigned a project to test the security of www.abc.com. You have searched all open ports of the ABC server. Now, you want to perform the next information-gathering step, i.e., passive OS fingerprinting.

Which of the following tools can you use to accomplish the task?

Which of the following Denial-of-Service (DoS) attacks employ IP fragmentation mechanism?

Each correct answer represents a complete solution. (Choose two.)

An attacker makes an attempt against a Web server. The result is that the attack takes the form of URLs. These URLs search for a certain string that identifies an attack against the Web server.

Which IDS/IPS detection method do the URLs use to detect and prevent an attack?

Which of the following tools performs comprehensive tests against web servers for multiple items, including over 6100 potentially dangerous files/CGIs?

Which of the following can be applied as countermeasures against DDoS attacks?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following tools is an open source protocol analyzer that can capture traffic in real time?

Which of the following responsibilities does not come under the audit process?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following is the module of OpenSER?

You work as a Network Administrator for Infonet Inc. The company has a Windows Server 2008 Active Directory-based single forest multiple domain IPv4 network. All the DNS servers on the network run Windows Server 2008. The users in the network use NetBIOS name to connect network application on the network. You have migrated the network to IPv6-enabled network. Now you want to enable DNS Server to perform lookups in GlobalNames Zone.

Which of the following commands will you use to accomplish the task?

Which of the following address translation types only translates one (and only one) IP address to another without using ports?

You are a professional Computer Hacking forensic investigator. You have been called to collect the evidences of Buffer Overflows or Cookie snooping attack.

Which of the following logs will you review to accomplish the task?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following has a set of system-independent functions for packet capture and network analysis?

Jain works as a professional Ethical Hacker. He has been assigned the project of testing the security of testing the security of www.abc.com. Jain notices that the ABC network is vulnerable to a man-in-the-middle attack since the key exchange process of the cryptographic algorithm it is using does not authenticate participants.

Which of the following cryptographic algorithms is being used by the ABC server?

Which of the following files is a Cisco IOS configuration file that resides in RAM?

Which of the following tools is described below?

It is a set of tools that are used for sniffing passwords, e-mail, and HTTP traffic. Some of its tools include arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf. It is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools for switching across switched networks. It can also be used to capture authentication information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP, etc.

Which of the following types of firewall functions at the Session layer of Open System Interconnection (OSI) model?

You work as a Security Administrator for ABC Inc. You have implemented and configured a web application security scanner in the company's network. It helps in the automated review of the web applications with the defined purpose of discovering security vulnerabilities. In order to perform this task, the web application security scanner examines a number of vulnerabilities.

What are these vulnerabilities?

Each correct answer represents a complete solution. (Choose three.)

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system.

Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following wireless security policies helps to prevent the wireless enabled laptops from peer-to-peer attacks when the laptops are used in public access network? (Choose two.)

Which of the following commands configures a router to encrypt all passwords entered after the command has been executed, as well as all passwords already on the running configuration?

Jain works as a contract Ethical Hacker. He has recently got a project to do security checking for www.abc.com. He wants to find out the operating system of the ABC server in the information gathering step.

Which of the following commands will he use to accomplish the task?

Each correct answer represents a complete solution. (Choose two.)

You send and receive messages on Internet. A man-in-the-middle attack can be performed to capture and read your message.

Which of the following Information assurance pillars ensures the security of your message or data against this type of attack?

You work as a Network Administrator for Net World Inc. You have configured a few routers on the company's network. You are required to accomplish the following goals:

• Encrypt all service passwords immediately.

• Ensure that encryption is also applied on the passwords changed in the future.

You run the following command service password-encryption.

Which of the goals will this action accomplish?

Which of the following is used as a default port by the TELNET utility?

You are implementing a host based intrusion detection system on your web server. You feel that the best way to monitor the web server is to find your baseline of activity (connections, traffic, etc.) and to monitor for conditions above that baseline.

This type of IDS is called __________.