SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
GIAC
Start Test
Study First
Subjects
:
certifications
,
giac
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. OSI
When talking about protocols and referencing layers - what stack is used
The protected enclave to defense in depth
Datagram length of a UDP packet
Group
2. open source tool for monitoring - can be used as a NIDS - has quick updates and flexibility for custom rules
Overview of TCP
Snort
A netmask
Brute force
3. 1 and 2 - Voice/Low speed data - 3 - Voice/Data 10Mb - 4 - Voice/Data 16Mb - 5 - 5e - Voice/Data 100Mb to 1Gb - 6 - Standard for gigabit
The different cable categories
War Dialing
the application layer
Some malware propagation techniques
4. Stateful firewalls maintain state of traffic flows
Trap door
Datagram length of a UDP packet
Stateful firewall
The goals of cryptography
5. Free linux WLAN analysis tool - completely passive - cannot be detected - supports advanced GPS integration and mapping features - used for wardriving - WLAN vulerability assessment
Types of viruses
Kismet
Nmap scanning techniques
The Information Centric defense in depth
6. Handles transmissions across the physical media like wires - fiber - etc
Router
The physical layer stack
ACK piggybacking
IDS not
7. A hash is produced when applied to a monitored file. The hash always generates the same value unless a change was made. HIDS software checks the hashes of monitored files and if a change is found - analyst is notified. - ie: tripwire
Smurf attack
IDS
File Integrity checking work
WAN
8. ATM supports two types of virtual circuits: permanent virtual circuits and switches virtual circuit - PVC is set up in advance - usually manually - SVC is established automatically through a signaling protocol and can be created on the fly - establis
Ciphertext
Types of ATM virtual circuits
Internet
3-way handshake
9. Outside attack from network - Outsider attack from telephone - Insider attack from local network - insider attack from local system - attack from malicious code
LAN
The five threat vectors
Defense in depth
EXE program infector
10. Slow - requires stateful data tracking - inspects all fields - including variable-length fields
Multi protocol label switching
Nmap
Deep packet inspection
the application layer
11. Netmasks or subnets provide a method for identifying what portion of an address is the network - and what portion is the host
Group
A netmask
The threat vector analysis in defense in depth
IDS not
12. 192.0.0.0 through 223.255.255.255 - subnet mask of 255.255.255.0
What range is a class C network?
NIDS challenges
The four basic approaches to defense in depth
A netcat listener
13. Four layers - Network Layer - Internet Layer - Transport Layer - Application layer
Buffer overflow
The four basic approaches to defense in depth
The four types of events reported by IDS
The TCP/IP model
14. When someone has compromised the integrity of data or a program. Allows attackers to create backdoors.
A network protocol
Alteration of code
SQL Slammer Worm
Honeyd
15. Hash Authentication - asymmetric - non repudiation - digital signature - hash + asymmetry
Integrity of Data
Honeypot
The protected enclave to defense in depth
Alteration of code
16. Poor programming without error checking can allow commands to be run in an input field. This can point to a command further in the buffer that will execute the attacker's payload.
Some NIDS topology limitations
Proxy or application gateway
Buffer overflow
Some FTP dangers
17. free windows based wireless scanner for 802.1b - detects access point settings - supports GSP integration - identifies networks as encrypted or unencrypted
ATM work
The TCP/IP model
Network stumbler
What's an easy way to test encryption?
18. The practice of sending an ACK inside another packet going to the same destination
ACK piggybacking
A network protocol
Some Pen Test techniques
Denial of service
19. It interacts with data and prepares it to be transmitted across the network. It ensures reliable connectivity from end-to-end
Address Resolution Protocol (ARP)
Program infector
The transport layer
The data link layer
20. Wide Area Network - Larger than MAN or LAN - uses public network - phone lines - and leased lines to tie LAN and MAN over a dispersed area
WAN
Deep packet inspection
The four types of events reported by IDS
What categories do vulnerabilities fall into?
21. Confidentiality - integrity - availability
The transport layer
Some disadvantages of honeypots
Anomaly analysis work
The three goals of security
22. TCP/IP - the IP protoco - The core routing protocol of the internet - - deals with transmission of packets between end points - defines the addressing scheme for the internet
When implementing protocols - what stack should be used?
Some common UDP ports
Trojan horse
Permutation
23. Anonymous FTP - FTP passes through clear text - Bounce attacks with the PORT command - user can cause an FTP to open a connection from the FTP's own commands and bypass a firewall
The transport layer
Bridge
Some FTP dangers
What categories do vulnerabilities fall into?
24. Personal area network - phone tethering - bluetooth - etc
What threats should be protected against - based on threat levels
PAN
The physical layer stack
Snort
25. Work groups that require additional protection are segmented from the rest of the internal organization - restricting access to critical segments - system of VPNs - internal firewall - VLANs and ACLs
Total cell size for asynchronous transfer mode (ATM)
Some ways to bypass firewall protections
The protected enclave to defense in depth
No State Inspection ACK flag set
26. Uses flow control to handle network congestion - can send larger amounts of data per packet - has guaranteed delivery of transmitted data - better protection against spoofing - reduces need for error checking at higher OSI layers
Some reasons to use TCP over UDP
Alteration of code
To establish a TCP session
What threats should be protected against - based on threat levels
27. Threat requires a vector to cross the vulnerability - stop the ability of the threat to use the vector
Asynchronous Transfer Mode
Bus Topology
The threat vector analysis in defense in depth
What ways should the crypto key be protected?
28. Full open - half open (stealth scan) - UDP - Ping
WAN
No State Inspection ACK flag set
Nmap scanning techniques
What categories do vulnerabilities fall into?
29. Most common approach - firewall - VPN - intrusion detection - AV - disk encryption - all parts of the organization receive equal protection - particularly vulnerable to malicious inside attacks
The Uniform Protection to defense in depth
Overview of TCP
Boot record infector
The OSI model
30. Migrate to WPA2 - use strong authentication like PEAP or TTLS - audit network installations - require mutual auth between client and infrastructure equipment
A network protocol
Risk
Best way to protect wireless networks
Kismet
31. Confidentiality - symmetric encryption
The OSI model
The goals of cryptography
When setting up a virtual circuit
IDS data normalization
32. CIDR is a shorthand way of specifying which portion of the address is the network - and which portion is the host
Some FTP dangers
The conficker worm
CIDR
IDS not
33. Bits of code embedded in programs to quickly gain access at a later time
Some disadvantages of honeypots
Some FTP dangers
Trap door
Rotation?
34. Spread as an office attachment with executable code programmed using macro facility - targets are data files - visual basic editor and other macro languages - payload executes when the code is launched
The four basic approaches to defense in depth
What ways should the crypto key be protected?
Macro virus
The session layer
35. Resource exhaustion like DDoS or fork attack - unexpected input value the machine does not know how to process
IDS not
Honeypot
Denial of service
The TCP/IP model
36. Switches networks make it difficult to monitor traffic in promiscuous mode - topology must be able to support traffic aggregation for monitoring
Some NIDS topology limitations
File Integrity checking work
What range is a class B network?
Boot record infector
37. Infected millions through various methods - vulnerability in the MS Server Service - brute force admin password through network shares - infect removable devices with a malicious autorun script
IDS
The conficker worm
Some common UDP ports
Stateless packet filter
38. Intellectual property - business goals - validated data - historical
A netmask
Parasitic malware
SYN flood
What threats should be protected against - based on threat levels
39. 53 bytes - 48 bytes for data - 5 bytes for the header
Total cell size for asynchronous transfer mode (ATM)
Some NIDS topology limitations
Social engineering
TFTP
40. flags anomalous conditions in traffic on the network - requires understanding on what is normal - bases good traffic as a baseline
Anomaly analysis work
What threats should be protected against - based on threat levels
Some types of malicious code
Alteration of code
41. Used for connecting two physical segments of a network - segments traffic - breaks up collision domains - not generally used because of switches
Bridge
The physical layer stack
File integrity checking work
Address Resolution Protocol (ARP)
42. Network scanner.
UDP packet headers
The Information Centric defense in depth
Group
Nmap
43. UDP based infection - infected through vulnerability in SQL server - caused DoS on saturated networks
Kismet
Browsing attack
SQL Slammer Worm
IDS signature analysis work
44. 20 - FTP data - 21 - FTP - 23 - Telnet - 25 - SNMP - 53 - DNS - 79 - Finger - 80 - HTTP - 110 - POP - 443 - HTTPS
Some firewall challenges
A netmask
Router
Some common TCP ports
45. local area network - small network confined to small location - all equipment owned by a single entity - vulnerable to inside threats and logic bombs
LAN
Some NIDS topology limitations
Types of viruses
SQL Slammer Worm
46. A low end firewall that can quickly be deployed using existing hardware. They examine packets themselves with no content.
Stateless packet filter
Browsing attack
Trap door
A blind FTP
47. Small program triggered by an event that provides an action. E.g. scheduled file removal if countdown isn't reset - ie: employee was fired
When implementing protocols - what stack should be used?
Nmap scanning techniques
Logic bomb
ACK piggybacking
48. FIN 130 - ACK 131 - FIN 570 - ACK 571
The Information Centric defense in depth
Macro virus
Integrity of Data
To close a TCP session
49. Good for multimedia - can use small single packets - multicasting is required - speed is the highest priority
Smurf attack
Log monitoring work?
Some reasons to use UDP over TCP
Stateful firewall
50. Protocol for mapping an IP address to a physical machine address that is recognized on the local network - A table - usually called the ARP cache - is used to maintain a correlation between each MAC and it's corresponding IP address
Address Resolution Protocol (ARP)
The different cable categories
Risk
Some NIDS topology limitations