GCED Online Practice Questions and Answers
Which could be described as a Threat Vector?
A. A web server left6 unpatched and vulnerable to XSS
B. A coding error allowing remote code execution
C. A botnet that has infiltrated perimeter defenses
D. A wireless network left open for anonymous use
Network administrators are often hesitant to patch the operating systems on CISCO router and switch operating systems, due to the possibility of causing network instability, mainly because of which of the following?
A. Having to rebuild all ACLs
B. Having to replace the kernel
C. Having to re-IP the device
D. Having to rebuild ARP tables
E. Having to rebuild the routing tables
A company estimates a loss of $2,374 per hour in sales if their website goes down. Their webserver hosting site's documented downtime was 7 hours each quarter over the last two years. Using the information, what can the analyst determine?
A. Annualized loss expectancy
B. CVSS risk score
C. Total cost of ownership
D. Qualitative risk posture
Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?
A. Event logs from a central repository
B. Directory listing of system files
C. Media in the CDrom drive
D. Swap space and page files
Why would the pass action be used in a Snort configuration file?
A. The pass action simplifies some filtering by specifying what to ignore.
B. The pass action passes the packet onto further rules for immediate analysis.
C. The pass action serves as a placeholder in the snort configuration file for future rule updates.
D. Using the pass action allows a packet to be passed to an external process.
E. The pass action increases the number of false positives, better testing the rules.
Before re-assigning a computer to a new employee, what data security technique does the IT department use to make sure no data is left behind by the previous user?
A. Fingerprinting
B. Digital watermarking
C. Baselining
D. Wiping
How does the Cisco IOS IP Source Guard feature help prevent spoofing attacks?
A. Filters traffic based on IP address once a DHCP address has been assigned
B. Prevents unauthorized MAC addresses from receiving an IP address on the network
C. Blocks unsolicited ARP packets after a client has received an IP address
D. Rate limits client traffic to prevent CAM table flooding
An analyst will capture traffic from an air-gapped network that does not use DNS. The analyst is looking for unencrypted Syslog data being transmitted. Which of the following is most efficient for this purpose?
A. tcpdump –s0 –i eth0 port 514
B. tcpdump –nnvvX –i eth0 port 6514
C. tcpdump –nX –i eth0 port 514
D. tcpdump –vv –i eth0 port 6514
Which of the following is considered a preventative control in operational security?
A. Smoke Sensors
B. Fire Suppressant
C. Voltage Regulators
D. Vibration Alarms
How does data classification help protect against data loss?
A. DLP systems require classification in order to protect data
B. Data at rest is easier to protect than data in transit
C. Digital watermarks can be applied to sensitive data
D. Resources and controls can be appropriately allocated