GPPA GIAC Certified Perimeter Protection Analyst Question and Answers

Which of the following tools is described below?

It is a set of tools that are used for sniffing passwords, e-mail, and HTTP traffic. Some of its tools include arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf. It is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools for switching across switched networks. It can also be used to capture authentication information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP, etc.

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Which of the following commands can change the IOS to be loaded in a router?

Which of the following well-known ports is used by BOOTP?

You send and receive messages on Internet. A man-in-the-middle attack can be performed to capture and read your message.

Which of the following Information assurance pillars ensures the security of your message or data against this type of attack?

Jain works as a contract Ethical Hacker. He has recently got a project to do security checking for www.abc.com. He wants to find out the operating system of the ABC server in the information gathering step.

Which of the following commands will he use to accomplish the task?

Each correct answer represents a complete solution. (Choose two.)

Which of the following types of Network Address Translation (NAT) uses a pool of public IP addresses?

You work as a Network Administrator for Tech Perfect Inc. You are required to verify security policies configured in the company's networks.

Which of the following applications will you use to accomplish the task?

A firewall is a combination of hardware and software, used to provide security to a network. It is used to protect an internal network or intranet against unauthorized access from the Internet or other outside networks. It restricts inbound and outbound access and can analyze all traffic between an internal network and the Internet. Users can configure a firewall to pass or block packets from specific IP addresses and ports.

Which of the following tools works as a firewall for the Linux 2.4 kernel?

Secure Shell (SSH) is a network protocol that allows data to be exchanged using a secure channel between two networked devices.

Which of the following features are supported by Secure Shell?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following statements are true about the Network Honeypot a rulebase?

Each correct answer represents a complete solution. (Choose all that apply.)

Your customer is concerned about security. He wants to make certain no one in the outside world can see the IP addresses inside his network.

What feature of a router would accomplish this?

Adam, a malicious hacker purposely sends fragmented ICMP packets to a remote target. The total size of this ICMP packet once reconstructed is over 65,536 bytes.

On the basis of above information, which of the following types of attack is Adam attempting to perform?

You are tasked with configuring your routers with a minimum security standard that includes the following:

• A local Username and Password configured on the router

• A strong privilege mode password

• Encryption of user passwords

• Configuring telnet and ssh to authenticate against the router user database

Choose the configuration that meets these requirements best.

Fill in the blank with the appropriate tool name.

__________ consists of flexible system architecture that provides a proper way for conducting industrial audits when it is required to identify unique positions of items.

Jain works as a professional Ethical Hacker. He has been assigned a project for testing the security of www.abc.com.

He wants to corrupt an IDS signature database so that performing attacks on the server is made easy and he can observe the flaws in the ABC server.

To perform his task, he first of all sends a virus that continuously changes its signature to avoid detection from IDS. Since the new signature of the virus does not match the old signature, which is entered in the IDS signature database, IDS becomes unable to point out the malicious virus.

Which of the following IDS evasion attacks is John performing?

Poplu works as a Computer Hacking Forensic Investigator. He has been called by an organization to conduct a seminar to give necessary information related to sexual harassment within the work place. Poplu started with the definition and types of sexual harassment. He then wants to convey that it is important that records of the sexual harassment incidents should be maintained, which helps in further legal prosecution.

Which of the following data should be recorded in this documentation?

Each correct answer represents a complete solution. (Choose all that apply.)

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. John wants to redirect all TCP port 80 traffic to UDP port 40, so that he can bypass the firewall of the We-are-secure server.

Which of the following tools will John use to accomplish his task?

Which of the following IPv6 transition technologies is used by the DirectAccess if a user is in a remote location and a public IPv4 address, instead of public IPv6 address, has been assigned to the computer?

What is the function of baseline audit?

You are the Network Administrator for a large corporate network. You want to monitor all network traffic on your local network for suspicious activities and receive a notification when a possible attack is in process.

Which of the following actions will you take for this?

Which of the following is a chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event?

You run the tcpdump command line utility and get a report produced by tcpdump.

What information does this report include?

Each correct answer represents a complete solution. (Choose three.)

John works as a Network Administrator for Web Perfect Inc. The company has a wireless LAN network. John has configured shared key authentication on a client. The client and the AP start exchanging the frames to enable authentication.

Which of the following vulnerabilities may occur while the client and the AP exchange the challenge text over the wireless link?

Which of the following steps are generally followed in computer forensic examinations?

Each correct answer represents a complete solution. (Choose three.)

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

Which of the following modes is also referred to as client mode?

You work as a Network Administrator for ABC Inc. The company has a TCP/IP-based routed network. Two routers have been configured on the network. A router receives a packet.

Which of the following actions will the router take to route the incoming packet?

Each correct answer represents a part of the solution. (Choose two.)

Jain works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.abc.com. In order to do so, he performs the following steps of the preattack phase successfully:

• Information gathering

• Determination of network range

• Identification of active systems

• Location of open ports and applications 

Now, which of the following tasks should he perform next?

Which of the following honeypots is a low-interaction honeypot and is used by companies or corporations for capturing limited information about malicious hackers?

Which of the following firewall types operates at the Network layer of the OSI model and can filter data by port, interface address, source address, and destination address?

You work as a Security Manager for Tech Perfect Inc. The company has a Windows-based network. You want to scroll real-time network traffic to a command console in a readable format.

Which of the following command line utilities will you use to accomplish the task?

Which of the following can be applied as countermeasures against DDoS attacks?

Each correct answer represents a complete solution. (Choose all that apply.)

As a professional hacker, you want to crack the security of secureserver.com. For this, in the information gathering step, you performed scanning with the help of nmap utility to retrieve as many different protocols as possible being used by the secureserver.com so that you could get the accurate knowledge about what services were being used by the secure server.com.

Which of the following nmap switches have you used to accomplish the task?

You work as the Security Administrator for Prodotxiss Inc. You want to ensure the security of your Wi-Fi enterprise network against the wireless snooping attacks.

Which of the following measures will you take over the site network devices of the network?

Which of the following features does the Nmap utility have?

Each correct answer represents a complete solution. (Choose all that apply.)

The general form of the Cisco IOS is a.b.c.de.

Which of the following indicates the major version number of the Cisco IOS?

You work as a Network Administrator for ABC Inc. The company has a corporate intranet setup. A router is configured on your network to connect outside hosts to the internetworking. For security, you want to prevent outside hosts from pinging to the hosts on the internetwork.

Which of the following steps will you take to accomplish the task?

You work as a Network Administrator for Net Perfect Inc. The company has a Windows Server 2008 network environment. The network is configured as a Windows Active Directory-based single forest single domain network. The network is configured on IP version 6 protocol. All the computers on the network are connected to a switch device. One day, users complain that they are unable to connect to a file server. You try to ping the client computers from the server, but the pinging fails. You try to ping the server's own loopback address, but it fails to ping. You restart the server, but the problem persists.

What is the most likely cause?